KyuubiYoru
108 lines
5.4 KiB
Markdown
108 lines
5.4 KiB
Markdown
# SpaceGame consumer pilot
|
|
|
|
Tracking: Rendezvous #21 and SpaceGame #3.
|
|
|
|
The first SpaceGame checkpoint proves that the v1 client boundary can establish
|
|
authenticated direct LiteNetLib traffic without taking ownership of the game's
|
|
protocol, admission, player identity, entity identity, capacity, or gameplay
|
|
payloads. It does not yet pass the complete consumer-pilot gate. The public
|
|
package restore, actual Godot-process integration, connected fallback transport,
|
|
remote Linux dedicated run, representative external NAT run, and reconnect path
|
|
remain required before #21 can close.
|
|
|
|
## Pinned checkpoint
|
|
|
|
| Input | Value |
|
|
| --- | --- |
|
|
| Rendezvous source | `7fb85059fb7003ca0984ebd0cc9541218d33ae93` plus the #21 compatibility changes |
|
|
| SpaceGame source | `86424ebde69a7eeae110106ab5f84c68f04af89b` |
|
|
| Client package | `FinalFactory.Rendezvous.Client` `1.0.0` |
|
|
| Contracts package | `FinalFactory.Rendezvous.Contracts` `1.0.0` |
|
|
| LiteNetLib | `2.1.4` |
|
|
| HTTP, UDP, ticket contracts | `1` |
|
|
| SpaceGame gameplay protocol | `2` |
|
|
|
|
At the checkpoint date, the Final Factory Gitea NuGet service was reachable but
|
|
both `FinalFactory.Rendezvous.*` `1.0.0` registrations returned HTTP 404. The run
|
|
therefore restored locally built candidate packages with the hashes recorded in
|
|
[`spacegame.json`](../evidence/consumers/spacegame.json). This proves candidate
|
|
compatibility, not immutable registry publication. The release package restore
|
|
must be repeated from the public feed.
|
|
|
|
## Proven local path
|
|
|
|
The SpaceGame host and client each create one caller-owned `NetManager`, set its
|
|
three gameplay QoS channels before `Start`, and give the same manager and
|
|
`RendezvousNetListener` to the coordinator. Rendezvous authenticates discovery,
|
|
join authorization, host presence, mediation, and connection outcome reporting.
|
|
After traversal, SpaceGame performs a separate audience-bound admission exchange
|
|
on its own reliable command channel. A trusted game-auth boundary mints the
|
|
opaque assertion; the player process never receives the signing key.
|
|
|
|
The authoritative host rejects expired, replayed, incorrectly signed,
|
|
wrong-listing, duplicate-player, over-capacity, identity-mismatched,
|
|
out-of-sequence, and over-rate traffic. It assigns a canonical game entity ID
|
|
only after admission. The player ID, entity ID, listing ID, join-attempt ID, and
|
|
LiteNetLib peer ID remain distinct values.
|
|
|
|
The bounded two-process harness observed:
|
|
|
|
- host publication and lease maintenance;
|
|
- browser compatibility filtering and join authorization;
|
|
- typed traversal outcome `Connected`;
|
|
- successful audience-bound game admission;
|
|
- one reliable ordered input and one sequenced state snapshot on the direct
|
|
gameplay socket;
|
|
- zero SpaceGame gameplay payloads handled by Rendezvous; and
|
|
- successful host deregistration.
|
|
|
|
Both Debug and Release builds passed. Both Debug and Release test runs passed 29
|
|
tests with zero failures. The focused formatter, shell checker, clean
|
|
candidate-package restore, and adversarial branch review also passed.
|
|
|
|
## Failure evidence
|
|
|
|
| Path | Evidence | Status |
|
|
| --- | --- | --- |
|
|
| Incompatible protocol | protocol `999` returns no compatible listing and starts no traversal | Proven |
|
|
| Stale/no host presence | typed `NoHostPresence/RendezvousService/HostPresence/Mediation` | Proven |
|
|
| Traversal timeout | non-listening mediator produces typed `PunchTimedOut/LocalTraversal/NatTraversal/NatTraversal` | Proven |
|
|
| Rejected game admission | invalid signature and wrong audience deny gameplay; expiry and replay are regression-tested | Proven at protocol/unit boundary |
|
|
| Capacity and duplicate player | game-owned roster rejects both and publishes current capacity | Regression-tested |
|
|
| Configured fallback | policy excludes authorization, compatibility, and capacity failures | Policy only; transport path open |
|
|
| Disconnect | direct session ends and host deregisters | Proven for checkpoint shutdown |
|
|
| Reconnect | a second authenticated session after disconnect | Open |
|
|
|
|
## Rendezvous-side compatibility fixes
|
|
|
|
The pilot found generic integration gaps and keeps their fixes in this
|
|
repository:
|
|
|
|
- the local production-shaped smoke tenant accepts SpaceGame gameplay protocol
|
|
`2` and the bounded `mode` metadata key;
|
|
- SDK guidance requires games using multiple LiteNetLib QoS channels to set
|
|
`ChannelsCount` before `Start` and states that Rendezvous reserves no gameplay
|
|
channel; and
|
|
- the local credential helper rejects any signing-key file with group or other
|
|
permissions, in addition to its ownership, symlink, and hard-link checks.
|
|
|
|
Documentation contract tests cover these generic requirements.
|
|
|
|
## Remaining acceptance gates
|
|
|
|
Do not mark #21 passed until all of these have direct evidence:
|
|
|
|
1. restore the exact immutable `1.0.0` packages from the public Gitea feed;
|
|
2. drive the host and client through actual Godot game processes, not only the
|
|
console pilot;
|
|
3. implement and exercise the configured dedicated fallback connection with the
|
|
same game admission and identity rules;
|
|
4. prove disconnect followed by a fresh authenticated reconnect;
|
|
5. run a remote client against a Linux dedicated host and capture normal
|
|
termination/drain behavior;
|
|
6. run representative external NAT canaries and record the network topology and
|
|
typed outcome; and
|
|
7. clear the current SpaceGame Linux runtime blocker: its pre-existing ImGui
|
|
GDExtension native library is absent. A headless process exit code of zero
|
|
while that load error is present is not runtime proof.
|