Freeze SCUM SQLite template run contract

platform/validator/job_channel.go

@@ -56,6 +56,11 @@ func ValidateRunJobResult(result domain.RunJobResult) error {
 			violations = append(violations, "executionResult.sqliteSchemaProbe: "+err.Error())
 		}
 	}
+	if result.ExecutionResult.SQLiteTemplate != nil {
+		if err := ValidateSCUMSQLiteTemplateResult(*result.ExecutionResult.SQLiteTemplate); err != nil {
+			violations = append(violations, "executionResult.sqliteTemplate: "+err.Error())
+		}
+	}
 	return finish(violations)
 }
 

platform/validator/resources.go

@@ -1533,6 +1533,14 @@ func ValidateJob(job domain.Job) error {
 			violations = append(violations, "executionInput.sourceRcon must not persist adapter inputs")
 		}
 	}
+	if job.ExecutionInput.SQLiteTemplate != nil {
+		if err := ValidateSCUMSQLiteTemplateRequest(*job.ExecutionInput.SQLiteTemplate); err != nil {
+			violations = append(violations, "executionInput.sqliteTemplate: "+err.Error())
+		}
+		if job.Capability != domain.JobCapabilityRemoteRunDBSQLiteQuery {
+			violations = append(violations, "executionInput.sqliteTemplate is allowed only for sqlite query jobs")
+		}
+	}
 	violations = append(violations, validateRemoteAdapterInputs("executionInput.inputs", job.ExecutionInput.Inputs)...)
 	if job.ExecutionResult.Checksum != "" && !validSHA256Checksum(job.ExecutionResult.Checksum) {
 		violations = append(violations, "executionResult.checksum must be sha256:<hex>")
@@ -1548,6 +1556,11 @@ func ValidateJob(job domain.Job) error {
 			violations = append(violations, "executionResult.sqliteSchemaProbe: "+err.Error())
 		}
 	}
+	if job.ExecutionResult.SQLiteTemplate != nil {
+		if err := ValidateSCUMSQLiteTemplateResult(*job.ExecutionResult.SQLiteTemplate); err != nil {
+			violations = append(violations, "executionResult.sqliteTemplate: "+err.Error())
+		}
+	}
 	if job.Capability == domain.JobCapabilityConfigWrite || job.Capability == domain.JobCapabilityFilesRead || job.Capability == domain.JobCapabilityFilesWrite {
 		if job.ServerInstanceID == "" {
 			violations = append(violations, "serverInstanceId is required for scoped file jobs")

platform/validator/scum_live_data.go

@@ -16,10 +16,15 @@ const (
 	maxSCUMProbeSamples          = 3
 	maxSCUMProbeTimeoutMS        = 10000
 	maxSCUMProbeResultBytes      = 1024 * 1024
+	maxSCUMTemplateParameters    = 64
+	maxSCUMTemplateRows          = 1000
+	maxSCUMTemplateBusyTimeoutMS = 1000
+	maxSCUMTemplateValueBytes    = 4096
 )
 
 var scumHashPattern = regexp.MustCompile(`^sha256:[a-fA-F0-9]{64}$|^[a-fA-F0-9]{16,128}$`)
 var scumDataTargetSafeErrorPattern = regexp.MustCompile(`^data_target_[a-z0-9_]{1,80}$`)
+var scumTemplateKeyPattern = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_.-]{0,127}$`)
 
 func ValidateSCUMSchemaProbeRequest(request domain.SCUMSchemaProbeRequest) error {
 	var violations []string
@@ -30,6 +35,37 @@ func ValidateSCUMSchemaProbeRequest(request domain.SCUMSchemaProbeRequest) error
 	return finish(violations)
 }
 
