feat(publisher): advertise access-token admission with Game v2

PROVENANCE.md

@@ -13,6 +13,18 @@ for the linked public issues. No historical MIT provenance grant is used.
 | `internal/observability` | `atrinik/server#21` and Go/OpenTelemetry/OpenMetrics public APIs | New implementation and synthetic bounded-input tests | Server maintainers |
 | `internal/publisher`, publisher configuration/lifecycle | `atrinik/server#68`, `atrinik/protocol@v1.3.0`, RFC 9421, and RFC 9530 | New Go HTTP/state scheduler implementation; protocol-owned MIT types, validators, and golden values | Server/protocol maintainers |
 
+The access-policy publication update derives from the protocol-owned MIT
+access-token and Game publisher v2 contracts at
+`atrinik/protocol@1584053ee5f5bb1d96b59ff85f4035579bc17617`.
+The certificate, body, digest and signature golden values in
+`internal/publisher/client_test.go` come from that revision's synthetic MIT
+`fixtures/metaserver-game-publisher-v2.json` (SHA-256
+`78eabb2287bd2f45e17e81c1eb071c807c2061687f93ca94ac03650df5f90a01`). Its configuration, scheduler,
+identity-boundary tests and synthetic cases are independently authored here;
+no Classic source, credentials, player state or generated bindings were copied.
+This metadata adapter does not implement future gameplay admission or token
+persistence.
+
 The metaserver publisher consumes only the released MIT protocol package; it
 does not copy or hand-edit generated bindings. Future gameplay bindings remain
 subject to the same pinned generator/drift contract.

README.md

@@ -87,6 +87,21 @@ DER certificate, and sends the protocol-owned one-request signed body. HTTP
 redirects are forbidden and ordinary Go HTTPS certificate verification remains
 mandatory.
 
+Admission metadata uses `-access-required` (default `false`) independently of
+`-server-public`. Public open servers need no code; public protected servers
+advertise that a code is required. Private servers stay out of public listings
+regardless of their admission policy. The obsolete `-password-required` flag is
+rejected. These flags describe the future gameplay admission policy: the M1
+foundation still has no gameplay listener, token administration, or private
+rendezvous consumer, and setting a flag does not implement those services.
+
+The publisher consumes the protocol-owned Game publisher v2 body and
+`accessRequired` field. This publisher advertises GP1 version 1.1; explicit
+older or future minor versions are rejected before publication. Publisher identity remains SHA-256 of the exact DER leaf
+certificate. The future QUIC transport's SPKI fingerprint is a distinct value;
+reissuing a certificate for the same key changes the publisher identity and must
+not silently rebind access routes.
+
 The non-secret publish sequence is durably reserved before every request in
 `state/metaserver/publish-sequence-v1.log`. Ambiguous attempts consume their
 sequence. A valid replay response raises the local high-water mark before one

cmd/atrinik-server/main_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -48,3 +49,40 @@ func TestCommandErrorsAreExplicit(t *testing.T) {
 		}
 	}
 }
+
+func TestAccessPolicyIsIndependentOfPublicationVisibility(t *testing.T) {
+	t.Parallel()
+	for _, public := range []bool{false, true} {
+		for _, required := range []bool{false, true} {
+			var output bytes.Buffer
+			args := []string{"config", "-server-public=" + strconv.FormatBool(public), "-access-required=" + strconv.FormatBool(required)}
+			if err := run(args, &output, &bytes.Buffer{}); err != nil {
+				t.Fatal(err)
+			}
+			var settings config.RedactedConfig
+			if err := json.Unmarshal(output.Bytes(), &settings); err != nil {
+				t.Fatal(err)
+			}
+			if settings.Publisher.Public != public || settings.Publisher.AccessRequired != required {
+				t.Fatal("configuration conflated visibility and admission policy")
+			}
+			if strings.Contains(output.String(), "password_required") || !strings.Contains(output.String(), "access_required") {
+				t.Fatal("configuration does not use the access-token policy field")
+			}
+			configuration := config.Default().Publisher
+			configuration.Public, configuration.AccessRequired = public, required
+			snapshot, err := configuredSnapshot(configuration)
+			if err != nil || snapshot.Public != public || snapshot.AccessRequired != required || snapshot.ProtocolMinor != 1 {
+				t.Fatal("publication snapshot lost admission policy")
+			}
+		}
+	}
+	for _, minor := range []string{"0", "2"} {
+		if err := run([]string{"config", "-publish-origin=https://publish.meta.atrinik.org", "-protocol-minor=" + minor}, &bytes.Buffer{}, &bytes.Buffer{}); err == nil {
+			t.Fatal("unsupported publisher protocol version was accepted")
+		}
+	}
+	if err := run([]string{"config", "-password-required=true"}, &bytes.Buffer{}, &bytes.Buffer{}); err == nil {
+		t.Fatal("obsolete shared-password flag was accepted")
+	}
+}

