mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-11 00:14:00 +00:00
feat: apply certified ratings during result completion
This commit is contained in:
Josh Creek
+3
-1
@@ -142,7 +142,9 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md).
|
||||
- [ ] **IN PROGRESS:** Ranked: exactly six humans, solo-only, no bots/backfill,
|
||||
random-enabled non-elevated arenas only, 60 s reconnect grace and escalating abandons.
|
||||
- [ ] **IN PROGRESS:** Implement the documented exact Glicko-2 equations, fractional 3v3
|
||||
weights, inactivity/update locking/golden vectors and ten provisional games.
|
||||
weights, inactivity/update locking/golden vectors and ten provisional games. Certified
|
||||
result completion now applies the canonical per-player update inside the same durable
|
||||
transaction, with lexical rating locks and ranked-game revision increments.
|
||||
Backend-owned provisional status and validated ranked-tier derivation now exist;
|
||||
authenticated ranked-profile transport now exists; client display and
|
||||
persisted tier configuration remain.
|
||||
|
||||
+2
-2
@@ -1199,11 +1199,11 @@ the local/CI/community transport, not a silent production fallback.
|
||||
| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, queue creation has a durable idempotency/owner-read adapter, participant-scoped proposal recovery now expires OPEN proposals and pending participants transactionally at read time, and proposal accept/decline now uses participant/proposal locks, revision fencing and durable idempotency; response attempts also advance expired proposals and pending participants before returning closed; runnable casual matcher polling now reads an authoritative PostgreSQL candidate batch and delegates its final claim to this transaction | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go`, `proposal_recovery_sql.go`, `server/matcher/worker.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped queue/proposal recovery, expiry at read and mutation boundaries, response replay/conflict, stale revisions, zero-row claim aborts, atomic statement ordering, incomplete matcher batches and source/claim failures; opt-in PostgreSQL execution now covers queue create/replay/fencing, assignment persistence, proposal claim/promotion, participant recovery, unanimous response and rollback of partial claims; ranked provider, Redis-backed worker repair, worker-failure and concurrent two-matcher integration tests remain |
|
||||
| 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain |
|
||||
| 8.20 `[D:8.18]` | **IN PROGRESS.** Pure Go ranked admission requires six unique verified solo humans, rejects bots/backfill/parties, and allows only random-enabled non-elevated arenas; proposal preparation requires matching metadata for every formed player | `server/domain/ranked.go`, `formation.go` cover count, identity, party, bot/backfill, arena eligibility and formed-player metadata rejection; `ArenaRegistry` integration, allocation wiring and innocent-ticket restoration remain |
|
||||
| 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring | `server/domain/rating.go` has canonical/inactivity/weight/invalid-input plus draw/OT/abandon fixtures; PostgreSQL snapshot locking, rating transaction integration, seasons and concurrent result transaction tests remain |
|
||||
| 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring; certified result completion now applies per-player updates inside the durable transaction with lexical row locks and revision increments | `server/domain/rating.go`, `server/store/result_sql.go` and tests cover canonical/inactivity/weight/invalid-input, draw/OT/abandon, ordered participant snapshots, lock/value re-read and rating update SQL; live PostgreSQL rating, seasons and concurrent result transaction tests remain |
|
||||
| 8.22 `[D:8.21]` | **IN PROGRESS.** Pure Go ranked profile exposes the first ten games as provisional, derives tiers only through validated backend-owned rating bands, and keeps casual ratings outside the API; authenticated HTTP now returns the authoritative ranked view | `server/domain/rating.go`, `tier_test.go` and `server/api/service.go` cover provisional override, exact band boundaries, malformed policy rejection, session authentication and ranked-only response fields; persisted tier policy, client UI and reconnect transport remain |
|
||||
| 8.23 `[D:8.21]` | **IN PROGRESS.** Pure Go ranked-only season policy compresses 25% toward 1500, clamps RD to 200–350, preserves volatility/history, is idempotent by season ID, and defines exact 12-week windows/due detection; migration and Go store now persist a per-player/per-season marker and rating update atomically; `cmd/maintenance` runs bounded due-season batches with signal-bound shutdown | `server/domain/rating.go`, `season_test.go`, `server/migrations/0001_initial.sql` and `server/store/maintenance_sql.go` cover compression, floor/cap, duplicate replay, window boundary, completed-season idempotence, bounded enumeration, row locking and conflict-safe rollover markers; opt-in PostgreSQL execution now covers the durable rating update, marker creation and duplicate replay without a second compression; live maintenance/DB execution remains |