+func ValidateSCUMSQLiteTemplateRequest(request domain.SCUMSQLiteTemplateRequest) error {
+	var violations []string
+	violations = appendRequired(violations, "requestId", request.RequestID)
+	violations = appendRequired(violations, "jobId", request.JobID)
+	violations = append(violations, validateSCUMBindingIdentity("binding", request.Binding)...)
+	if !validSCUMReadCapability(request.Capability) {
+		violations = append(violations, "capability must be a read capability")
+	}
+	violations = append(violations, validateSCUMTemplateKey("targetKey", request.TargetKey)...)
+	violations = append(violations, validateSCUMTemplateKey("templateKey", request.TemplateKey)...)
+	violations = appendRequired(violations, "adapterVersion", request.AdapterVersion)
+	if request.AdapterVersion != "" && containsSCUMProtectedMaterial(request.AdapterVersion) {
+		violations = append(violations, "adapterVersion contains protected material")
+	}
+	if request.AdapterVersion != "" && request.Binding.AdapterVersion != "" && request.AdapterVersion != request.Binding.AdapterVersion {
+		violations = append(violations, "adapterVersion must match binding.adapterVersion")
+	}
+	if !validSCUMFingerprint(request.RequiredSchemaFingerprint) {
+		violations = append(violations, "requiredSchemaFingerprint must be a digest/fingerprint")
+	}
+	if !validSCUMDigest(request.AssetDigest) {
+		violations = append(violations, "assetDigest must be sha256 digest")
+	}
+	if !validSCUMDigest(request.ParameterDigest) {
+		violations = append(violations, "parameterDigest must be sha256 digest")
+	}
+	violations = append(violations, validateSCUMSQLiteTemplateBounds("bounds", request.Bounds)...)
+	violations = append(violations, validateSCUMValueMap("parameters", request.Parameters, request.Bounds.MaxParameters)...)
+	return finish(violations)
+}
+
 func ValidateSCUMSchemaProbeResult(result domain.SCUMSchemaProbeResult) error {
 	var violations []string
 	violations = appendRequired(violations, "requestId", result.RequestID)
@@ -59,6 +95,65 @@ func ValidateSCUMSchemaProbeResult(result domain.SCUMSchemaProbeResult) error {
 	return finish(violations)
 }
 
+func ValidateSCUMSQLiteTemplateResult(result domain.SCUMSQLiteTemplateResult) error {
+	var violations []string
+	violations = appendRequired(violations, "requestId", result.RequestID)
+	violations = appendRequired(violations, "jobId", result.JobID)
+	violations = append(violations, validateSCUMBindingIdentity("binding", result.Binding)...)
+	if !validSCUMTerminalResultStatus(result.Status) {
+		violations = append(violations, "status is invalid")
+	}
+	if !validSCUMReadCapability(result.Capability) {
+		violations = append(violations, "capability must be a read capability")
+	}
+	violations = append(violations, validateSCUMTemplateKey("targetKey", result.TargetKey)...)
+	violations = append(violations, validateSCUMTemplateKey("templateKey", result.TemplateKey)...)
+	violations = appendRequired(violations, "adapterVersion", result.AdapterVersion)
+	if result.AdapterVersion != "" && containsSCUMProtectedMaterial(result.AdapterVersion) {
+		violations = append(violations, "adapterVersion contains protected material")
+	}
+	if result.AdapterVersion != "" && result.Binding.AdapterVersion != "" && result.AdapterVersion != result.Binding.AdapterVersion {
+		violations = append(violations, "adapterVersion must match binding.adapterVersion")
+	}
+	if result.SchemaFingerprint != "" && !validSCUMFingerprint(result.SchemaFingerprint) {
+		violations = append(violations, "schemaFingerprint must be a digest/fingerprint")
+	}
+	if !validSCUMDigest(result.AssetDigest) {
+		violations = append(violations, "assetDigest must be sha256 digest")
+	}
+	if !validSCUMDigest(result.ParameterDigest) {
+		violations = append(violations, "parameterDigest must be sha256 digest")
+	}
+	if result.SourceFingerprint != "" && !validSCUMFingerprint(result.SourceFingerprint) {
+		violations = append(violations, "sourceFingerprint must be a digest/fingerprint")
+	}
+	if !validSCUMFingerprint(result.ResultDigest) {
+		violations = append(violations, "resultDigest must be a digest/fingerprint")
+	}
+	violations = append(violations, validateSCUMSafeError("safeError", result.SafeError)...)
+	violations = append(violations, validateSCUMSQLiteTemplateBounds("limits", result.Limits)...)
+	if result.RowCount != len(result.Rows) {
+		violations = append(violations, "rowCount must match returned rows")
+	}
+	if len(result.Rows) > result.Limits.MaxRows && result.Limits.MaxRows > 0 {
+		violations = append(violations, "rows exceeds declared limit")
+	}
+	for i, row := range result.Rows {
+		violations = append(violations, validateSCUMValueMap(fmt.Sprintf("rows[%d]", i), row, 256)...)
+	}
+	if result.Status == domain.SCUMTerminalResultSucceeded {
+		if result.SchemaFingerprint == "" || result.SourceFingerprint == "" {
+			violations = append(violations, "succeeded result requires schema/source fingerprints")
+		}
+		if result.SafeError.Code != "" && result.SafeError.Code != domain.SCUMSafeErrorNone {
+			violations = append(violations, "succeeded result must not carry an error code")
+		}
+	} else if result.SafeError.Code == "" || result.SafeError.Code == domain.SCUMSafeErrorNone {
+		violations = append(violations, "non-succeeded result requires a safe error code")
+	}
+	return finish(violations)
+}
+
 func ValidateSCUMCapabilityEvidence(evidence domain.SCUMCapabilityEvidence) error {
 	var violations []string
 	if !validSCUMDataCapability(evidence.Capability) {
@@ -213,6 +308,68 @@ func validateSCUMSchemaProbeBounds(prefix string, value domain.SCUMSchemaProbeBo
 	return violations
 }
 
