Files
browser/openspec/changes/move-scum-feature-ownership-to-plugin/design.md
T

30 lines
1.6 KiB
Markdown

## Design
The platform owns only reusable authorization, server isolation, auditing,
queues, opaque storage, and channels to Run. The SCUM plugin owns its page,
allowlists, schemas, event parsers, and Companion adapters. `platform_web`
mounts the declared plugin page generically.
Run emits SCUM process stdout/stderr records through the durable log channel;
these are not server execution logs. The Companion parses only declared,
bounded record formats into semantic events. Unknown records make a bounded
diagnostic and are skipped. A per-server correlation digest may be derived
locally but never includes a raw network value in an upload.
The Companion receives only typed commands and invokes only registered typed
ports. Its game-data port exposes allowlisted player, vehicle, and position
data as bounded projections, never DSNs, paths, credentials, or rows. Fixed
server-management ports expose only declared operations. State changes read
the precondition, verify a safe window, write allowed fields, then confirm the
write. Reward delivery freezes a grant and maps each receipt to delivered,
failed, or unknown without retrying unknown outcomes. A command's failure or
unknown result affects that command alone.
Runtime capability/schema probes decide whether a particular handler is
available. They do not depend on a server/game/UE4SS/database version, build,
or source revision, and a failed probe never disables unrelated features.
`vehicle.spawn` is the one fixed administration template. It accepts only a
catalogued identifier and builds exactly `#spawnvehicle <vehicleCode>` inside
the Companion. The text stays private to its typed transport/audit boundary.