id: investigate: match audit — netcode log format, replay validation, and cheating signals

LIST 10b. The full netcode-level log (every key up/down, low-level state-machine detail) can be recorded for a game and sent to an AUDITOR who replays it: is it a valid set of operations, would the game even technically play that way, are there signs of cheating? Investigate: log format and size, deterministic replay requirements, and the metadata competitive play needs (ping, known IP, …) to distinguish technically-valid state machines from actually-valid gameplay (speedrunning, competitive FPS). Deliverable: audit pipeline sketch + metadata list.

Program: Drew's 2026-10-28 directive (full text: hatch-personal memory/topics/id-program-2026-10-28.md).
Working pattern: parallel investigations, then the named synthesis issue merges them into a full design. Route guidance: Workhorse by default; Specialist/Summit for synthesis and ramification-heavy work. A result that says "done" is not the endpoint — the orchestrator reviews it and may commission another round. Deliverables: a markdown design/investigation doc (mermaid/SVG diagrams welcome) linked from this issue, plus follow-up issues for anything buildable. Build a proof of concept where the design calls for one, but do NOT build the permanent feature on top of an unreviewed PoC.

CODE-959

Parent epic: #2056 — ID platform expansion (2026-10-28 directive).

Top priority — ID program wave-1. Drew directed this be picked up in the next runs (2026-10-29): enqueued directly as triage task 3351 in repo-health-code-pilot at queue priority 20 (only breakage-class work at priority 10 outranks it). Wave-1 is the ungated investigations and designs; syntheses and PoCs stay gated on their named inputs. Investigation route: Workhorse.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), Lane D shift
Session / ID: queue task 3351
Found via: queue claim
Task: Triage/investigation for id: investigate: match audit — netcode log format, replay validation, and cheating signals #2038 — match audit: netcode log format, replay validation, cheating signals. Produce the investigation doc (doc/ per repo convention, via PR), record the result on this issue, and route follow-on work in the same pass.
Expectation: effort class m — "done" = investigation doc PR opened + summary comment here + follow-on routed (gated synthesis stays gated on its named inputs).
Links: queue task 3351 (developing-today/code)

Investigation result — match audit (queue task 3351)

Deliverable: PR #2252 — doc/2026-10-29T10-54-33Z_investigation_match_audit_netcode_replay/ (386 lines). Mirror: ~/workspace/id-program-2026-10-28/investigations/match-audit.md.

Headline verdict: replay audit fits ID well — worlds are already journaled, sandboxed Roc/Wasm programs, and src/world/clock.rs is exactly the seam a log-driven replay mode needs — but replay proves only the weakest claim people want from it:

Authenticity + "the result follows from these inputs" — provable, if the log is hash-chained/signed with program+rules pinned by hash (§2), and if the world program is deterministic under replay (§3). Determinism is a property to engineer and test, not one we have by default; the float-discipline question is the hard open problem.
"A human played this fairly" — never provable by replay: a bot/TAS/spliced log can be technically valid. That claim needs observed metadata — countersigned by a peer/relay/witness, never self-reported — plus statistical screening, and even then the honest verdict is flagged / not flagged, never "proven fair".

Also delivered in the doc:

Log format: header / tick-indexed inputs / events / per-second checkpoint hashes + sparse snapshots / signed footer; result is a claim inside the log. Size is a non-issue: turn-based KBs; a 5v5 45-min FPS match ≈ 2–5 MB compressed.
Metadata list (§4.1): observed IP (salted hash in the public log, full IP only in an auditor-sealed section), RTT samples over the match, connection path, clock skew, join/leave/reconnect events, device/build context, stakes profile.
Cheating signals (§4.2): superhuman reaction distributions, frame-perfect TAS sequences, inputs reacting to events before the observed RTT could deliver them, entropy collapse, splice attempts (those are L1 cryptographic failures, not flags).
Audit pipeline (§5): L0 provenance → L1 integrity → L2 deterministic replay → L3 plausibility screen, tiered by stakes, closed verdict vocabulary (INVALID RECORD / REPLAY DIVERGES at tick T / TECHNICALLY VALID, FLAGGED / TECHNICALLY VALID, NO FLAGS at depth D / INCONCLUSIVE), handing off to the attestation flow — the auditor decides nothing about prizes or bans.
Offline matches honestly scoped: L1/L2 still work; L3 is permanently INCONCLUSIVE — no observed metadata there, and id: design: match attestation + audit v1 #2039 must price that.

Follow-on routing: synthesis #2039 is the named consumer (noted there); it stays gated on sibling investigation #2037. The four proposed buildable slices (determinism proof first — it gates everything) are in doc §6 for #2039 to adopt or cut; deliberately not pre-filed as separate issues so the synthesis owns the set. Nothing here is a permanent feature or a PoC built upon.

🤖 Agent note · done (pending PR #2252 merge)

Agent: queue worker (repo-worker-code), Lane D shift
Session / ID: queue task 3351
Found via: queue claim
Task: triage/investigation for this issue — delivered as PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 + this summary; follow-on routed to gated synthesis id: design: match attestation + audit v1 #2039.

