chore(release): cut edge over to main — protocol 14 and Steam sign-in (MODULE_API 1.17.0) #58
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: RunicGateway/Module-Rust#58
Reference in New Issue
Block a user
No description provided.
Delete Branch "edge"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What & why
The last step of PLAN_LAST_FIXES stage 6: Module-Rust
edge→main. Its pieces are already out:mainis at6890a74(website#220), MODULE_API 1.17.0.module.json'scoreApiis^1.17.0, andci/core-ref.jsonpoints at that sha (#57).v2/rust/current.json2026.10.22 is protocol 14: Rust-Link v0.3.0, Rust-Plugins v0.3.0 andRunicNPC v1.0.0. Each hash in it matches its release's
SHA256SUMS.Everything here was already reviewed into
edge. The protocol 14 module covers the kit weekend, linked rewards, rewardmessages and the kit warning (PLAN_REDESIGNS §2); Economics (§11.2); Backpacks (§11.3); permissions as event rewards
(§12); Rust's own world events (§14.3.1); TruePVE in the zone step (§14.3.2); Dynamic PVP (§14.3.3); Dangerous Treasures
(§14.3.4); Guarded Crate (§14.3.5); ZLevels (§14.3.6); console-command steps and rewards (§16); RaidableBases (§11.4);
Steam sign-in as a Rust link (§15, D392/D396). The last fixes are in too: W21, W4 (#54), the small fixes (#55) and the
zone
until(W1, #56).The release engine should cut v0.5.0 (feat commits since v0.4.0).
How it was tested
Each PR into
edgepassed server tests, the client build and the frozen manifest. The whole tree was walked in the endwalk and the last fixes (PLAN_LAST_FIXES §8). After release I check the tarball against
SHA256SUMSand the manifest(
coreApi^1.17.0). Then I install it on the walk site against the protocol 14 rigs, which get the released bridge fromthe 2026.10.22 bundle through installer v0.8.0.
Checklist
AI-assisted contributions (required)
Claude Code (Claude Opus 5.5). I have reviewed and understand every change, andtake responsibility for it. AI-authored commits are marked with a
Co-Authored-Bytrailer.License
the right to contribute it.
🤖 Generated with Claude Code
https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
PLAN_REDESIGNS §2, the Rust half (D164, D192, D332, D333): - rust.template.kit_weekend (core registerEventTemplates, MODULE_API 1.13.0): inputs kit/minutes/message/delivery; one phase advance after the weekend, core.lease rust.group.permission default/<kit permission> + rust.kit.entitle linked. Steps only where the kit can use them; validated by the real core. - rust.kit.entitle: recipients 'linked' (every linked player who has played on the server, no tally, refused past the bound), optional message ({kit}) and delivery, stored per row (rust_perm_run_grants.notice*). - perm.sync notices: the untold set to the picked account, keyed run:step:user, in the digest; the report's noticesTold marks them told. - rust.options.grouppermissions notes a kit's permission rows via kits.uses (cached a minute per server; a failure is no note). - duration: 'minutes' on rust.zone.open and rust.participation.open; the group-permission lease's value example is true. - protocol 13 -> 14, coreApi ^1.13.0; ci/core-ref.json pinned to website#212's head while it is open; engagement-triggers.json regenerated (coreApi line). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeYThe site half of §11.2.2, on protocol 14: - `rust.coins.pay` ("Pay coins"): irreversible, reversible none (D335). The recipient modes of rust.kit.entitle including `linked`, one payment per website user (D103's rule), an optional message with {amount}, a new `rust.coins` budget. Refused with "Economics is not installed on this server" in the dry run too (D199). Core's key goes to the plugin, so a retried step answers `repeat` and pays nobody twice. - `rust_player_wipe_stats.balance`: the tally's balance, written as a value. A nameless balance frame (an offline player) moves nobody's last-seen. `economics.wiped` clears the wipe's balances, except at a new save. - The richest: a Coins leaderboard column on one wipe of a server that reports Economics, `sort=balance`, and a `richest` title category (Magnate); both rank only above the starting balance (D336). - GET /player/rust/economics (live, falling back to the last known), and GET/POST /admin/users/:id/rust/economics for staff — scoped to the user's own links, keyed per submission, an activity row with before and after. - Client: the account page's Coins, the admin user page's