Freeze SCUM typed RCON run contract

openspec/changes/replace-scum-projections-with-real-data-management/evidence/run-typed-rcon-template-execution-handoff-2026-08-13.md

@@ -0,0 +1,32 @@
+# Run Typed RCON Template Execution Handoff (2026-08-13)
+
+This is a browser-repository handoff for a separately authorized task in the independent Run repository `git@git.npc0.com:admin343/run.git`. It is not Run implementation or deployment evidence, and it does not enable SCUM write capabilities by itself.
+
+## Positive prompt (正向提示词)
+
+Implement generic plugin-owned typed RCON-template execution for Run's protected RCON capability so Platform can dispatch reviewed SCUM command writes without sending browser command text, raw RCON, SQL, XML, host paths, sockets, credentials, or undeclared command keys. Success means Run accepts only a typed leased `rconTemplate` request containing logical transport/target keys, template key, adapter/schema version, immutable asset digest, canonical payload digest, confirmation digest, target identity digest, idempotency key, bounded scalar payload, safe review reason, and strict limits; renders only the packaged template; executes through generic protected RCON; performs the declared confirmation path; and returns a typed `rcon.template-command` terminal envelope that Platform can validate against the original durable job.
+
+## Directional prompt (方向提示词)
+
+Work only in the independent Run repository. Preserve Run as a generic executor: resolve protected RCON transports and packaged command templates from the generated Run workspace, verify asset/payload/confirmation digests and active binding, validate scalar payload against packaged schema, render only the packaged template with bound values, enforce payload/response/confirmation limits, honor timeout and cancellation, redact rendered command text from all result envelopes, and return stable safe error codes. The terminal envelope must contain request/job/binding identity, capability, transport/target/template key, adapter version, schema fingerprint when required, asset digest, payload digest, confirmation digest, target identity digest, observed time, result digest, response digest, confirmation status, confirmation digest id, safe summary, safe error, and applied limits.
+
+Expected Run verification: focused protocol/runtime tests for valid template execution, unknown template, digest mismatch, payload schema rejection, missing protected transport, timeout/cancellation, response limits, confirmation success/failure/unknown, duplicate/late terminal result behavior, and `go test ./...` from the Run repository root. After implementation, record the tested Run commit, distribution/deployment evidence for the active binding, and safe terminal-envelope evidence back in this browser-repository change before enabling typed command or gift gates.
+
+## Boundary prompt (任务边界)
+
+Do not edit or vendor Run source into this browser repository, add a `run/` tree here, accept browser command text, expose rendered RCON text, expose host paths/credentials/sockets/raw XML/SQL/IPs/player identities in evidence, add SCUM-specific executor branches, branch on SCUM keys/commands/tables/gift/economy semantics, enable typed RCON templates or gift catalogs in the production SCUM manifest, enable write gates before current-service command/readback evidence and tested Run evidence are recorded, or treat this handoff as product acceptance evidence. Run must remain game-agnostic and execute only package-declared generic assets under the active signed binding and lease.
+
+## Browser-side frozen contract
+
+- Platform domain/DTO contracts define `SCUMTypedRCONTemplateRequest`, `SCUMTypedRCONTemplateResult`, typed RCON bounds, terminal statuses, and confirmation statuses.
+- Job-channel DTOs expose leased `executionInput.rconTemplate` to Run and parse terminal `executionResult.rconTemplate` from Run.
+- Validators reject unsafe template keys, protected material, raw command-like payload keys, invalid digests, loose bounds, unsafe review reasons, unsafe summaries, unconfirmed success, and mismatched adapter/binding versions.
+- Service job completion accepts `rcon.template-command` only for `remote.run.protected.rcon` jobs carrying a typed template request, requires the typed result on success, checks leased job/binding/transport/template/schema/asset/payload/confirmation/target identity, and includes typed result digests in terminal idempotency fingerprints.
+
+## Remaining evidence required before enabling writes
+
+- Tested Run commit and `go test ./...` output from the independent Run repository.
+- Generated Run package carrying any future packaged RCON templates and immutable digests.
+- Current-service evidence proving supported command semantics, confirmation/readback behavior, item aliases/transports where relevant, and safe failure outcomes.
+- Active binding deployment evidence showing compatible Run executes `remote.run.protected.rcon` through the typed envelope without raw command exposure.
+- Platform acceptance evidence for at least one safe typed command job against isolated test data or an explicitly authorized test player.