+func validateSCUMSQLiteTemplateBounds(prefix string, value domain.SCUMSQLiteTemplateBounds) []string {
+	var violations []string
+	if value.MaxParameters < 0 || value.MaxParameters > maxSCUMTemplateParameters {
+		violations = append(violations, prefix+".maxParameters is out of bounds")
+	}
+	if value.MaxRows < 1 || value.MaxRows > maxSCUMTemplateRows {
+		violations = append(violations, prefix+".maxRows is out of bounds")
+	}
+	if value.TimeoutMS < 1 || value.TimeoutMS > maxSCUMProbeTimeoutMS {
+		violations = append(violations, prefix+".timeoutMs is out of bounds")
+	}
+	if value.BusyTimeoutMS < 0 || value.BusyTimeoutMS > maxSCUMTemplateBusyTimeoutMS {
+		violations = append(violations, prefix+".busyTimeoutMs is out of bounds")
+	}
+	if value.MaxResultBytes < 1 || value.MaxResultBytes > maxSCUMProbeResultBytes {
+		violations = append(violations, prefix+".maxResultBytes is out of bounds")
+	}
+	return violations
+}
+
+func validateSCUMTemplateKey(prefix, value string) []string {
+	var violations []string
+	violations = appendRequired(violations, prefix, value)
+	if value != "" && (!scumTemplateKeyPattern.MatchString(value) || containsSCUMProtectedMaterial(value) || strings.Contains(value, "..")) {
+		violations = append(violations, prefix+" is unsafe")
+	}
+	return violations
+}
+
+func validateSCUMValueMap(prefix string, values map[string]any, maxItems int) []string {
+	var violations []string
+	if maxItems >= 0 && len(values) > maxItems {
+		violations = append(violations, prefix+" exceeds declared limit")
+	}
+	for key, value := range values {
+		if !scumTemplateKeyPattern.MatchString(key) || containsSCUMProtectedMaterial(key) || strings.Contains(key, "..") {
+			violations = append(violations, prefix+" key is unsafe")
+		}
+		field := prefix + ".value"
+		violations = append(violations, validateSCUMValue(field, value)...)
+	}
+	return violations
+}
+
+func validateSCUMValue(prefix string, value any) []string {
+	var violations []string
+	switch item := value.(type) {
+	case nil, bool, int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64:
+		return nil
+	case string:
+		if len([]byte(item)) > maxSCUMTemplateValueBytes {
+			violations = append(violations, prefix+" is too large")
+		}
+		if containsSCUMProtectedMaterial(item) {
+			violations = append(violations, prefix+" contains protected material")
+		}
+	default:
+		violations = append(violations, prefix+" must be a scalar value")
+	}
+	return violations
+}
+
 func validateSCUMSchemaObjectEvidence(prefix string, value domain.SCUMSchemaObjectEvidence) []string {
 	var violations []string
 	if !validSCUMFingerprint(value.ObjectHash) {
@@ -283,6 +440,24 @@ func validSCUMDataCapability(value domain.SCUMDataCapability) bool {
 	}
 }
 
