🤖 Agent: merged. Creative pick block in inventories (fixes#1048, Visivel). Integration proof (main + #1079#1081#1082#1083#1085#1086#1087), 2026-10-21: desktop parity 103/105; the 2 others (world_reopen, save_roundtrip) need a display and pass on the Mac mini. Verify passed.
The middle button (keyPickItem) over an inventory or the creative screen no
longer clicks like the left button: with infinite materials it clones the
hovered stack at full size (CLONE) or, holding a stack, drags full stacks into
slots (quick craft type 2); otherwise it does nothing. Agents can middle-click
widgets (click ID middle), and creative slots are ui widgets now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🤖 Agent: merged. Verify passed. Integration proof (main + #1041#1043#1021#1020#1032#659#1029#1066), 2026-10-21: 97 of 100 harnesses passed on the desktop. world_reopen and save_roundtrip need a display there; they pass on the Mac mini with #1041/#1043. dedicated_server is a pre-existing flake: it fails on plain main too, and is pass/fail in 2 runs on the integration.
🤖 Agent: merged. Verify passed. Integration proof (main + #1041#1043#1021#1020#1032#659#1029#1066), 2026-10-21: 97 of 100 harnesses passed on the desktop. world_reopen and save_roundtrip need a display there; they pass on the Mac mini with #1041/#1043. dedicated_server is a pre-existing flake: it fails on plain main too, and is pass/fail in 2 runs on the integration.
Lithium, FerriteCore, ImmediatelyFast, Gnetum, ScalableLux, Structure
Layout Optimizer, AsyncParticles and Ixeris: per technique, the vanilla
cost it targets, whether Horizon already avoids it, and whether it is
worth measuring. From public descriptions only; no mod code read.
Fixes#991
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tools/gen_version_consts.py writes what the pinned client jar's version.json
states (name, id, protocol, data version, pack formats, Java, stable, build
time) into horizon_core::version, and every Rust site reads it from there:
PROTOCOL_VERSION, GAME_VERSION, DATA_VERSION, the save's and the datafixer's
version name, /version, the crash report, the legacy ping, the dedicated
server's start line, the title screens, the default resource folder, the
resource pack format, and the launcher's and horizon-ctl's fallbacks. CI
checks the file against the pinned jar.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- crates/horizon-release-sign/legacy-releases.txt pins the SHA-256 of every archive of the 131 releases published
before signing (GitHub's upload digests, written by tools/ci/legacy_releases.py). The launcher and
horizon-server update install those releases only with exactly those files, so rolling back to one works and
nobody can swap its files later; every other release needs its signed SHA256SUMS.
- the_launcher_ships_with_a_release_key and horizon_server_ships_with_a_release_key fail while
release-keys.txt lists no key, so this can't ship refusing everything.
- Test tags moved to v2099.* so they never collide with a pinned release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The launcher (game installs and its own updates) and `horizon-server update` fetch a release's
SHA256SUMS and SHA256SUMS.sig, check the signature against the keys built in from
crates/horizon-release-sign/release-keys.txt and the archive against the signed SHA-256, and
refuse anything unsigned, signed for another tag or by another key, or that doesn't match, with a
message saying why. Merge only once release-keys.txt lists the key and a signed stable release
exists: until then every download is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🤖 Agent: merged. Reviewed the storage host: keys are one [a-z0-9_.-] segment, ids are [a-z0-9_], and the quota, key cap and per-call write budget all hold. Thanks @Yvonne-Aizawa!
🤖 Agent: merged after verify and CI parity passed (modpacks-11: Chipped's 11 vines carried as vines; the 11 blockstate errors are gone from the game log).
- Reject a second running mod with an id already in use: two mods
sharing an id would also share capability storage's data_dir,
letting one read, overwrite or delete the other's state.
- Cap storage to 64 keys per mod, not just 4 MiB: zero- or near-zero-
byte values could otherwise flood the directory with files the
byte quota never sees.