openspec/changes/replace-scum-projections-with-real-data-management/tasks.md

@@ -115,10 +115,17 @@
 - Added focused tests for DTO parsing, safe validator rejection of raw SQL/path-like material and loose bounds, typed row/result validation, service lease fencing, and digest mismatch rejection. Verification passed: `go test ./dto ./validator ./service -run 'Test(RunJobResultRequestParsesSQLite|ValidateSCUMSQLiteTemplate|CoreServiceRunJobSQLiteTemplateEnvelopeIsFencedToLease)'`.
 - Recorded the separately rooted Run handoff prompt in `evidence/run-sqlite-template-execution-handoff-2026-08-13.md` with positive, directional, and boundary prompts. This is a contract handoff only; tasks 4.7, 4.9, and DB-backed read gates remain unchecked until tested Run commit/deployment/terminal-envelope evidence is recorded.
 
+### Typed RCON-template contract freeze and Run handoff evidence (2026-08-13)
+
+- Platform protocol docs now freeze the generic `rconTemplate` request and `rcon.template-command` terminal envelope: logical transport/target/template keys, adapter/schema fingerprint when required, asset digest, payload digest, confirmation digest, target identity digest, idempotency key, bounded scalar payload, safe review reason, response/confirmation limits, conclusive confirmation status, and stable safe result/error codes.
+- Added Platform domain/DTO/job-channel/validator/service contracts for `SCUMTypedRCONTemplateRequest` and `SCUMTypedRCONTemplateResult`. Run assignments can carry only the typed template request, not browser command text; Run results can return only safe digests/status/summary; Platform verifies leased job identity, binding, transport, template, schema, asset, payload, confirmation, and target digests before accepting success.
+- Added focused tests for DTO parsing, validator rejection of raw command-like payload keys, unsafe review reasons, loose bounds, unconfirmed success, unsafe summaries, service lease fencing, and payload digest mismatch rejection. Verification passed: `go test ./dto ./validator ./service -run 'Test(RunJobResultRequestParses(SQLite|TypedRCON)|ValidateSCUM(SQLiteTemplate|TypedRCON)|CoreServiceRunJob(SQLiteTemplate|TypedRCONTemplate)EnvelopeIsFencedToLease)'`.
+- Recorded the separately rooted Run handoff prompt in `evidence/run-typed-rcon-template-execution-handoff-2026-08-13.md` with positive, directional, and boundary prompts. This is a contract handoff only; typed RCON templates, gift catalogs, write gates, and task 4.7 remain unchecked until tested Run commit/deployment/current-service command/readback evidence is recorded.
+
 - [x] 4.1 Add Platform protocol contracts under `platform/protocol`, API DTOs under `platform/dto`, validation under `platform/validator`, and plugin contracts/assets under `plugins/sdk` and `plugins/schemas`, plus contract documentation/mocks for probes, read-only template execution, typed RCON, guarded SQLite/XML mutation, parsed log events, and terminal result envelopes.
 - [x] 4.2 Freeze the generic executor/result contract and hand off a separately authorized Run-repository task for packaged SQLite-template execution with query-only connections, bound parameters, one-statement validation, short busy/operation timeouts, cancellation, and row/result-byte limits.
 - [x] 4.3 Require the independent Run task to return typed envelopes containing server/plugin binding, adapter/schema version, template key, asset digest, job identity, observed time, checksum, rows or affected-row count, and stable safe result/error codes.
-- [ ] 4.4 Require the independent Run task to implement generic plugin-owned typed RCON-template execution without accepting browser command text or adding branches for SCUM, SCUM keys, SCUM commands, or SCUM tables.
+- [x] 4.4 Require the independent Run task to implement generic plugin-owned typed RCON-template execution without accepting browser command text or adding branches for SCUM, SCUM keys, SCUM commands, or SCUM tables.
 - [ ] 4.5 Require the independent Run task to implement generic guarded single-row SQLite/XML mutation execution with expected identity/value/checksum guards, a bounded transaction, preserving XML patching, rollback on zero/multiple affected rows, and read-after-write confirmation.
 - [ ] 4.6 Require the independent Run task to implement or extend generic plugin-declared log-source tailing so cursor persistence, rotation, truncate, restart, partial-line buffering, parser digest fencing, logical event fingerprinting, and replay remain independent of SCUM-specific source paths.
 - [ ] 4.7 Verify from the independent Run task's acceptance evidence that control/job/log/artifact priorities, leases, fencing, acknowledgements, idempotency, and late/duplicate terminal-result handling remain intact for the new generic capabilities.