Enable assembly trimming for Eagle Installer

Enable PublishTrimmed to reduce installer size from ~73MB to potentially
~15-25MB by removing unused .NET framework code.

Using TrimMode=partial for conservative trimming that's safer with
Windows Forms. Can try TrimMode=full later for more aggressive trimming.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.bazelrc

@@ -26,8 +26,8 @@ common --host_cxxopt="--std=c++23"
 common --javacopt="-Xlint:-options"
 
 # suppress warnings due to https://developer.apple.com/forums/thread/733317
-common --linkopt=-Wl
-common:macos --linkopt=-Wl,-no_warn_duplicate_libraries
+# Use host_linkopt for macOS-specific flags to avoid passing them to Linux cross-compilation
+common:macos --host_linkopt=-Wl,-no_warn_duplicate_libraries
 
 # Fix Xcode version caching issue - avoids need for `bazel clean --expunge` after Xcode updates
 common:macos --repo_env=DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
@@ -36,3 +36,7 @@ common --java_language_version=17
 common --java_runtime_version=remotejdk_17
 common --tool_java_language_version=17
 common --tool_java_runtime_version=remotejdk_17
+
+# Workspace status for build stamping (git commit, timestamp)
+common --workspace_status_command=tools/workspace_status.sh
+common --stamp

.github/workflows/artifact_storage_check.yml

@@ -0,0 +1,37 @@
+name: Artifact Storage Check
+
+on:
+  schedule:
+    # Run every 6 hours
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+jobs:
+  check-storage:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check artifact storage size
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Calculate total artifact storage
+          total_bytes=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
+            --paginate -q '.artifacts[].size_in_bytes' | awk '{sum+=$1} END {print sum}')
+
+          total_mb=$((total_bytes / 1024 / 1024))
+          echo "Total artifact storage: ${total_mb} MB"
+
+          # Fail if over 500MB
+          if [ "$total_mb" -gt 500 ]; then
+            echo "::error::Artifact storage is ${total_mb} MB, which exceeds the 500 MB threshold!"
+            echo ""
+            echo "Largest artifacts:"
+            gh api "repos/${{ github.repository }}/actions/artifacts" \
+              --paginate -q '.artifacts[] | "\(.size_in_bytes)\t\(.name)\t\(.created_at)"' | \
+              sort -rn | head -20 | \
+              awk -F'\t' '{printf "%d MB\t%s\t%s\n", $1/1024/1024, $2, $3}'
+            exit 1
+          fi
+
+          echo "Storage is within acceptable limits."

