Let an authorized host publish and maintain a session that is visible only while its lease and gameplay-socket presence are fresh.
Scope
Implement create, update, renew, deregister, expiry, ownership, and idempotency.
Model Registered → AwaitingPresence → Listed, demoting on stale UDP presence and removing on lease expiry/deletion.
Return opaque lease and host-presence capabilities plus heartbeat/refresh timing.
Accept bounded capacity, region, protocol/build, visibility, and metadata inputs under GamePolicy.
Treat reported capacity as advisory; the game host retains final admission authority.
Keep public endpoints, local endpoints, lease secrets, and internal store keys out of public responses.
Acceptance criteria
Create/renew/update/delete and all expiry transitions have deterministic tests.
A valid HTTP lease without fresh UDP host presence never appears in public browse results.
Lost presence can be refreshed without changing canonical game identity.
Concurrent renew/delete and idempotent retry behavior are correct.
Abandoned registrations expire and memory remains bounded.
One principal cannot mutate or renew another listing.
Invalid metadata, capacity, protocol, region, and visibility values produce stable typed errors.
Parent: #1
Depends on: #5, #6
## Outcome
Let an authorized host publish and maintain a session that is visible only while its lease and gameplay-socket presence are fresh.
## Scope
- Implement create, update, renew, deregister, expiry, ownership, and idempotency.
- Model `Registered → AwaitingPresence → Listed`, demoting on stale UDP presence and removing on lease expiry/deletion.
- Return opaque lease and host-presence capabilities plus heartbeat/refresh timing.
- Accept bounded capacity, region, protocol/build, visibility, and metadata inputs under `GamePolicy`.
- Treat reported capacity as advisory; the game host retains final admission authority.
- Keep public endpoints, local endpoints, lease secrets, and internal store keys out of public responses.
## Acceptance criteria
- Create/renew/update/delete and all expiry transitions have deterministic tests.
- A valid HTTP lease without fresh UDP host presence never appears in public browse results.
- Lost presence can be refreshed without changing canonical game identity.
- Concurrent renew/delete and idempotent retry behavior are correct.
- Abandoned registrations expire and memory remains bounded.
- One principal cannot mutate or renew another listing.
- Invalid metadata, capacity, protocol, region, and visibility values produce stable typed errors.
Starting implementation on codex/issue-7-session-leases, stacked on the verified #2–#6 foundation. I’ll connect provisioning and the atomic store into the host-facing create/update/renew/delete lifecycle, issue opaque lease and host-presence capabilities, enforce policy/ownership/idempotency, gate listing visibility on fresh gameplay-socket presence, and cover every expiry/race/error transition deterministically.
Starting implementation on `codex/issue-7-session-leases`, stacked on the verified #2–#6 foundation. I’ll connect provisioning and the atomic store into the host-facing create/update/renew/delete lifecycle, issue opaque lease and host-presence capabilities, enforce policy/ownership/idempotency, gate listing visibility on fresh gameplay-socket presence, and cover every expiry/race/error transition deterministically.
Kyuubi
self-assigned this 2026-07-16 05:33:29 +02:00
Implemented and pushed on codex/issue-7-session-leases at 49564c7.
Delivered:
authenticated create/renew/update/delete HTTP lifecycle requiring a tenant-scoped publisher bearer credential plus the matching opaque lease capability for mutation;
stable typed HTTP error envelopes, bearer challenges, explicit OpenAPI bearer security on all publisher operations, and additive renewal/presence timing fields in the frozen v1 contract;
policy enforcement for exact game/environment/protocol, allowed region/visibility/trust mode, bounded nonblank build/display values, advisory capacity, metadata schema, and atomic publisher quotas;
HMAC-derived opaque IDs, lease tokens, and host-presence capabilities with domain separation, canonical metadata-order-independent idempotency, random per-registration salts, keyed store fingerprints, plaintext-free retention, and rotation after idempotency expiry;
ownership-hidden mutation semantics, immutable canonical game identity, compare-and-swap renewal, idempotent delete, deterministic expiry, bounded abandoned-registration cleanup, and fail-closed drain/unavailable behavior;
gameplay-socket UDP host-presence processing that uses the packet's observed source endpoint, silently rejects invalid capabilities, gates public visibility, demotes on staleness, and restores the same listing identity on refresh;
ADR 0005 plus generated OpenAPI/public API/golden contract updates.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #5, #6
Outcome
Let an authorized host publish and maintain a session that is visible only while its lease and gameplay-socket presence are fresh.
Scope
Registered → AwaitingPresence → Listed, demoting on stale UDP presence and removing on lease expiry/deletion.GamePolicy.Acceptance criteria
Starting implementation on
codex/issue-7-session-leases, stacked on the verified #2–#6 foundation. I’ll connect provisioning and the atomic store into the host-facing create/update/renew/delete lifecycle, issue opaque lease and host-presence capabilities, enforce policy/ownership/idempotency, gate listing visibility on fresh gameplay-socket presence, and cover every expiry/race/error transition deterministically.Implemented and pushed on
codex/issue-7-session-leasesat49564c7.Delivered:
Verification:
The issue remains open until the stacked branch is landed.