test(multiplayer): verify live assignment delivery

Game/scripts/assignment_state.gd

@@ -21,7 +21,7 @@ func apply(payload: Dictionary, expected_player_id: String = "") -> bool:
 	for key in ["match_id", "server_id", "player_id", "slot", "expires_at", "protocol_version", "transport", "endpoint", "join_authorisation"]:
 		if not payload.has(key):
 			return _reject("Assignment response is missing " + key)
-	if not payload["match_id"] is String or not payload["server_id"] is String or not payload["player_id"] is String or not payload["slot"] is int or not payload["expires_at"] is String or not payload["protocol_version"] is int or not payload["transport"] is String or not payload["endpoint"] is String or not payload["join_authorisation"] is String:
+	if not payload["match_id"] is String or not payload["server_id"] is String or not payload["player_id"] is String or not (payload["slot"] is int or payload["slot"] is float) or not payload["expires_at"] is String or not (payload["protocol_version"] is int or payload["protocol_version"] is float) or not payload["transport"] is String or not payload["endpoint"] is String or not payload["join_authorisation"] is String:
 		return _reject("Assignment response contains invalid types")
 	var next_match_id := String(payload["match_id"])
 	var next_server_id := String(payload["server_id"])

Game/tests/control_plane_smoke.gd

@@ -23,6 +23,8 @@ const TIMEOUT_SECONDS := 10.0
 
 var _finished := false
 var _ticket_id := ""
+var _assignment_match_id := ""
+var _steam_ticket := ""
 
 
 func _ready() -> void:
@@ -30,6 +32,10 @@ func _ready() -> void:
 	for arg in OS.get_cmdline_user_args():
 		if arg.begins_with("--control-plane-url="):
 			control_plane_url = arg.substr("--control-plane-url=".length())
+		elif arg.begins_with("--assignment-match-id="):
+			_assignment_match_id = arg.substr("--assignment-match-id=".length())
+		elif arg.begins_with("--steam-ticket="):
+			_steam_ticket = arg.substr("--steam-ticket=".length())
 	if control_plane_url.is_empty():
 		_finish(false, "missing --control-plane-url")
 		return
@@ -45,7 +51,7 @@ func _ready() -> void:
 	ControlPlaneClient.request_succeeded.connect(_on_request_succeeded)
 	ControlPlaneClient.request_failed.connect(_on_request_failed)
 
-	var web_api_ticket := "smoke-web-api-ticket-%d" % Time.get_ticks_usec()
+	var web_api_ticket := _steam_ticket if not _steam_ticket.is_empty() else "smoke-web-api-ticket-%d" % Time.get_ticks_usec()
 	var err := ControlPlaneClient.login_steam(web_api_ticket)
 	if err != OK:
 		_finish(false, "login_steam() failed to start: %s" % error_string(err))
@@ -65,10 +71,21 @@ func _on_request_succeeded(operation: String, payload: Dictionary) -> void:
 		return
 	match operation:
 		"steam_session":
+			if not _assignment_match_id.is_empty():
+				print("SMOKE: logged in as %s, fetching player-scoped assignment..." % ControlPlaneClient.player_id)
+				var err := ControlPlaneClient.fetch_assignment(_assignment_match_id)
+				if err != OK:
+					_finish(false, "fetch_assignment() failed to start: %s" % error_string(err))
+				return
 			print("SMOKE: logged in as %s, fetching ranked profile (expect none yet)..." % ControlPlaneClient.player_id)
 			var err := ControlPlaneClient.fetch_ranked_profile()
 			if err != OK:
 				_finish(false, "fetch_ranked_profile() failed to start: %s" % error_string(err))
+		"assignment":
+			if payload.get("match_id", "") != _assignment_match_id or payload.get("player_id", "") != ControlPlaneClient.player_id or not ControlPlaneClient.assignment.available:
+				_finish(false, "unexpected assignment payload: %s" % payload)
+				return
+			_finish(true, "authenticated assignment fetch returned the player-scoped endpoint and join authorisation")
 		"ranked_profile":
 			_finish(false, "a brand-new testkit identity unexpectedly already has a ranked profile: %s" % payload)
 		"queue_create":
@@ -134,6 +151,9 @@ func _on_request_failed(operation: String, http_code: int, detail: String) -> vo
 		if err != OK:
 			_finish(false, "queue_create() failed to start: %s" % error_string(err))
 		return
+	if operation == "assignment":
+		_finish(false, "assignment fetch failed: http=%d detail=%s" % [http_code, detail])
+		return
 	_finish(false, "%s failed: http=%d detail=%s" % [operation, http_code, detail])
 
