30 lines
1.6 KiB
Markdown
30 lines
1.6 KiB
Markdown
## Design
|
|
|
|
The platform owns only reusable authorization, server isolation, auditing,
|
|
queues, opaque storage, and channels to Run. The SCUM plugin owns its page,
|
|
allowlists, schemas, event parsers, and Companion adapters. `platform_web`
|
|
mounts the declared plugin page generically.
|
|
|
|
Run emits SCUM process stdout/stderr records through the durable log channel;
|
|
these are not server execution logs. The Companion parses only declared,
|
|
bounded record formats into semantic events. Unknown records make a bounded
|
|
diagnostic and are skipped. A per-server correlation digest may be derived
|
|
locally but never includes a raw network value in an upload.
|
|
|
|
The Companion receives only typed commands and invokes only registered typed
|
|
ports. Its game-data port exposes allowlisted player, vehicle, and position
|
|
data as bounded projections, never DSNs, paths, credentials, or rows. Fixed
|
|
server-management ports expose only declared operations. State changes read
|
|
the precondition, verify a safe window, write allowed fields, then confirm the
|
|
write. Reward delivery freezes a grant and maps each receipt to delivered,
|
|
failed, or unknown without retrying unknown outcomes. A command's failure or
|
|
unknown result affects that command alone.
|
|
|
|
Runtime capability/schema probes decide whether a particular handler is
|
|
available. They do not depend on a server/game/UE4SS/database version, build,
|
|
or source revision, and a failed probe never disables unrelated features.
|
|
|
|
`vehicle.spawn` is the one fixed administration template. It accepts only a
|
|
catalogued identifier and builds exactly `#spawnvehicle <vehicleCode>` inside
|
|
the Companion. The text stays private to its typed transport/audit boundary.
|