# Unscouted consumer pilot

Tracking: Rendezvous #22 and Unscouted #459.

The current checkpoint independently proves that the v1 contracts are not
shaped only around SpaceGame. A real Godot Unscouted host and clients consume
the same Client and Contracts package surface, use one caller-owned LiteNetLib
socket for NAT callbacks and gameplay, perform Unscouted's own keypair
authentication and host admission, exchange gameplay, and exercise a
game-owned fallback. The public package restore and representative external
NAT/CGNAT canary remain required before #22 can close.

## Pinned checkpoint

| Input | Value |
| --- | --- |
| Rendezvous configuration source | `f368fec6eb4344a6042974f58f888cf0f1ac8e8e` |
| Rendezvous package source | `07004cd75fe172aa5dfdb3edda22fc280a4c4477` |
| Unscouted implementation | `1e5886aa7f1e44689b4c75e32693eb7b19fd72d7` |
| Unscouted evidence | `f0574a7de82aadff6495ca5657dfc19cf7c2f67c` |
| Client package | `FinalFactory.Rendezvous.Client` `1.0.0` |
| Contracts package | `FinalFactory.Rendezvous.Contracts` `1.0.0` |
| LiteNetLib | `2.1.4` |
| Godot | `4.7.stable.mono.arch_linux.5b4e0cb0f` |
| Game / environment / region | `unscouted` / `smoke` / `local` |
| Rendezvous and gameplay protocol | `1` |

The exact package hashes are recorded in
[`unscouted.json`](../evidence/consumers/unscouted.json). A clean restore into an
empty package directory using only the consumer's checked-in `NuGet.config`
returns `NU1101` for both packages. The verified local run used those exact
candidate package files from the existing cache. This proves compatibility,
not immutable registry publication.

## Game-neutral service boundary

Rendezvous #22 adds provisioning data, not an Unscouted branch in the server or
SDK. The local production-shaped tenant permits protocol `1`, region `local`,
public managed-dedicated listings, and the three bounded presentation keys
`mode`, `world`, and `mods`. The short-lived credential helper accepts only the
explicitly provisioned `space-game` and `unscouted` scopes and selects a
distinct game-scoped signing-key ID and subject.

The consumer rejects any metadata key outside its three-key presentation
schema and neutralizes control/BBCode characters before display. Rendezvous
never receives Unscouted player keys or resolved identities, colony authority,
simulation or persistence state, fog/interest state, or gameplay packets.

## Proven real Godot path

The normal `NetLaunch` argument path recognizes `--rendezvous-pilot` and opens a
dedicated scene. That scene uses Unscouted's real `LiteNetLibTransport`,
`GameServer`, `GameClient`, `ServerAuthenticator`, and `ClientAuthenticator`.
It is not a copied SDK adapter.

One bounded run against the hardened Compose service started a host plus:

- a protocol-`999` client that found no compatible listing;
- a direct client that received an authorized introduction, completed
  same-socket traversal, passed Unscouted keypair admission, and exchanged an
  Unscouted gameplay ping/pong; and
- a client pointed at a non-listening mediator that received a typed traversal
  failure, applied the fallback decision in Unscouted code, repeated admission,
  and exchanged the same gameplay ping/pong through the ordinary game
  transport.

The direct client also proved that both a `space-game` join request and a
`production` environment join request return exact `NotFound` results for the
Unscouted listing. The host renewed its lease, admitted two independently
authenticated sessions, completed two gameplay exchanges, and deregistered the
listing on shutdown.

## Verification

- Rendezvous Debug and Release: 299 tests passed in each configuration, zero
  failures.
- Unscouted Debug and Release: non-incremental builds passed; 3,310 tests passed
  with 15 intentional skips in each configuration.
- Unscouted gdUnit/Godot: 360 tests passed, zero skipped or failed. The harness
  fix in Unscouted #461 keeps compilation headless and leaves the open editor's
  build tree unchanged.
- The final Godot pilot, ShellCheck, JSON/whitespace checks, formatting gate,
  and adversarial branch review passed.
- Export is not applicable because the Unscouted checkout has no
  `export_presets.cfg`; both C# configurations and the actual Godot entry point
  were exercised.

## Remaining acceptance gates

Do not mark #22 passed until both external gates have direct evidence:

1. publish or expose the exact immutable `1.0.0` packages on the configured
   Gitea feed and repeat the empty-cache consumer restore; and
2. run the same Godot host/client path across representative residential,
   CGNAT, and IPv6/multi-host networks, recording the topology and typed
   direct/fallback outcome.

The loopback run proves the real process, socket, authentication, and gameplay
shape. It does not claim production Internet traversal coverage.