S3-106: Verify untrusted input and release security

Parent and ownership

Parent epic: https://github.com/stacksjs/the-settlers-iii-remake/issues/16 Source owner: stacksjs/the-settlers-iii-remake. Master roadmap: https://github.com/stacksjs/the-settlers-iii-remake/issues/4.

Problem and observable result

Fuzz map, asset, save, and network inputs. Enforce bounded allocation and ownership. Verify provenance and secret-free release artifacts.

The current application is a browser prototype. Passing the Riverlands campaign does not establish original-game or native parity. This issue is complete only when its stated behavior has retained evidence.

Evidence and interfaces

Qualification consumes retained behavioral, visual, performance, security, installation, and distribution evidence. Compilation, uploads, or prototype victory alone do not prove completion.

https://github.com/stacksjs/the-settlers-iii-remake/blob/884406e97f912d18a50a33734b535a27dd25531d/docs/fidelity-audit.md

Pin the inspected revisions and fixture hashes in the implementation evidence. Original-game observations govern rules and timing. JSettlers is implementation evidence, not an authoritative balance specification. Unknown values remain explicitly unverified.

Acceptance criteria

Fuzz map, asset, save, and network inputs.
Enforce bounded allocation and ownership.
Verify provenance and secret-free release artifacts.
The visible result agrees with the underlying simulation or platform state, including failure paths.
Tests exercise the maintained public interface and retain reproducible fixtures or execution receipts.

Test matrix

Submit malformed and oversized fixtures.
Scan bundled files and rejected commands.
Exercise invalid input, cancellation or interruption, and repeated execution where this interface permits them.
Verify determinism/conservation for simulation changes and resource ownership/disposal for platform changes.
Run owning-repository lint, relevant type checks and tests. Capture actual native output for native capability claims.

Scope constraints

Implement this behavior as a complete verifiable slice. Do not silently expand into adjacent tickets or substitute simplified gameplay. Keep the shared TypeScript simulation, shared stx signals, and ts-css conventions. Native gameplay and HUD must not depend on a WebView. HomeOS reuse must not introduce a kernel dependency into the game. Existing unrelated edits and authored guidance must be preserved.

Blocked by

Upstream release and adoption

Application behavior belongs here. If a reproduction identifies a framework defect, repair and release its owning source first, update Stacks where affected, then install the verified packages here.

No node_modules edits, copied runtimes, generated-source string patches, fabricated globals, successful no-op implementations, or skipped release gates. Push tested conventional commits as Chris to the owning origin/main without coauthor trailers or force pushes.

Completion evidence

Implementation commits and relevant upstream issue links.
Exact checks and results, fixture hashes, and screenshots/native execution evidence where applicable.
Published package versions, downstream lockfile identity, and release receipts when affected.
Remaining limitations stated explicitly. Partial work does not close this issue.

Progress: untrusted input (still open)

Inputs now validated as untrusted: saves (every field bounded, references resolved, checksum verified, prototype and newer formats refused), commands (shape, size, tick, sequence and ownership), missions (fixed vocabulary, cycle and depth limits, no code), original maps (size, part and dimension limits before allocation), and converted map assets in the browser. Fuzzing and release-security work remain.

Evidence base for this update (all on main, authored as Chris):

3ca4847 deterministic session, rules profile, routing, goods, carriers, construction, production, territory, visibility, saves and replays
da2a104 reference building geometry and the delivery livelock fix
b2efc1f the browser game on the engine, expanded original-media import
7b1cc36 worlds from decoded original maps
a495e7a, 0a3ff46, 0e7889e, e5c1a53, f3b71ce, ed1dc8f controls, missions, render scene, save migration, checkpoints, audit and statistics

Checks: ./buddy lint (0 problems), bun run typecheck (app, tools, stx), ./buddy test --unit (106 tests, 0 failures), bun run assets:verify, bun run content:verify, and the production browser scenario. CI passed on 0e7889e and 9e2ba7c (which contains f3b71ce), including the production Chrome check.

Rule values are the roman-engineering 0.2.0 profile (resources/game/engine/rules.ts). Every value names its evidence class: manual candidates (M) from the pinned manual, reference-remake geometry (E), or placeholders (U) that name their owning issue. qualificationGaps() lists them and the profile cannot qualify a release. Adopting observed original values remains with S3-002/S3-007; nothing here is an original-executable observation.