cmd/atrinik-server/publisher.go

@@ -10,7 +10,7 @@ import (
 	"log/slog"
 	"os"
 
-	metaserverv1 "github.com/atrinik/protocol/gen/go/atrinik/metaserver/v1"
+	metaserverv2 "github.com/atrinik/protocol/gen/go/atrinik/metaserver/v2"
 	"github.com/atrinik/server/internal/config"
 	"github.com/atrinik/server/internal/observability"
 	"github.com/atrinik/server/internal/publisher"
@@ -35,7 +35,7 @@ func configurePublisherFlags(flags *flag.FlagSet, configuration *config.Publishe
 	flags.StringVar(&configuration.ContentRevisionSHA256, "content-revision-sha256", configuration.ContentRevisionSHA256, "compiled-content revision digest")
 	flags.UintVar(&configuration.PlayersCapacity, "players-capacity", configuration.PlayersCapacity, "public player capacity")
 	flags.BoolVar(&configuration.Public, "server-public", configuration.Public, "publish this server in the public directory")
-	flags.BoolVar(&configuration.PasswordRequired, "password-required", configuration.PasswordRequired, "require independent game join authentication")
+	flags.BoolVar(&configuration.AccessRequired, "access-required", configuration.AccessRequired, "advertise required access-token admission (gameplay listener unavailable in M1)")
 	flags.StringVar(&configuration.DirectHostname, "direct-hostname", configuration.DirectHostname, "optional explicit public DNS fallback")
 	flags.UintVar(&configuration.DirectPort, "direct-port", configuration.DirectPort, "explicit public DNS fallback UDP port")
 	flags.DurationVar(&configuration.HeartbeatInterval, "publish-heartbeat", configuration.HeartbeatInterval, "slow liveness publication interval")
@@ -106,14 +106,14 @@ func configuredSnapshot(configuration config.PublisherConfig) (publisher.Snapsho
 		Name: configuration.Name, Description: configuration.Description,
 		ProtocolMinor: uint32(configuration.ProtocolMinor), ContentID: configuration.ContentID,
 		ContentRevisionSHA256: digest, PlayersCapacity: uint32(configuration.PlayersCapacity),
-		Status: metaserverv1.DirectoryServerStatus_DIRECTORY_SERVER_STATUS_ONLINE,
-		Public: configuration.Public, PasswordRequired: configuration.PasswordRequired,
+		Status: metaserverv2.DirectoryServerStatus_DIRECTORY_SERVER_STATUS_ONLINE,
+		Public: configuration.Public, AccessRequired: configuration.AccessRequired,
 	}
 	if configuration.Region != "" {
 		snapshot.Region = &configuration.Region
 	}
 	if configuration.DirectHostname != "" {
-		snapshot.Endpoint = &metaserverv1.DirectEndpoint{Hostname: configuration.DirectHostname, Port: uint32(configuration.DirectPort)}
+		snapshot.Endpoint = &metaserverv2.DirectEndpoint{Hostname: configuration.DirectHostname, Port: uint32(configuration.DirectPort)}
 	}
 	return snapshot, nil
 }

