65 lines
3.2 KiB
Markdown
65 lines
3.2 KiB
Markdown
# Server deployment lifecycle
|
|
|
|
`deployment.plan.v1` gates only generic custom-command deployment execution:
|
|
Platform sends a protected `RunJobAssignmentResponse.executionInput.deployment`
|
|
when a server uses `custom-command` mode and Run executes the operator-reviewed
|
|
argv-oriented command inside its local policy.
|
|
|
|
Guided or existing-server game setup is plugin-owned. Platform dispatches the
|
|
plugin-declared lifecycle action reference, such as `actions/install.json` or a
|
|
supervised `actions/start.json` bootstrap, and may include generic deployment
|
|
context (`mode`, `profileKey`, `serverRoot`, and `createInputs`) so the plugin
|
|
action can resolve its own behavior. Platform does not create a game-specific
|
|
`serverDeploymentPlan`, and SCUM no longer requires a `deployment.scum.v1`
|
|
capability.
|
|
|
|
## Capability and policy
|
|
|
|
Run advertises normal lifecycle capabilities (`process.install`,
|
|
`process.start`, `process.stop`, `process.status`) and generic primitives such as
|
|
scoped files, logs, artifacts, dependency helpers, and custom deployment plan
|
|
execution. A Run that supports shell commands advertises its local shell policy
|
|
out of band with operator configuration. Platform must not infer shell support
|
|
from command text. Empty `shell` means argv-oriented execution.
|
|
|
|
## Plugin-owned game lifecycle
|
|
|
|
Game plugins own concrete game policy: install/update commands, app ids,
|
|
executable refs, default launch flags, stop-before-update behavior, and startup
|
|
argument construction. For SCUM, those values live in the SCUM plugin action
|
|
assets and scripts; Platform and Run only pass the bounded deployment context to
|
|
the declared lifecycle action and execute it through generic action handling.
|
|
|
|
Generated Run distributions carry validated plugin lifecycle assets into the
|
|
server-scoped workspace. Run materializes those assets at startup and executes
|
|
them through generic action template handling; it does not branch on game ids,
|
|
Steam app ids, SCUM executable paths, or launch flags.
|
|
|
|
## Required local preflight
|
|
|
|
Before a custom-command action, Run validates the selected protected deployment
|
|
body:
|
|
|
|
- absolute server root and working directory are allowed only where permitted by
|
|
local Run policy;
|
|
- selected shell kind and custom-command policy are enabled;
|
|
- no raw command, path, secret, socket address, or credential is emitted in a
|
|
result, diagnostic, log batch, or artifact name.
|
|
|
|
For plugin-owned actions, Run validates scoped action template paths, executable
|
|
asset refs, bounded environment variables, and lifecycle action/capability
|
|
matches. Deployment create inputs may be exposed to the action as bounded
|
|
environment variables such as `SERVER_CREATE_GAMEPORT`; protected command text is
|
|
not exposed unless the server explicitly uses custom-command mode.
|
|
|
|
## Safe progress reports
|
|
|
|
Run reports bounded progress with `percent`, `phase`, and a safe message. The
|
|
allowed phase vocabulary is `queued`, `claimed`, `preflight`, `scan`, `install`,
|
|
`configure`, `mapping`, `start`, and `health`. On failure it reports a stable
|
|
safe error code and summary, never the supplied path or command text.
|
|
|
|
Platform treats Run preflight as authoritative. It does not open a direct shell,
|
|
SSH connection, raw socket, or host filesystem to compensate for a failed
|
|
preflight.
|