feat: gate allocator roster publication

multiplayer-next.md

@@ -58,9 +58,10 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md).
   fencing; `server/agones` now submits and validates namespaced
   `GameServerAllocation` responses, including dynamic address/port data;
   `server/allocator` now requires provider allocation reconciliation into the
-  durable registry before returning an endpoint; durable roster publication
-  now verifies canonical join-authorisation signatures before exposing player
-  rows; live Agones integration remains.
+  durable registry before returning an endpoint; allocator-facing roster
+  publication now requires an allocated endpoint and verifies canonical
+  join-authorisation signatures before exposing player rows; live Agones
+  integration remains.
 - [ ] **IN PROGRESS:** Run the Go control plane against PostgreSQL/Redis with
   independently runnable API, matcher, allocator and maintenance roles. The
   `cmd/control-plane` API role now opens PostgreSQL, applies migrations, wires

multiplayer-todo.md

@@ -1214,7 +1214,7 @@ the local/CI/community transport, not a silent production fallback.
 | 8.28 `[D:8.6,8.27]` | **IN PROGRESS.** Supervisor separates explicit process-ready from Agones Ready and never scrapes stdout; allocated mode refuses to mark Ready without a configured readiness probe | `server/supervisor/` tests prove Ready follows the probe and direct mode remains functional; `server_control.gd`, `agones_sdk.gd` and process-level smokes prove loopback `/ready`, `/health`, bearer-protected `/drain`, sidecar-shaped Health/Ready calls and drain admission fencing; detached-container and Health-reclaim integration remain |
 | 8.29 `[D:8.26,8.27]` | **IN PROGRESS.** Supervisor discovers and validates the Agones endpoint, propagates the actual dynamic `--port`, and exports `SDR_LISTEN_PORT`/`SDR_IP` only for Hosted-SDR while preserving an isolated ENet path | `server/supervisor/` tests cover invalid address/port rejection, dynamic port argument/env propagation and SDR-vs-ENet separation; real Agones dynamic/passthrough mapping, POP/cert/firewall/NAT and multi-match fixture remain |
 | 8.30 `[D:8.18,8.26,8.28,8.29]` | **IN PROGRESS.** Pure Go allocator filters Ready servers by region/build/protocol/transport, atomically claims one with idempotent allocation replay, and now owns the assignment-publication boundary; PostgreSQL adds durable GameServer registration and compatible `SKIP LOCKED` claims with request-digest fencing; `server/agones` submits and validates namespaced `GameServerAllocation` responses and dynamic endpoints; `server/allocator` reconciles provider success into durable state before exposing the endpoint | `server/domain/allocator.go`, `server/store/allocator_sql.go`, `server/agones/allocation.go`, `server/allocator/service.go`, `server/migrations/0004_allocator_registry.sql` and tests cover deterministic compatible selection, exhaustion, conflicting/identical allocation replay, unknown allocations, SQL claim ordering, invalid input, provider error/malformed response/IPv6 endpoint handling, durable-reconciliation failure isolation and assignment replay/conflict; `TestPostgreSQLAllocatorClaimReplayAndCapacityFence` now covers live registration/selection/replay/conflict/no-capacity when the disposable database gate is run; signed roster metadata, bounded cross-replica retry and live integration remain |
-| 8.31 `[D:8.9,8.30]` | **IN PROGRESS.** Pure Go assignment gate requires Allocated state, exact allocation ID/match/server/region/build/protocol/transport compatibility, non-empty hosted endpoint and verified manifest signature before exposure; allocator publication cannot expose Ready state; durable roster persistence now verifies each canonical join-authorisation signature before publishing player rows | `server/domain/assignment.go`, `allocator.go`, `store/assignment_sql.go` plus adversarial fixtures cover early-connect, tampered signature/manifest, wrong compatibility, empty endpoint, unknown allocation, forged roster signature, valid signature and post-publication mutation rejection; Agones metadata watch, hosted-address registration, production signer and client-ticket publication remain |
+| 8.31 `[D:8.9,8.30]` | **IN PROGRESS.** Pure Go assignment gate requires Allocated state, exact allocation ID/match/server/region/build/protocol/transport compatibility, non-empty hosted endpoint and verified manifest signature before exposure; allocator publication cannot expose Ready state; durable roster persistence now verifies each canonical join-authorisation signature before publishing player rows; allocator service gates roster publication on allocated state and endpoint presence | `server/domain/assignment.go`, `allocator.go`, `store/assignment_sql.go` plus adversarial fixtures cover early-connect, tampered signature/manifest, wrong compatibility, empty endpoint, unknown allocation, forged roster signature, valid signature, premature publication and post-publication mutation rejection; Agones metadata watch, hosted-address registration, production signer and client-ticket publication remain |
 | 8.32 `[D:8.2,8.26,8.30]` | **IN PROGRESS.** Provider-neutral FleetAutoscaler baseline preserves a two-process Ready buffer, caps warm capacity, and leaves Allocated scale-down independent of the Ready floor; Fleet image references remain digest-pinned for current/rollback pre-pull | `deploy/k8s/base/fleet-autoscaler.yaml` and manifest tests cover Fleet ownership, Buffer policy and floor/cap invariants; regional on-demand node pools/failure domains, pre-pull rollout, warm-allocation p95/p99 and N+1 certification remain |
 | 8.33 `[D:8.26,8.32]` | **IN PROGRESS.** Fleet scheduling now requires on-demand capacity and spreads Ready processes across zones with skew 1; the autoscaler preserves the two-process Ready floor | `deploy/k8s/base/fleet.yaml` and manifest tests reject interruptible placement and single-zone concentration structurally; regional node pools, forced node-loss testing and measured N+1 headroom remain |
 | 8.34 `[D:8.28,8.29]` | Native x86_64 benchmark of boot-to-process-ready and assignment-ready, p99 CPU/RSS/network and 60 Hz ticks; limits/node cap with 30% headroom | Measurements replace old estimates and certify density with no tick backlog |