go.mod

@@ -3,7 +3,7 @@ module github.com/atrinik/server
 go 1.26.6
 
 require (
-	github.com/atrinik/protocol v1.5.5
+	github.com/atrinik/protocol v1.5.6-0.20261004163427-58ed75f13fab
 	go.opentelemetry.io/otel v1.46.0
 	go.opentelemetry.io/otel/trace v1.46.0
 	golang.org/x/sys v0.48.0
@@ -15,7 +15,7 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/metric v1.46.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )

go.sum

@@ -1,5 +1,5 @@
-github.com/atrinik/protocol v1.5.5 h1:QafJ5Gr8AqPEXNBbfh7yIC34Od5lNqv/5QL2HoJo9do=
-github.com/atrinik/protocol v1.5.5/go.mod h1:0dgwIP+jrzj0ciI5f17H8ErmfP6Rqqnbkkx8AyK+vNk=
+github.com/atrinik/protocol v1.5.6-0.20261004163427-58ed75f13fab h1:OoOggudXtgxbRcxJHFISj3Ehied/Ep5XQ28aYo3vBKo=
+github.com/atrinik/protocol v1.5.6-0.20261004163427-58ed75f13fab/go.mod h1:LF3GaBvSjd06G6yrXKhs4nDFU1ZwjjAT1Ut3FAbvt4M=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -21,11 +21,11 @@ go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu6
 go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

internal/config/config.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"
 
-	metaserverv1 "github.com/atrinik/protocol/gen/go/atrinik/metaserver/v1"
-	protocolmeta "github.com/atrinik/protocol/metaserver"
+	metaserverv2 "github.com/atrinik/protocol/gen/go/atrinik/metaserver/v2"
+	protocolmeta "github.com/atrinik/protocol/metaserver/v2"
 )
 