.github/workflows/auth_build.yml

@@ -0,0 +1,201 @@
+name: Auth Service Build and Deploy
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'src/main/go/net/eagle0/authservice/**'
+      - 'src/main/go/net/eagle0/authcli/**'
+      - 'src/main/protobuf/net/eagle0/eagle/api/auth.proto'
+      - 'src/main/protobuf/net/eagle0/eagle/api/admin/**'
+      - 'src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
+      - 'ci/BUILD.bazel'
+      - '.github/workflows/auth_build.yml'
+  workflow_dispatch:
+    inputs:
+      push_images:
+        description: 'Push images to container registry'
+        required: true
+        default: 'false'
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build-auth:
+    runs-on: [self-hosted, bazel]
+    outputs:
+      image_tag: ${{ steps.push-auth.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Build Auth Server Docker image
+        id: build-auth
+        run: |
+          set -ex
+
+          # Build auth server image (Go binary has explicit goos/goarch in BUILD.bazel)
+          bazel build //ci:auth_server_image
+
+          # Save the resolved path before any other bazel command changes bazel-bin symlink
+          IMAGE_PATH=$(readlink -f bazel-bin/ci/auth_server_image)
+          echo "Image path: $IMAGE_PATH"
+          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
+
+      - name: Login to DigitalOcean Container Registry
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
+        run: |
+          mkdir -p ~/.docker
+          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
+          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
+
+      - name: Push Auth image to DO registry
+        id: push-auth
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
+        run: |
+          set -ex
+
+          AUTH_IMAGE="${{ steps.build-auth.outputs.image_path }}"
+          echo "Using Auth image: $AUTH_IMAGE"
+
+          if [ -z "$AUTH_IMAGE" ] || [ ! -d "$AUTH_IMAGE" ]; then
+            echo "ERROR: Auth image not found at: $AUTH_IMAGE"
+            exit 1
+          fi
+
+          # Build the push target to get crane in runfiles
+          bazel build //ci:auth_server_push
+
+          # Use crane directly for push
+          CRANE="bazel-bin/ci/push_auth_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
+          echo "Using crane: $CRANE"
+
+          # Push with SHA tag
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+          IMAGE_TAG="registry.digitalocean.com/eagle0/auth-server:${GIT_SHA}"
+          echo "Pushing auth image: $IMAGE_TAG"
+          $CRANE push "$AUTH_IMAGE" "$IMAGE_TAG"
+
+          # Output the full image tag for deploy step
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+          # Also update :latest for convenience
+          echo "Copying to :latest tag"
+          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/auth-server:latest"
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build-auth]
+    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+    environment: production
+    env:
+      AUTH_IMAGE: ${{ needs.build-auth.outputs.image_tag }}
+      DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
+      DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
+      GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+      GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+      GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+      GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+      APPLE_SIGNIN_CLIENT_ID: ${{ secrets.APPLE_SIGNIN_CLIENT_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_SIGNIN_KEY_ID: ${{ secrets.APPLE_SIGNIN_KEY_ID }}
+      APPLE_SIGNIN_PRIVATE_KEY: ${{ secrets.APPLE_SIGNIN_PRIVATE_KEY }}
+      TWITCH_CLIENT_ID: ${{ secrets.TWITCH_CLIENT_ID }}
+      TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_CLIENT_SECRET }}
+      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
+      FASTMAIL_API_TOKEN: ${{ secrets.FASTMAIL_API_TOKEN }}
+      FASTMAIL_FROM_EMAIL: ${{ secrets.FASTMAIL_FROM_EMAIL }}
+      FASTMAIL_FROM_NAME: ${{ secrets.FASTMAIL_FROM_NAME }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Deploy auth service to production
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DO_DROPLET_IP }}
+          username: deploy
+          key: ${{ secrets.DO_SSH_KEY }}
+          script_stop: true
+          envs: AUTH_IMAGE,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,GH_OAUTH_CLIENT_ID,GH_OAUTH_CLIENT_SECRET,APPLE_SIGNIN_CLIENT_ID,APPLE_TEAM_ID,APPLE_SIGNIN_KEY_ID,APPLE_SIGNIN_PRIVATE_KEY,TWITCH_CLIENT_ID,TWITCH_CLIENT_SECRET,JWT_PRIVATE_KEY,FASTMAIL_API_TOKEN,FASTMAIL_FROM_EMAIL,FASTMAIL_FROM_NAME
+          script: |
+            set -x
+            cd /opt/eagle0
+
+            # Export env vars for docker compose (appleboy/ssh-action sets them but doesn't export)
+            export AUTH_IMAGE="${AUTH_IMAGE}"
+            export DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
+            export DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
+            export GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
+            export GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
+            export GH_OAUTH_CLIENT_ID="${GH_OAUTH_CLIENT_ID}"
+            export GH_OAUTH_CLIENT_SECRET="${GH_OAUTH_CLIENT_SECRET}"
+            export APPLE_SIGNIN_CLIENT_ID="${APPLE_SIGNIN_CLIENT_ID}"
+            export APPLE_TEAM_ID="${APPLE_TEAM_ID}"
+            export APPLE_SIGNIN_KEY_ID="${APPLE_SIGNIN_KEY_ID}"
+            export APPLE_SIGNIN_PRIVATE_KEY="${APPLE_SIGNIN_PRIVATE_KEY}"
+            export TWITCH_CLIENT_ID="${TWITCH_CLIENT_ID}"
+            export TWITCH_CLIENT_SECRET="${TWITCH_CLIENT_SECRET}"
+            export JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
+            export FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
+            export FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
+            export FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
+
+            # Login to registry
+            echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
+
+            echo "Deploying auth service: $AUTH_IMAGE"
+
+            # Pull the image directly (docker is already logged in)
+            echo "Pulling Auth image..."
+            docker pull "${AUTH_IMAGE}" || { echo "ERROR: Failed to pull auth image"; exit 1; }
+
+            # Tag as :latest locally so any fallback uses correct image
+            docker tag "${AUTH_IMAGE}" registry.digitalocean.com/eagle0/auth-server:latest
+
+            # Debug: check environment and .env file
+            echo "DEBUG: AUTH_IMAGE=$AUTH_IMAGE"
+            env | grep AUTH || echo "AUTH_IMAGE not in env output"
+            if [ -f .env ]; then
+              echo "DEBUG: .env file contents related to AUTH:"
+              grep AUTH .env || echo "No AUTH in .env"
+            fi
+
+            # Recreate auth container - pass AUTH_IMAGE explicitly on command line
+            AUTH_IMAGE="${AUTH_IMAGE}" docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate auth
+
+            # Wait for health check
+            sleep 5
+
+            # Verify container is using the correct image
+            # Note: docker-compose may use :latest tag (which we tagged to the correct image)
+            echo "=== Verifying auth container image ==="
+            RUNNING_IMAGE=$(docker inspect auth-server --format '{{.Config.Image}}')
+            RUNNING_DIGEST=$(docker inspect auth-server --format '{{.Image}}')
+            EXPECTED_DIGEST=$(docker inspect "${AUTH_IMAGE}" --format '{{.Id}}')
+            echo "Expected image: ${AUTH_IMAGE}"
+            echo "Running image:  ${RUNNING_IMAGE}"
+            echo "Expected digest: ${EXPECTED_DIGEST}"
+            echo "Running digest:  ${RUNNING_DIGEST}"
+
+            if [ "$RUNNING_DIGEST" != "$EXPECTED_DIGEST" ]; then
+              echo "ERROR: Container is running wrong image!"
+              exit 1
+            fi
+            echo "Image digests match - correct image is running"
+
+            # Show container status
+            docker compose -f docker-compose.prod.yml ps auth
+
+            # Cleanup old images
+            docker image prune -f

.github/workflows/bazel_test.yml

@@ -26,13 +26,15 @@ permissions:
 
 jobs:
   test:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
       with:
         lfs: false
+    - name: Check BUILD.bazel dependencies
+      run: ./scripts/check_build_deps.sh --strict
     - name: Run tests
       id: test
       continue-on-error: true
@@ -75,6 +77,7 @@ jobs:
       with:
         name: test.json
         path: test.json
+        retention-days: 5
     - name: Archive failed test logs
       if: always()
       uses: actions/upload-artifact@v4
@@ -82,6 +85,7 @@ jobs:
         name: failed-test-logs
         path: failed_test_logs/
         if-no-files-found: ignore
+        retention-days: 5
     - name: Fail if tests failed
       if: steps.test.outcome == 'failure'
       run: exit 1

.github/workflows/build_protos_test.yml

@@ -1,21 +0,0 @@
-name: Build Protos
-
-on:
-  pull_request:
-    paths:
-      - "src/main/protobuf/**"
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: self-hosted
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-      - name: Run tests
-        run: ./scripts/build_protos.sh

.github/workflows/build_sysroot.yml

@@ -8,12 +8,22 @@ on:
         required: true
         default: 'v2'
         type: string
+      architecture:
+        description: 'Target architecture'
+        required: true
+        default: 'amd64'
+        type: choice
+        options:
+          - amd64
+          - arm64
+          - both
 
 permissions:
   contents: read
 
 jobs:
-  build-sysroot:
+  build-sysroot-amd64:
+    if: ${{ inputs.architecture == 'amd64' || inputs.architecture == 'both' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -25,13 +35,17 @@ jobs:
       - name: Upload sysroot artifact
         uses: actions/upload-artifact@v4
         with:
-          name: ubuntu-noble-sysroot
+          name: ubuntu-noble-sysroot-amd64
           path: tools/sysroot/output/
+          retention-days: 1
 
       - name: Install AWS CLI
         run: |
-          sudo apt-get update
-          sudo apt-get install -y awscli
+          if ! command -v aws &> /dev/null; then
+            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+            unzip -q awscliv2.zip
+            sudo ./aws/install
+          fi
 
       - name: Upload to DigitalOcean Spaces
         env:
@@ -40,24 +54,86 @@ jobs:
         run: |
           # Upload sysroot tarball to DO Spaces
           aws s3 cp tools/sysroot/output/ubuntu_noble_amd64_sysroot.tar.xz \
-            s3://eagle0/sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz \
+            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz \
             --endpoint-url https://sfo3.digitaloceanspaces.com \
             --acl public-read
 
           # Upload sha256 file
           aws s3 cp tools/sysroot/output/ubuntu_noble_amd64_sysroot.sha256 \
-            s3://eagle0/sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.sha256 \
+            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.sha256 \
             --endpoint-url https://sfo3.digitaloceanspaces.com \
             --acl public-read
 
           echo ""
-          echo "=== Sysroot uploaded ==="
-          echo "URL: https://eagle0.sfo3.digitaloceanspaces.com/sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz"
+          echo "=== AMD64 Sysroot uploaded ==="
+          echo "URL: https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz"
           echo "SHA256: $(cat tools/sysroot/output/ubuntu_noble_amd64_sysroot.sha256)"
           echo ""
           echo "Update MODULE.bazel with:"
           echo "sysroot("
           echo "    name = \"linux_sysroot\","
           echo "    sha256 = \"$(cat tools/sysroot/output/ubuntu_noble_amd64_sysroot.sha256)\","
-          echo "    urls = [\"https://eagle0.sfo3.digitaloceanspaces.com/sysroot/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz\"],"
+          echo "    urls = [\"https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_amd64_sysroot.tar.xz\"],"
+          echo ")"
+
+  build-sysroot-arm64:
+    if: ${{ inputs.architecture == 'arm64' || inputs.architecture == 'both' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU for ARM64 emulation
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build ARM64 sysroot
+        run: ./tools/sysroot/build_sysroot_arm64.sh
+
+      - name: Upload sysroot artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ubuntu-noble-sysroot-arm64
+          path: tools/sysroot/output/
+          retention-days: 1
+
+      - name: Install AWS CLI
+        run: |
+          if ! command -v aws &> /dev/null; then
+            curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+            unzip -q awscliv2.zip
+            sudo ./aws/install
+          fi
+
+      - name: Upload to DigitalOcean Spaces
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.SECRET_KEY }}
+        run: |
+          # Upload sysroot tarball to DO Spaces
+          aws s3 cp tools/sysroot/output/ubuntu_noble_arm64_sysroot.tar.xz \
+            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.tar.xz \
+            --endpoint-url https://sfo3.digitaloceanspaces.com \
+            --acl public-read
+
+          # Upload sha256 file
+          aws s3 cp tools/sysroot/output/ubuntu_noble_arm64_sysroot.sha256 \
+            s3://eagle0-sysroot/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.sha256 \
+            --endpoint-url https://sfo3.digitaloceanspaces.com \
+            --acl public-read
+
+          echo ""
+          echo "=== ARM64 Sysroot uploaded ==="
+          echo "URL: https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.tar.xz"
+          echo "SHA256: $(cat tools/sysroot/output/ubuntu_noble_arm64_sysroot.sha256)"
+          echo ""
+          echo "Update MODULE.bazel with:"
+          echo "sysroot("
+          echo "    name = \"linux_sysroot_arm64\","
+          echo "    sha256 = \"$(cat tools/sysroot/output/ubuntu_noble_arm64_sysroot.sha256)\","
+          echo "    urls = [\"https://eagle0-sysroot.sfo3.digitaloceanspaces.com/${{ inputs.version }}/ubuntu_noble_arm64_sysroot.tar.xz\"],"
           echo ")"

.github/workflows/client_presigner.yml

@@ -1,35 +0,0 @@
-name: Client Presigner
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - ".github/workflows/client_presigner.yml"
-      - "src/main/go/net/eagle0/client_download/**"
-      - "src/main/go/net/eagle0/util/**"
-  pull_request:
-    paths:
-      - ".github/workflows/client_presigner.yml"
-      - "src/main/go/net/eagle0/client_download/**"
-      - "src/main/go/net/eagle0/util/**"
-
-permissions:
-  contents: read
-
-jobs:
-  client-presigner:
-    runs-on: self-hosted
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          lfs: false
-          clean: false
-      - name: Build Client Presigner
-        run: bazel build --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //src/main/go/net/eagle0/client_download
-      - name: Archive presigner binary
-        if: success() || failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: client_download
-          path: bazel-bin/src/main/go/net/eagle0/client_download/client_download_/client_download

.github/workflows/docker_build.yml

@@ -4,12 +4,21 @@ on:
   push:
     branches: [ "main" ]
     paths:
-      - 'src/main/cpp/**'
+      # Note: C++ changes trigger shardok_arm64_build.yml instead
+      # Note: Auth changes trigger auth_build.yml instead
+      - 'src/main/go/**'
+      - '!src/main/go/net/eagle0/authservice/**'
+      - '!src/main/go/net/eagle0/authcli/**'
       - 'src/main/scala/**'
       - 'src/main/protobuf/**'
+      - '!src/main/protobuf/net/eagle0/eagle/api/auth.proto'
+      - '!src/main/protobuf/net/eagle0/eagle/api/admin/**'
+      - '!src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
       - 'src/main/resources/**'
       - 'ci/BUILD.bazel'
       - 'MODULE.bazel'
+      - 'docker-compose.prod.yml'
+      - 'nginx/**'
       - '.github/workflows/docker_build.yml'
   workflow_dispatch:
     inputs:
@@ -19,20 +28,63 @@ on:
         default: 'false'
         type: boolean
 
+# Only allow one deployment at a time to prevent race conditions
+concurrency:
+  group: docker-build-deploy
+  cancel-in-progress: false  # Don't cancel running deployments, queue new ones
+
 permissions:
   contents: read
 
 jobs:
-  build-eagle:
-    runs-on: self-hosted
+  # Single consolidated build job - builds all images with one bazel invocation
+  # This uses 1 runner slot instead of 4, and Bazel parallelizes internally
+  # NOTE: Must run on a runner with the bazel label to ensure consistent Bazel cache
+  build-all:
+    runs-on: [self-hosted, bazel]
+    outputs:
+      eagle_image_tag: ${{ steps.push-images.outputs.eagle_image_tag }}
+      admin_image_tag: ${{ steps.push-images.outputs.admin_image_tag }}
+      jfr_sidecar_image_tag: ${{ steps.push-images.outputs.jfr_sidecar_image_tag }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           lfs: false
 
