Sign up
View stargazersSign up
Commits

RELEASE-READINESS.md

Standalone source preview — 2026-10-27

Destination: https://git.cafe/rs-sdk/palanti-rs-sdk

This is a reviewable source preview, not a claim of complete gameplay or agent-provider acceptance. No account sessions, missions or external-agent tasks were executed while preparing it.

Completed

  • Explicit source export without private Git history, credentials, runtime databases, roster imports, conversations, grants, logs or personal report payloads. EXPORT-MANIFEST.json records source/output hashes.
  • Independent pnpm installation; Playwright is now declared directly rather than accidentally inherited from a parent repository.
  • Fresh pinned viewer clone/patch/build, cache download and atlas generation.
  • Screenshot-led README with twelve actual application captures, Max Bittker/upstream credits and the copied Dithercn MIT notice. Generated MCP configuration was verified from a foreign working directory against a non-default localhost port (72 tools listed; read-only world status succeeded).
  • Standalone local-project Settings with username-only discovery, API/CLI/MCP setup and explicit connection preview. No external roster connector is bundled.
  • Latest source-preview check on 2026-10-27: TypeScript, 654 application tests and the frontend build passed (zero failures). Worker/confinement tests now wait for readiness with integration-appropriate budgets and cleanup; production security policies are unchanged. Three optional upstream source-comparison tests are skipped when RS_SDK_ROOT is absent. With it explicitly set to the compatible source checkout, all 18 location/layout/multi-combat tests passed, including the three source comparisons.
  • 84 Python market tests passed. A private historical-report dependency was replaced by synthetic mixed-price/thin-liquidity regression evidence.
  • Follow-up TypeScript and 12 routes/identity tests passed after the standalone ownership root correction.
  • Export scan with Gitleaks found no leaks. One specific non-credential normalization expression is allowlisted in .gitleaks.toml; all other default rules remain enabled. A secret scan is not proof of asset redistribution rights or complete security certification.
  • Read-only independent packaging review found and prompted the ownership-root correction. The optional monorepo MCP check now requires an explicit source root.
  • Existing localhost UI fixes: friendly players rank first in monitor pickers; hotspot/player popovers respect viewport collision space. Rightmost three-column tile and 390px phone viewport were checked.

Before a stable release

  • Security follow-up: the mediated workspace credential-file exclusion was corrected with one shared broker/test-sandbox policy; older certificates require recertification. Focused tests use synthetic credentials only. The static audit covered 66 of the original 456 files completely, with targeted searches/mapping elsewhere; it is not complete security certification.

  • Compatible overrides update transitive undici to 7.30.1 and fast-uri to 3.1.9. Registry advisory count dropped from 13 to 1. The remaining high advisory GHSA-mrhx-c7xc-m3w5 is Zod 3.22.3 via @whop/react → @whop/iframe 0.0.6. The registry still lists that dependency in the latest package. Do not force a Zod major upgrade or suppress the alert; resolve with a compatible upstream change or reviewed patch before claiming a clean audit. Runtime exploitability has not been demonstrated. The separate viewer dependency tree remains outside this advisory result.

  • Complete the dependency/asset distribution review described in THIRD-PARTY-NOTICES.md. Game cache downloads and game image rights remain separate from the app source license. Retain upstream attribution.

  • Establish the private security-reporting channel and a supported-platform matrix.

  • Community onboarding, the offline doctor and read-only source drift workflow are available. Broader clean-install browser journey automation and a graphical onboarding wizard remain future work.

  • Complete selected real provider/gameplay pilots before removing experimental labels. In particular, do not claim Tincan cancellation, remote scoped coding or live gameplay parity from simulator tests.

  • Review retained engineering documents for historical monorepo report links and older implementation descriptions. README governs standalone setup.

Data and development

Keep one canonical app source after the import is accepted. Personal installations retain ignored local configuration/state. Do not share a writable database between instances or copy a live WAL database casually. No migration of the original private installation was performed.

Optional source parity: RS_SDK_ROOT=/path/to/compatible/rs-sdk bun test server/locations.test.ts scripts/monitor-arrangement.test.ts scripts/multi-combat.test.ts.

Do not include generated dependencies, vendor checkout, cache, build output or QA runtime data when publishing source. Build those locally from the documented pinned inputs.