Coins panel with its form, the leaderboard column, and Economics in the server's mod line (saying when its config could not be read). Server 535/535 (14 new in test/economics.test.js), client 74/74, routes.manifest regenerated against the pinned core (87 routes), swagger fragment regenerated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeYThe site half of §11.3.2, on protocol 14: - `rust.backpack.size` ("Bigger backpack"): a kit reward with a different permission (D337) — one rust_perm_run_grants row per website user with backpacks.size.N, no kit, no credit; the perm mirror pushes it and the run's revert deletes it. risk change, reversible ledger, a new `rust.backpacks` budget, rust.kit.entitle's recipient modes including `linked`. Refused with "Backpacks is not installed on this server" in the dry run too (D199), and a size the server does not offer is refused by name. Its message is never silent: empty is the take-back warning (D338). - `rust.options.backpacksizes`: each server's sizes above its smallest, from the last hello, grouped by server. - GET /player/rust/backpacks (own links only, 20 reads a minute) and GET /admin/users/:id/rust/backpacks (that user's links only). Live, never stored; a stranger's id is a 404 and never reaches the game. - Client: a shared Backpack panel (pick server and account, open, read once) on the account page and the admin user page; the grid draws pages of pageSize, each slot named by the game (D340, no icons), blueprints by what they make (D341), overflow marked. Backpacks joins the server's mod line. Server 548/548 (13 new in test/backpacks.test.js), client 79/79 (5 new), routes.manifest regenerated against the pinned core (89 routes), swagger fragment regenerated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeYStage 3 of the §14.3 integration plan (D362, D368): world.zone's optional truePve ({exclude: true} or {ruleset}), all or nothing, unmapped on every path that erases one of our zones, with truepve.json for erases while TruePVE is away. Docs and PRs still to come. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeYStage 3 of the §14.3 integration plan (D362, D368), on protocol 14 (docs rust-link/PROTOCOL.md §20.6). - rust.zone.open gains noPvpProtection (boolean) and pvpRuleset (string), sent as world.zone's truePve { exclude: true } or { ruleset }. - Both set, a name over 64 characters, or a server whose hello says TruePVE is not loaded is refused for good, at verify too. A server that has not said is left to the plugin, as a dome is. - truepve-missing and truepve-ruleset are permanent failures, with the plugin's words. - The zone servers list carries each server's truePve from hello; Server settings' plugin line says whether TruePVE is loaded; the integrations schema documents it (swagger fragment regenerated). - README lists TruePVE among the optional plugins. Tests: five new in zones.test.js; server 603/603 and all checks, client 84/84 and the build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeYTwo event steps in server/eventCommands.js, on one new budget, `rust.commands` (D382-D385): - rust.command.run: up to 10 typed commands once on one server, with optional teardown commands. irreversible / ledger: the ledger row keeps the teardown as it was, and core reverts it when the run ends or is cancelled. Priced one unit per command, teardown included. - rust.command.reward: the kit reward's recipient picker (tally modes and linked), by Steam id, so no website account is needed. The bridge fills {steamid} and {name}; offline recipients are skipped and named (D383). irreversible / none. Priced commands x people, the bound for a mode that is not a count. Both take core's `multiple` string field as a free text box (no allowlist, D384) and a required "I am sure" toggle. {steamid}/{name} in a run step are refused. unknown-command, malformed, events-disabled, interrupted are permanent; the error says how many ran before it. D385: the run also hands its teardown to the bridge, which keeps it with the key. A revert with only the key (the step failed, or its answer was lost, so core recorded nothing) asks every enabled server to run what it kept; a server the step never reached runs nothing. sidecarClient.commandsRun -> POST /commands/run; ci/bundle.json lists the new file; entry.test.js pins the new ids; 21 tests in test/commandSteps.test.js. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY