Runic Sentinel 1.2.0

Runic Sentinel is a standalone Raven's Gate security plugin for the Runic Mod Suite. It uses an administrator-friendly rules file with required/whitelisted, optional, gray-list, and forbidden mods; signed administrators; and banned platform identities. An authenticated F3 panel manages and signs that canonical RUNIC-SENTINEL/3 passport on the authoritative server.

Runic Sentinel does not require Runic Core or Runic Persistence. Its compatibility exchange, administrator channel, replay bounds, and Steam/PlayFab identity binding are implemented inside Runic Sentinel over Valheim's own routed networking.

The external Forge remains available for offline verification and offline-key deployments; it is not required for the server-managed F3 workflow and is not installed into BepInEx.

What Raven's Gate enforces

• Plugin ID, version, and SHA-256 rules from the signed passport.
• Deny-by-default unknown plugins when unknownMods is Forbidden.
• Signed administrator and banned-user lists bound to authenticated platform identity, not a changeable character name.
• A bounded standalone compatibility exchange after Valheim establishes the routed peer; Required mode disconnects peers whose reported signed profile does not match.
• Server request blocking, bounded evidence, and graduated disconnects for repeated high-confidence or conclusive violations.
• Low-frequency runtime detection when a loaded plugin DLL or active passport asset changes.
• A verified Runic Safety world backup before a server loads an existing world under a different signed policy or plugin snapshot.
• Clear client denial explanations, a bounded persistent security flight recorder, and a bounded support report.

A client controls its own process and can falsify self-reported file evidence. The signed server policy is authentic; a client's DLL claim is compatibility evidence, not unforgeable proof. The authoritative protection is that consequential Runic requests are revalidated by the server against transport identity, permissions, bounds, replay state, and durable transaction rules.

Runtime enforcement coverage

• Sentinel rejects malformed, stale, oversized, replay-conflicting, and profile-incompatible standalone compatibility requests and applies Required-mode disconnection when appropriate.
• Runic Portals keeps its feature-owned server checks for exact peer identity, group authority, ward access, source distance, endpoint revision, and destination permission. Malformed envelopes, unbound identities, and conflicting request replays are additionally reported to Sentinel after they have already been rejected.
• Production, Crafting, Agriculture, Storage, Inventory, Interaction, Safety, and precision-building mutations do not expose a general client-to-server command channel: their changes retain native local ZDO ownership, range, ward, inventory, or transaction checks. Sentinel admission still requires their exact configured plugin hashes.
• Awareness, Exploration, Build Camera, Velocity, and the observatory portion of World Engine are client-local or read-only and do not create a server gameplay mutation request to authorize.

Ordinary gameplay mistakes—such as lacking a ward permission—are denied but are not treated as cheating. Automatic disconnection is reserved for repeated high-confidence protocol violations or conclusive evidence.

Administrator setup

1. Start the authoritative host/server once in Optional mode and wait for Sentinel's profile snapshot to become ready.

2. At the authoritative server console, initialize the server-managed RSA-3072 key and first signed administrator exactly once:

   runic_sentinel bootstrap steam <your SteamID64>

3. Join using that authenticated Steam account and press F3. Only identities in the active signed administrator list can open the panel. Every panel request is independently re-authorized by the server; a character name is never accepted as administrator identity.

4. Use the panel to manage required/optional/gray/forbidden mods, administrators, banned users, admission mode, runtime checks, graduated disconnection thresholds, transition backups, support reports, and administrator-only production/portal network snapshots.

5. Select Apply & Sign Policy. The server validates all fields, creates a verified world backup when a world is loaded, generates the next sequence and issue time, signs with its private key, archives the prior public policy assets, and reloads the verified policy.

6. Distribute only RunicSentinel.policy, RunicSentinel.policy.sig, and RunicSentinel.policy.pub to clients before their next Required-mode admission. Never distribute BepInEx/config/RunicSentinel/server-private/RunicSentinel.private.key.

7. Verify independently with the optional external Forge if desired:

   RunicSentinel.Forge verify <policy> <signature> <public-key> <public-key-pin>
   

8. Confirm runic_sentinel status, then use Required admission for the group.

Every intentional policy update must increase sequence. A lower sequence or different signed payload at an already accepted sequence is rejected for that process lifetime.

Lists and meaning

• requiredMods: must be present and match version/hash.
• optionalMods: may be absent; if present, version/hash must match.
• grayListMods: explicitly known and allowed, while remaining named policy evidence.
• forbiddenMods: denied when present.
• unknownMods: normally Forbidden; Unmanaged permits unknown entries and is not recommended for Raven's Gate.
• administrators and bannedUsers: { "authority": "steam", "subject": "<SteamID64>" } or another transport authority/subject pair supported by Sentinel's Valheim transport binding.

Commands

• runic_sentinel status shows integrity, policy profile/sequence, admission transport, and the last bounded denial code.
• runic_sentinel report writes a maximum 512 KiB report under BepInEx/config/RunicSentinel/reports. Reports include plugin IDs/versions/hashes, Runic integrity and bounded evidence. They omit paths, passwords, tokens, private keys, and raw chat.
• Accepted security evidence is also written automatically under BepInEx/config/RunicSentinel/flight-recorder. The recorder keeps only a 512 KiB current file and one 512 KiB previous file. An audit-write failure is logged once and never disables request blocking or interrupts gameplay.
• runic_sentinel networks is accepted only by the authoritative server/host console. It writes a bounded point-in-time topology snapshot of loaded Runic portal endpoints and production links; it is not a continuously running overlay and is never broadcast to ordinary clients.

Performance and bounds

• DLL hashing runs on a background worker at startup or explicit refresh, not every frame.
• Runtime integrity checks compare stable file metadata every 5–300 seconds (15 by default).
• Compatibility evaluation runs at connection startup and then only at a low-frequency refresh.
• Evidence is fixed at 32 providers with eight entries each (256 total).
• Persistent flight-recorder storage is capped at two 512 KiB files.
• Policy is capped at 1 MiB; at most 512 plugins are observed; each DLL is capped at 512 MiB and total unique DLL input is capped at 4 GiB.
• No continuous chest, production, portal, player, or world-object scan is performed. The administrator topology command scans at most 16,384 already-loaded ZDOs only when requested.

Runic Sentinel 1.2.0 requires Runic Safety 1.0.0 for verified transition backups. It has no Runic Core or Runic Persistence dependency. In the F3 workflow the private RSA-3072 key is server-managed and never sent through the panel or network. Offline-key operators may continue using the separate Forge workflow instead.

Changelog

1.2.0 - 2026-08-31

• Added a ConfigManager-style F3 administrator panel with signed mod lists, administrators, bans, admission policy, runtime integrity, and graduated enforcement controls.
• Added server-side backend-account authorization on every panel read and mutation; ordinary players receive no policy document and cannot invoke reports, maps, backups, or signing.
• Added one-time server-console bootstrap and a server-managed RSA-3072 key kept under the non-package server-private directory; the key is never returned to the client panel.
• Added panel actions for bounded support reports, administrator-only production/portal maps, and immediate verified Runic Safety world backups.
• Made the high/very-high escalation counts and rolling enforcement window effective server settings.
• Preserved Runic Sentinel as a standalone plugin: no Runic Core or Runic Persistence package, project, manifest, or assembly dependency. The F3 channel uses Valheim's routed networking and exact current Steam/PlayFab peer identity.

1.1.0 - 2026-08-31

• Kept the first-run Optional/monitor-only workflow usable when no signed passport exists yet; transition backup enforcement now fails closed only when Raven's Gate admission is Required.
• Added explicit player explanations for expired passports and protected transition-backup failures.
• Added a crash-surviving bounded security flight recorder with one 512 KiB current file and one 512 KiB previous file; recorder I/O is isolated from request blocking and gameplay.
• Hardened the standalone routed profile comparison and Required-mode disconnection behavior.
• Added signed v3 plugin lists, administrators, and banned identities.
• Added runtime integrity monitoring, automatic request enforcement, support reports, clear denial UI, offline Forge tooling, current-profile export, and verified transition backups.
• Added an authoritative-server-only, on-demand bounded portal and production topology snapshot.

1.0.0 - 2026-08-22

• Added a private bounded standalone compatibility exchange with explicit Disabled, Optional-default, and Required outcomes. Required enforces the server's verified signed policy digest/sequence/profile; all client snapshot/hash/disposition values remain explicitly self-reported compatibility evidence.

• Added timestamp freshness, bounded current-peer validation, and replay/equivocation/rollback detection without a remote-administration claim.

• Replaced the forgeable same-process HMAC design with strict RSA-3072/SHA-256 PKCS#1 v1.5 verification of exact RUNIC-SENTINEL/2 bytes. Sentinel loads only a public key whose exact canonical-file SHA-256 is pinned in configuration.

• Added strict public-key and signature-file canonicalization, policy sequence/issue/expiry fields, and in-process rollback/equivocation rejection.

• Kept attestation, admission, and evidence contracts private to Runic Sentinel and corrected the canonical capability from security.attestation to security.attest.

• Renamed the public nonce digest to an unauthenticated nonce binding and explicitly reports that it is neither client-authenticity proof nor an authoritative transport.

• Added exact local-lease evidence-provider registration, per-provider fair queues, immutable reads, requested/effective action, policy sequence, and saturating accepted/drop counters.

• Made worker publication generation-safe, cancellation-gated, platform-path-correct, and deduplicated so multiple plugin descriptors sharing one path hash that file only once.

• Made Enabled = false startup-inert: no worker, network handler, or service is created.

0.1.0

• Hardened plugin and signed-policy input reads against size-check/read races: hashing consumes the exact admitted length through one reusable bounded buffer, and policy/signature/key streams must remain byte-exact and metadata-stable through EOF before verification.

• Added bounded signed-policy parsing and HMAC-SHA256 verification with fail-closed monitor-only fallback.

• Added deterministic loaded-plugin attestation, fresh-nonce response, admission policy, and a 256-entry evidence ledger.

• Published security.attestation, security.admission, and security.evidence protocol 1.0 services.

• Deliberately deferred connection enforcement until an authenticated server/client transport exists.