- Add a 1 MiB per-call write budget, separate from the 4 MiB on-disk
quota: a loop replacing one key stays under the quota on every
check (the total on disk never grows) while still doing unbounded
synchronous disk I/O per call, which fuel never meters.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A mod with capability storage gets get(key)/set(key, value)/delete(key),
backed by real files beside horizon-mods/ (.horizon-mod-data/<id>/, 4 MiB
quota per mod). Keys are a single path segment so they can't leave the
mod's own directory. Unlike in-memory mod state, this survives a
cargo-horizon-mod dev reload, since it's keyed by the mod's path and id
rather than its Store.
🤖 Agent: merged after verify passed, security-1's dry runs on the branch, and an independent review whose findings were all fixed. Every release goes out as a beta and is promoted to stable after 6 hours if its smoke test passed and no release-blocker issue is open; launcher-v0.14.0 (stable by default) is already out.
🤖 Agent: merged after verify passed, security-1's dry runs on the branch, and an independent review whose findings were all fixed. docs/security.md: the security model in plain words, with what is live and what still waits.
🤖 Agent: merged after verify and CI parity passed (40 server tests; the whole create → start → join → whitelist → backup → restore → update → stop flow ran on the Mac mini and the ThinkPad). Adds `horizon-server config`, `backups --json`, `update --check --json`; fixes whitelisting on offline servers and updates as root in containers.
repurposed_structures:structure_void_processor returns null for a
template's structure_void blocks, which is what vanilla's block_ignore
does with blocks: [structure_void]. Carry writes it that way, so the
82 lists that use it (its mineshafts, ocean village and temples, the
jungle pyramid's hidden room, swamp village) no longer place structure
voids over the terrain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A mod's file for a vanilla, convention or other mod's tag adds its values in
load order; one with "replace": true now drops vanilla's entries and the
earlier mods' first, as a higher data pack does, and the log says which mod
replaced what (kept with the cached root, so a reused root warns too).
Carry keeps such tags instead of setting them aside: Towns and Towers'
seven minecraft:has_structure biome tags load. Mods still own no other
minecraft content.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26.3's EnterBlockTrigger reads a block list from 'blocks' and skips
1.21.1's 'block', so a carried criterion matched any block the player
entered: Regions Unexplored's Downer, From the Tree Tops and Light as a
Frog were granted on the first dive into the sea. Carry renames the
field (20 advancements in Regions Unexplored, with its boat recipes'
in-water criteria).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without the oracle, a block's template is guessed from its blockstate's
property names, and a vine's (east, north, south, up, west) fit
cobblestone_wall. The game then refused Chipped's 11 vine blockstates:
a wall's sides are none, low or tall, so 'true' is an unknown multipart
property value. block_template looks at the sides' values and makes those
vines; Luminax's 32 walls stay walls.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🤖 Agent: merged after verify passed and a local check on main + #983 + #984 (clippy clean; chunk_generation and locator_bar, the two harnesses that failed in CI on the old head, both pass; modpacks-10's integration ran 301/301). Structures built under the sea are flooded and waterlogged; Better Ocean Monuments' processors carried.
- A table of what is live, waiting to merge, or waiting for Ludovic, so the page doesn't read as if it all were.
- Forks: their checks need a maintainer's approval, and run-parity runs them on the Mac mini; the Mac mini
section no longer says forks don't run there, and says what a clean release checkout does and doesn't fix.
- Blockers hold every beta while open; releases from before signing stay installable with pinned files.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
What an attacker could do before (instructions hidden in reports, a skipped check that counted as
passed, releases straight to every player, downloads trusting GitHub alone, pipeline files changed
like any other), what stops it now (untrusted text, verify always running, beta then stable,
signed updates, code owners, the agents' own GitHub App), what still needs Ludovic, and what it
doesn't solve. Written for the website's Contributing page; CONTRIBUTING.md links it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A release-blocker issue's text is never read: its author can edit it after a maintainer labels it, so an
open blocker holds every beta, and one closed as completed still holds the betas published before it closed.
- Even --force never promotes a beta that isn't newer than the stable release: horizon-server update and
install.sh download GitHub's latest.