 const (
@@ -47,7 +47,7 @@ type PublisherConfig struct {
 	ContentRevisionSHA256 string        `json:"content_revision_sha256"`
 	PlayersCapacity       uint          `json:"players_capacity"`
 	Public                bool          `json:"public"`
-	PasswordRequired      bool          `json:"password_required"`
+	AccessRequired        bool          `json:"access_required"`
 	DirectHostname        string        `json:"direct_hostname"`
 	DirectPort            uint          `json:"direct_port"`
 	HeartbeatInterval     time.Duration `json:"heartbeat_interval"`
@@ -80,7 +80,7 @@ type RedactedPublisherConfig struct {
 	ContentRevisionSHA256 string `json:"content_revision_sha256"`
 	PlayersCapacity       uint   `json:"players_capacity"`
 	Public                bool   `json:"public"`
-	PasswordRequired      bool   `json:"password_required"`
+	AccessRequired        bool   `json:"access_required"`
 	DirectHostname        string `json:"direct_hostname"`
 	DirectPort            uint   `json:"direct_port"`
 	HeartbeatInterval     string `json:"heartbeat_interval"`
@@ -100,6 +100,7 @@ func Default() Config {
 			CertificatePath:       "identity/certificate.pem",
 			PrivateKeyPath:        "identity/private-key.pem",
 			Name:                  "Atrinik Server",
+			ProtocolMinor:         1,
 			ContentID:             "atrinik-main",
 			ContentRevisionSHA256: strings.Repeat("0", 64),
 			PlayersCapacity:       100,
@@ -158,7 +159,8 @@ func (configuration PublisherConfig) Validate() error {
 	if !safeRelativePath(configuration.CertificatePath) || !safeRelativePath(configuration.PrivateKeyPath) {
 		return errors.New("publisher identity paths must be relative without traversal")
 	}
-	if configuration.ProtocolMinor > 65_535 || configuration.PlayersCapacity < 1 || configuration.PlayersCapacity > protocolmeta.MaximumDirectoryPlayers ||
+	// This build advertises the current access-token negotiation only.
+	if configuration.ProtocolMinor != 1 || configuration.PlayersCapacity < 1 || configuration.PlayersCapacity > protocolmeta.MaximumDirectoryPlayers ||
 		configuration.HeartbeatInterval < time.Hour || configuration.HeartbeatInterval > maximumPublisherHeartbeatInterval ||
 		configuration.ChangeDebounce <= 0 || configuration.ChangeDebounce > time.Minute ||
 		(configuration.DirectHostname == "") != (configuration.DirectPort == 0) || configuration.DirectPort > 65_535 {
@@ -169,20 +171,20 @@ func (configuration PublisherConfig) Validate() error {
 		return errors.New("publisher content revision must be lowercase SHA-256")
 	}
 	serverID := make([]byte, 32)
-	server := &metaserverv1.DirectoryServer{
+	server := &metaserverv2.DirectoryServer{
 		ServerId: serverID, CertificateSha256: append([]byte(nil), serverID...),
 		Name: configuration.Name, Description: configuration.Description,
 		ProtocolMajor: 1, ProtocolMinor: uint32(configuration.ProtocolMinor),
 		ContentId: configuration.ContentID, ContentRevisionSha256: contentRevision,
-		PlayersCapacity:  uint32(configuration.PlayersCapacity),
-		Status:           metaserverv1.DirectoryServerStatus_DIRECTORY_SERVER_STATUS_ONLINE,
-		PasswordRequired: configuration.PasswordRequired,
+		PlayersCapacity: uint32(configuration.PlayersCapacity),
+		Status:          metaserverv2.DirectoryServerStatus_DIRECTORY_SERVER_STATUS_ONLINE,
+		AccessRequired:  configuration.AccessRequired,
 	}
 	if configuration.Region != "" {
 		server.Region = &configuration.Region
 	}
 	if configuration.DirectHostname != "" {
-		server.Endpoint = &metaserverv1.DirectEndpoint{Hostname: configuration.DirectHostname, Port: uint32(configuration.DirectPort)}
+		server.Endpoint = &metaserverv2.DirectEndpoint{Hostname: configuration.DirectHostname, Port: uint32(configuration.DirectPort)}
 	}
 	if !protocolmeta.DirectoryServerCompatible(server, 1, uint32(configuration.ProtocolMinor), configuration.ContentID, contentRevision) {
 		return errors.New("publisher directory metadata is invalid")
@@ -236,7 +238,7 @@ func (configuration PublisherConfig) Redacted() RedactedPublisherConfig {
 		ProtocolMinor: configuration.ProtocolMinor, ContentID: configuration.ContentID,
 		ContentRevisionSHA256: configuration.ContentRevisionSHA256,
 		PlayersCapacity:       configuration.PlayersCapacity, Public: configuration.Public,
-		PasswordRequired: configuration.PasswordRequired, DirectHostname: configuration.DirectHostname,
+		AccessRequired: configuration.AccessRequired, DirectHostname: configuration.DirectHostname,
 		DirectPort: configuration.DirectPort, HeartbeatInterval: configuration.HeartbeatInterval.String(),
 		ChangeDebounce: configuration.ChangeDebounce.String(),
 	}

