funman300
3442eac6f0
Four defects found by running the suites and the staging lifecycle end to end after the kit milestone. 1. club-stats kits were half-implemented. The global `kits` counter was real but `kitsHome`/`kitsAway` and every per-team `kits` bucket stayed hardcoded 0, so the same screen reported two owned kits and zero home/away kits. `kits` is a total with a family split, exactly like players/playersGold and staff/staffManager. The split key is `fcc_kitcards.assetid`: 14 is the home family and 15 the away family, verified across all 1482 rows of the kit table (assetid 14 covers exactly the 63xxxxx carddbids, 828 rows; assetid 15 exactly the 64xxxxx ones, 654 rows; no exceptions either way). ClubStatInput now carries `asset_id`, and a kit buckets onto the team that wears it -- including a team the club owns no player from, the normal case for a kit won from a pack. The host reads both from the catalog through new NON-MINTING accessors: `resolve`/`resolve_kit` allocate a wire id, which a read-only stats query must never do as a side effect. 2. host_test.rs had 10 tests red since the squad-manager work (25f4ad1/d37a9d5);56bd9ddupdated the squad_projection integration test and stopped there. `put_body` hardcoded the captured manager ref 100000427 into EVERY save, including tests with no manager fixture, so each one was refused with `unresolved_wire_ids` -- the tests were reporting a real invariant against a fixture that could not satisfy it. The manager is now an explicit `Option<i64>` per test, and FakeCore models Core's manager persistence instead of inheriting the "not implemented" default that 502'd every save. Added the coverage whose absence let this rot: a manager assignment round-trips as a Core owned id, a later save without one CLEARS it, and an unowned manager ref refuses the whole save with nothing committed. 3. `club_route_maps_query_and_shapes_core_items` pinned `offset`/`limit` forwarding to Core, which the kit commit deliberately replaced with host-side pagination. It only ever passed because FakeCore ignored the window -- against a real Core, `start=10` over a one-item club was always an empty page. Retargeted to the real contract (Core gets semantic filters and NO window) plus a new test that the window is applied locally after filtering, which the old fake made vacuous. 4. The staging lifecycle scripts identified production by hardcoded pids, so a correct teardown FATAL'd: production moved into containers and pids 3631953/3374264 died with a container restart days ago. A pinned pid rots into the worst of both worlds -- a kill-refusal gate that no longer names any real production process, and a liveness gate that fails a healthy teardown. New shared `scripts/openfut_production.py` resolves production pids AND published ports from the container runtime at the moment they are needed, refuses to signal anything it cannot see, and proves production is the same processes serving the same ports before and after. Both lifecycle scripts use it, which also closed a real gap: port 8085 is published by openfut-fut-backend but was missing from the up script's forbidden list, so staging could have bound a production port. Also fixes the economy differential, red because `complete_match` unlocks achievements in the same transaction that pays the match reward -- a deliberate Core feature the Python oracle has no counterpart for. `rust WIN +400` asserted that progression did not exist; it now asserts the delta is the 400 match reward plus exactly the achievements the match unlocked, read from Core's own report.
openfut-adapter-fifa17
The FIFA 17 game adapter. Everything true of FIFA 17 specifically lives here, so that neither OpenFUT Core nor the generic protocol crates have to know about it.
openfut-protocol-blaze generic Blaze: Fire2 framing, Heat2/TDF codec
▲
openfut-adapter-fifa17 THIS: command tables, response bodies, dispatch order
▲
OpenFUT Core game-independent FUT domain (not yet wired)
Status
| Surface | Port | State |
|---|---|---|
| Blaze / Fire2 RPC | 42130 | Implemented, byte-for-byte parity-tested |
| Redirector (HTTPS + XML) | 42127 | Python only |
| Nucleus OAuth stub | 42131 | Python only |
| LSX / Origin | 4216 | Python only |
| Roster XML | 8081 | Python only |
| UTAS / RS4 | 8099 | Python only |
| POW / EASFC | 8094 / 8080 | Python only |
Nothing here is wired into the running backend. The crate answers frames; it opens no socket, terminates no TLS and owns no runtime. The Python backend remains the live service and the behavioural oracle.