-      - name: Build Eagle Docker image
-        run: bazel build //ci:eagle_server_image
+      - name: Build all Docker images
+        id: build-all
+        run: |
+          set -ex
+
+          # Build ALL images in a single bazel command - Bazel parallelizes internally
+          # Note: Shardok is built separately for ARM64 and deployed to Hetzner
+          echo "=== Building Docker images ==="
+          bazel build \
+            --platforms=//:linux_x86_64 \
+            --extra_toolchains=@llvm_toolchain_linux//:all \
+            //ci:eagle_server_image \
+            //ci:admin_server_image \
+            //ci:jfr_sidecar_image \
+            //src/main/go/net/eagle0/warmup:warmup_linux_amd64
+
+          # Copy warmup binary to scripts/ for deployment
+          mkdir -p scripts/bin
+          cp bazel-bin/src/main/go/net/eagle0/warmup/warmup_linux_amd64_/warmup_linux_amd64 scripts/bin/warmup
+
+          # Save all image paths before any other bazel command changes bazel-bin symlink
+          EAGLE_PATH=$(readlink -f bazel-bin/ci/eagle_server_image)
+          ADMIN_PATH=$(readlink -f bazel-bin/ci/admin_server_image)
+          JFR_PATH=$(readlink -f bazel-bin/ci/jfr_sidecar_image)
+
+          echo "eagle_path=$EAGLE_PATH" >> $GITHUB_OUTPUT
+          echo "admin_path=$ADMIN_PATH" >> $GITHUB_OUTPUT
+          echo "jfr_path=$JFR_PATH" >> $GITHUB_OUTPUT
+
+          echo "=== Image paths ==="
+          echo "Eagle: $EAGLE_PATH"
+          echo "Admin: $ADMIN_PATH"
+          echo "JFR Sidecar: $JFR_PATH"
 
       - name: Login to DigitalOcean Container Registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
@@ -42,31 +94,289 @@ jobs:
           mkdir -p ~/.docker
           AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
           echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
 
-      - name: Push Eagle image to DO registry
+      - name: Push all images to DO registry
+        id: push-images
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        run: bazel run //ci:eagle_server_push
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
+        run: |
+          set -ex
 
-  build-shardok:
-    runs-on: self-hosted
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+
+          # Get crane from push target runfiles
+          bazel build //ci:eagle_server_push
+          CRANE="bazel-bin/ci/push_eagle_server_push.sh.runfiles/rules_oci~~oci~oci_crane_darwin_arm64/crane"
+
+          if [ ! -e "$CRANE" ]; then
+            # Fallback: find any Darwin crane
+            RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
+            CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
+          fi
+
+          if [ -z "$CRANE" ] || [ ! -e "$CRANE" ]; then
+            echo "ERROR: crane not found"
+            exit 1
+          fi
+          echo "Using crane: $CRANE"
+
+          # Push Eagle image
+          EAGLE_IMAGE="${{ steps.build-all.outputs.eagle_path }}"
+          EAGLE_TAG="registry.digitalocean.com/eagle0/eagle-server:${GIT_SHA}"
+          echo "Pushing Eagle: $EAGLE_TAG"
+          $CRANE push "$EAGLE_IMAGE" "$EAGLE_TAG"
+          $CRANE copy "$EAGLE_TAG" "registry.digitalocean.com/eagle0/eagle-server:latest"
+          echo "eagle_image_tag=$EAGLE_TAG" >> $GITHUB_OUTPUT
+
+          # Push Admin image
+          ADMIN_IMAGE="${{ steps.build-all.outputs.admin_path }}"
+          ADMIN_TAG="registry.digitalocean.com/eagle0/admin-server:${GIT_SHA}"
+          echo "Pushing Admin: $ADMIN_TAG"
+          $CRANE push "$ADMIN_IMAGE" "$ADMIN_TAG"
+          $CRANE copy "$ADMIN_TAG" "registry.digitalocean.com/eagle0/admin-server:latest"
+          echo "admin_image_tag=$ADMIN_TAG" >> $GITHUB_OUTPUT
+
+          # Push JFR Sidecar image
+          JFR_IMAGE="${{ steps.build-all.outputs.jfr_path }}"
+          JFR_TAG="registry.digitalocean.com/eagle0/jfr-sidecar:${GIT_SHA}"
+          echo "Pushing JFR Sidecar: $JFR_TAG"
+          $CRANE push "$JFR_IMAGE" "$JFR_TAG"
+          $CRANE copy "$JFR_TAG" "registry.digitalocean.com/eagle0/jfr-sidecar:latest"
+          echo "jfr_sidecar_image_tag=$JFR_TAG" >> $GITHUB_OUTPUT
+
+          echo "=== All images pushed successfully ==="
+
+  deploy:
+    runs-on: [self-hosted, bazel]
+    needs: [build-all]
+    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+    environment: production
+    env:
+      EAGLE_IMAGE: ${{ needs.build-all.outputs.eagle_image_tag }}
+      ADMIN_IMAGE: ${{ needs.build-all.outputs.admin_image_tag }}
+      JFR_SIDECAR_IMAGE: ${{ needs.build-all.outputs.jfr_sidecar_image_tag }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      GPT_MODEL_NAME: ${{ secrets.GPT_MODEL_NAME }}
+      EAGLE_ENABLE_S3: ${{ secrets.EAGLE_ENABLE_S3 }}
+      DO_SPACES_ACCESS_KEY: ${{ secrets.DO_SPACES_ACCESS_KEY }}
+      DO_SPACES_SECRET_KEY: ${{ secrets.DO_SPACES_SECRET_KEY }}
+      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
+      DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
+      DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
+      GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+      GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+      GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+      GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+      APPLE_SIGNIN_CLIENT_ID: ${{ secrets.APPLE_SIGNIN_CLIENT_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_SIGNIN_KEY_ID: ${{ secrets.APPLE_SIGNIN_KEY_ID }}
+      APPLE_SIGNIN_PRIVATE_KEY: ${{ secrets.APPLE_SIGNIN_PRIVATE_KEY }}
+      TWITCH_CLIENT_ID: ${{ secrets.TWITCH_CLIENT_ID }}
+      TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_CLIENT_SECRET }}
+      SHARDOK_ADDRESS: ${{ secrets.SHARDOK_ADDRESS }}
+      SHARDOK_AUTH_TOKEN: ${{ secrets.SHARDOK_AUTH_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      FASTMAIL_API_TOKEN: ${{ secrets.FASTMAIL_API_TOKEN }}
+      FASTMAIL_FROM_EMAIL: ${{ secrets.FASTMAIL_FROM_EMAIL }}
+      FASTMAIL_FROM_NAME: ${{ secrets.FASTMAIL_FROM_NAME }}
+      DO_DROPLET_IP: ${{ secrets.DO_DROPLET_IP }}
+      DO_REGISTRY_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-        with:
-          lfs: false
 
-      - name: Build Shardok Docker image (cross-compile for Linux)
-        run: bazel build --platforms=//:linux_x86_64 //ci:shardok_server_image
-
-      - name: Login to DigitalOcean Container Registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        env:
-          DO_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
+      - name: Setup SSH key
         run: |
-          mkdir -p ~/.docker
-          AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
-          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DO_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H "$DO_DROPLET_IP" >> ~/.ssh/known_hosts 2>/dev/null || true
 
-      - name: Push Shardok image to DO registry
-        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
-        run: bazel run --platforms=//:linux_x86_64 //ci:shardok_server_push
+      - name: Build warmup tool
+        run: |
+          bazel build //src/main/go/net/eagle0/warmup:warmup_linux_amd64
+          mkdir -p scripts/bin
+          cp bazel-bin/src/main/go/net/eagle0/warmup/warmup_linux_amd64_/warmup_linux_amd64 scripts/bin/warmup
+
+      - name: Copy config files to droplet
+        run: |
+          # Create directory structure on remote
+          ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << 'SETUP_DIRS'
+          set -e
+          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx
+          rm -f /opt/eagle0/scripts/bin/warmup
+          SETUP_DIRS
+
+          # Copy files
+          scp -i ~/.ssh/deploy_key docker-compose.prod.yml deploy@"$DO_DROPLET_IP":/opt/eagle0/
+          scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/
+          scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
+          scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/
+
+      - name: Deploy to production droplet
+        run: |
+          ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << DEPLOY_SCRIPT
+          set -ex
+          cd /opt/eagle0
+
+          # =================================================================
+          # CRITICAL: Validate environment variables before proceeding
+          # This catches GitHub Actions secret store hiccups early
+          # =================================================================
+          validate_env() {
+              local var_name="\$1"
+              local var_value="\$2"
+              local default_value="\${3:-}"
+
+              if [ -z "\${var_value}" ]; then
+                  echo "ERROR: \${var_name} is empty. GitHub Actions secrets may have failed to load."
+                  echo "Please retry the workflow."
+                  return 1
+              fi
+
+              # Check if we got a default value instead of the real secret
+              if [ -n "\${default_value}" ] && [ "\${var_value}" = "\${default_value}" ]; then
+                  echo "ERROR: \${var_name} has default value '\${default_value}' instead of the actual secret."
+                  echo "This indicates GitHub Actions secrets failed to load. Please retry the workflow."
+                  return 1
+              fi
+
+              return 0
+          }
+
+          echo "Validating critical environment variables..."
+
+          # These are the raw values from GitHub Actions (before export)
+          # We check them before exporting to catch issues early
+          VALIDATION_FAILED=0
+
+          validate_env "SHARDOK_ADDRESS" "${SHARDOK_ADDRESS}" "" || VALIDATION_FAILED=1
+          validate_env "EAGLE_IMAGE" "${EAGLE_IMAGE}" "" || VALIDATION_FAILED=1
+          validate_env "JWT_PRIVATE_KEY" "${JWT_PRIVATE_KEY}" "" || VALIDATION_FAILED=1
+          validate_env "DO_REGISTRY_TOKEN" "${DO_REGISTRY_TOKEN}" "" || VALIDATION_FAILED=1
+
+          if [ "\${VALIDATION_FAILED}" -eq 1 ]; then
+              echo ""
+              echo "========================================="
+              echo "DEPLOYMENT ABORTED: Missing critical secrets"
+              echo "This is likely a transient GitHub Actions issue."
+              echo "Please retry the workflow."
+              echo "========================================="
+              exit 1
+          fi
+
+          echo "All critical environment variables validated successfully."
+
+          # =================================================================
+          # Export environment variables for docker compose
+          # These are passed via heredoc and exported so child processes (docker compose) can access them
+          export EAGLE_IMAGE="${EAGLE_IMAGE}"
+          export ADMIN_IMAGE="${ADMIN_IMAGE}"
+          export JFR_SIDECAR_IMAGE="${JFR_SIDECAR_IMAGE}"
+          export OPENAI_API_KEY="${OPENAI_API_KEY}"
+          export GPT_MODEL_NAME="${GPT_MODEL_NAME:-gpt-4o}"
+          export EAGLE_ENABLE_S3="${EAGLE_ENABLE_S3:-false}"
+          export DO_SPACES_ACCESS_KEY="${DO_SPACES_ACCESS_KEY}"
+          export DO_SPACES_SECRET_KEY="${DO_SPACES_SECRET_KEY}"
+          export JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
+          export DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
+          export DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
+          export GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
+          export GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
+          export GH_OAUTH_CLIENT_ID="${GH_OAUTH_CLIENT_ID}"
+          export GH_OAUTH_CLIENT_SECRET="${GH_OAUTH_CLIENT_SECRET}"
+          export APPLE_SIGNIN_CLIENT_ID="${APPLE_SIGNIN_CLIENT_ID}"
+          export APPLE_TEAM_ID="${APPLE_TEAM_ID}"
+          export APPLE_SIGNIN_KEY_ID="${APPLE_SIGNIN_KEY_ID}"
+          export APPLE_SIGNIN_PRIVATE_KEY="${APPLE_SIGNIN_PRIVATE_KEY}"
+          export TWITCH_CLIENT_ID="${TWITCH_CLIENT_ID}"
+          export TWITCH_CLIENT_SECRET="${TWITCH_CLIENT_SECRET}"
+          export SHARDOK_ADDRESS="${SHARDOK_ADDRESS}"
+          export SHARDOK_AUTH_TOKEN="${SHARDOK_AUTH_TOKEN}"
+          export SENTRY_DSN="${SENTRY_DSN}"
+          export FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
+          export FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
+          export FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
+          export DO_REGISTRY_TOKEN="${DO_REGISTRY_TOKEN}"
+
+          # Check Docker has IPv6 support
+          if ! cat /etc/docker/daemon.json 2>/dev/null | grep -q '"ip6tables"'; then
+            echo "WARNING: Docker IPv6 not configured. Eagle may not reach Hetzner Shardok."
+          fi
+
+          # Login to registry
+          echo "\$DO_REGISTRY_TOKEN" | docker login registry.digitalocean.com -u "\$DO_REGISTRY_TOKEN" --password-stdin
+
+          echo "Using images: \$EAGLE_IMAGE, \$ADMIN_IMAGE, \$JFR_SIDECAR_IMAGE"
+
+          # Install crane for pulling OCI images
+          echo "Installing crane..."
+          rm -f crane
+          curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
+          chmod +x crane
+
+          # Pull and load all images
+          echo "Pulling Eagle image..."
+          ./crane pull "\${EAGLE_IMAGE}" eagle.tar && docker load -i eagle.tar && rm eagle.tar
+
+          echo "Pulling Admin image..."
+          ./crane pull "\${ADMIN_IMAGE}" admin.tar && docker load -i admin.tar && rm admin.tar
+
+          echo "Pulling JFR Sidecar image..."
+          ./crane pull "\${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar && docker load -i jfr-sidecar.tar && rm jfr-sidecar.tar
+
+          # Pull other compose images
+          docker pull nginx:alpine || true
+          docker pull certbot/certbot || true
+
+          echo "All images pulled successfully"
+
+          # =================================================================
+          # Verify Shardok connectivity before proceeding with deployment
+          # This catches network/firewall issues early
+          # =================================================================
+          echo "Verifying Shardok connectivity..."
+          SHARDOK_HOST=\$(echo "\${SHARDOK_ADDRESS}" | cut -d: -f1)
+          SHARDOK_PORT=\$(echo "\${SHARDOK_ADDRESS}" | cut -d: -f2)
+
+          # Try to connect to Shardok (timeout after 10 seconds)
+          if nc -z -w 10 "\${SHARDOK_HOST}" "\${SHARDOK_PORT}" 2>/dev/null; then
+              echo "Shardok connectivity verified: \${SHARDOK_ADDRESS} is reachable"
+          else
+              echo ""
+              echo "========================================="
+              echo "ERROR: Cannot reach Shardok at \${SHARDOK_ADDRESS}"
+              echo "This may indicate:"
+              echo "  - Shardok server is not running on Hetzner"
+              echo "  - Network/firewall issues between DigitalOcean and Hetzner"
+              echo "  - Incorrect SHARDOK_ADDRESS configuration"
+              echo ""
+              echo "DEPLOYMENT ABORTED: Shardok must be reachable for battles to work."
+              echo "========================================="
+              exit 1
+          fi
+
+          # Stop local shardok container if running (now runs on Hetzner)
+          docker stop shardok-server 2>/dev/null || true
+          docker rm shardok-server 2>/dev/null || true
+
+          # Deploy Eagle with blue-green (handles eagle, nginx, admin, jfr-sidecar)
+          # Note: Shardok runs on Hetzner, deployed separately via shardok_arm64_build.yml
+          # Note: Auth is deployed separately via auth_build.yml - do NOT touch auth here
+          chmod +x /opt/eagle0/scripts/*.sh
+          [ -f "/opt/eagle0/scripts/bin/warmup" ] && chmod +x /opt/eagle0/scripts/bin/warmup
+          GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
+          /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}"
+
+          # Verify
+          sleep 10
+          docker compose -f docker-compose.prod.yml ps
+          docker compose -f docker-compose.prod.yml images
+
+          # Cleanup
+          docker container prune -f
+          docker image prune -f
+          DEPLOY_SCRIPT

