jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-10 16:04:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: record the backfill roster-delivery decision and remaining work

Browse Source 
A backfilled player's join authorisation is issued after their server
started, but the supervisor fetches the roster once before launching the
game child and the game process has no reload path, so backfill cannot
work end to end regardless of how good the selection rule is.

Decided: the control plane marks the roster changed, the supervisor
re-fetches and rewrites the roster file, then signals the game process to
reload. Chosen because it reuses the authenticated channel and roster
endpoint that already exist -- no inbound path into the game pod, no new
trust boundary -- and keeps the roster an allowlist the server was told
to expect rather than admitting anyone holding a valid signature.
Signature verification is untouched and already binds match, server, slot
and generation.

Recorded in docs/MATCHMAKING.md, which the repo treats as the design
source of truth, so the decision is not re-litigated from a task row.
Remaining implementation is tracked in #32 and summarised in §7 8.19.
This commit is contained in:
Josh Creek
2026-09-05 18:09:10 +01:00
parent 1becfb4f3f
commit 654f20e28f
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/MATCHMAKING.md
+11
View File
@@ -259,6 +259,17 @@ only after the same transition commits.
- An original casual participant gets 30 seconds to reconnect; leaving after
that applies a 60-second queue cooldown. The match's ordinary hidden-rating
result still applies, with no extra rating penalty.
- **Late roster delivery.** A backfilled player's join authorisation is issued
after their server started, but the supervisor fetches the roster once before
launching the game child and the game process has no reload path. The agreed
model is: the control plane marks the roster changed, the supervisor -- which
already holds an authenticated channel to the control plane and already owns
the roster file -- re-fetches and rewrites it, then signals the game process
to reload. This deliberately adds no inbound path into the game pod and no new
trust boundary; the roster stays an allowlist the server is told to expect,
rather than admitting anyone holding a valid signature. Signature
verification is unchanged and already covers match, server, slot and
generation.
- An accepted casual initial-connect no-show gets the same 60-second cooldown.
The match proceeds with a bot only if at least one human connected on each
team; otherwise it cancels and restores every innocent ticket with original