browser/openspec/changes/synchronize-run-deployment-execution/specs/run-deployment-execution-receipts/spec.md

ADDED Requirements

Requirement: Frozen deployment execution

Platform SHALL send a typed, versioned deployment definition with every lifecycle job for a configured server, and Run SHALL reject a definition it cannot validate or execute for the requested lifecycle action.

Scenario: Start uses the leased revision

• WHEN Run receives a valid process.start job with deployment revision 7
• THEN it SHALL execute only the fields in that leased revision and SHALL not fetch a mutable replacement definition

Scenario: Incompatible Run is rejected

• WHEN a selected Run does not advertise deployment-execution support
• THEN Platform SHALL reject dispatch before assigning a lifecycle job

Requirement: Execution revision receipt

Run SHALL include a non-sensitive deployment execution receipt in each terminal deployment-aware lifecycle result, and Platform SHALL validate the receipt against the job's leased definition before projecting confirmation.

Scenario: Matching receipt is projected

• WHEN Run succeeds a start job and returns the job's deployment revision and action
• THEN Platform SHALL show that Run confirmed execution of that revision

Scenario: Mismatched receipt is rejected

• WHEN Run reports a deployment revision or lifecycle action different from the lease
• THEN Platform SHALL reject the terminal result and SHALL not mark the job successful

Requirement: Explicit deployment field clearing

Platform SHALL preserve a deployment value when an update omits it and SHALL clear an optional field only when the update explicitly names that field for clearing.

Scenario: Omitted shell remains unchanged

• WHEN an editor saves a deployment update without a shell value
• THEN Platform SHALL preserve the saved shell selection

Scenario: Optional command is cleared

• WHEN an editor submits stopCommand in its explicit clear list
• THEN Platform SHALL store no stop command for the next deployment revision

Requirement: SCUM guided deployment is template-owned

For a frozen SCUM guided-install assignment, Run SHALL execute the declared SCUM installation template rather than requiring an operator-provided install or start command. The operator supplies only the protected target root and plugin create inputs.

Scenario: Missing runtime prerequisites are installed silently

• WHEN a Windows SCUM guided-install detects a required declared Microsoft runtime is absent
• THEN Run SHALL obtain the approved Microsoft artifact, invoke only its fixed silent installer arguments, verify the runtime marker, and continue only when verification passes

Scenario: SteamCMD installs into the selected root

• WHEN a valid SCUM guided-install is executed for root C:\\scumserver
• THEN Run SHALL invoke SteamCMD with +force_install_dir C:\\scumserver, anonymous login, App 3792580, validation, and quit as separate argument values

Scenario: Guided execution does not disclose raw values remotely

• WHEN Run completes or fails a SCUM guided-install
• THEN its progress, result, evidence, artifact names, and uploaded logs SHALL contain no raw root, command line, credential, or installer URL