mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
Josh Creek
654f20e28f
A backfilled player's join authorisation is issued after their server started, but the supervisor fetches the roster once before launching the game child and the game process has no reload path, so backfill cannot work end to end regardless of how good the selection rule is. Decided: the control plane marks the roster changed, the supervisor re-fetches and rewrites the roster file, then signals the game process to reload. Chosen because it reuses the authenticated channel and roster endpoint that already exist -- no inbound path into the game pod, no new trust boundary -- and keeps the roster an allowlist the server was told to expect rather than admitting anyone holding a valid signature. Signature verification is untouched and already binds match, server, slot and generation. Recorded in docs/MATCHMAKING.md, which the repo treats as the design source of truth, so the decision is not re-litigated from a task row. Remaining implementation is tracked in #32 and summarised in §7 8.19.