- When the oldest beta newer than the stable release has waited 24 hours, promote.yml opens a "Promotion to
stable has stalled" issue with the last reason; the next promotion closes it.
- promote.yml: persist-credentials: false; issues: write for the stall issue.
- Website: the newest 100 releases, plus GitHub's latest (the stable one) when a day of betas pushes it out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Game releases go out as betas (GitHub pre-releases, never "latest") with the Mac mini's smoke
report attached. promote.yml (every 30 minutes, or by hand from a phone) runs
tools/release_channels.py, which makes the newest beta stable and latest once it has been out 6
hours, passed its smoke test and no release-blocker issue covers it, with notes rewritten to cover
everything since the last stable release. release_train.py counts merges from the newest release of
either channel, and a beta's notes say it is one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🤖 Agent: merged after verify passed, with security-1's dry runs on the branch and an independent review (no regression: parity still runs on every PR from this repo; releases go out unsigned with a warning until the signing key is set).
🤖 Agent: merged after verify passed, with security-1's dry runs on the branch and an independent review (no regression: parity still runs on every PR from this repo; releases go out unsigned with a warning until the signing key is set).
🤖 Agent: merged after verify and CI parity passed, plus modpacks-10's local integration (parity 301/301, structure-start oracle 150/150 and 134/134). Towns and Towers' namespaces carried in its manifest.
🤖 Agent: merged after verify and CI parity passed, plus modpacks-10's local integration (all nine branches on main: parity 301/301, structure-start oracle 150/150 and 134/134). Content mods may own namespaces besides their id; two mods may not share one.
🤖 Agent: merged after verify and CI parity passed, plus modpacks-10's local integration (all nine branches on main: parity 301/301, structure-start oracle 150/150 and 134/134). Mod loot tables from every namespace, so modded structure chests are filled.
The game resolves names as vanilla does, Mojang first, so on an offline server a name someone owns got that
account's UUID and the player, who joins under the offline UUID, was refused. horizon-server now writes the
offline entry and has the game reload the whitelist.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Any repository code running earlier in the job that holds the key could reach it (a build patched
through Cargo.toml, or a step writing $GITHUB_ENV or $GITHUB_PATH for the next one). The `sign`
job checks out only tools/ci/sign_release.sh, which signs with the runner's OpenSSL; the publish
job, without the key, checks the result with horizon-release-sign as launchers will.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
crates/horizon-release-sign signs a release's checksums with an Ed25519 key that exists only as a
secret of the `release` environment, and checks them as launchers will, against the public keys
built in from release-keys.txt. Dry runs sign with a throwaway key. Until release-keys.txt lists a
key, releases keep going out with SHA256SUMS alone and a warning; once it does, a missing or
unknown key fails the release before anything is published. tools/ci/new_release_key.sh pipes a
new key straight into the secret and prints only the public key. ring and base64 are already in
the lockfile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Labels started `checks` runs whose verify job was skipped, and GitHub counts a skipped required
check as passed: auto-merge merged #823 and #837 before the real verify finished. Labels no longer
start `checks` (the fork-only run-parity label has its own workflow), and verify has no condition.
The parity job moves into a reusable workflow both call.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`config [--json]` prints the settings; `config set KEY=VALUE...` writes them through
toml_edit, checked as server.toml is checked (nothing is written if one is wrong). A
running server takes the difficulty, the default game mode and the whitelist at once
through its console, and the backup settings because the supervisor reads them each
time; the rest waits for the next start, and the command says which.
Also `backups --json` and `update --check --json`, for the launcher's Servers page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🤖 Agent: merged after verify passed; cloud_render, environment_render, weather_render and 923 client tests pass, with before/after screenshots of Complementary Unbound. Java shader packs get real eye brightness, custom uniforms, Iris's sun path and tilt, and clouds=off/sun/moon flags. Part of #944 (reported by brabus_); shadows and gbuffers still to come.
🤖 Agent: merged after the verify rerun passed (the first run's failure was a flake; horizon-server tests pass 39/39 locally) and CI parity passed. Old releases are pruned automatically after an update.
Ludovic Marie
rdbtCVS
yvonne