+func validSCUMReadCapability(value domain.SCUMDataCapability) bool {
+	switch value {
+	case domain.SCUMDataCapabilityPlayerRead, domain.SCUMDataCapabilityPlayerDetailRead, domain.SCUMDataCapabilitySquadRead, domain.SCUMDataCapabilitySquadMemberRead, domain.SCUMDataCapabilityVehicleRead, domain.SCUMDataCapabilityFlagRead, domain.SCUMDataCapabilityPositionRead:
+		return true
+	default:
+		return false
+	}
+}
+
+func validSCUMTerminalResultStatus(value domain.SCUMTerminalResultStatus) bool {
+	switch value {
+	case domain.SCUMTerminalResultSucceeded, domain.SCUMTerminalResultFailed, domain.SCUMTerminalResultCancelled:
+		return true
+	default:
+		return false
+	}
+}
+
 func validSCUMCapabilityEvidenceStatus(value domain.SCUMCapabilityEvidenceStatus) bool {
 	switch value {
 	case domain.SCUMCapabilityEvidenceMissing, domain.SCUMCapabilityEvidenceCompatible, domain.SCUMCapabilityEvidenceIncompatible, domain.SCUMCapabilityEvidenceFailed:
@@ -303,7 +478,7 @@ func validSCUMSchemaProbeResultStatus(value domain.SCUMCapabilityEvidenceStatus)
 
 func validSCUMSafeErrorCode(value domain.SCUMSafeErrorCode) bool {
 	switch value {
-	case "", domain.SCUMSafeErrorNone, domain.SCUMSafeErrorProbeExecutorAbsent, domain.SCUMSafeErrorProbeMissing, domain.SCUMSafeErrorProbeFailed, domain.SCUMSafeErrorSchemaIncompatible, domain.SCUMSafeErrorBindingMismatch, domain.SCUMSafeErrorAdapterMismatch, domain.SCUMSafeErrorFingerprintMismatch, domain.SCUMSafeErrorDigestMismatch, domain.SCUMSafeErrorEvidenceExpired, domain.SCUMSafeErrorInvalidProbePayload, domain.SCUMSafeErrorInvalidRequest, domain.SCUMSafeErrorTargetUnavailable, domain.SCUMSafeErrorSourceUnavailable, domain.SCUMSafeErrorSQLiteOpenFailed, domain.SCUMSafeErrorSQLiteReadFailed, domain.SCUMSafeErrorDatabaseBusy, domain.SCUMSafeErrorTimeout, domain.SCUMSafeErrorCancelled, domain.SCUMSafeErrorSourceChanged, domain.SCUMSafeErrorResultLimitExceeded:
+	case "", domain.SCUMSafeErrorNone, domain.SCUMSafeErrorProbeExecutorAbsent, domain.SCUMSafeErrorProbeMissing, domain.SCUMSafeErrorProbeFailed, domain.SCUMSafeErrorSchemaIncompatible, domain.SCUMSafeErrorBindingMismatch, domain.SCUMSafeErrorAdapterMismatch, domain.SCUMSafeErrorFingerprintMismatch, domain.SCUMSafeErrorDigestMismatch, domain.SCUMSafeErrorEvidenceExpired, domain.SCUMSafeErrorInvalidProbePayload, domain.SCUMSafeErrorInvalidRequest, domain.SCUMSafeErrorTargetUnavailable, domain.SCUMSafeErrorSourceUnavailable, domain.SCUMSafeErrorSQLiteOpenFailed, domain.SCUMSafeErrorSQLiteReadFailed, domain.SCUMSafeErrorDatabaseBusy, domain.SCUMSafeErrorTimeout, domain.SCUMSafeErrorCancelled, domain.SCUMSafeErrorSourceChanged, domain.SCUMSafeErrorResultLimitExceeded, domain.SCUMSafeErrorTemplateMissing, domain.SCUMSafeErrorTemplateMismatch, domain.SCUMSafeErrorParameterInvalid, domain.SCUMSafeErrorRowLimitExceeded, domain.SCUMSafeErrorResultSchemaInvalid:
 		return true
 	default:
 		return scumDataTargetSafeErrorPattern.MatchString(string(value))

platform/validator/scum_live_data_test.go

@@ -85,6 +85,45 @@ func TestValidateSCUMSchemaProbeResultAcceptsRunTerminalStatuses(t *testing.T) {
 	}
 }
 
