browser/openspec/changes/replace-scum-projections-with-real-data-management/evidence/run-log-source-tailing-handoff-2026-08-13.md

Run Log-Source Tailing Handoff (2026-08-13)

This is a browser-repository handoff for a separately authorized task in the independent Run repository git@git.npc0.com:admin343/run.git. It is not Run implementation or deployment evidence, and it does not enable SCUM login-driven player creation by itself.

Positive prompt (正向提示词)

Implement or extend generic plugin-declared log-source tailing in Run so Platform can consume sanitized parsed login/logout events from the current bound SCUM service without sending or receiving raw log paths, raw log lines, IP/network material, sockets, credentials, SQL, XML, or SCUM-specific executor branches. Success means Run tails only package-declared logical log sources, persists transport cursor state, handles rotation, copy-truncate, restart/resume, zero-byte active files, partial-line buffering, parser digest fencing, logical event fingerprinting, and replay, then returns typed log.parsed-events terminal envelopes or later parsed-event ingress payloads that Platform can validate against the active binding and declared parser identity.

Directional prompt (方向提示词)

Work only in the independent Run repository. Preserve Run as a generic executor: resolve file.tail sources from the generated Run package and runtime bindings, keep host paths and globs local to Run, fence every parser by package asset digest and parser digest, decode lines according to the packaged parser declaration, buffer incomplete lines across polling/restart boundaries, detect rotation or truncate by source fingerprint/generation rather than SCUM file names, persist acknowledged cursor state (source identity digest, stream generation, sequence), and emit sanitized logical events whose stable logicalEventDigest excludes source identity, stream generation, sequence, IP/network material, and coordinates.

Expected Run verification: focused protocol/runtime tests for zero-byte active file startup, append after empty file, UTF-16LE decoding, partial line buffering, oversized/undecodable/malformed line handling, failed-login discard, rotation, copy-truncate overlap, restart/resume from acknowledged cursor, duplicate transport cursor rejection, duplicate logical event replay, parser digest mismatch, stale binding/source identity rejection, bounded batch limits, safe error codes, and go test ./... from the Run repository root. After implementation, record the tested Run commit, distribution/deployment compatibility evidence for the active binding, and a safe redacted terminal-envelope sample back in this browser-repository change before enabling login-event ingestion tasks.

Boundary prompt (任务边界)

Do not edit or vendor Run source into this browser repository, add a run/ tree here, expose raw host paths, resolved log names, glob patterns, log lines, IP/network identifiers, sockets, credentials, SQL, XML, raw player identities, or parser-internal source paths in Platform, browser, AI context, or evidence. Do not branch Run behavior on SCUM file names, SCUM table names, SCUM parser keys, or SCUM event semantics; do not treat ordinary log ingest as a parsed-event success path; do not fabricate players/sessions from malformed, failed-login, duplicate, obsolete-binding, or out-of-order events; and do not treat this handoff as product acceptance evidence.

Browser-side frozen contract

• Platform domain/DTO contracts define SCUMParsedLogBatchResult, SCUMParsedLogEvent, SCUMParsedLogCursor, parsed-log batch limits, tail states (advanced, rotated, truncated, restarted, partial-buffered, replayed), and safe terminal statuses.
• Job-channel DTOs parse terminal executionResult.parsedLogBatch from Run when executionResult.kind is log.parsed-events.
• Validators require request/job/binding identity, source/stream/parser key, adapter version, parser asset digest, parser digest, first/last redacted source identity and generation cursors, bounded event counts, logical event digests, event/payload digests, safe scalar payloads, and applied limits.
• Validators reject raw log/path/IP/network material, raw XML, SQL-like text, unsafe summaries, unsafe safe-error messages, duplicate transport cursors, duplicate logical event digests within a batch, event-count mismatches, loose line/payload/result bounds, parser digest omissions, and cross-generation batch success.
• Service job completion accepts log.parsed-events only for logs.backfill jobs carrying a leased declared file.tail log source, checks server/Run endpoint, declared source/stream key, plugin id/version when frozen, parser key/version/digest/adapter version when frozen in execution inputs, and single source identity/generation boundaries.
• Terminal idempotency fingerprints include parsed-log result digest, asset digest, parser digest, stream generation, event count, and tail state.

Remaining evidence required before enabling parsed-login ingestion

• Tested Run commit and go test ./... output from the independent Run repository.
• Generated Run package evidence carrying the declared file.tail source, parser asset, parser digest, max-line limit, cursor policy, and privacy policy.
• Active current-service evidence showing the latest zero-byte login file, non-empty UTF-16LE fixtures, rotation/truncate behavior, and sanitized parser output with no raw network material.
• Platform acceptance evidence proving parsed batches are authenticated, fenced to the current server/Run/plugin/parser binding, idempotent across replay, and rejected for stale parser digest, stale source identity, duplicate transport cursor, and unsafe payloads.
• Follow-on Platform ingestion tests from task 6.1 proving successful login creates one local player/session, logout closes only matching sessions, and malformed/failed/duplicate/out-of-order events do not fabricate state.