Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

The system in SysML

Blocks

BlockResponsibilityConstraint
Installerthe Windows GUI: nine pages, one worker thread, the install engine.exe under 700 kB; no tokio, reqwest, rustls, hyper or GUI crate; only DLLs Windows ships
Package Servercatalogue, auth, downloads, conflict reports, the admin CLIone static binary; TLS is the reverse proxy’s job
Shared Protocolthe wire types both sides compile againstserde only: no I/O, no async, no HTTP
Package Cataloguezips, sidecars, schemas, the generated manifest, the MOTD, reportsone folder per game under --data
Auth Databasekeys and their grantslibSQL; raw keys are never stored
Game Installationthe game folder a run targetsthe only place anything is written

The composition is deliberate: shared/ is the only code the two binaries have in common, and it holds no behaviour that could grow a runtime the installer cannot afford.

Deployment and interfaces

FromToCarries
PlayerInstallerchoices; the one thing it sends anywhere is an anonymous conflict report
InstallerCaddyHTTPS: GET /packages, /download/..., /motd, /whoami; POST /report/conflict
CaddyServerplain HTTP on :8080; TLS ends at the proxy
ServerCataloguemanifest.json and the zip streams
ServerAuth DBSELECT ... FROM tokens LEFT JOIN grants
InstallerGame Installationthe extracted overlay, and the cache, ledger, restore points and logs in .pacenotes
OperatorCatalogue, Auth DBcopy a zip and sidecar, manifest gen; token mint, grant, revoke

The installer’s HTTPS is WinHTTP, so the TLS handshake is Schannel’s: that is why the binary ships no TLS crate, and why the server can speak plain HTTP behind the proxy. Redirects are followed by the installer itself, never by WinHTTP, so the access key never leaves the origin it was meant for.

Requirements

IdRequirementSatisfied byVerified by
R-SIZEthe .exe stays under 700 kB and imports only DLLs Windows shipsInstallerinstaller/tests/Test-BinarySize.ps1
R-TLSHTTPS through WinHTTP and Schannel; no TLS, async or GUI crateInstaller / httpinstaller/tests/Test-PublicEndpoint.ps1
R-REDIRECTredirects followed by the installer; the key never leaves its originInstaller / httpinstaller/tests/Test-Redirects.ps1
R-OVERLAYa package is a game-root overlay; its content is never interpretedInstaller / engineinstaller/tests/applying_a_selection.rs
R-LOCALnothing is written outside the game folderInstaller / cache + ledgerinstaller/src/cache/tests.rs, installer/src/ledger/tests.rs
R-OFFLINEinstall and restore work from the cacheInstaller / engine + restoreinstaller/tests/restoring_a_game_folder.rs
R-SCHEMAan unknown schema hash blocks downloading for that game onlyInstaller / schemainstaller/src/schema/tests.rs
R-AUTHbearer keys stored as sha256, grants per directory, no tiersServer / auththe decide table in server/src/auth/access_decision.rs
R-ENUMstatuses never enumerate; there is no 403Server / routesserver/tests/access_matrix.rs
R-PATHURL parts are lookup keys, never pathsServer / storeserver/tests/package_download.rs
R-PUREthe manifest is a pure function of zips, sidecars and schemasServer / storeserver/tests/publishing.rs
R-REPORTreports are unauthenticated, capped, validated and rate limitedServer / reportsserver/tests/conflict_reports.rs