internal/config/config_test.go

@@ -21,7 +21,7 @@ func TestRedactedNeverContainsToken(t *testing.T) {
 func TestPublisherConfigurationIsDisabledByDefaultAndStrictWhenEnabled(t *testing.T) {
 	t.Parallel()
 	configuration := Default()
-	if configuration.Publisher.Enabled() || configuration.Validate() != nil {
+	if configuration.Publisher.Enabled() || configuration.Publisher.ProtocolMinor != 1 || configuration.Validate() != nil {
 		t.Fatal("default publisher configuration is not safely disabled")
 	}
 	configuration.Publisher.Origin = "https://publish.meta.atrinik.org"
@@ -30,6 +30,8 @@ func TestPublisherConfigurationIsDisabledByDefaultAndStrictWhenEnabled(t *testin
 		t.Fatalf("valid publisher configuration failed: %v", err)
 	}
 	for _, mutate := range []func(*PublisherConfig){
+		func(value *PublisherConfig) { value.ProtocolMinor = 0 },
+		func(value *PublisherConfig) { value.ProtocolMinor = 2 },
 		func(value *PublisherConfig) { value.Origin = "http://publish.meta.atrinik.org" },
 		func(value *PublisherConfig) { value.Origin = "https://publish.meta.atrinik.org/path" },
 		func(value *PublisherConfig) { value.CertificatePath = "../certificate.pem" },

internal/publisher/client.go

@@ -19,8 +19,8 @@ import (
 	"strings"
 	"time"
 
-	metaserverv1 "github.com/atrinik/protocol/gen/go/atrinik/metaserver/v1"
-	protocolmeta "github.com/atrinik/protocol/metaserver"
+	metaserverv2 "github.com/atrinik/protocol/gen/go/atrinik/metaserver/v2"
+	protocolmeta "github.com/atrinik/protocol/metaserver/v2"
 )
 
 const (
@@ -47,10 +47,10 @@ type Snapshot struct {
 	ContentRevisionSHA256 [32]byte
 	PlayersOnline         uint32
 	PlayersCapacity       uint32
-	Status                metaserverv1.DirectoryServerStatus
+	Status                metaserverv2.DirectoryServerStatus
 	Public                bool
-	PasswordRequired      bool
-	Endpoint              *metaserverv1.DirectEndpoint
+	AccessRequired        bool
+	Endpoint              *metaserverv2.DirectEndpoint
 }
 
 // ResultKind is a closed scheduling decision. It contains no response data.
@@ -210,11 +210,15 @@ func (client *Client) buildRequest(ctx context.Context, snapshot Snapshot) (*htt
 }
 
 func (client *Client) bodyFor(snapshot Snapshot) ([]byte, error) {
+	// Metadata must not advertise historical or future negotiation for this build.
+	if snapshot.ProtocolMinor != 1 {
+		return nil, errors.New("publisher protocol version is unsupported")
+	}
 	serverID, err := hex.DecodeString(client.identity.serverID)
 	if err != nil {
 		return nil, errors.New("publisher identity is invalid")
 	}
-	server := &metaserverv1.DirectoryServer{
+	server := &metaserverv2.DirectoryServer{
 		ServerId:              serverID,
 		CertificateSha256:     append([]byte(nil), serverID...),
 		Name:                  snapshot.Name,
@@ -227,7 +231,7 @@ func (client *Client) bodyFor(snapshot Snapshot) ([]byte, error) {
 		PlayersOnline:         snapshot.PlayersOnline,
 		PlayersCapacity:       snapshot.PlayersCapacity,
 		Status:                snapshot.Status,
-		PasswordRequired:      snapshot.PasswordRequired,
+		AccessRequired:        snapshot.AccessRequired,
 		Endpoint:              cloneEndpoint(snapshot.Endpoint),
 	}
 	body, err := protocolmeta.MarshalGamePublishJSON(&protocolmeta.GamePublishRequest{
@@ -350,11 +354,11 @@ func cloneString(value *string) *string {
 	return &copy
 }
 
-func cloneEndpoint(value *metaserverv1.DirectEndpoint) *metaserverv1.DirectEndpoint {
+func cloneEndpoint(value *metaserverv2.DirectEndpoint) *metaserverv2.DirectEndpoint {
 	if value == nil {
 		return nil
 	}
-	return &metaserverv1.DirectEndpoint{Hostname: value.Hostname, Port: value.Port}
+	return &metaserverv2.DirectEndpoint{Hostname: value.Hostname, Port: value.Port}
 }
 
 func (kind ResultKind) String() string { return string(kind) }