.github/workflows/eagle_build.yml

@@ -0,0 +1,37 @@
+name: Eagle Build
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'src/main/scala/**'
+      - 'src/main/protobuf/net/eagle0/eagle/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'WORKSPACE'
+      - 'MODULE.bazel'
+      - 'BUILD.bazel'
+      - '.github/workflows/eagle_build.yml'
+  pull_request:
+    paths:
+      - 'src/main/scala/**'
+      - 'src/main/protobuf/net/eagle0/eagle/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'WORKSPACE'
+      - 'MODULE.bazel'
+      - 'BUILD.bazel'
+      - '.github/workflows/eagle_build.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: [self-hosted, bazel]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+      - name: Build Eagle server
+        run: bazel build //src/main/scala/net/eagle0/eagle:eagle_server

.github/workflows/installer_build.yml

@@ -10,13 +10,15 @@ on:
     paths:
       - ".github/workflows/installer_build.yml"
       - "src/main/csharp/net/eagle0/clients/win/installer/**"
+  workflow_dispatch:
 
 permissions:
   contents: read
+  actions: write  # Required to delete artifacts after deploy
 
 jobs:
   build-installer:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
       - uses: actions/checkout@v4
@@ -29,6 +31,19 @@ jobs:
         with:
           dotnet-version: '8.0.x'
 
+      - name: Inject manifest public key
+        env:
+          MANIFEST_PUBLIC_KEY: ${{ secrets.MANIFEST_PUBLIC_KEY }}
+        run: |
+          if [ -n "$MANIFEST_PUBLIC_KEY" ]; then
+            CONFIG_FILE="src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/configuration.txt"
+            echo "manifest_public_key = $MANIFEST_PUBLIC_KEY" >> "$CONFIG_FILE"
+            echo "Injected manifest public key into configuration.txt"
+            cat "$CONFIG_FILE"
+          else
+            echo "MANIFEST_PUBLIC_KEY not set, skipping injection"
+          fi
+
       - name: Restore dependencies
         run: dotnet restore src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/EagleInstaller.csproj
 
@@ -41,6 +56,7 @@ jobs:
         with:
           name: eagle-installer
           path: ./installer-output/EagleInstaller.exe
+          retention-days: 1
 
