Command layer

How the command layer works as built, and why: one dispatcher behind every front end, checking, running and auditing every admin action. The facts to look up are on Command layer dispatcher and the generated Command layer commands; the web console, the player portal and in-game commands are on Command layer design.

How it fits together

The shape

flowchart TD
    CON["Local console"] -->|"a line, as the console actor"| D["Dispatcher"]
    D -->|"checks, then runs"| CMD["Command"]
    CMD -->|"posts, waits for the reply"| AO["Account owner"]
    D -->|"one audit row"| WB["Write-behind queue"]

Loading

An admin action is a command: a definition naming its parameters, its permission, whether it's console-only, and what it runs. The server registers its commands from one list, and the commands page is generated from the same list, so the two can't disagree.

One dispatcher behind every front end. A front end hands it one line of text and the actor who typed it, and gets one reply back. The dispatcher checks the permission on the server, runs the command, and writes one audit row, whichever front end the line came from (Command layer dispatcher).

A command changes state only through its owner. It posts to the owner that holds what it changes and waits for the reply, and for the commit where it writes, so a command never writes state an owner holds.

Why it's built this way

A permission checked only in a front end is a permission anyone who gets past that front end can skip. One dispatcher behind every front end means one place to check, one place to audit, and the same command doing the same thing from the console, the web or in game. The harness drives the server through these same commands, which is why the layer came first.

Idea	What killed it
Permission checks only in the console's interface	Any account that gets in could grant itself any role. Every command checks its permission on the server

Knobs

Setting	Default	Sets
Cli:Enabled	on	Whether the server reads commands from its console

Known edges

• The local console is the only front end so far, and its actor holds every permission; roles arrive with in-game commands.

Where the code lives

Piece	Path
The dispatcher, definitions, actors and the line splitter	Source/NexusTomorrow.Commands/
The account and server commands, and the list the server registers (BuiltinCommands.cs)	Source/NexusTomorrow.Commands/Builtin/
The console front end	Source/NexusTomorrow.Server/ConsoleFrontEnd.cs
The audit row	Source/NexusTomorrow.Persistence/Ops/
Tests	Tests/NexusTomorrow.Commands.Tests/