key-store/key.store
15
0
Fork 0
Code Pull requests 18 Releases 180 Activity Actions 5

office: 12 game-only tools incl. validated guide/set_spawn, nix-anchored tests (#52) #280

Merged
founder merged 4 commits from infra/office-sight-52 into main 2026-09-14 05:18:38 +00:00
Conversation 3 Commits 4 Files changed 6 +286 -2
infra commented 2026-09-14 03:22:55 +00:00
Member
Copy link

Residents can inspect the Minecraft office, check their inventory, escort a player, guide a player to a checked destination, and set a personal spawn through the shared MCP hub. The worker exposes 12 typed game tools; the hub discovers and forwards all 12 under the caller's identity.

Observation returns actual nearby blocks, players and entities with explicit unknown-chunk and truncation fields (radius at most 8; detailed block list at most 1024). Escort moves the caller to a safe adjacent cell. Guide validates loaded, in-campus footing and verifies arrival. Spawn accepts integer block coordinates and reports submission honestly; an actual respawn is required to prove effective respawn behavior. Commands remain typed and scoped to the office world under the founder's existing game authority.

Validation: canonical Nix worker and hub builds passed on 62e9beee. The worker build runs syntax checks and all 10 validation tests against the real site-plan schema. A packaged MCP client canary discovered all 12 tools, observed the manager's furnished home with zero unknown blocks, read inventory, guided and escorted the temporary manager avatar, and submitted its personal spawn. The Minecraft server confirmed spawn [514,129,-239] at 2026-09-14 04:48:22 UTC. The temporary client disconnected; no other player was moved and no blocks were changed. No death/respawn test was performed.

Final head 416eb143 rebases onto merged shared hub main a20029b1. All six office files are byte-identical to the canary-tested head; exact-head senior review confirms that comparison. The new tools are source-ready; deployment and live resident discovery remain tracked in #52/#51 under KSE-0197. The existing sent_commands counter counts build commands only and will need a separate instrumentation follow-up.

Residents can inspect the Minecraft office, check their inventory, escort a player, guide a player to a checked destination, and set a personal spawn through the shared MCP hub. The worker exposes 12 typed game tools; the hub discovers and forwards all 12 under the caller's identity. Observation returns actual nearby blocks, players and entities with explicit unknown-chunk and truncation fields (radius at most 8; detailed block list at most 1024). Escort moves the caller to a safe adjacent cell. Guide validates loaded, in-campus footing and verifies arrival. Spawn accepts integer block coordinates and reports submission honestly; an actual respawn is required to prove effective respawn behavior. Commands remain typed and scoped to the office world under the founder's existing game authority. Validation: canonical Nix worker and hub builds passed on 62e9beee. The worker build runs syntax checks and all 10 validation tests against the real site-plan schema. A packaged MCP client canary discovered all 12 tools, observed the manager's furnished home with zero unknown blocks, read inventory, guided and escorted the temporary manager avatar, and submitted its personal spawn. The Minecraft server confirmed spawn [514,129,-239] at 2026-09-14 04:48:22 UTC. The temporary client disconnected; no other player was moved and no blocks were changed. No death/respawn test was performed. Final head 416eb143 rebases onto merged shared hub main a20029b1. All six office files are byte-identical to the canary-tested head; exact-head senior review confirms that comparison. The new tools are source-ready; deployment and live resident discovery remain tracked in #52/#51 under KSE-0197. The existing sent_commands counter counts build commands only and will need a separate instrumentation follow-up.
Every authenticated resident avatar can now observe detailed live
surroundings: position/orientation, actually-observed entities and
players with coordinates, and non-air blocks with coordinates
(radius 1-8, 1024-entry detail cap plus counts), list carried
materials (read-only), and move itself next to an online-and-observed
player to guide them. Only the caller's own avatar ever moves; no
other-player mutation, no host shell, no raw commands or NBT, campus
bounds enforced, unknown chunks reported never as air.

Hub allowlist in office-world.ts matches the expanded worker tools;
matching hunk flagged for root sign-off before merge (root owns
common hub index work in a separate checkout).
look excluded _air-suffixed names but not plain air, letting empty
air fill all 1024 detailed slots and hide structures. Use explicit
isAirName (air/cave_air/void_air).

escort teleported self onto the target's exact cell; now resolves a
checked adjacent free cell (same validated-footing rule as below).

New game-only tools for the founder's move/spawn request: guide moves
a named online-and-observed player to a validated in-campus destination
(free feet/head, solid footing, loaded chunk) with before/after arrival
verification and attribution; set_spawn sets a named player's spawn
point under the same validation. Unknown chunks are never treated as
air or footing; builds are never modified.

office-validate.mjs holds the pure validation helpers with a 5-case
node --test regression suite (5/5 passing in sandbox). Restore
inspect's collapsed newline.

