Rendezvous/docs/integration/spacegame-pilot.md

SpaceGame consumer pilot

Tracking: Rendezvous #21 and SpaceGame #3.

The first SpaceGame checkpoint proves that the v1 client boundary can establish authenticated direct LiteNetLib traffic without taking ownership of the game's protocol, admission, player identity, entity identity, capacity, or gameplay payloads. It does not yet pass the complete consumer-pilot gate. The public package restore, actual Godot-process integration, connected fallback transport, remote Linux dedicated run, representative external NAT run, and reconnect path remain required before #21 can close.

Pinned checkpoint

Input	Value
Rendezvous source	7fb85059fb7003ca0984ebd0cc9541218d33ae93 plus the #21 compatibility changes
SpaceGame source	86424ebde69a7eeae110106ab5f84c68f04af89b
Client package	FinalFactory.Rendezvous.Client 1.0.0
Contracts package	FinalFactory.Rendezvous.Contracts 1.0.0
LiteNetLib	2.1.4
HTTP, UDP, ticket contracts	1
SpaceGame gameplay protocol	2

At the checkpoint date, the Final Factory Gitea NuGet service was reachable but both FinalFactory.Rendezvous.* 1.0.0 registrations returned HTTP 404. The run therefore restored locally built candidate packages with the hashes recorded in spacegame.json. This proves candidate compatibility, not immutable registry publication. The release package restore must be repeated from the public feed.

Proven local path

The SpaceGame host and client each create one caller-owned NetManager, set its three gameplay QoS channels before Start, and give the same manager and RendezvousNetListener to the coordinator. Rendezvous authenticates discovery, join authorization, host presence, mediation, and connection outcome reporting. After traversal, SpaceGame performs a separate audience-bound admission exchange on its own reliable command channel. A trusted game-auth boundary mints the opaque assertion; the player process never receives the signing key.

The authoritative host rejects expired, replayed, incorrectly signed, wrong-listing, duplicate-player, over-capacity, identity-mismatched, out-of-sequence, and over-rate traffic. It assigns a canonical game entity ID only after admission. The player ID, entity ID, listing ID, join-attempt ID, and LiteNetLib peer ID remain distinct values.

The bounded two-process harness observed:

• host publication and lease maintenance;
• browser compatibility filtering and join authorization;
• typed traversal outcome Connected;
• successful audience-bound game admission;
• one reliable ordered input and one sequenced state snapshot on the direct gameplay socket;
• zero SpaceGame gameplay payloads handled by Rendezvous; and
• successful host deregistration.

Both Debug and Release builds passed. Both Debug and Release test runs passed 29 tests with zero failures. The focused formatter, shell checker, clean candidate-package restore, and adversarial branch review also passed.

Failure evidence

Path	Evidence	Status
Incompatible protocol	protocol 999 returns no compatible listing and starts no traversal	Proven
Stale/no host presence	typed NoHostPresence/RendezvousService/HostPresence/Mediation	Proven
Traversal timeout	non-listening mediator produces typed PunchTimedOut/LocalTraversal/NatTraversal/NatTraversal	Proven
Rejected game admission	invalid signature and wrong audience deny gameplay; expiry and replay are regression-tested	Proven at protocol/unit boundary
Capacity and duplicate player	game-owned roster rejects both and publishes current capacity	Regression-tested
Configured fallback	policy excludes authorization, compatibility, and capacity failures	Policy only; transport path open
Disconnect	direct session ends and host deregisters	Proven for checkpoint shutdown
Reconnect	a second authenticated session after disconnect	Open

Rendezvous-side compatibility fixes

The pilot found generic integration gaps and keeps their fixes in this repository:

• the local production-shaped smoke tenant accepts SpaceGame gameplay protocol 2 and the bounded mode metadata key;
• SDK guidance requires games using multiple LiteNetLib QoS channels to set ChannelsCount before Start and states that Rendezvous reserves no gameplay channel; and
• the local credential helper rejects any signing-key file with group or other permissions, in addition to its ownership, symlink, and hard-link checks.

Documentation contract tests cover these generic requirements.

Remaining acceptance gates

Do not mark #21 passed until all of these have direct evidence:

1. restore the exact immutable 1.0.0 packages from the public Gitea feed;
2. drive the host and client through actual Godot game processes, not only the console pilot;
3. implement and exercise the configured dedicated fallback connection with the same game admission and identity rules;
4. prove disconnect followed by a fresh authenticated reconnect;
5. run a remote client against a Linux dedicated host and capture normal termination/drain behavior;
6. run representative external NAT canaries and record the network topology and typed outcome; and
7. clear the current SpaceGame Linux runtime blocker: its pre-existing ImGui GDExtension native library is absent. A headless process exit code of zero while that load error is present is not runtime proof.