From b47c7dc3fa63e2378571b99f3262a65b80bf678a Mon Sep 17 00:00:00 2001 From: Josh Creek <8179928+jcreek@users.noreply.github.com> Date: Mon, 31 Aug 2026 22:04:57 +0100 Subject: [PATCH] fix: enforce matchmaking compatibility boundaries --- multiplayer-todo.md | 2 +- server/domain/matcher.go | 19 ++++++++++++++++++- server/domain/matcher_test.go | 30 ++++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 2 deletions(-) diff --git a/multiplayer-todo.md b/multiplayer-todo.md index be61b9d2..9e426a11 100644 --- a/multiplayer-todo.md +++ b/multiplayer-todo.md @@ -1193,7 +1193,7 @@ the local/CI/community transport, not a silent production fallback. |---|---|---| | 8.14 `[D:8.4,8.5,8.8]` | **IN PROGRESS.** Pure Go queue domain enforces one active ticket per verified player under concurrent mutation, 10 s heartbeat/30 s expiry, retry-safe create/heartbeat/cancel, owner-only recovery reads and deterministic candidate projection; store layer adds a rebuildable candidate-cache boundary and authenticated HTTP queue adapter with playlist/build/protocol compatibility metadata | `server/domain/queue.go`, `server/store/candidates.go` and `server/api/service.go` cover ownership/expiry/idempotency, concurrent create fencing, expired recovery as a terminal error, server-owned candidate resolution, strict compatibility metadata and cache loss/atomic rebuild; PostgreSQL row adapter, real Redis index/TTLs and restart/failover integration remain | | 8.15 `[D:7.8,8.3]` | **IN PROGRESS.** Pure Go probe validation treats Steam location as opaque, requires nonce/freshness/region and server-computed RTT, and implements discrepancy quarantine/release; authenticated HTTP now accepts only opaque location/nonce input through a server-owned probe provider | `server/domain/probes.go`, adversarial fixtures and `server/api/service.go` cover stale/wrong/forged evidence, the 25 ms/30% threshold, three-sample quarantine, five-clean release, authenticated provider arguments and rejection of client RTT fields; Steam coordinator and regional probe adapters remain | -| 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection and fences duplicate player identities | `server/domain/matcher.go`, `teams.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities and queue-backed oldest-anchor formation; full population fixtures and durable matcher claim integration remain | +| 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection, fences duplicate player identities and rejects playlist/build/protocol mixing | `server/domain/matcher.go`, `teams.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities, compatibility mismatches and queue-backed oldest-anchor formation; full population fixtures and durable matcher claim integration remain | | 8.17 `[D:8.14,8.16]` | **IN PROGRESS.** Pure Go proposal policy sends a 10-second response window to every selected human, requires unanimous acceptance, applies exact decline/timeout cooldowns and ranked escalation; authenticated API exposes revisioned accept/decline mutations; formed matches now pass through a playlist-aware proposal boundary | `server/domain/proposal.go`, `formation.go` and `server/api/service.go` plus adversarial fixtures cover partial/unanimous response, expiry, replay/conflict, stale API revision, casual lineup preparation and ranked metadata validation; queue precedence and allocation integration remain | | 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction | `server/store/serializable.go`, `proposal_sql.go` and tests cover retry classification, claim-boundary invariants, zero-row claim aborts and atomic statement ordering; live PostgreSQL adapter/row decoding, Redis candidate index/repair, worker-failure and concurrent two-matcher integration tests remain | | 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain | diff --git a/server/domain/matcher.go b/server/domain/matcher.go index 40574138..dd95008e 100644 --- a/server/domain/matcher.go +++ b/server/domain/matcher.go @@ -92,7 +92,7 @@ func SelectCandidates(anchor Candidate, candidates []Candidate, size int, now ti seen := map[string]bool{} seenPlayers := map[string]bool{} add := func(candidate Candidate) { - if validCandidate(candidate) && !seen[candidate.TicketID] && !seenPlayers[candidate.PlayerID] { + if validCandidate(candidate) && compatibleMetadata(anchor, candidate) && !seen[candidate.TicketID] && !seenPlayers[candidate.PlayerID] { seen[candidate.TicketID] = true seenPlayers[candidate.PlayerID] = true pool = append(pool, candidate) @@ -139,6 +139,23 @@ func SelectCandidates(anchor Candidate, candidates []Candidate, size int, now ti return best, nil } +// compatibleMetadata prevents a queue projection from crossing playlist or +// protocol/build boundaries. Empty anchor metadata is retained for older +// direct/community callers; once the queue has selected a compatibility +// contract, every participant must carry the exact same values. +func compatibleMetadata(anchor, candidate Candidate) bool { + if anchor.Playlist != "" && candidate.Playlist != anchor.Playlist { + return false + } + if anchor.ClientBuild != "" && candidate.ClientBuild != anchor.ClientBuild { + return false + } + if anchor.ProtocolVersion > 0 && candidate.ProtocolVersion != anchor.ProtocolVersion { + return false + } + return true +} + func validCandidate(candidate Candidate) bool { if candidate.TicketID == "" || candidate.PlayerID == "" || candidate.EnqueuedAt.IsZero() || math.IsNaN(candidate.Rating) || math.IsInf(candidate.Rating, 0) { return false diff --git a/server/domain/matcher_test.go b/server/domain/matcher_test.go index af2237c7..90f77cbd 100644 --- a/server/domain/matcher_test.go +++ b/server/domain/matcher_test.go @@ -101,3 +101,33 @@ func TestSelectCandidatesRejectsMalformedCandidateInsteadOfTrustingIt(t *testing t.Fatal("duplicate player candidate accepted") } } + +func TestSelectCandidatesDoesNotMixQueueCompatibilityContracts(t *testing.T) { + now := time.Unix(100000, 0) + anchor := candidate("a", 1500, 0, 40, 40, now) + anchor.Playlist = Ranked + anchor.ClientBuild = "build-1" + anchor.ProtocolVersion = 2 + compatible := anchor + compatible.TicketID = "b" + compatible.PlayerID = "player-b" + mismatchPlaylist := compatible + mismatchPlaylist.TicketID = "c" + mismatchPlaylist.PlayerID = "player-c" + mismatchPlaylist.Playlist = Casual + mismatchBuild := compatible + mismatchBuild.TicketID = "d" + mismatchBuild.PlayerID = "player-d" + mismatchBuild.ClientBuild = "build-2" + mismatchProtocol := compatible + mismatchProtocol.TicketID = "e" + mismatchProtocol.PlayerID = "player-e" + mismatchProtocol.ProtocolVersion = 3 + selection, err := SelectCandidates(anchor, []Candidate{mismatchPlaylist, mismatchBuild, mismatchProtocol, compatible}, 2, now) + if err != nil { + t.Fatal(err) + } + if ticketIDs(selection.Players) != "a\x00b\x00" { + t.Fatalf("selected incompatible metadata: %q", ticketIDs(selection.Players)) + } +}