34 lines
2.0 KiB
Markdown
34 lines
2.0 KiB
Markdown
## Design
|
|
|
|
The platform owns reusable authorization, tenant/server isolation, approvals,
|
|
auditing, expiry, queues, protected storage, and channels to Run. The SCUM
|
|
plugin owns its page, request generation, schemas, event parsers, and
|
|
Companion adapters. `platform_web` mounts the declared plugin page generically.
|
|
|
|
A bridge command may declare a protected request transport of kind `sql`,
|
|
`rcon`, or `program`. The declaration names only logical transport and target
|
|
keys plus a bounded text field; it cannot name a DSN, path, socket, credential,
|
|
or executable. A plugin can generate the request text, but Platform retains it
|
|
as protected payload, emits only redacted audit metadata, and forwards it only
|
|
after the normal server scope, permission, approval, expiry, and queue checks.
|
|
Run consumes a fenced, server-bound authorized request and resolves secrets and
|
|
the actual transport locally. Platform does not parse game-specific SQL, RCON,
|
|
or program syntax. `program` means a management-program transport accepted by
|
|
Run policy, never an operating-system shell.
|
|
|
|
Run emits SCUM process stdout/stderr console records through the durable log
|
|
channel; these are not file execution logs. The Companion parses only declared,
|
|
bounded record formats into semantic events. Unknown records make a bounded
|
|
diagnostic and are skipped. A per-server correlation digest may be derived
|
|
locally but never includes a raw network value in an upload.
|
|
|
|
The Companion receives only authorized, server-bound bridge commands and
|
|
bounded console records. Plugins, pages, and AI never receive DSNs, paths,
|
|
credentials, raw connections, sockets, or shell access. Run results are bounded
|
|
to `succeeded`, `failed`, or `unknown` with safe diagnostics. A request failure,
|
|
unknown text, or unsupported field affects that request alone.
|
|
|
|
Runtime capability/schema probes decide whether a particular handler is
|
|
available. They do not depend on a server/game/UE4SS/database version, build,
|
|
or source revision, and a failed probe never disables unrelated features.
|