       - name: Verify installer exists
         if: success()
@@ -68,15 +84,46 @@ jobs:
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
+          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
         run: |
-          # Create installer manifest content  
+          # Create installer manifest content
           INSTALLER_SHA=$(sha256sum ./installer-output/EagleInstaller.exe | cut -d' ' -f1)
           echo "installer_version=$INSTALLER_SHA" > /tmp/installer_manifest.txt
           echo "installer_url=installer/EagleInstaller.exe" >> /tmp/installer_manifest.txt
-          
+
           echo "=== Installer manifest content ==="
           cat /tmp/installer_manifest.txt
           echo "=================================="
-          
-          # Update the unified manifest
-          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer /tmp/installer_manifest.txt
+
+          # Write signing key to temp file (if available)
+          SIGNING_ARGS=""
+          if [ -n "$MANIFEST_SIGNING_KEY" ]; then
+            echo "$MANIFEST_SIGNING_KEY" > /tmp/manifest_signing_key
+            chmod 600 /tmp/manifest_signing_key
+            SIGNING_ARGS="/tmp/manifest_signing_key"
+            echo "Manifest signing key available"
+          else
+            echo "Warning: MANIFEST_SIGNING_KEY not set, manifest will be unsigned"
+          fi
+
+          # Update the unified manifest (with optional signing)
+          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer /tmp/installer_manifest.txt $SIGNING_ARGS
+
+          # Cleanup
+          rm -f /tmp/manifest_signing_key
+
+      - name: Delete all installer artifacts
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete ALL eagle-installer artifacts to free up storage
+          # The installer is deployed to S3, so artifacts are redundant
+          echo "Fetching all eagle-installer artifacts..."
+          artifact_ids=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
+            --paginate -q '.artifacts[] | select(.name == "eagle-installer") | .id')
+          for id in $artifact_ids; do
+            echo "Deleting artifact ID: $id"
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" || true
+          done
+          echo "Cleanup complete"

.github/workflows/mac_build.yml

@@ -0,0 +1,332 @@
+name: Mac Build
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - ".github/workflows/mac_build.yml"
+      - "src/main/csharp/net/eagle0/clients/unity/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
+      - "src/main/go/net/eagle0/build/mac_build_handler/**"
+      - "scripts/build_protos.sh"
+      - "scripts/build_mac_plugin.sh"
+      - "scripts/inject_sparkle.sh"
+      - "scripts/codesign_mac_app.sh"
+      - "scripts/notarize_submit.sh"
+      - "scripts/notarize_wait.sh"
+      - "ci/github_actions/build_mac.sh"
+      - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/upload_addressables.sh"
+      - "ci/mac/**"
+  pull_request:
+    paths:
+      - ".github/workflows/mac_build.yml"
+      - "src/main/csharp/net/eagle0/clients/unity/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
+      - "src/main/go/net/eagle0/build/mac_build_handler/**"
+      - "scripts/build_mac_plugin.sh"
+      - "scripts/inject_sparkle.sh"
+      - "scripts/codesign_mac_app.sh"
+      - "scripts/notarize_submit.sh"
+      - "scripts/notarize_wait.sh"
+      - "ci/github_actions/build_mac.sh"
+      - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/upload_addressables.sh"
+      - "ci/mac/**"
+  workflow_dispatch:
+    inputs:
+      skip_signing:
+        description: 'Skip code signing, notarization, and deploy (build only)'
+        required: false
+        default: 'false'
+        type: boolean
+
+permissions:
+  contents: read
+  actions: write  # Required to delete artifacts after deploy
+
+jobs:
+  build-and-sign:
+    runs-on: [self-hosted, macOS, unity-mac]
+    outputs:
+      submission_id: ${{ steps.notarize-submit.outputs.submission_id }}
+      should_deploy: ${{ steps.check-deploy.outputs.should_deploy }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+          clean: true  # Remove untracked files like old SparklePlugin.bundle
+          fetch-depth: 0  # For version numbering from git history
+
+      - name: Pull LFS files
+        run: git lfs pull
+
+      - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: mac
+        run: ./ci/github_actions/restore_library.sh
+
+      - name: Build Mac Unity
+        run: ./ci/github_actions/build_unity_mac.sh "/tmp/eagle0/eagle0MAC"
+
+      - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: mac
+        run: ./ci/github_actions/persist_library.sh
+
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh StandaloneOSX
+
+      - name: Inject Sparkle Framework
+        if: success()
+        env:
+          SPARKLE_EDDSA_PUBLIC_KEY: ${{ secrets.SPARKLE_EDDSA_PUBLIC_KEY }}
+        run: |
+          chmod +x ./scripts/inject_sparkle.sh
+          ./scripts/inject_sparkle.sh "/tmp/eagle0/eagle0MAC/eagle0.app"
+
+      - name: Check if should deploy
+        id: check-deploy
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.skip_signing }}" == "true" ]]; then
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          else
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Import Code Signing Certificate
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        env:
+          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
+        run: |
+          # Generate random keychain password (only used within this workflow run)
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
+
+          # Decode certificate
+          echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
+
+          # Delete any existing keychain from previous runs
+          security delete-keychain build.keychain 2>/dev/null || true
+
+          # Create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+
+          # Import certificate
+          security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+
+          # Allow codesign to access keychain
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+
+          # Clean up
+          rm certificate.p12
+
+      - name: Code Sign App
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        env:
+          SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
+        run: |
+          chmod +x ./scripts/codesign_mac_app.sh
+          ./scripts/codesign_mac_app.sh "/tmp/eagle0/eagle0MAC/eagle0.app" "ci/mac/eagle0.entitlements"
+
+      - name: Submit for Notarization
+        id: notarize-submit
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+          TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          chmod +x ./scripts/notarize_submit.sh
+          ./scripts/notarize_submit.sh "/tmp/eagle0/eagle0MAC/eagle0.app" >> $GITHUB_OUTPUT
+
+      - name: Cleanup Keychain
+        if: always()
+        run: |
+          security delete-keychain build.keychain 2>/dev/null || true
+
+      - name: Zip signed app for artifact
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          ditto -c -k --keepParent eagle0.app eagle0.app.zip
+
+      - name: Upload signed app
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: signed-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC/eagle0.app.zip
+          retention-days: 1
+
+      - name: Archive Build Log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: editor_mac.log
+          path: /tmp/eagle0/editor_mac.log
+          retention-days: 5
+
+  wait-notarization:
+    needs: build-and-sign
+    if: needs.build-and-sign.outputs.should_deploy == 'true'
+    runs-on: [self-hosted, macOS, notarize]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: scripts
+
+      - name: Clean download directory
+        run: rm -rf /tmp/eagle0/eagle0MAC
+
+      - name: Download signed app
+        uses: actions/download-artifact@v4
+        with:
+          name: signed-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC
+
+      - name: Unzip signed app
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          ditto -x -k eagle0.app.zip .
+          rm eagle0.app.zip
+          ls -la /tmp/eagle0/eagle0MAC/eagle0.app/
+
+      - name: Wait for Notarization and Staple
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+          TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          chmod +x ./scripts/notarize_wait.sh
+          ./scripts/notarize_wait.sh "${{ needs.build-and-sign.outputs.submission_id }}" "/tmp/eagle0/eagle0MAC/eagle0.app"
+
+      - name: Zip notarized app for artifact
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          rm -f eagle0.app.zip
+          ditto -c -k --keepParent eagle0.app eagle0.app.zip
+
+      - name: Upload notarized app
+        uses: actions/upload-artifact@v4
+        with:
+          name: notarized-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC/eagle0.app.zip
+          retention-days: 1
+
+  deploy:
+    needs: [build-and-sign, wait-notarization]
+    if: needs.build-and-sign.outputs.should_deploy == 'true'
+    runs-on: [self-hosted, macOS, unity-mac]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # For version numbering
+
+      - name: Clean download directory
+        run: rm -rf /tmp/eagle0/eagle0MAC
+
+      - name: Download notarized app
+        uses: actions/download-artifact@v4
+        with:
+          name: notarized-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC
+
+      - name: Unzip notarized app
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          ditto -x -k eagle0.app.zip .
+          rm eagle0.app.zip
+
+      - name: Deploy Mac Build
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+          SPARKLE_EDDSA_PRIVATE_KEY: ${{ secrets.SPARKLE_EDDSA_PRIVATE_KEY }}
+        run: |
+          # Write private key to temp file for signing
+          SPARKLE_PRIVATE_KEY_PATH="/tmp/sparkle_private_key"
+          echo "$SPARKLE_EDDSA_PRIVATE_KEY" > "$SPARKLE_PRIVATE_KEY_PATH"
+          chmod 600 "$SPARKLE_PRIVATE_KEY_PATH"
+
+          # Install dmgbuild (creates .DS_Store programmatically, no AppleScript needed)
+          pip3 install dmgbuild
+
+          # Background image for styled DMG
+          BACKGROUND_PATH="$(pwd)/ci/mac/dmg/background.png"
+
+          # Read version from the built app's Info.plist to ensure appcast matches the actual app
+          APP_PATH="/tmp/eagle0/eagle0MAC/eagle0.app"
+          BUILD_NUMBER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$APP_PATH/Contents/Info.plist")
+          VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$APP_PATH/Contents/Info.plist")
+
+          bazel run //src/main/go/net/eagle0/build/mac_build_handler:mac_build_handler -- \
+            "/tmp/eagle0/eagle0MAC/eagle0.app" \
+            "$VERSION" \
+            "$BUILD_NUMBER" \
+            "$BACKGROUND_PATH" \
+            "$SPARKLE_PRIVATE_KEY_PATH"
+
+          rm "$SPARKLE_PRIVATE_KEY_PATH"
+
+      - name: Delete this run's Mac app artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete this run's artifacts (names include run ID to avoid conflicts)
+          for artifact_name in signed-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }}; do
+            echo "Deleting artifact: $artifact_name"
+            artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+              -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+            if [ -n "$artifact_id" ]; then
+              echo "Deleting artifact ID: $artifact_id"
+              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+            fi
+          done
+          echo "Cleanup complete"
+
+  # Cleanup job runs regardless of success/failure to prevent artifact accumulation
+  cleanup:
+    needs: [build-and-sign, wait-notarization, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete this run's Mac app artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete this run's artifacts (names include run ID to avoid conflicts)
+          for artifact_name in signed-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }}; do
+            echo "Deleting artifact: $artifact_name"
+            artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+              -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+            if [ -n "$artifact_id" ]; then
+              echo "Deleting artifact ID: $artifact_id"
+              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+            fi
+          done
+          echo "Cleanup complete"