server/allocator/service.go

@@ -18,12 +18,27 @@ type Durable interface {
 	RecordProviderAllocation(context.Context, domain.Allocation, time.Time) (domain.Allocation, error)
 }
 
+type RosterPublisher interface {
+	PublishRoster(context.Context, domain.Assignment, []domain.SignedJoinAuthorisation, func([]byte, []byte) bool) error
+}
+
 type Service struct {
 	Provider Provider
 	Durable  Durable
+	Roster   RosterPublisher
 	Now      func() time.Time
 }
 
+func (s Service) PublishRoster(ctx context.Context, assignment domain.Assignment, roster []domain.SignedJoinAuthorisation, verify func([]byte, []byte) bool) error {
+	if s.Roster == nil {
+		return errNotConfigured
+	}
+	if assignment.Allocation.State != domain.ServerAllocated || assignment.Endpoint == "" {
+		return domain.ErrManifestRejected
+	}
+	return s.Roster.PublishRoster(ctx, assignment, roster, verify)
+}
+
 func (s Service) Allocate(ctx context.Context, request domain.AllocationRequest, labels map[string]string) (agones.AllocatedServer, error) {
 	if s.Provider == nil || s.Durable == nil || s.Now == nil {
 		return agones.AllocatedServer{}, errNotConfigured

server/allocator/service_test.go

@@ -27,6 +27,16 @@ type durableSpy struct {
 	err        error
 }
 
+type rosterSpy struct {
+	calls int
+	err   error
+}
+
+func (r *rosterSpy) PublishRoster(_ context.Context, _ domain.Assignment, _ []domain.SignedJoinAuthorisation, _ func([]byte, []byte) bool) error {
+	r.calls++
+	return r.err
+}
+
 func (d *durableSpy) RecordProviderAllocation(_ context.Context, allocation domain.Allocation, _ time.Time) (domain.Allocation, error) {
 	d.calls++
 	d.allocation = allocation
@@ -52,3 +62,16 @@ func TestServiceDoesNotReturnProviderResultAfterDurableFailure(t *testing.T) {
 		t.Fatalf("result=%+v err=%v calls=%d", result, err, durable.calls)
 	}
 }
+
+func TestServicePublishesRosterOnlyForAllocatedAssignment(t *testing.T) {
+	roster := &rosterSpy{}
+	service := Service{Roster: roster}
+	assignment := domain.Assignment{Allocation: domain.Allocation{State: domain.ServerAllocated}, Endpoint: "127.0.0.1:7777"}
+	if err := service.PublishRoster(context.Background(), assignment, []domain.SignedJoinAuthorisation{{Signature: []byte("sig")}}, func([]byte, []byte) bool { return true }); err != nil || roster.calls != 1 {
+		t.Fatalf("publish err=%v calls=%d", err, roster.calls)
+	}
+	assignment.Allocation.State = domain.ServerReady
+	if err := service.PublishRoster(context.Background(), assignment, nil, nil); err != domain.ErrManifestRejected || roster.calls != 1 {
+		t.Fatalf("premature publish err=%v calls=%d", err, roster.calls)
+	}
+}

server/store/assignment_sql.go

@@ -32,6 +32,12 @@ type DurableAssignment struct {
 	Revision          uint64
 }
 
+type PostgresRosterStore struct{ DB *sql.DB }
+
+func (s PostgresRosterStore) PublishRoster(ctx context.Context, assignment domain.Assignment, roster []domain.SignedJoinAuthorisation, verify func([]byte, []byte) bool) error {
+	return SaveVerifiedAssignmentRoster(ctx, s.DB, assignment, roster, verify)
+}
+
 const AssignmentUpsertSQL = `INSERT INTO assignments
     (match_id, player_id, allocation_id, server_id, slot, region, client_build,
      protocol_version, transport, endpoint, join_authorisation, manifest_digest,