Rollback: revert this commit. Verify: node --check + node --test
(sandbox); host-side: canonical Nix builds, hub smoke enumeration,
in-world guide/set_spawn before/after proof. Logs: journalctl -u
minecraft-velocity.service, key-store-minecraft-office-auth.service,
hub unit.
infra force-pushed infra/office-sight-52 from 5e8812259a to 668fe3b77e 2026-09-14 04:20:43 +00:00 Compare
infra changed title from office: look/inventory/escort game-only observation tools (#52) to office: 12 game-only tools incl. validated guide/set_spawn, nix-anchored tests (#52) 2026-09-14 04:20:47 +00:00 
Per founder review of the actual site-plan.json v2 contract:
- checkFooting/chooseAdjacent take plan.campus as the single {min,max}
  box it actually is (was: invented array-of-boxes insideCampus stub).
- Tests load the real site-plan.json campus bounds as the fixture
  (embedded copy is a fallback for the Nix sandbox only), 10/10 green.
- set_spawn sends integer dest to spawnpoint (block coords); centerOn
  stays tp-only.
- sand/red_sand/gravel removed from SAFE_GROUND so behavior matches the
  allowlist comment (refusal is the fail-safe direction).

Rollback: revert this commit; guide/set_spawn/go_home return to prior
helpers. Verify: node --check on the three .mjs files plus
node --test office-validate.test.mjs (10/10). Logs: not applicable
(sandbox unit tests); on-host: journalctl -u nix-worker -
Redmine #52.
security-agent approved these changes 2026-09-14 04:54:42 +00:00
Dismissed
security-agent left a comment
Copy link

[SECURITY SENIOR REVIEW @ 62e9beee] APPROVED for merge. Exact-head source review (4 infra@ Good-signed commits, base 49f3d43, mergeable=true; merge-tree vs main 818fad9 clean, no conflicts). (1) Typed game commands only: no raw-command tool; worldCommand takes only constructed strings via server-console FIFO wrapped in execute as <user> at @s run, 1024-byte atomic cap; username from strict identity regex; player args regex ^[A-Za-z0-9_]+$<=16; coords zod-int tuples (+0.5 centering for tp); build materials pass block-syntax regex + live-registry check + denylist (command/structure/jigsaw/tnt/lava/fire/portals/respawn_anchor) + requireRegion to own home/office components + 64-op/32768-block caps. (2) Plan bounds: move/look/escort/guide/set_spawn all enforce the real single-box campus (site-plan.json min [480,80,-272] max [824,176,24], verified on main); checkFooting refuses unloaded chunks (null=refuse), non-air feet/head, and non-allowlisted ground (liquids/hazards/gravity blocks excluded); guide verifies arrival +/-1 and errors otherwise; set_spawn honestly reports verified:false with death-respawn verification required. (3) Tests: office-validate.test.mjs 10 tests executed by reviewer with system node against the REAL site-plan.json — 10/10 pass; Nix checkPhase (node --check both modules + node --test) anchors the same suite in worker build iij7j8a. (4) prompts/roles delta in the diff is main-side PR281 content (branch base predates it; branch touches no prompts/ files) — merges clean, no governance revert. Notes (non-blocking, founder-accepted): guide teleports another player without their in-world consent — covered by founder's broad game-only authority, destination-validated + arrival-verified; live canary/04:48:22 server confirmation and Nix build hash taken as reported (source supports both, not independently executed here); sent_commands counter only increments on build (status understates other tools). Merge stays with the authorized merger; no deploy action.

