browser/openspec/changes/move-scum-feature-ownership-to-plugin/specs/scum-companion-runtime-adapter/spec.md

ADDED Requirements

Requirement: Companion uses runtime capability isolation

The SCUM Companion SHALL dispatch only declared typed handlers bound to its authorized server. Handler availability SHALL come from runtime capability and schema probes, not a game, UE4SS, database, build, revision, or version gate. A probe or command failure SHALL affect only that handler invocation.

Scenario: A runtime adapter is unavailable

• WHEN a typed port or schema probe is unavailable
• THEN the Companion returns a typed unavailable/failed/unknown result for that command and does not disable an unrelated plugin feature

Requirement: Run data channels are bounded

Run SHALL send SCUM stdout/stderr records to the Companion through the durable log channel and SHALL provide database data only as typed allowlisted projections and fixed server-management operations. No plugin, web page, or AI request SHALL receive a path, DSN, credential, raw row, arbitrary SQL, shell, socket, or RCON command.

Scenario: Unknown console output

• WHEN stdout or stderr does not match a declared semantic parser
• THEN the Companion records a bounded diagnostic and uploads no semantic event or raw line

Requirement: Mutations prove safety

State patch adapters SHALL use field allowlists, a pre-read, safe-window verification, a bounded write, and read-after-write confirmation. Reward adapters SHALL freeze their typed grant and return delivered, failed, or unknown without automatically retrying unknown outcomes.

Scenario: Confirmation cannot be established

• WHEN a typed write or post-write read cannot establish success
• THEN the Companion returns unknown and does not repeat the operation

Requirement: Vehicle spawning remains fixed

vehicle.spawn SHALL accept only a catalogued vehicle code and create exactly #spawnvehicle <vehicleCode> inside the Companion. Protected audit text SHALL not be present in command results or browser payloads.

Scenario: Unsafe spawn input

• WHEN input includes an unlisted code, an extra field, command text, SQL, a path, credential, socket, shell text, or RCON text
• THEN no transport call occurs and validation fails