Runic Sentinel 1.0.0

Runic Sentinel is a standalone BepInEx mod for bounded local plugin snapshots and signed policy review. It has no Runic Foundation runtime dependency. It hashes loaded plugin files on a background worker, canonicalizes the observations, and evaluates them against a strictly canonical RUNIC-SENTINEL/2 policy.

Policy verification uses RSA-3072 with SHA-256 and PKCS#1 v1.5. Sentinel loads only a verification public key:

RUNIC-RSA-PUBLIC/1
modulus=<canonical Base64 for exactly 384 bytes>
exponent=AQAB

The file ends in exactly one LF and its exact-byte SHA-256 must match Policy.TrustedPublicKeySha256. The detached signature is the canonical Base64 encoding of exactly 384 signature bytes followed by one LF. The private signer belongs in external Server Forge or an offline provisioning tool. Sentinel performs public verification only: no private key or shared signing secret is configured, read, retained, or distributed by this mod.

The signed policy has a fixed line order and signs the exact bytes, including the final LF:

RUNIC-SENTINEL/2
profile=2026.08.22
sequence=42
issued=1787356800
expires=0
unknown=Quarantined
rule=Required|example.mod|1.0.0|<64 lowercase hex or *>

Rules are ordered by plugin ID. A lower sequence, or a different payload at an already accepted sequence, is rejected for the process lifetime. Invalid, absent, expired, oversized, changed, unpinned, or incorrectly signed files leave Sentinel monitor-only.

Compatibility exchange

When enabled, Sentinel owns two namespaced Valheim routed RPCs. A client sends its aggregate snapshot digest, capture time, policy digest/sequence/profile, local disposition, exact Sentinel version, and a short-lived request ID. The server acts only after rebinding the routed sender ID to the exact current ready ZNetPeer. Messages are schema-bound, size-limited, exact-consumption decoded, and kept only in bounded memory. There is no durable journal, global lock, recovery state, or shared RPC framework.

This exchange occurs after Valheim has authenticated and connected the peer. It is honest compatibility evidence, not cryptographic proof that a full-trust client is clean. Only the server's signed policy is authenticated.

Remote Admission.Policy is sampled at startup:

• Optional records bounded mismatch evidence without disconnecting the peer. This is the safe first-run default.
• Required disconnects the exact authenticated peer when the client version, snapshot, signed policy, timestamp, or allow disposition does not match.
• Disabled creates no RPC handlers or remote-evidence lease.

Use the same signed policy and key pin on the server and clients before selecting Required.

Bounds and privacy

• At most 512 plugin descriptors, 512 MiB per unique DLL, and 4 GiB across unique DLL paths.
• Policy is capped at 1 MiB; public-key and signature files are capped at 1 KiB.
• Worker generations cancel superseded work, and stable reads reject concurrent file changes.
• Evidence has at most 32 local providers with eight entries each (256 total). One provider cannot evict another provider's allocation.
• Compatibility duplicate results are capped at 256 and expire after one minute. A client has one pending request, three attempts, and a six-second timeout.
• Evidence is process-memory only. Sentinel writes no world data and sends no telemetry.
• Enabled = false is startup-inert: no worker or network handlers are created.

Install Runic Sentinel and BepInEx on the machines where you want its policy behavior. No Runic Core, Persistence, Permissions, or Transactions DLL is required.

Changelog

1.2.0 - 2026-08-31

• Added a ConfigManager-style F3 administrator panel with signed mod lists, administrators, bans, admission policy, runtime integrity, and graduated enforcement controls.
• Added server-side backend-account authorization on every panel read and mutation; ordinary players receive no policy document and cannot invoke reports, maps, backups, or signing.
• Added one-time server-console bootstrap and a server-managed RSA-3072 key kept under the non-package server-private directory; the key is never returned to the client panel.
• Added panel actions for bounded support reports, administrator-only production/portal maps, and immediate verified Runic Safety world backups.
• Made the high/very-high escalation counts and rolling enforcement window effective server settings.
• Preserved Runic Sentinel as a standalone plugin: no Runic Core or Runic Persistence package, project, manifest, or assembly dependency. The F3 channel uses Valheim's routed networking and exact current Steam/PlayFab peer identity.

1.1.0 - 2026-08-31

• Kept the first-run Optional/monitor-only workflow usable when no signed passport exists yet; transition backup enforcement now fails closed only when Raven's Gate admission is Required.
• Added explicit player explanations for expired passports and protected transition-backup failures.
• Added a crash-surviving bounded security flight recorder with one 512 KiB current file and one 512 KiB previous file; recorder I/O is isolated from request blocking and gameplay.
• Hardened the standalone routed profile comparison and Required-mode disconnection behavior.
• Added signed v3 plugin lists, administrators, and banned identities.
• Added runtime integrity monitoring, automatic request enforcement, support reports, clear denial UI, offline Forge tooling, current-profile export, and verified transition backups.
• Added an authoritative-server-only, on-demand bounded portal and production topology snapshot.

1.0.0 - 2026-08-22

• Added a private bounded standalone compatibility exchange with explicit Disabled, Optional-default, and Required outcomes. Required enforces the server's verified signed policy digest/sequence/profile; all client snapshot/hash/disposition values remain explicitly self-reported compatibility evidence.

• Added timestamp freshness, bounded current-peer validation, and replay/equivocation/rollback detection without a remote-administration claim.

• Replaced the forgeable same-process HMAC design with strict RSA-3072/SHA-256 PKCS#1 v1.5 verification of exact RUNIC-SENTINEL/2 bytes. Sentinel loads only a public key whose exact canonical-file SHA-256 is pinned in configuration.

• Added strict public-key and signature-file canonicalization, policy sequence/issue/expiry fields, and in-process rollback/equivocation rejection.

• Kept attestation, admission, and evidence contracts private to Runic Sentinel and corrected the canonical capability from security.attestation to security.attest.

• Renamed the public nonce digest to an unauthenticated nonce binding and explicitly reports that it is neither client-authenticity proof nor an authoritative transport.

• Added exact local-lease evidence-provider registration, per-provider fair queues, immutable reads, requested/effective action, policy sequence, and saturating accepted/drop counters.

• Made worker publication generation-safe, cancellation-gated, platform-path-correct, and deduplicated so multiple plugin descriptors sharing one path hash that file only once.

• Made Enabled = false startup-inert: no worker, network handler, or service is created.

0.1.0

• Hardened plugin and signed-policy input reads against size-check/read races: hashing consumes the exact admitted length through one reusable bounded buffer, and policy/signature/key streams must remain byte-exact and metadata-stable through EOF before verification.

• Added bounded signed-policy parsing and HMAC-SHA256 verification with fail-closed monitor-only fallback.

• Added deterministic loaded-plugin attestation, fresh-nonce response, admission policy, and a 256-entry evidence ledger.

• Published security.attestation, security.admission, and security.evidence protocol 1.0 services.

• Deliberately deferred connection enforcement until an authenticated server/client transport exists.