# SpaceGame consumer pilot

Tracking: Rendezvous #21 and SpaceGame #3.

The first SpaceGame checkpoint proves that the v1 client boundary can establish
authenticated direct LiteNetLib traffic without taking ownership of the game's
protocol, admission, player identity, entity identity, capacity, or gameplay
payloads. It does not yet pass the complete consumer-pilot gate. The public
package restore, actual Godot-process integration, connected fallback transport,
remote Linux dedicated run, representative external NAT run, and reconnect path
remain required before #21 can close.

## Pinned checkpoint

| Input | Value |
| --- | --- |
| Rendezvous source | `7fb85059fb7003ca0984ebd0cc9541218d33ae93` plus the #21 compatibility changes |
| SpaceGame source | `86424ebde69a7eeae110106ab5f84c68f04af89b` |
| Client package | `FinalFactory.Rendezvous.Client` `1.0.0` |
| Contracts package | `FinalFactory.Rendezvous.Contracts` `1.0.0` |
| LiteNetLib | `2.1.4` |
| HTTP, UDP, ticket contracts | `1` |
| SpaceGame gameplay protocol | `2` |

At the checkpoint date, the Final Factory Gitea NuGet service was reachable but
both `FinalFactory.Rendezvous.*` `1.0.0` registrations returned HTTP 404. The run
therefore restored locally built candidate packages with the hashes recorded in
[`spacegame.json`](../evidence/consumers/spacegame.json). This proves candidate
compatibility, not immutable registry publication. The release package restore
must be repeated from the public feed.

## Proven local path

The SpaceGame host and client each create one caller-owned `NetManager`, set its
three gameplay QoS channels before `Start`, and give the same manager and
`RendezvousNetListener` to the coordinator. Rendezvous authenticates discovery,
join authorization, host presence, mediation, and connection outcome reporting.
After traversal, SpaceGame performs a separate audience-bound admission exchange
on its own reliable command channel. A trusted game-auth boundary mints the
opaque assertion; the player process never receives the signing key.

The authoritative host rejects expired, replayed, incorrectly signed,
wrong-listing, duplicate-player, over-capacity, identity-mismatched,
out-of-sequence, and over-rate traffic. It assigns a canonical game entity ID
only after admission. The player ID, entity ID, listing ID, join-attempt ID, and
LiteNetLib peer ID remain distinct values.

The bounded two-process harness observed:

- host publication and lease maintenance;
- browser compatibility filtering and join authorization;
- typed traversal outcome `Connected`;
- successful audience-bound game admission;
- one reliable ordered input and one sequenced state snapshot on the direct
  gameplay socket;
- zero SpaceGame gameplay payloads handled by Rendezvous; and
- successful host deregistration.

Both Debug and Release builds passed. Both Debug and Release test runs passed 29
tests with zero failures. The focused formatter, shell checker, clean
candidate-package restore, and adversarial branch review also passed.

## Failure evidence

| Path | Evidence | Status |
| --- | --- | --- |
| Incompatible protocol | protocol `999` returns no compatible listing and starts no traversal | Proven |
| Stale/no host presence | typed `NoHostPresence/RendezvousService/HostPresence/Mediation` | Proven |
| Traversal timeout | non-listening mediator produces typed `PunchTimedOut/LocalTraversal/NatTraversal/NatTraversal` | Proven |
| Rejected game admission | invalid signature and wrong audience deny gameplay; expiry and replay are regression-tested | Proven at protocol/unit boundary |
| Capacity and duplicate player | game-owned roster rejects both and publishes current capacity | Regression-tested |
| Configured fallback | policy excludes authorization, compatibility, and capacity failures | Policy only; transport path open |
| Disconnect | direct session ends and host deregisters | Proven for checkpoint shutdown |
| Reconnect | a second authenticated session after disconnect | Open |

## Rendezvous-side compatibility fixes

The pilot found generic integration gaps and keeps their fixes in this
repository:

- the local production-shaped smoke tenant accepts SpaceGame gameplay protocol
  `2` and the bounded `mode` metadata key;
- SDK guidance requires games using multiple LiteNetLib QoS channels to set
  `ChannelsCount` before `Start` and states that Rendezvous reserves no gameplay
  channel; and
- the local credential helper rejects any signing-key file with group or other
  permissions, in addition to its ownership, symlink, and hard-link checks.

Documentation contract tests cover these generic requirements.

## Remaining acceptance gates

Do not mark #21 passed until all of these have direct evidence:

1. restore the exact immutable `1.0.0` packages from the public Gitea feed;
2. drive the host and client through actual Godot game processes, not only the
   console pilot;
3. implement and exercise the configured dedicated fallback connection with the
   same game admission and identity rules;
4. prove disconnect followed by a fresh authenticated reconnect;
5. run a remote client against a Linux dedicated host and capture normal
   termination/drain behavior;
6. run representative external NAT canaries and record the network topology and
   typed outcome; and
7. clear the current SpaceGame Linux runtime blocker: its pre-existing ImGui
   GDExtension native library is absent. A headless process exit code of zero
   while that load error is present is not runtime proof.