|
||||
| 8.24 `[D:8.9,8.20,8.21]` | **IN PROGRESS.** Pure Go ranked connection policy binds match/server/player/team/slot/protocol, supports 60 s reclaim with server-owned generations, fences old connections, and applies the rolling 7-day 5 m/15 m/1 h/24 h abandon ladder; canonical signed authorisation issuance/verification now gates admission | `server/domain/reconnect.go`, `join_auth.go` and adversarial fixtures cover repeated backend-independent reclaim, all signed claim binding, tampering, failed verification, old-generation fencing, grace boundary and deterministic cooldown audit ordering; persistent lease fencing, join transport and full match/result integration remain |
|
||||
| 8.25 `[D:8.10,8.24]` | **IN PROGRESS.** Pure Go result policy binds match/server/workload identity, hashes canonical payloads, makes identical retries idempotent, leaves conflicts inert, separates integrity eligibility, classifies roster/simulation/result/fairness evidence, validates annotation signatures/digests, and exposes 5 m alert/30 m review delivery thresholds; Go store SQL now executes the receipt → match lock → completion → receipt acknowledgment → outbox boundary atomically, and exposes bounded ordered outbox reads plus publish acknowledgements for replayable fan-out; `OutboxDispatcher` now delivers in order and acknowledges only after successful fan-out; the API validates workload-bound server result submissions and the PostgreSQL adapter repeats domain validation before invoking this durable boundary | `server/domain/result.go`, `workload.go`, `server/workload/jwt.go`, `server/api/service.go`, `server/store/result_sql.go` and `outbox.go` plus adversarial fixtures cover credential binding, duplicate/conflict, annotation forgery, server/match mismatch, invalid direct-adapter payloads, delivery-outage-versus-integrity classification, commit ordering, idempotent SQL reconciliation, unpublished-event replay/ack boundaries and delivery-before-ack failure ordering; opt-in PostgreSQL execution now covers result-pending completion, durable receipt/outbox publication, ack removal, identical replay and conflicting replay rejection; production credential verification, Agones annotation persistence/reconciliation, rating-lock integration and integrity evidence adapters remain |
|
||||
| 8.25 `[D:8.10,8.24]` | **IN PROGRESS.** Pure Go result policy binds match/server/workload identity, hashes canonical payloads, makes identical retries idempotent, leaves conflicts inert, separates integrity eligibility, classifies roster/simulation/result/fairness evidence, validates annotation signatures/digests, and exposes 5 m alert/30 m review delivery thresholds; Go store SQL now executes receipt → match lock → certified rating updates → completion → receipt acknowledgment → outbox atomically, and exposes bounded ordered outbox reads plus publish acknowledgements for replayable fan-out; `OutboxDispatcher` now delivers in order and acknowledges only after successful fan-out; the API validates workload-bound server result submissions and the PostgreSQL adapter repeats domain validation before invoking this durable boundary | `server/domain/result.go`, `workload.go`, `server/workload/jwt.go`, `server/api/service.go`, `server/store/result_sql.go` and `outbox.go` plus adversarial fixtures cover credential binding, duplicate/conflict, annotation forgery, server/match mismatch, invalid direct-adapter payloads, delivery-outage-versus-integrity classification, commit ordering, idempotent SQL reconciliation, ordered rating locks, certified-update gating, unpublished-event replay/ack boundaries and delivery-before-ack failure ordering; opt-in PostgreSQL execution now covers result-pending completion, durable receipt/outbox publication, ack removal, identical replay and conflicting replay rejection; live rating/concurrency verification, production credential verification, Agones annotation persistence/reconciliation and integrity evidence adapters remain |
|
||||
|
||||
#### 8D — Agones, allocation and regional scaling
|
||||
|
||||
|
||||
+154
-3
@@ -51,6 +51,23 @@ WHERE player_id = ANY($1)
|
||||
ORDER BY player_id
|
||||
FOR UPDATE`
|
||||
|
||||
const MatchParticipantRatingsSQL = `SELECT mp.player_id, mp.team, r.rating, r.deviation,
|
||||
r.volatility, r.ranked_games, r.updated_at
|
||||
FROM match_participants mp
|
||||
JOIN ratings r ON r.player_id = mp.player_id
|
||||
WHERE mp.match_id = $1
|
||||
ORDER BY mp.player_id`
|
||||
|
||||
const RatingValuesSQL = `SELECT player_id, rating, deviation, volatility, ranked_games, updated_at
|
||||
FROM ratings
|
||||
WHERE player_id = ANY($1)
|
||||
ORDER BY player_id`
|
||||
