admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(scum): declare protected run requests

Browse Source
This commit is contained in:
npc0-hue
2026-07-29 22:37:16 +08:00
parent d7465bfd32
commit 99be8f0f3a
28 changed files with 497 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/move-scum-feature-ownership-to-plugin/design.md
+22 -18
View File
@@ -1,29 +1,33 @@
## Design
The platform owns only reusable authorization, server isolation, auditing,
queues, opaque storage, and channels to Run. The SCUM plugin owns its page,
allowlists, schemas, event parsers, and Companion adapters. `platform_web`
mounts the declared plugin page generically.
The platform owns reusable authorization, tenant/server isolation, approvals,
auditing, expiry, queues, protected storage, and channels to Run. The SCUM
plugin owns its page, request generation, schemas, event parsers, and
Companion adapters. `platform_web` mounts the declared plugin page generically.
Run emits SCUM process stdout/stderr records through the durable log channel;
these are not server execution logs. The Companion parses only declared,
A bridge command may declare a protected request transport of kind `sql`,
`rcon`, or `program`. The declaration names only logical transport and target
keys plus a bounded text field; it cannot name a DSN, path, socket, credential,
or executable. A plugin can generate the request text, but Platform retains it
as protected payload, emits only redacted audit metadata, and forwards it only
after the normal server scope, permission, approval, expiry, and queue checks.
Run consumes a fenced, server-bound authorized request and resolves secrets and
the actual transport locally. Platform does not parse game-specific SQL, RCON,
or program syntax. `program` means a management-program transport accepted by
Run policy, never an operating-system shell.
Run emits SCUM process stdout/stderr console records through the durable log
channel; these are not file execution logs. The Companion parses only declared,
bounded record formats into semantic events. Unknown records make a bounded
diagnostic and are skipped. A per-server correlation digest may be derived
locally but never includes a raw network value in an upload.
The Companion receives only typed commands and invokes only registered typed
ports. Its game-data port exposes allowlisted player, vehicle, and position
data as bounded projections, never DSNs, paths, credentials, or rows. Fixed
server-management ports expose only declared operations. State changes read
the precondition, verify a safe window, write allowed fields, then confirm the
write. Reward delivery freezes a grant and maps each receipt to delivered,
failed, or unknown without retrying unknown outcomes. A command's failure or
unknown result affects that command alone.
The Companion receives only authorized, server-bound bridge commands and
bounded console records. Plugins, pages, and AI never receive DSNs, paths,
credentials, raw connections, sockets, or shell access. Run results are bounded
to `succeeded`, `failed`, or `unknown` with safe diagnostics. A request failure,
unknown text, or unsupported field affects that request alone.
Runtime capability/schema probes decide whether a particular handler is
available. They do not depend on a server/game/UE4SS/database version, build,
or source revision, and a failed probe never disables unrelated features.
`vehicle.spawn` is the one fixed administration template. It accepts only a
catalogued identifier and builds exactly `#spawnvehicle <vehicleCode>` inside
the Companion. The text stays private to its typed transport/audit boundary.