feat: gate allocation on accepted proposals

multiplayer-next.md

@@ -59,7 +59,9 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md).
   fencing; `server/agones` now submits and validates namespaced
   `GameServerAllocation` responses, including dynamic address/port data;
   `server/allocator` now requires provider allocation reconciliation into the
-  durable registry before returning an endpoint; allocator-facing roster
+  durable registry before returning an endpoint and exposes an accepted-proposal
+  gate that validates unanimous responses and playlist/participant invariants;
+  allocator-facing roster
   publication now requires an allocated endpoint and verifies canonical
   join-authorisation signatures before exposing player rows; live Agones
   integration remains.

multiplayer-todo.md

@@ -1213,7 +1213,7 @@ the local/CI/community transport, not a silent production fallback.
 | 8.27 `[D:8.26]` | **IN PROGRESS.** Go supervisor package provides local-safe Agones REST discovery, validates assigned address/port data, injects dynamic `SDR_LISTEN_PORT`/`SDR_IP`, performs explicit process-ready probing and Ready transition; direct mode bypasses Agones | `server/supervisor/` covers allocated/direct startup, invalid endpoint rejection, dynamic endpoint/Ready ordering and authenticated drain; allocated Godot now supplies a loopback readiness/drain control surface and `agones_sdk.gd` supplies sidecar Health/Ready/Shutdown/annotation REST operations; metadata watch, real Agones annotation/shutdown confirmation and emulator integration remain |
 | 8.28 `[D:8.6,8.27]` | **IN PROGRESS.** Supervisor separates explicit process-ready from Agones Ready and never scrapes stdout; allocated mode refuses to mark Ready without a configured readiness probe | `server/supervisor/` tests prove Ready follows the probe and direct mode remains functional; `server_control.gd`, `agones_sdk.gd` and process-level smokes prove loopback `/ready`, `/health`, bearer-protected `/drain`, sidecar-shaped Health/Ready calls and drain admission fencing; detached-container and Health-reclaim integration remain |
 | 8.29 `[D:8.26,8.27]` | **IN PROGRESS.** Supervisor discovers and validates the Agones endpoint, propagates the actual dynamic `--port`, and exports `SDR_LISTEN_PORT`/`SDR_IP` only for Hosted-SDR while preserving an isolated ENet path | `server/supervisor/` tests cover invalid address/port rejection, dynamic port argument/env propagation and SDR-vs-ENet separation; real Agones dynamic/passthrough mapping, POP/cert/firewall/NAT and multi-match fixture remain |
-| 8.30 `[D:8.18,8.26,8.28,8.29]` | **IN PROGRESS.** Pure Go allocator filters Ready servers by region/build/protocol/transport, atomically claims one with idempotent allocation replay, and now owns the assignment-publication boundary; PostgreSQL adds durable GameServer registration and compatible `SKIP LOCKED` claims with request-digest fencing; `server/agones` submits and validates namespaced `GameServerAllocation` responses and dynamic endpoints; `server/allocator` reconciles provider success into durable state before exposing the endpoint | `server/domain/allocator.go`, `server/store/allocator_sql.go`, `server/agones/allocation.go`, `server/allocator/service.go`, `server/migrations/0004_allocator_registry.sql` and tests cover deterministic compatible selection, exhaustion, conflicting/identical allocation replay, unknown allocations, SQL claim ordering, invalid input, provider error/malformed response/IPv6 endpoint handling, durable-reconciliation failure isolation and assignment replay/conflict; `TestPostgreSQLAllocatorClaimReplayAndCapacityFence` now covers live registration/selection/replay/conflict/no-capacity when the disposable database gate is run; signed roster metadata, bounded cross-replica retry and live integration remain |
+| 8.30 `[D:8.18,8.26,8.28,8.29]` | **IN PROGRESS.** Pure Go allocator filters Ready servers by region/build/protocol/transport, atomically claims one with idempotent allocation replay, verifies unanimous accepted-proposal/playlist/participant invariants before provider invocation, and now owns the assignment-publication boundary; PostgreSQL adds durable GameServer registration and compatible `SKIP LOCKED` claims with request-digest fencing; `server/agones` submits and validates namespaced `GameServerAllocation` responses and dynamic endpoints; `server/allocator` reconciles provider success into durable state before exposing the endpoint | `server/domain/allocator.go`, `server/store/allocator_sql.go`, `server/agones/allocation.go`, `server/allocator/service.go`, `server/migrations/0004_allocator_registry.sql` and tests cover deterministic compatible selection, exhaustion, conflicting/identical allocation replay, unknown allocations, SQL claim ordering, invalid input, provider error/malformed response/IPv6 endpoint handling, accepted-proposal gating, durable-reconciliation failure isolation and assignment replay/conflict; `TestPostgreSQLAllocatorClaimReplayAndCapacityFence` now covers live registration/selection/replay/conflict/no-capacity when the disposable database gate is run; signed roster metadata, bounded cross-replica retry and live integration remain |
 | 8.31 `[D:8.9,8.30]` | **IN PROGRESS.** Pure Go assignment gate requires Allocated state, exact allocation ID/match/server/region/build/protocol/transport compatibility, non-empty hosted endpoint and verified manifest signature before exposure; allocator publication cannot expose Ready state; durable roster persistence now verifies each canonical join-authorisation signature before publishing player rows; allocator service gates roster publication on allocated state and endpoint presence | `server/domain/assignment.go`, `allocator.go`, `store/assignment_sql.go` plus adversarial fixtures cover early-connect, tampered signature/manifest, wrong compatibility, empty endpoint, unknown allocation, forged roster signature, valid signature, premature publication and post-publication mutation rejection; Agones metadata watch, hosted-address registration, production signer and client-ticket publication remain |
 | 8.32 `[D:8.2,8.26,8.30]` | **IN PROGRESS.** Provider-neutral FleetAutoscaler baseline preserves a two-process Ready buffer, caps warm capacity, and leaves Allocated scale-down independent of the Ready floor; Fleet image references remain digest-pinned for current/rollback pre-pull | `deploy/k8s/base/fleet-autoscaler.yaml` and manifest tests cover Fleet ownership, Buffer policy and floor/cap invariants; regional on-demand node pools/failure domains, pre-pull rollout, warm-allocation p95/p99 and N+1 certification remain |
 | 8.33 `[D:8.26,8.32]` | **IN PROGRESS.** Fleet scheduling now requires on-demand capacity and spreads Ready processes across zones with skew 1; the autoscaler preserves the two-process Ready floor | `deploy/k8s/base/fleet.yaml` and manifest tests reject interruptible placement and single-zone concentration structurally; regional node pools, forced node-loss testing and measured N+1 headroom remain |