|
||||
const RatingUpdateSQL = `UPDATE ratings
|
||||
SET rating = $2, deviation = $3, volatility = $4,
|
||||
ranked_games = ranked_games + $5, updated_at = $6, revision = revision + 1
|
||||
WHERE player_id = $1`
|
||||
|
||||
type PostgresResults struct{ DB *sql.DB }
|
||||
|
||||
func (r PostgresResults) SubmitResult(ctx context.Context, resultID string, result domain.MatchResult, binding domain.WorkloadBinding, payload []byte, now time.Time) error {
|
||||
@@ -65,7 +82,7 @@ func (r PostgresResults) SubmitResult(ctx context.Context, resultID string, resu
|
||||
return err
|
||||
}
|
||||
receipt := domain.ResultReceipt{ResultID: resultID, MatchID: result.MatchID, ResultNonce: result.ResultNonce, PayloadDigest: domain.ResultDigest(result), IntegrityState: result.IntegrityState, ReceivedAt: now}
|
||||
return CompleteResult(ctx, r.DB, receipt, binding.ServerID, resultID, payload, now)
|
||||
return CompleteResultWithResult(ctx, r.DB, receipt, binding.ServerID, resultID, payload, result, now)
|
||||
}
|
||||
|
||||
// CompleteResult is the durable receipt/reconciliation boundary. The caller
|
||||
@@ -73,15 +90,23 @@ func (r PostgresResults) SubmitResult(ctx context.Context, resultID string, resu
|
||||
// digest. Duplicate identical receipts continue the same completion path;
|
||||
// conflicting payloads fail without mutating the existing receipt.
|
||||
func CompleteResult(ctx context.Context, db *sql.DB, receipt domain.ResultReceipt, serverID, eventID string, payload []byte, now time.Time) error {
|
||||
return completeResult(ctx, db, receipt, serverID, eventID, payload, now, nil)
|
||||
}
|
||||
|
||||
func CompleteResultWithResult(ctx context.Context, db *sql.DB, receipt domain.ResultReceipt, serverID, eventID string, payload []byte, result domain.MatchResult, now time.Time) error {
|
||||
return completeResult(ctx, db, receipt, serverID, eventID, payload, now, &result)
|
||||
}
|
||||
|
||||
func completeResult(ctx context.Context, db *sql.DB, receipt domain.ResultReceipt, serverID, eventID string, payload []byte, now time.Time, result *domain.MatchResult) error {
|
||||
if receipt.ResultID == "" || receipt.MatchID == "" || serverID == "" || eventID == "" || len(payload) == 0 {
|
||||
return fmt.Errorf("invalid result transaction arguments")
|
||||
}
|
||||
return RunSerializable(ctx, db, DefaultSerializableAttempts, func(ctx context.Context, tx *sql.Tx) error {
|
||||
result, err := tx.ExecContext(ctx, ResultReceiptInsertSQL, receipt.ResultID, receipt.MatchID, receipt.ResultNonce, receipt.PayloadDigest[:], string(receipt.IntegrityState), receipt.ReceivedAt)
|
||||
insertResult, err := tx.ExecContext(ctx, ResultReceiptInsertSQL, receipt.ResultID, receipt.MatchID, receipt.ResultNonce, receipt.PayloadDigest[:], string(receipt.IntegrityState), receipt.ReceivedAt)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
inserted, err := result.RowsAffected()
|
||||
inserted, err := insertResult.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -108,6 +133,11 @@ func CompleteResult(ctx context.Context, db *sql.DB, receipt domain.ResultReceip
|
||||
if state != "RESULT_PENDING" {
|
||||
return fmt.Errorf("match is not result-pending: %s", state)
|
||||
}
|
||||
if result != nil && domain.RatingEligible(receipt) {
|
||||
if err := applyResultRatings(ctx, tx, receipt.MatchID, domain.Playlist(playlist), *result, now); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
updated, err := tx.ExecContext(ctx, ResultMatchCompleteSQL, receipt.MatchID, now)
|
||||
if err != nil {
|
||||
return err
|
||||
@@ -126,3 +156,124 @@ func CompleteResult(ctx context.Context, db *sql.DB, receipt domain.ResultReceip
|
||||
return err
|
||||
})
|
||||
}
|
||||
|
||||
type participantRating struct {
|
||||
playerID string
|
||||
team int
|
||||
rating domain.Rating
|
||||
rankedGames int
|
||||
}
|
||||
|
||||
func applyResultRatings(ctx context.Context, tx *sql.Tx, matchID string, playlist domain.Playlist, result domain.MatchResult, now time.Time) error {
|
||||
rows, err := tx.QueryContext(ctx, MatchParticipantRatingsSQL, matchID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer rows.Close()
|
||||
var players []participantRating
|
||||
for rows.Next() {
|
||||
var player participantRating
|
||||
if err := rows.Scan(&player.playerID, &player.team, &player.rating.Value, &player.rating.RD, &player.rating.Volatility, &player.rankedGames, &player.rating.LastRatedAt); err != nil {
|
||||
return err
|
||||
}
|
||||
players = append(players, player)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return err
|
||||
}
|
||||
if len(players) == 0 {
|
||||
return nil
|
||||
}
|
||||
ids := make([]string, len(players))
|
||||
for i := range players {
|
||||
ids[i] = players[i].playerID
|
||||
}
|
||||
// Lock all rating rows in lexical order before computing updates. This
|
||||
// matches the lock order used by every result transaction and prevents
|
||||
// cross-match deadlocks.