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), Lane D shift
Session / ID: queue task 3351
Found via: queue claim
Task: Investigation delivered — PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 opened, summary posted on this issue, follow-on routed to gated synthesis id: design: match attestation + audit v1 #2039. Parked only because PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252's CI (basic: proxy port fallbacks) is still pending past the 5-minute poll window.
Expectation: on resume — read PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 checks fresh; if green, merge (docs-only, standing merge directive), post the done note, strip the in-flight labels, and complete task 3351 with outcome triaged / PR merged. If CI fails, inspect whether the failure touches this docs-only change.
Links: PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 · branch queue/3351-2038-match-audit-investigation · laptop worktree ~/git/fleet/3351-2038

docs(id): fix review round-3 findings on match audit — checkpoint-int…

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), openchamber scheduled lane
Session / ID: queue task 3351, repo-health-code-pilot (resume)
Found via: queue claim
Done this run: fixed all four findings on head 917e8b55 in bef008e2 and pushed:
- Codex P2 — the public log now carries a keyed pseudonym (season-scoped HMAC under an auditor-held secret), with the 2^32 enumeration argument for why a salted hash is not enough.
- CodeRabbit — replay and the REPLAY DIVERGES verdict now report the first mismatching checkpoint interval, not an intra-interval tick; per-tick commitments named as optional.
- CodeRabbit — each player signs the header hash before the first input tick; the auditor verifies that before accepting the footer seed reveal, and the footer field list places the seed reveal and includes it in the signed tuple.
- CodeRabbit — every L3 outcome and the id: investigate: match-result attestation — mutual concession, witness adjudication, offline play #2037/id: design: match attestation + audit v1 #2039 hand-off inherit the L2 basis, carrying PARTIALLY VERIFIED — intervals <list> through; a bare TECHNICALLY VALID no longer exists.
  All four threads replied to and resolved.
Parked because: required check basic: proxy port fallbacks has been queued with no runner since 13:25Z (fleet runner backlog); mergeStateStatus is BLOCKED on it alone.
Resume condition: on green, enqueue/merge docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252; then complete task 3351 as triaged, strip the claim labels, and confirm the doc's follow-on routing is still intact. If the merge queue rejects it, record the rejection reason.
Links: PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 (head bef008e2)

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane B shift
Session / ID: queue task 3351 (triage, resume)
Found via: queue claim
Task: PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 CI is now GREEN (basic check pass, run 40881748340), PR MERGEABLE/CLEAN, and all 9 review threads are resolved (6 Codex + 3 CodeRabbit). However the Codex review of the current head bef008e still shows status running after several minutes of polling, so per the Codex findings gate this run will not merge past an unfinished review.
Expectation: resume: confirm the Codex review of bef008e completed; disposition any new findings (fix or reply); then enqueue PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 to the merge queue, complete task 3351 as triaged, and strip the queue/work/status labels.
Links: PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), OpenChamber scheduled lane
Session / ID: queue task 3351, repo-health-code-pilot (resume)
State found at 14:22Z: PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 head bef008e2, checks SUCCESS 3/3, MERGEABLE/CLEAN, 0 unresolved review threads (all 6 Codex + 3 CodeRabbit resolved; the four round-3 findings are fixed in bef008e2).
Action: verified the fix commit is docs-only (+72/−33 on the investigation doc), then enqueued docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 to the main merge queue (--match-head-commit bef008e2). It sits at position 7/8, AWAITING_CHECKS — the six ahead of it are also waiting on runners, so the queue is starved, not failing.
Codex: the re-review of bef008e2 has shown running since 13:25Z (~1h, 👀 reaction only). Treated as an infra stall, not a finding; recorded here rather than held indefinitely.
Expectation: parked to ~14:46Z; next lane confirms the merge, then completes the task as triaged and strips the queue/status labels. Deliverable comment stands at 10:56Z; follow-on slices stay routed to gated synthesis id: design: match attestation + audit v1 #2039 (gated on id: investigate: match-result attestation — mutual concession, witness adjudication, offline play #2037, still open).

🤖 Agent note · done (triaged)

Agent: queue worker (repo-worker-code), openchamber scheduled lane
Session / ID: queue task 3351 (triage, resume attempt 2)
Found via: queue claim (resumed from awaiting_ci)
Task: Investigation deliverable complete and verified: the match-audit doc (netcode log format, replay validation, technically-valid vs actually-valid separation, cheating signals) is in PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 — docs-only (+72/−33), head bef008e2, basic: proxy port fallbacks PASS, MERGEABLE/CLEAN, 0 unresolved review threads (all 6 Codex + 3 CodeRabbit resolved; round-3 findings fixed). Buildable follow-up routed as id: design: match attestation + audit v1 #2039 ("id: design: match attestation + audit v1"). PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 has NOT landed: the main merge queue is stalled repo-wide by the Actions runner jam tracked in ci: Actions check runs stuck in queued across PRs — no runner pickup since ~05:00Z 2026-10-28 #1599 (no merge since 10:57:51Z; entries ahead of it starved too). This is the second pass parked on that same wait, so the task is completed as triaged rather than parked again.
Expectation: no further work on this task. If the jam clears, docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 lands on its own; if it is ejected, read the reason fresh and requeue the doc.
Links: PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 · follow-up id: design: match attestation + audit v1 #2039 · blocker ci: Actions check runs stuck in queued across PRs — no runner pickup since ~05:00Z 2026-10-28 #1599

Navigation Menu

Repository navigation

id: investigate: match audit — netcode log format, replay validation, and cheating signals #2038

Investigation result — match audit (queue task 3351)

24 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: investigate: match audit — netcode log format, replay validation, and cheating signals #2038

Description

Activity

developing-today commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

Investigation result — match audit (queue task 3351)

dezren39 commented on Oct 29, 2026

24 remaining items

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions