linus-dandClaude Opus 4.8
9d9d5ce41c
Builds the browser game around the existing Rust runtime: a window into the universe, not a second simulation. Pure std, no external crates. New crates: - protocol: versioned, hashable client/server messages + hand-rolled JSON value and total parser (malformed packet -> Err, never panic). - game_runtime: authoritative match state. Resolves turns through the INDEPENDENT interpreter (runtime_under_test::native_resolve), not the reference engine; filters visibility/knowledge; records and regenerates replays. A match is a pure function of (seed, roster, ordered inputs). - web_assets/web_client: embedded browser client (arena, rune editor, knowledge panels, replay viewer) + static HTTP delivery. - server: std::net HTTP + WebSocket (hand-rolled SHA-1/base64/RFC-6455 framing), turn timer, disconnect handling, panic-proof dispatch, poison-tolerant lock. - web_tests: dependency-free WebSocket test client + Phase H gates. Trust hardening per review: - game_runtime no longer delegates to reference_runtime::execute; it runs the independent interpreter that the runtime-equivalence gate proves correct. - Protocol/socket/replay/visibility/resilience gates are merge-blocking (added to the merge_group-required job in merge-gates.yml): 1k matches/0 drift, 10k fuzz/0 panics, 100 headless socket E2E, 0 hidden-state leaks. - Rendered-browser E2E is marked EXTERNAL-BLOCKED: Playwright runs advisory-only (continue-on-error, artifacts) until CI infrastructure with a browser exists; it is treated as unsatisfied, not green. The headless 100-match gate is labeled protocol-level coverage, not rendered-browser coverage. - README documents the hand-rolled crypto/parser audit risk explicitly. Fixes an integer-overflow panic in observed-volatility inference (i64 sum / abs near i64::MIN) that could poison the server mutex. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
73 lines
2.7 KiB
YAML
73 lines
2.7 KiB
YAML
name: magicka-web-gates
|
|
|
|
# Phase H of plan2.md — the web CI gates.
|
|
#
|
|
# MERGE-BLOCKING gates live in merge-gates.yml (the merge_group-required job),
|
|
# which runs the protocol + socket + replay/visibility/resilience suite. This
|
|
# workflow provides the same Rust gates as fast PR/push feedback, plus the
|
|
# rendered-browser layer.
|
|
#
|
|
# The Rust gates (web-rust-gates) enforce, deterministically and without a
|
|
# browser:
|
|
# * 1,000 simulated matches, 0 replay hash mismatches (determinism.rs)
|
|
# * 10,000 protocol fuzz cases, 0 server panics (fuzz.rs)
|
|
# * 100 end-to-end matches over real sockets (e2e.rs, protocol-level)
|
|
# * 0 hidden-state leaks (visibility.rs)
|
|
# * disconnect/reconnect + timer edges (resilience.rs)
|
|
#
|
|
# The rendered-browser layer (rendered-browser-e2e) is EXTERNAL-BLOCKED: it
|
|
# cannot be merge-blocking until CI infrastructure with a real browser exists.
|
|
# Until then it runs advisory-only (continue-on-error) and uploads Playwright
|
|
# artifacts. It is NOT counted as satisfied coverage.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
web-rust-gates:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Protocol / server / game-runtime unit tests
|
|
run: cargo test --release -p protocol -p game_runtime -p server -p web_assets -p web_client
|
|
- name: Web CI gates (1k matches, 10k fuzz, 100 e2e, leak + resilience)
|
|
run: cargo test --release -p web_tests
|
|
|
|
# EXTERNAL-BLOCKED: rendered-browser end-to-end. A real browser is not
|
|
# available in this CI, so this job is advisory only and never blocks merge.
|
|
# It produces Playwright artifacts as evidence; it does not satisfy the
|
|
# "rendered browser" coverage claim until CI infrastructure exists.
|
|
rendered-browser-e2e:
|
|
name: rendered-browser-e2e (ADVISORY — blocked on CI infra)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
continue-on-error: true
|
|
needs: web-rust-gates
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
- name: Install Playwright (Chromium)
|
|
working-directory: crates/web_tests/e2e
|
|
continue-on-error: true
|
|
run: |
|
|
npm install
|
|
npx playwright install --with-deps chromium
|
|
- name: Rendered-browser E2E (advisory)
|
|
working-directory: crates/web_tests/e2e
|
|
continue-on-error: true
|
|
run: npm test
|
|
- name: Upload advisory Playwright report
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: playwright-report-advisory
|
|
path: crates/web_tests/e2e/playwright-report
|
|
if-no-files-found: ignore
|