1.6 KiB
Design
The platform owns only reusable authorization, server isolation, auditing,
queues, opaque storage, and channels to Run. The SCUM plugin owns its page,
allowlists, schemas, event parsers, and Companion adapters. platform_web
mounts the declared plugin page generically.
Run emits SCUM process stdout/stderr records through the durable log channel; these are not server execution logs. The Companion parses only declared, bounded record formats into semantic events. Unknown records make a bounded diagnostic and are skipped. A per-server correlation digest may be derived locally but never includes a raw network value in an upload.
The Companion receives only typed commands and invokes only registered typed ports. Its game-data port exposes allowlisted player, vehicle, and position data as bounded projections, never DSNs, paths, credentials, or rows. Fixed server-management ports expose only declared operations. State changes read the precondition, verify a safe window, write allowed fields, then confirm the write. Reward delivery freezes a grant and maps each receipt to delivered, failed, or unknown without retrying unknown outcomes. A command's failure or unknown result affects that command alone.
Runtime capability/schema probes decide whether a particular handler is available. They do not depend on a server/game/UE4SS/database version, build, or source revision, and a failed probe never disables unrelated features.
vehicle.spawn is the one fixed administration template. It accepts only a
catalogued identifier and builds exactly #spawnvehicle <vehicleCode> inside
the Companion. The text stays private to its typed transport/audit boundary.