2.0 KiB
Design
The platform owns reusable authorization, tenant/server isolation, approvals,
auditing, expiry, queues, protected storage, and channels to Run. The SCUM
plugin owns its page, request generation, schemas, event parsers, and
Companion adapters. platform_web mounts the declared plugin page generically.
A bridge command may declare a protected request transport of kind sql,
rcon, or program. The declaration names only logical transport and target
keys plus a bounded text field; it cannot name a DSN, path, socket, credential,
or executable. A plugin can generate the request text, but Platform retains it
as protected payload, emits only redacted audit metadata, and forwards it only
after the normal server scope, permission, approval, expiry, and queue checks.
Run consumes a fenced, server-bound authorized request and resolves secrets and
the actual transport locally. Platform does not parse game-specific SQL, RCON,
or program syntax. program means a management-program transport accepted by
Run policy, never an operating-system shell.
Run emits SCUM process stdout/stderr console records through the durable log channel; these are not file execution logs. The Companion parses only declared, bounded record formats into semantic events. Unknown records make a bounded diagnostic and are skipped. A per-server correlation digest may be derived locally but never includes a raw network value in an upload.
The Companion receives only authorized, server-bound bridge commands and
bounded console records. Plugins, pages, and AI never receive DSNs, paths,
credentials, raw connections, sockets, or shell access. Run results are bounded
to succeeded, failed, or unknown with safe diagnostics. A request failure,
unknown text, or unsupported field affects that request alone.
Runtime capability/schema probes decide whether a particular handler is available. They do not depend on a server/game/UE4SS/database version, build, or source revision, and a failed probe never disables unrelated features.