Architecture
Six tiers, read from the bottom up.
The runtime topology is a proposal. What exists today at each tier is an in-memory seam with deterministic tests; no tier is connected to a live neighbour. The host keeps authority throughout.
proposed topology · confirmed per-tier seams, in memory · unverified runtime, host, game
Topologybottom to top
Runtime topology
What crosses each arrow is source-derived from the repositories' README and ARCHITECTURE documents. Today every arrow ends at an injected fake; no two tiers run against each other.
Boundaries
Boundary table
| Repository | Owns | Does not own | Confirmed today | Unverified |
|---|---|---|---|---|
| sts2-game-core | Host-independent domain: typed Identity/Generation/Phase/State/Action/Request; pure validate; policy rules with no I/O | Any host, loader, HTTP, MCP, gateway, provider, save format | Pure validate returning an accepted proposal or structured rejection; golden vectors reproducible ×64 | Any host, loader, HTTP, MCP, gateway, provider, save-format, or game-mechanics compatibility |
| sts2-game-mod | Game-process adapter: host port, bounded main-thread queue, dispatcher, versioned ABI descriptor, transport-free HTTP admission guard, composition seam | A managed loader, a real host adapter, a route catalog, domain behavior, packaging | Queue, dispatcher, ABI validation, admission guard; source-only .NET 9 ↔ Rust C-ABI experiment | Game launched, loader discovered, host assembly stored, listener exposed, real main-thread mutation |
| sts2-gateway | In-memory control plane: allocate/reconcile/renew/release/cleanup/expire/shutdown; one lease per instance with epoch fencing; fixed routes; byte limits | Listener, process supervisor, game connection, auth at an external boundary | Fencing (WrongInstance, Missing, Expired, WrongCaller, WrongSession, WrongLease, StaleEpoch); routes ReadOnly/Command/Receipt; body/response limits; fail-closed on process, readiness, transport faults; fresh lease epoch is 1 | Listener, process supervisor, game connection, auth at an external boundary, isolation under real concurrency, host compatibility, release |
| sts2-mcp-server | JSON-RPC framing; initialize/tools/list/tools/call; single tool sts2_get_state | Gateway policy, game state, any transport | Maps to exactly one gateway request GET /v1/instances/{id}/state with x-mcp-request-id/x-mcp-session-id; rejects malformed JSON (-32700), invalid params (-32602), unsupported capability (-32601) before gateway access; gateway Unauthorized → -32001 | Live MCP transport, gateway connection, game load, provider call, deployment |
| sts2-harness | Pure coordinator ports (router, provider, record, replay, artifact); retry/idempotency; record/replay; artifact lineage; bounded shutdown | Any provider, MCP or gateway exchange, game action | The ports and seams above, against deterministic fakes | Provider execution, MCP/gateway exchange, game action, replay fidelity vs a game, scoring, training, packaged runtime |
| sts2-protocol | Neutral identity/correlation/lineage metadata; version/profile/digest descriptors; lifecycle/deadline metadata; error envelope; manifest | Any transport, host, gateway, MCP, model, storage, runtime | Schema + golden fixtures + conformance test | Any transport, host, gateway, MCP, model, storage, or runtime behavior |
Wording follows the frozen facts ledger's claim ceilings; nothing stronger appears on any public surface.
Definitions
Four terms
- Lease
- The gateway's record that one caller, in one session, currently holds one instance. It carries an instance id, caller id, session id, lease id, an epoch, and an expiry tick. A forward request must present a proof of that lease.
- Epoch fencing
- Each lease has an epoch that starts at 1 and rises whenever the lease is renewed or replaced. A request whose proof carries an older epoch is denied as
StaleEpoch, before any transport call. A proof naming a different instance is denied asWrongInstance. The fence runs first; the transport never sees a fenced request. - Fixed route
- A forward names one of three routes —
ReadOnly,Command,Receipt— rather than an arbitrary path. There is no route catalog to extend at runtime. - Fail closed
- When a process, readiness, or transport port reports a fault, the gateway refuses further work on that instance instead of guessing. Shutdown closes admission. Denial is the default outcome of doubt.
All four are shown in the proof replay and mapped to tests on the evidence page.