What the adapter owns, and what it must not
Owns: component/command/notification IDs, response body shapes, dispatch
ordering, session identity, the fetchClientConfig tables.
Must not own: FUT domain state. Blaze is an auth/session/config protocol — no
coins, packs, clubs or squads appear on this wire — so Session holds a session
key, a locale, a service name, an auth code and a flag, and that is all. When
UTAS is migrated that boundary will need active defending; here it comes free.
Parity
./check-parity.sh # oracle freshness + byte-for-byte replay
./check-parity.sh --regen # after an intentional oracle change
fixtures/blaze_transactions.jsonl holds 49 request→response(s) transactions
produced by calling the real blaze_responder_v3b.dispatch(). They replay in
order against a shared session per connection, so ordering-dependent behaviour
is exercised rather than assumed: preAuth captures the locale that later ALOC
fields echo, and login sets the auth code getAuthToken returns afterwards.
Comparison is byte-for-byte including frame count and order — a missing post-login notification or a reply where the oracle stays silent fails here.
The suite was mutation-tested: swapping two post-login notifications,
flipping one enum deep inside AccountInfo, and hardcoding an address in
utas_base()/nucleus_base() were each verified to turn it red. The third
initially did not, because the config templating had made those helpers dead
code; the table now templates on URL-level tokens so they are the single place a
URL shape is defined.
Three behaviours that are easy to get wrong
- Login answers with four frames, in order: reply, then
UserAuthenticated,UserSessionExtendedDataUpdate,UserAdded. - An unimplemented RPC still gets an empty reply. Silence makes the client wait for a timeout; an empty reply lets every field fall back to a client-side default and the boot continues.
- Non-request message types get nothing at all.
No error replies are emitted. msgType 3 exists, but the error-code placement
is UNRESOLVED — three clean-room sources disagree between header[14:16], a
metadata ERRC, and a payload CNTX/ERRC — so emitting one would be a guess
on the wire.
The client config table
fixtures/client_config.json carries 227–243 rows per CFID, generated from the
Python oracle and templated on {utas_base}, {nucleus_base},
{pow_content_url}, {advertise}, {bind}, {pow_host}. It is
reverse-engineered data, not logic, and deriving it mechanically removes a
class of transcription typo no reviewer could catch. The generator does not take
its own templating on trust: it substitutes real addresses back in and diffs
against the oracle for every section before writing the file.
The table must be complete, not representative. The client resolves a per-call
key (FUT_RS4_URL_<CALL>) before a per-module one, and any unresolved call falls
back to a real, dead EA host — that is what produced "there has been an error
connecting to FIFA 17 Ultimate Team" mid-session when only the boot subset was
served.
Known defect reproduced deliberately
nucleusConnect and nucleusConnectTrusted are built from the bind address,
not the advertised one. On the live split deployment that means the backend
tells a client on another machine to reach Nucleus at http://0.0.0.0:42131,
which it cannot. Verified against the running container, not inferred.
This is reproduced exactly, because it is what the only proven-working configuration does and changing it would break parity. It also implies the Nucleus stub is not actually reached in the current remote flow. Fixing it is a separate change that needs live validation — see the vault.
Configuration
Nothing is hardcoded. AdapterConfig carries Identity (persona, ids, email,
namespace, entitlement group, …) and Endpoints (advertise, bind, POW hosts,
telemetry/ticker/QoS ports). Default gives the project's synthetic offline
identity on loopback; a remote deployment must override advertise.
Bind and advertise are deliberately distinct: an advertised URL must carry the address the client can reach, which on a two-machine deployment is not the address the server binds.