 

multiplayer-next.md

@@ -1235,7 +1235,7 @@ the local/CI/community transport, not a silent production fallback.
 |---|---|---|
 | 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness; the API can now use the durable participant-scoped proposal provider for both recovery and accept/decline mutations | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents`, `TestStateChangingAPIActionsPublishTargetedEvents`, `TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped` and store proposal SQL tests reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain |
 | 8.40 `[D:8.3,8.14]` | **IN PROGRESS.** Pure Go revisioned replica reducer rejects gaps for REST resync, makes duplicate/out-of-order events idempotent, and resumes from the authoritative snapshot revision; authenticated queue-ticket recovery now has an owner-checked REST read; Godot client projection persists non-secret ticket/proposal state, forces authoritative recovery after restart, and can replay a lost queue-create response with the original ticket/idempotency key; the Go API now exposes an authenticated `/v1/events` WebSocket with bounded per-player queues, strict upgrade/vocabulary validation and REST-resync-safe slow-client failure; Godot `ControlPlaneClient` can connect to the stream using Godot 4.7's handshake-header API, consume validated events, automatically reconnect with bounded backoff, and trigger REST recovery on projection gaps and stream return, including a deferred recovery when an event arrives during an in-flight HTTP mutation; `OutboxDispatcher` now provides ordered at-least-once delivery after durable commit; assignment recovery events carry the durable assignment revision without leaking it into REST JSON; prediction startup now distinguishes the sequence-0 warm-up acknowledgement from genuine missing/evicted history, preventing a false hard-snap during a live match; proposal creation now writes one durable targeted `proposal_changed` outbox event per proposal aggregate revision, and both production `cmd/control-plane` and the test-only API harness dispatch only that event type to authenticated participants, leaving result events for their separate consumer | `server/domain/sync.go`, `server/api/events.go`, `server/api/outbox.go`, `server/api/service.go`, `server/store/outbox.go`, `server/store/proposal_sql.go`, `server/cmd/control-plane`, `server/cmd/testkit-api`, `service_test.go`, `outbox_test.go`, `matchmaking_state.gd`, `control_plane_client.gd`, `local_prediction_history.gd`, `net_ship_predictor.gd` and tests cover gap, snapshot, replay, same-revision conflict, owner-only ticket recovery, expired-ticket terminal handling, malformed restart snapshots, API-level duplicate-create replay/conflict, authenticated handshake/key rejection, targeted event delivery, exactly-once slow-subscriber closure, invalid-event rejection, delivery-before-ack failure ordering, assignment event/response revision separation, prediction warm-up/hard-resync separation, deferred proposal recovery and proposal outbox filtering/delivery failures; Godot 4.7.1 headless project parse and 150-test unit harness pass with compatibility rendering, and a two-process ENet authoritative match smoke passes spawn, movement, prediction, 0% snapshot loss and 0 hard snaps; `cmd/control-plane` provides a signal-bound API role, `cmd/matcher` now supports casual and explicitly enabled ranked roles with durable identity lookup, and `cmd/maintenance` provides bounded season maintenance. **Live multi-process control-plane/game verification now exists**: `scripts/verify_control_plane_integration.sh` runs a real `postgres:17-alpine`, the real `api.Service` (via the new test-only `server/cmd/testkit-api`, wired identically to `cmd/control-plane` except for a fake Steam login — see §8.7), and a real headless Godot client (`control_plane_smoke.gd`) round-tripping login → `fetch_ranked_profile` (expect 404, §8.22) → `queue_create` → heartbeat → `cancel_queue` over an actual network connection — the first time this boundary was exercised end to end rather than against a mock on either side. **The two-player proposal extension now also passes**: `scripts/verify_control_plane_proposal_integration.sh` starts isolated PostgreSQL, the real matcher and testkit API, launches two headless Godot clients, seeds deterministic RTT projections, observes the real WebSocket `OPEN` proposal, accepts from both clients, and verifies both durable tickets plus the proposal reach `ACCEPTED` (including authoritative recovery when the concurrent revision advances). Allocator and Redis fan-out live verification remain |