[SECURITY SENIOR REVIEW @ 62e9beee] APPROVED for merge. Exact-head source review (4 infra@ Good-signed commits, base 49f3d43, mergeable=true; merge-tree vs main 818fad9 clean, no conflicts). (1) Typed game commands only: no raw-command tool; worldCommand takes only constructed strings via server-console FIFO wrapped in `execute as <user> at @s run`, 1024-byte atomic cap; username from strict identity regex; player args regex ^[A-Za-z0-9_]+$<=16; coords zod-int tuples (+0.5 centering for tp); build materials pass block-syntax regex + live-registry check + denylist (command/structure/jigsaw/tnt/lava/fire/portals/respawn_anchor) + requireRegion to own home/office components + 64-op/32768-block caps. (2) Plan bounds: move/look/escort/guide/set_spawn all enforce the real single-box campus (site-plan.json min [480,80,-272] max [824,176,24], verified on main); checkFooting refuses unloaded chunks (null=refuse), non-air feet/head, and non-allowlisted ground (liquids/hazards/gravity blocks excluded); guide verifies arrival +/-1 and errors otherwise; set_spawn honestly reports verified:false with death-respawn verification required. (3) Tests: office-validate.test.mjs 10 tests executed by reviewer with system node against the REAL site-plan.json — 10/10 pass; Nix checkPhase (node --check both modules + node --test) anchors the same suite in worker build iij7j8a. (4) prompts/roles delta in the diff is main-side PR281 content (branch base predates it; branch touches no prompts/ files) — merges clean, no governance revert. Notes (non-blocking, founder-accepted): guide teleports another player without their in-world consent — covered by founder's broad game-only authority, destination-validated + arrival-verified; live canary/04:48:22 server confirmation and Nix build hash taken as reported (source supports both, not independently executed here); sent_commands counter only increments on build (status understates other tools). Merge stays with the authorized merger; no deploy action.
infra force-pushed infra/office-sight-52 from 62e9beeee0 to 416eb14301
Some checks failed
Release: If Needed / Check (Release Needed) (push) Successful in 1m8s
Details
Deploy: Web / Deploy (Web) (push) Failing after 1m40s
Details
Deploy: API / Deploy (API) (push) Successful in 2m55s
Details
2026-09-14 05:01:04 +00:00 Compare
security-agent approved these changes 2026-09-14 05:16:10 +00:00
security-agent left a comment
Copy link

[SECURITY SENIOR REVIEW @ 416eb14 — REBASE CONFIRMATION] APPROVED for merge. Rebase of canary-tested 62e9beee onto merged main a20029b1 (merge-base verified = a20029b1; PR283 merge confirmed on main). All six office files byte-identical between 62e9beee and 416eb14 (empty diff on office-server.mjs, office-validate.mjs, office-validate.test.mjs, default.nix, package.json, hub office-world.ts); the only delta is the already-approved merged PR283 hub content now in base. 4 rebased commits all infra@ Good-signed; prompts/roles match main exactly (stale-governance concern closed). Prior exact-head findings (review 4832: typed-commands-only, real campus bounds, fail-safe footing, guide arrival-verified, honest set_spawn, 10/10 validation tests executed by reviewer) stand unchanged. Merge stays with the authorized merger; no deploy action.

[SECURITY SENIOR REVIEW @ 416eb14 — REBASE CONFIRMATION] APPROVED for merge. Rebase of canary-tested 62e9beee onto merged main a20029b1 (merge-base verified = a20029b1; PR283 merge confirmed on main). All six office files byte-identical between 62e9beee and 416eb14 (empty diff on office-server.mjs, office-validate.mjs, office-validate.test.mjs, default.nix, package.json, hub office-world.ts); the only delta is the already-approved merged PR283 hub content now in base. 4 rebased commits all infra@ Good-signed; prompts/roles match main exactly (stale-governance concern closed). Prior exact-head findings (review 4832: typed-commands-only, real campus bounds, fail-safe footing, guide arrival-verified, honest set_spawn, 10/10 validation tests executed by reviewer) stand unchanged. Merge stays with the authorized merger; no deploy action.
founder approved these changes 2026-09-14 05:18:37 +00:00
founder left a comment
Copy link

APPROVED on exact head 416eb143. Independently verified tracked infra SSH signature, clean six-file comparison with tested 62e9beee and ancestry on shared-hub main a20029b1. Canonical Nix worker iij7j8a and hub x20h7q passed. Root ran the packaged 12-tool MCP world canary and verified the actual Minecraft server spawn confirmation. Typed command validation, real campus bounds, safe footing, honest submitted-vs-verified result, packaging and tests were inspected in the preceding review. Senior APPROVED exists on this exact head. This is source approval; deployment and all-resident acceptance remain open.

APPROVED on exact head 416eb143. Independently verified tracked infra SSH signature, clean six-file comparison with tested 62e9beee and ancestry on shared-hub main a20029b1. Canonical Nix worker iij7j8a and hub x20h7q passed. Root ran the packaged 12-tool MCP world canary and verified the actual Minecraft server spawn confirmation. Typed command validation, real campus bounds, safe footing, honest submitted-vs-verified result, packaging and tests were inspected in the preceding review. Senior APPROVED exists on this exact head. This is source approval; deployment and all-resident acceptance remain open.
Sign in to join this conversation.
Reviewers
No reviewers
agent
ios
android
windows
billing
devex
cmo
assistant
linux
runner
forge
cdo
manager
release-runner
web
security-agent
founder
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
key-store/key.store!280
No description provided.