server/allocator/service.go

@@ -29,6 +29,36 @@ type Service struct {
 	Now      func() time.Time
 }
 
+// AllocateAcceptedProposal is the hand-off from proposal consensus to server
+// allocation. Keeping this check beside the provider call prevents a caller
+// from allocating capacity for an OPEN/DECLINED proposal or for a request
+// whose playlist does not match the proposal that produced it.
+func (s Service) AllocateAcceptedProposal(ctx context.Context, proposal domain.Proposal, request domain.AllocationRequest, playlist domain.Playlist, labels map[string]string) (agones.AllocatedServer, error) {
+	if proposal.State != domain.Accepted || proposal.Playlist != playlist || len(proposal.Participants) == 0 {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	if proposal.Playlist == domain.Ranked && len(proposal.Participants) != 6 {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	if proposal.Playlist == domain.Casual && (len(proposal.Participants) < 2 || len(proposal.Participants) > 6) {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	seen := make(map[string]struct{}, len(proposal.Participants))
+	for _, participant := range proposal.Participants {
+		if participant.PlayerID == "" || participant.Response != domain.AcceptedResponse {
+			return agones.AllocatedServer{}, domain.ErrAllocationInput
+		}
+		if _, exists := seen[participant.PlayerID]; exists {
+			return agones.AllocatedServer{}, domain.ErrAllocationInput
+		}
+		seen[participant.PlayerID] = struct{}{}
+	}
+	if request.MatchID == "" {
+		return agones.AllocatedServer{}, domain.ErrAllocationInput
+	}
+	return s.Allocate(ctx, request, labels)
+}
+
 func (s Service) PublishRoster(ctx context.Context, assignment domain.Assignment, roster []domain.SignedJoinAuthorisation, verify func([]byte, []byte) bool) error {
 	if s.Roster == nil {
 		return errNotConfigured

server/allocator/service_test.go

@@ -63,6 +63,44 @@ func TestServiceDoesNotReturnProviderResultAfterDurableFailure(t *testing.T) {
 	}
 }
 
+func TestServiceAllocatesOnlyUnanimouslyAcceptedMatchingProposal(t *testing.T) {
+	proposal := domain.Proposal{
+		ProposalID: "proposal-1", Playlist: domain.Casual, State: domain.Accepted,
+		Participants: []domain.ProposalParticipant{
+			{PlayerID: "player-a", Response: domain.AcceptedResponse},
+			{PlayerID: "player-b", Response: domain.AcceptedResponse},
+		},
+	}
+	provider := &providerSpy{result: agones.AllocatedServer{Allocation: domain.Allocation{AllocationID: "a", MatchID: "m", State: domain.ServerAllocated}, Endpoint: "127.0.0.1:7777"}}
+	durable := &durableSpy{}
+	service := Service{Provider: provider, Durable: durable, Now: func() time.Time { return time.Unix(1000, 0) }}
+	request := domain.AllocationRequest{AllocationID: "a", MatchID: "m", Region: "EU", Build: "b", Protocol: 1, Transport: "enet"}
+	if _, err := service.AllocateAcceptedProposal(context.Background(), proposal, request, domain.Casual, map[string]string{"region": "EU"}); err != nil {
+		t.Fatalf("accepted proposal was rejected: %v", err)
+	}
+	if provider.calls != 1 || durable.calls != 1 {
+		t.Fatalf("provider/durable calls = %d/%d", provider.calls, durable.calls)
+	}
+
+	for name, mutate := range map[string]func(*domain.Proposal){
+		"open":           func(p *domain.Proposal) { p.State = domain.Open },
+		"wrong-playlist": func(p *domain.Proposal) { p.Playlist = domain.Ranked },
+		"pending":        func(p *domain.Proposal) { p.Participants[0].Response = domain.Pending },
+		"duplicate":      func(p *domain.Proposal) { p.Participants[1].PlayerID = p.Participants[0].PlayerID },
+	} {
+		invalid := proposal
+		invalid.Participants = append([]domain.ProposalParticipant(nil), proposal.Participants...)
+		mutate(&invalid)
+		before := provider.calls
+		if _, err := service.AllocateAcceptedProposal(context.Background(), invalid, request, domain.Casual, map[string]string{"region": "EU"}); err == nil {
+			t.Fatalf("%s proposal was accepted", name)
+		}
+		if provider.calls != before {
+			t.Fatalf("%s proposal reached provider", name)
+		}
+	}
+}
+
 func TestServicePublishesRosterOnlyForAllocatedAssignment(t *testing.T) {
 	roster := &rosterSpy{}
 	service := Service{Roster: roster}