+func TestValidateSCUMSQLiteTemplateRequestAllowsBoundedGenericTemplate(t *testing.T) {
+	request := validatorSCUMSQLiteTemplateRequest()
+
+	if err := ValidateSCUMSQLiteTemplateRequest(request); err != nil {
+		t.Fatalf("expected valid SQLite template request, got %v", err)
+	}
+}
+
+func TestValidateSCUMSQLiteTemplateRequestRejectsSQLPathsAndLooseBounds(t *testing.T) {
+	request := validatorSCUMSQLiteTemplateRequest()
+	request.TemplateKey = "select * from players"
+	request.Parameters = map[string]any{"profilePath": `C:\SCUM\Saved\SCUM.db`}
+	request.Bounds.MaxRows = 50000
+
+	err := ValidateSCUMSQLiteTemplateRequest(request)
+	if err == nil || !strings.Contains(err.Error(), "templateKey is unsafe") || !strings.Contains(err.Error(), "protected material") || !strings.Contains(err.Error(), "maxRows") {
+		t.Fatalf("expected template/key/bounds violations, got %v", err)
+	}
+}
+
+func TestValidateSCUMSQLiteTemplateResultAcceptsTypedRows(t *testing.T) {
+	result := validatorSCUMSQLiteTemplateResult()
+
+	if err := ValidateSCUMSQLiteTemplateResult(result); err != nil {
+		t.Fatalf("expected valid SQLite template result, got %v", err)
+	}
+}
+
+func TestValidateSCUMSQLiteTemplateResultRejectsUnsafeRowsAndMismatchedCounts(t *testing.T) {
+	result := validatorSCUMSQLiteTemplateResult()
+	result.RowCount = 2
+	result.Rows[0]["displayName"] = "select * from user_profile"
+
+	err := ValidateSCUMSQLiteTemplateResult(result)
+	if err == nil || !strings.Contains(err.Error(), "rowCount") || !strings.Contains(err.Error(), "protected material") {
+		t.Fatalf("expected row-count and protected-row violations, got %v", err)
+	}
+}
+
 func TestValidateSCUMCapabilityEvidenceRequiresSafeCurrentServiceIdentity(t *testing.T) {
 	evidence := domain.SCUMCapabilityEvidence{Capability: domain.SCUMDataCapabilityPlayerRead, Status: domain.SCUMCapabilityEvidenceCompatible, Binding: validatorSCUMBinding(), AdapterVersion: "adapter-1", SchemaFingerprint: scumProbeHash, ProbeResultDigest: scumProbeHash, AssetDigests: []string{scumProbeHash}, SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}}
 	if err := ValidateSCUMCapabilityEvidence(evidence); err != nil {
@@ -100,3 +139,12 @@ func TestValidateSCUMCapabilityEvidenceRequiresSafeCurrentServiceIdentity(t *tes
 func validatorSCUMBinding() domain.SCUMBindingIdentity {
 	return domain.SCUMBindingIdentity{ServerInstanceID: "server-1", RunBindingID: "binding-1", RunEndpointID: "run-1", PluginID: "game.scum", PluginVersion: "0.1.6", AdapterVersion: "adapter-1", GameVersion: "scum-1", DatabaseIdentity: "db-fingerprint-1"}
 }
+
+func validatorSCUMSQLiteTemplateRequest() domain.SCUMSQLiteTemplateRequest {
+	return domain.SCUMSQLiteTemplateRequest{RequestID: "request-1", JobID: "job-1", Binding: validatorSCUMBinding(), Capability: domain.SCUMDataCapabilityPlayerRead, TargetKey: "scum-database", TemplateKey: "players.active.v1", AdapterVersion: "adapter-1", RequiredSchemaFingerprint: scumProbeHash, AssetDigest: scumProbeHash, ParameterDigest: scumProbeHash, Parameters: map[string]any{"cursor": "", "limit": 100.0}, Bounds: domain.DefaultSCUMSQLiteTemplateBounds(), RequestedAt: time.Now()}
+}
+
+func validatorSCUMSQLiteTemplateResult() domain.SCUMSQLiteTemplateResult {
+	request := validatorSCUMSQLiteTemplateRequest()
+	return domain.SCUMSQLiteTemplateResult{RequestID: request.RequestID, JobID: request.JobID, Binding: request.Binding, Status: domain.SCUMTerminalResultSucceeded, Capability: request.Capability, TargetKey: request.TargetKey, TemplateKey: request.TemplateKey, AdapterVersion: request.AdapterVersion, SchemaFingerprint: request.RequiredSchemaFingerprint, AssetDigest: request.AssetDigest, ParameterDigest: request.ParameterDigest, SourceFingerprint: scumProbeHash, ObservedAt: time.Now(), ResultDigest: scumProbeHash, RowCount: 1, Rows: []map[string]any{{"externalPlayerId": "player-redacted", "displayName": "Known Player", "fame": 12.5, "online": true, "squadId": nil}}, Limits: request.Bounds, SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}}
+}