-| 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view including the hosted endpoint; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, validate and retain the endpoint, and `connect_to_assignment()` now starts only the validated ENet/Steam transport after assignment readiness; the opaque join authorisation is carried in the MatchNet hello payload rather than the endpoint URL; allocated Godot servers now fail closed unless an operator-mounted JSON roster of control-plane signed envelopes and an HMAC-SHA256 key are present, and MatchNet verifies the canonical Go claim bytes, checks exact token membership plus match/server/protocol/slot/expiry claims before admitting a peer, rejects concurrent reuse of an active token, tracks server-owned reconnect generations across the 60-second reclaim window, fences expired reclaims and invalidates old peers; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point; `SaveAssignments` publishes a complete signed roster atomically instead of allowing partial player visibility; `SaveVerifiedAssignmentRoster` rechecks signed claims before deriving player rows | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `control_plane_client.gd`, `match_net.gd`, `server_boot.gd`, `server_config.gd`, `test_assignment_state.gd`, `test_control_plane_client.gd`, `test_match_net.gd`, `server/contracts/v1/openapi.json`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport/endpoint boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling, atomic batch validation, signed-claim binding, strict endpoint splitting, allowlisted claim rejection, canonical HMAC interoperability, forged-signature rejection, duplicate active-token rejection, reclaim generation/expiry behavior and 146-test Godot compatibility coverage; the three-process disconnect/reclaim smoke passes ship retention, replacement drive and old-peer invalidation; SDR relay-ticket installation, live allocated-token process integration and live Godot/PostgreSQL verification remain |
+| 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view including the hosted endpoint; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, validate and retain the endpoint, and `connect_to_assignment()` now starts only the validated ENet/Steam transport after assignment readiness; the opaque join authorisation is carried in the MatchNet hello payload rather than the endpoint URL; allocated Godot servers now fail closed unless an operator-mounted JSON roster of control-plane signed envelopes and an HMAC-SHA256 key are present, and MatchNet verifies the canonical Go claim bytes, checks exact token membership plus match/server/protocol/slot/expiry claims before admitting a peer, rejects concurrent reuse of an active token, tracks server-owned reconnect generations across the 60-second reclaim window, fences expired reclaims and invalidates old peers; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point; `SaveAssignments` publishes a complete signed roster atomically instead of allowing partial player visibility; `SaveVerifiedAssignmentRoster` rechecks signed claims before deriving player rows; live authenticated Godot/PostgreSQL assignment verification now exists via `scripts/verify_assignment_integration.sh`, which seeds a durable player-scoped `ASSIGNMENT_READY` row behind the real testkit API and verifies the returned endpoint/join authorisation over HTTP/JSON (including the live numeric-decoding boundary) | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `control_plane_client.gd`, `match_net.gd`, `server_boot.gd`, `server_config.gd`, `test_assignment_state.gd`, `test_control_plane_client.gd`, `test_match_net.gd`, `server/contracts/v1/openapi.json`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport/endpoint boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling, atomic batch validation, signed-claim binding, strict endpoint splitting, allowlisted claim rejection, canonical HMAC interoperability, forged-signature rejection, duplicate active-token rejection, reclaim generation/expiry behavior and 150-test Godot compatibility coverage; the three-process disconnect/reclaim smoke passes ship retention, replacement drive and old-peer invalidation; SDR relay-ticket installation and live allocated-token process integration remain |
 | 8.42 `[D:8.22,8.23,8.24,8.40]` | **IN PROGRESS.** `RankedProfileState` and `ControlPlaneClient.fetch_ranked_profile()` expose the backend-authoritative rating/RD/volatility/games/tier/provisional/season view; matchmaking UI displays provisional/tier status without client-side rating math | `test_control_plane_client.gd` validates profile shape, numeric safety and provisional display; ranked profile fetch/display, committed revision after reconnect, abandon status and season countdown remain dependent on live auth/backend events and Godot runtime verification |
 | 8.43 `[D:8.39,8.40,8.41]` | **IN PROGRESS.** Matchmaking client now distinguishes expired queue recovery, session expiry, missing records and retryable control-plane outages; a 401 clears the in-memory token, emits `session_expired` and disables retry until a new session is configured; terminal messages remain visible and active searches are not falsely failed on transient errors | `MatchmakingState` and `ControlPlaneClient` tests cover explicit expiry and the existing terminal/retry-safe state paths; decline, version mismatch, regional outage retry UI, failed reconnect, duplicate-action recovery and live Godot verification remain |
 

