Runic Sentinel 1.2.0

Runic Sentinel is a standalone Raven's Gate security plugin for the Runic Mod Suite. It uses an administrator-friendly rules file with required/whitelisted, optional, gray-list, and forbidden mods; signed administrators; and banned platform identities. An authenticated F3 panel manages and signs that canonical RUNIC-SENTINEL/3 passport on the authoritative server.

Runic Sentinel does not require Runic Core or Runic Persistence. Its compatibility exchange, administrator channel, replay bounds, and Steam/PlayFab identity binding are implemented inside Runic Sentinel over Valheim's own routed networking.

The external Forge remains available for offline verification and offline-key deployments; it is not required for the server-managed F3 workflow and is not installed into BepInEx.

What Raven's Gate enforces

• Plugin ID, version, and SHA-256 rules from the signed passport.
• Deny-by-default unknown plugins when unknownMods is Forbidden.
• Signed administrator and banned-user lists bound to authenticated platform identity, not a changeable character name.
• A bounded standalone compatibility exchange after Valheim establishes the routed peer; Required mode disconnects peers whose reported signed profile does not match.
• Server request blocking, bounded evidence, and graduated disconnects for repeated high-confidence or conclusive violations.
• Low-frequency runtime detection when a loaded plugin DLL or active passport asset changes.
• A verified Runic Safety world backup before a server loads an existing world under a different signed policy or plugin snapshot.
• Clear client denial explanations, a bounded persistent security flight recorder, and a bounded support report.

A client controls its own process and can falsify self-reported file evidence. The signed server policy is authentic; a client's DLL claim is compatibility evidence, not unforgeable proof. The authoritative protection is that consequential Runic requests are revalidated by the server against transport identity, permissions, bounds, replay state, and durable transaction rules.

Runtime enforcement coverage

• Sentinel rejects malformed, stale, oversized, replay-conflicting, and profile-incompatible standalone compatibility requests and applies Required-mode disconnection when appropriate.
• Runic Portals keeps its feature-owned server checks for exact peer identity, group authority, ward access, source distance, endpoint revision, and destination permission. Malformed envelopes, unbound identities, and conflicting request replays are additionally reported to Sentinel after they have already been rejected.
• Production, Crafting, Agriculture, Storage, Inventory, Interaction, Safety, and precision-building mutations do not expose a general client-to-server command channel: their changes retain native local ZDO ownership, range, ward, inventory, or transaction checks. Sentinel admission still requires their exact configured plugin hashes.
• Awareness, Exploration, Build Camera, Velocity, and the observatory portion of World Engine are client-local or read-only and do not create a server gameplay mutation request to authorize.

Ordinary gameplay mistakes—such as lacking a ward permission—are denied but are not treated as cheating. Automatic disconnection is reserved for repeated high-confidence protocol violations or conclusive evidence.

Administrator setup

1. Start the authoritative host/server once in Optional mode and wait for Sentinel's profile snapshot to become ready.

2. At the authoritative server console, initialize the server-managed RSA-3072 key and first signed administrator exactly once:

   runic_sentinel bootstrap steam <your SteamID64>

3. Join using that authenticated Steam account and press F3. Only identities in the active signed administrator list can open the panel. Every panel request is independently re-authorized by the server; a character name is never accepted as administrator identity.

4. Use the panel to manage required/optional/gray/forbidden mods, administrators, banned users, admission mode, runtime checks, graduated disconnection thresholds, transition backups, support reports, and administrator-only production/portal network snapshots.

5. Select Apply & Sign Policy. The server validates all fields, creates a verified world backup when a world is loaded, generates the next sequence and issue time, signs with its private key, archives the prior public policy assets, and reloads the verified policy.

6. Distribute only RunicSentinel.policy, RunicSentinel.policy.sig, and RunicSentinel.policy.pub to clients before their next Required-mode admission. Never distribute BepInEx/config/RunicSentinel/server-private/RunicSentinel.private.key.

7. Verify independently with the optional external Forge if desired:

   RunicSentinel.Forge verify <policy> <signature> <public-key> <public-key-pin>
   

8. Confirm runic_sentinel status, then use Required admission for the group.

Every intentional policy update must increase sequence. A lower sequence or different signed payload at an already accepted sequence is rejected for that process lifetime.

Lists and meaning

• requiredMods: must be present and match version/hash.
• optionalMods: may be absent; if present, version/hash must match.
• grayListMods: explicitly known and allowed, while remaining named policy evidence.
• forbiddenMods: denied when present.
• unknownMods: normally Forbidden; Unmanaged permits unknown entries and is not recommended for Raven's Gate.
• administrators and bannedUsers: { "authority": "steam", "subject": "<SteamID64>" } or another transport authority/subject pair supported by Sentinel's Valheim transport binding.

Commands

• runic_sentinel status shows integrity, policy profile/sequence, admission transport, and the last bounded denial code.
• runic_sentinel report writes a maximum 512 KiB report under BepInEx/config/RunicSentinel/reports. Reports include plugin IDs/versions/hashes, Runic integrity and bounded evidence. They omit paths, passwords, tokens, private keys, and raw chat.
• Accepted security evidence is also written automatically under BepInEx/config/RunicSentinel/flight-recorder. The recorder keeps only a 512 KiB current file and one 512 KiB previous file. An audit-write failure is logged once and never disables request blocking or interrupts gameplay.
• runic_sentinel networks is accepted only by the authoritative server/host console. It writes a bounded point-in-time topology snapshot of loaded Runic portal endpoints and production links; it is not a continuously running overlay and is never broadcast to ordinary clients.

Performance and bounds

• DLL hashing runs on a background worker at startup or explicit refresh, not every frame.
• Runtime integrity checks compare stable file metadata every 5–300 seconds (15 by default).
• Compatibility evaluation runs at connection startup and then only at a low-frequency refresh.
• Evidence is fixed at 32 providers with eight entries each (256 total).
• Persistent flight-recorder storage is capped at two 512 KiB files.
• Policy is capped at 1 MiB; at most 512 plugins are observed; each DLL is capped at 512 MiB and total unique DLL input is capped at 4 GiB.
• No continuous chest, production, portal, player, or world-object scan is performed. The administrator topology command scans at most 16,384 already-loaded ZDOs only when requested.

Runic Sentinel 1.2.0 requires Runic Safety 1.0.0 for verified transition backups. It has no Runic Core or Runic Persistence dependency. In the F3 workflow the private RSA-3072 key is server-managed and never sent through the panel or network. Offline-key operators may continue using the separate Forge workflow instead.