HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Implement session registration, UDP-presence-gated leases, and expiry #7

New Issue
Open
opened 2026-07-15 10:04:16 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:16 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #5, #6

Outcome

Let an authorized host publish and maintain a session that is visible only while its lease and gameplay-socket presence are fresh.

Scope

  • Implement create, update, renew, deregister, expiry, ownership, and idempotency.
  • Model Registered → AwaitingPresence → Listed, demoting on stale UDP presence and removing on lease expiry/deletion.
  • Return opaque lease and host-presence capabilities plus heartbeat/refresh timing.
  • Accept bounded capacity, region, protocol/build, visibility, and metadata inputs under GamePolicy.
  • Treat reported capacity as advisory; the game host retains final admission authority.
  • Keep public endpoints, local endpoints, lease secrets, and internal store keys out of public responses.

Acceptance criteria

  • Create/renew/update/delete and all expiry transitions have deterministic tests.
  • A valid HTTP lease without fresh UDP host presence never appears in public browse results.
  • Lost presence can be refreshed without changing canonical game identity.
  • Concurrent renew/delete and idempotent retry behavior are correct.
  • Abandoned registrations expire and memory remains bounded.
  • One principal cannot mutate or renew another listing.
  • Invalid metadata, capacity, protocol, region, and visibility values produce stable typed errors.
Parent: #1 Depends on: #5, #6 ## Outcome Let an authorized host publish and maintain a session that is visible only while its lease and gameplay-socket presence are fresh. ## Scope - Implement create, update, renew, deregister, expiry, ownership, and idempotency. - Model `Registered → AwaitingPresence → Listed`, demoting on stale UDP presence and removing on lease expiry/deletion. - Return opaque lease and host-presence capabilities plus heartbeat/refresh timing. - Accept bounded capacity, region, protocol/build, visibility, and metadata inputs under `GamePolicy`. - Treat reported capacity as advisory; the game host retains final admission authority. - Keep public endpoints, local endpoints, lease secrets, and internal store keys out of public responses. ## Acceptance criteria - Create/renew/update/delete and all expiry transitions have deterministic tests. - A valid HTTP lease without fresh UDP host presence never appears in public browse results. - Lost presence can be refreshed without changing canonical game identity. - Concurrent renew/delete and idempotent retry behavior are correct. - Abandoned registrations expire and memory remains bounded. - One principal cannot mutate or renew another listing. - Invalid metadata, capacity, protocol, region, and visibility values produce stable typed errors.
Kyuubi commented 2026-07-16 05:33:28 +02:00
Author
Owner
Copy Link
Copy Source

Starting implementation on codex/issue-7-session-leases, stacked on the verified #2–#6 foundation. I’ll connect provisioning and the atomic store into the host-facing create/update/renew/delete lifecycle, issue opaque lease and host-presence capabilities, enforce policy/ownership/idempotency, gate listing visibility on fresh gameplay-socket presence, and cover every expiry/race/error transition deterministically.

Starting implementation on `codex/issue-7-session-leases`, stacked on the verified #2–#6 foundation. I’ll connect provisioning and the atomic store into the host-facing create/update/renew/delete lifecycle, issue opaque lease and host-presence capabilities, enforce policy/ownership/idempotency, gate listing visibility on fresh gameplay-socket presence, and cover every expiry/race/error transition deterministically.
Kyuubi self-assigned this 2026-07-16 05:33:29 +02:00
Kyuubi commented 2026-07-16 05:59:16 +02:00
Author
Owner
Copy Link
Copy Source

Implemented and pushed on codex/issue-7-session-leases at 49564c7.