scripts/verify_assignment_integration.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Assignment-specific variant of the real control-plane integration gate.
+# It reuses the isolated PostgreSQL + testkit API fixture, but seeds a
+# player-scoped assignment and drives the authenticated Godot assignment read.
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root_dir"
+ASSIGNMENT_SMOKE=1 bash scripts/verify_control_plane_integration.sh

scripts/verify_control_plane_integration.sh

@@ -28,6 +28,7 @@ password="cosmic_clash_test"
 pg_port="55434"
 api_port="18099"
 logs_dir="$(mktemp -d "${TMPDIR:-/tmp}/cosmic-clash-control-plane.XXXXXX")"
+assignment_smoke="${ASSIGNMENT_SMOKE:-0}"
 
 testkit_pid=""
 cleanup() {
@@ -92,8 +93,32 @@ for attempt in $(seq 1 30); do
   sleep 1
 done
 
-"$godot_bin" --headless --path Game res://tests/control_plane_smoke.tscn -- \
+godot_args=(--control-plane-url="http://127.0.0.1:${api_port}")
-  --control-plane-url="http://127.0.0.1:${api_port}" \
+if [ "$assignment_smoke" = "1" ]; then
+  # Seed one complete, player-scoped assignment behind the real API. The fake
+  # Steam provider derives the player ID from the supplied ticket, so this
+  # still exercises authenticated ownership and the PostgreSQL assignment
+  # adapter; no session or assignment state is injected into Godot.
+  assignment_ticket="assignment-smoke-web-api-ticket"
+  assignment_player_id="testkit-$(printf '%s' "$assignment_ticket" | shasum -a 256 | awk '{print substr($1,1,16)}')"
+  docker exec "$container_name" psql -v ON_ERROR_STOP=1 -U "$user" -d "$database" -c "
+INSERT INTO identities (player_id, steam_id) VALUES ('$assignment_player_id', 'assignment-smoke-steam') ON CONFLICT (player_id) DO NOTHING;
+INSERT INTO queue_tickets (ticket_id, player_id, playlist, state, client_build, protocol_version, enqueued_at, expires_at, revision)
+VALUES ('assignment-smoke-ticket', '$assignment_player_id', 'casual', 'ASSIGNMENT_READY', 'smoke-build', 1, now(), now() + interval '1 hour', 1)
+ON CONFLICT (ticket_id) DO NOTHING;
+INSERT INTO matches (match_id, playlist, state, region, protocol_version, server_id, revision)
+VALUES ('assignment-smoke-match', 'casual', 'ASSIGNMENT_READY', 'EU', 1, 'assignment-smoke-server', 1)
+ON CONFLICT (match_id) DO NOTHING;
+INSERT INTO match_participants (match_id, player_id, ticket_id, slot, team)
+VALUES ('assignment-smoke-match', '$assignment_player_id', 'assignment-smoke-ticket', 0, 0)
+ON CONFLICT (match_id, player_id) DO NOTHING;
+INSERT INTO assignments (match_id, player_id, allocation_id, server_id, slot, region, client_build, protocol_version, transport, endpoint, join_authorisation, manifest_digest, expires_at, revision)
+VALUES ('assignment-smoke-match', '$assignment_player_id', 'assignment-smoke-allocation', 'assignment-smoke-server', 0, 'EU', 'smoke-build', 1, 'enet', '127.0.0.1:30001', 'assignment-smoke-join-authorisation', decode('000102030405060708090a0b0c0d0e0f', 'hex'), now() + interval '1 hour', 1)
+ON CONFLICT (match_id, player_id) DO NOTHING;"
+  godot_args+=(--assignment-match-id="assignment-smoke-match" --steam-ticket="$assignment_ticket")
+fi
+
+"$godot_bin" --headless --path Game res://tests/control_plane_smoke.tscn -- "${godot_args[@]}" \
   >"$logs_dir/godot-client.log" 2>&1
 status=$?