refactor(scum): declare protected run requests

2026-07-29 22:37:16 +08:00
parent d7465bfd32
commit 99be8f0f3a
28 changed files with 497 additions and 152 deletions
@@ -5,12 +5,13 @@ feature gate: no SCUM game, database, UE4SS build, or source revision controls
 plugin availability.

 The Companion declares availability from its server-bound typed ports and
-runtime schema probes. Notification and fixed vehicle spawning can use a local
-typed transport, but callers never supply a command, socket, credential, path,
-or raw transport reply. Vehicle spawning creates only the private
-`#spawnvehicle <vehicleCode>` template from the plugin allowlist.
+runtime schema probes. Plugin-generated SQL, RCON, and management-program
+request text is declared through the protected Platform-to-Run transport, not
+executed by the Companion. Callers never receive a socket, credential, path,
+or raw transport reply. A management-program request is not host OS shell
+access.

-Semantic events come from bounded Run stdout/stderr records. Unknown records
-create diagnostics and never produce fabricated events. Run database access is
-limited to typed allowlisted projections and safe mutations; DSNs, rows, SQL,
-and credentials do not leave Run.
+Semantic events come from bounded Run stdout/stderr console records. Unknown
+records create diagnostics and never produce fabricated events. DSNs, rows,
+connections, and credentials do not leave Run; request text is protected and
+redacted from browser and audit projections.