|
||||
locked, err := tx.QueryContext(ctx, RatingLockSQL, ids)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for locked.Next() {
|
||||
var ignored string
|
||||
var rating domain.Rating
|
||||
var games int
|
||||
var revision uint64
|
||||
if err := locked.Scan(&ignored, &rating.Value, &rating.RD, &rating.Volatility, &games, &revision); err != nil {
|
||||
locked.Close()
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err := locked.Err(); err != nil {
|
||||
locked.Close()
|
||||
return err
|
||||
}
|
||||
if err := locked.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
// Re-read after acquiring the locks so the calculations use the values
|
||||
// protected by those locks rather than a pre-lock snapshot.
|
||||
values, err := tx.QueryContext(ctx, RatingValuesSQL, ids)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
ratings := make(map[string]domain.Rating, len(players))
|
||||
for values.Next() {
|
||||
var playerID string
|
||||
var rating domain.Rating
|
||||
var rankedGames int
|
||||
if err := values.Scan(&playerID, &rating.Value, &rating.RD, &rating.Volatility, &rankedGames, &rating.LastRatedAt); err != nil {
|
||||
values.Close()
|
||||
return err
|
||||
}
|
||||
ratings[playerID] = rating
|
||||
}
|
||||
if err := values.Err(); err != nil {
|
||||
values.Close()
|
||||
return err
|
||||
}
|
||||
if err := values.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
outcome := domain.MatchOutcome{Team0Score: result.Team0Score, Team1Score: result.Team1Score}
|
||||
for _, player := range players {
|
||||
current, ok := ratings[player.playerID]
|
||||
if !ok {
|
||||
return fmt.Errorf("rating row disappeared for player %s", player.playerID)
|
||||
}
|
||||
opponents := make([]domain.Opponent, 0, len(players)-1)
|
||||
for _, opponent := range players {
|
||||
if opponent.team != player.team {
|
||||
score, err := domain.ScoreForPlayer(outcome, player.playerID, player.team)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
opponents = append(opponents, domain.Opponent{PlayerID: opponent.playerID, Rating: ratings[opponent.playerID], Score: score})
|
||||
}
|
||||
}
|
||||
var weighted []domain.Opponent
|
||||
if playlist == domain.Ranked {
|
||||
weighted, err = domain.RankedOpponents(opponents)
|
||||
} else if playlist == domain.Casual {
|
||||
weighted, err = domain.CasualOpponents(opponents)
|
||||
} else {
|
||||
return fmt.Errorf("unsupported result playlist")
|
||||
}
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
updated, err := domain.UpdateRating(current, weighted, now)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rankedIncrement := 0
|
||||
if playlist == domain.Ranked {
|
||||
rankedIncrement = 1
|
||||
}
|
||||
if _, err := tx.ExecContext(ctx, RatingUpdateSQL, player.playerID, updated.Value, updated.RD, updated.Volatility, rankedIncrement, now); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -11,6 +11,9 @@ func TestResultSQLPreservesReceiptConflictAndAtomicCommitBoundaries(t *testing.T
|
||||
ResultReceiptCommitSQL: {"COALESCE(committed_at", "committed_at"},
|
||||
ResultOutboxSQL: {"match_completed", "aggregate_id", "revision"},
|
||||
RatingLockSQL: {"ORDER BY player_id", "FOR UPDATE"},
|
||||
MatchParticipantRatingsSQL: {"match_participants", "JOIN ratings", "ORDER BY mp.player_id"},
|
||||
RatingValuesSQL: {"player_id = ANY($1)", "ORDER BY player_id"},
|
||||
RatingUpdateSQL: {"ranked_games = ranked_games + $5", "revision = revision + 1"},
|
||||
}
|
||||
for query, fragments := range checks {
|
||||
for _, fragment := range fragments {
|
||||
|
||||
Reference in New Issue
Block a user