Delivered:

  • authenticated create/renew/update/delete HTTP lifecycle requiring a tenant-scoped publisher bearer credential plus the matching opaque lease capability for mutation;
  • stable typed HTTP error envelopes, bearer challenges, explicit OpenAPI bearer security on all publisher operations, and additive renewal/presence timing fields in the frozen v1 contract;
  • policy enforcement for exact game/environment/protocol, allowed region/visibility/trust mode, bounded nonblank build/display values, advisory capacity, metadata schema, and atomic publisher quotas;
  • HMAC-derived opaque IDs, lease tokens, and host-presence capabilities with domain separation, canonical metadata-order-independent idempotency, random per-registration salts, keyed store fingerprints, plaintext-free retention, and rotation after idempotency expiry;
  • ownership-hidden mutation semantics, immutable canonical game identity, compare-and-swap renewal, idempotent delete, deterministic expiry, bounded abandoned-registration cleanup, and fail-closed drain/unavailable behavior;
  • gameplay-socket UDP host-presence processing that uses the packet's observed source endpoint, silently rejects invalid capabilities, gates public visibility, demotes on staleness, and restores the same listing identity on refresh;
  • ADR 0005 plus generated OpenAPI/public API/golden contract updates.

Verification:

  • locked restore, formatter verification, Release solution build, generated OpenAPI worktree drift check, and 94/94 tests passed;
  • deterministic tests cover create/update/renew/delete, exact and conflicting retries, metadata order, post-retention capability rotation, lease/presence expiry and refresh, bounded exhaustion, cross-owner mutation, concurrent renew/delete, malformed/default/policy-invalid values, atomic-state loss, and public response privacy;
  • real local Kestrel integration covers 401 bearer challenge, typed malformed-JSON failure, 201 registration, 200 renewal, 204 update/delete, and canonical response contracts;
  • authenticated UDP presence processing is tested against the gameplay socket's observed endpoint;
  • the fully wired Development process bound temporary HTTP/UDP ports, reported ready, and returned the expected player-facing 401 envelope;
  • completion and multi-lens branch audits found no remaining actionable findings.

The issue remains open until the stacked branch is landed.

Implemented and pushed on `codex/issue-7-session-leases` at `49564c7`. Delivered: - authenticated create/renew/update/delete HTTP lifecycle requiring a tenant-scoped publisher bearer credential plus the matching opaque lease capability for mutation; - stable typed HTTP error envelopes, bearer challenges, explicit OpenAPI bearer security on all publisher operations, and additive renewal/presence timing fields in the frozen v1 contract; - policy enforcement for exact game/environment/protocol, allowed region/visibility/trust mode, bounded nonblank build/display values, advisory capacity, metadata schema, and atomic publisher quotas; - HMAC-derived opaque IDs, lease tokens, and host-presence capabilities with domain separation, canonical metadata-order-independent idempotency, random per-registration salts, keyed store fingerprints, plaintext-free retention, and rotation after idempotency expiry; - ownership-hidden mutation semantics, immutable canonical game identity, compare-and-swap renewal, idempotent delete, deterministic expiry, bounded abandoned-registration cleanup, and fail-closed drain/unavailable behavior; - gameplay-socket UDP host-presence processing that uses the packet's observed source endpoint, silently rejects invalid capabilities, gates public visibility, demotes on staleness, and restores the same listing identity on refresh; - ADR 0005 plus generated OpenAPI/public API/golden contract updates. Verification: - locked restore, formatter verification, Release solution build, generated OpenAPI worktree drift check, and 94/94 tests passed; - deterministic tests cover create/update/renew/delete, exact and conflicting retries, metadata order, post-retention capability rotation, lease/presence expiry and refresh, bounded exhaustion, cross-owner mutation, concurrent renew/delete, malformed/default/policy-invalid values, atomic-state loss, and public response privacy; - real local Kestrel integration covers 401 bearer challenge, typed malformed-JSON failure, 201 registration, 200 renewal, 204 update/delete, and canonical response contracts; - authenticated UDP presence processing is tested against the gameplay socket's observed endpoint; - the fully wired Development process bound temporary HTTP/UDP ports, reported ready, and returned the expected player-facing 401 envelope; - completion and multi-lens branch audits found no remaining actionable findings. The issue remains open until the stacked branch is landed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#7
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?