.github/workflows/mac_history_build.yml

@@ -1,29 +0,0 @@
-name: Mac History Editor Build
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - ".github/workflows/mac_history_build.yml"
-      - "src/main/swift/net/eagle0/EagleGameHistoryViewer/**"
-      - "src/main/protobuf/net/eagle0/eagle/**"
-  pull_request:
-    paths:
-      - ".github/workflows/mac_history_build.yml"
-      - "src/main/swift/net/eagle0/EagleGameHistoryViewer/**"
-      - "src/main/protobuf/net/eagle0/eagle/**"
-
-permissions:
-  contents: read
-
-jobs:
-  mac-history-build:
-    runs-on: self-hosted
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          lfs: false
-          clean: false
-      - name: Build the mac history
-        run: ./ci/github_actions/build_mac_history.sh

.github/workflows/registry_cleanup.yml

@@ -0,0 +1,92 @@
+name: Cleanup Old Container Images
+
+on:
+  schedule:
+    # Run daily at 3am UTC
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry run (show what would be deleted without deleting)'
+        required: true
+        default: 'true'
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install doctl
+        uses: digitalocean/action-doctl@v2
+        with:
+          token: ${{ secrets.DO_REGISTRY_TOKEN }}
+
+      - name: Cleanup old images
+        env:
+          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true' }}
+        run: |
+          set -e
+
+          RETENTION_DAYS=5
+          CUTOFF_DATE=$(date -d "-${RETENTION_DAYS} days" +%s)
+          REGISTRY="eagle0"
+
+          echo "Cleaning up images older than ${RETENTION_DAYS} days"
+          echo "Cutoff date: $(date -d "@${CUTOFF_DATE}" -Iseconds)"
+          echo "Dry run: ${DRY_RUN}"
+          echo ""
+
+          # List of repositories to clean
+          # Use tail to skip header row in case --no-header doesn't work
+          REPOS=$(doctl registry repository list-v2 --format Name --no-header | grep -v '^Name$' | grep -v '^$')
+
+          for REPO in $REPOS; do
+            echo "=== Processing repository: ${REPO} ==="
+
+            # Get all manifests with their tags and dates using JSON output for reliable parsing
+            MANIFESTS_JSON=$(doctl registry repository list-manifests "${REPO}" --output json 2>/dev/null || echo "[]")
+
+            if [ "$MANIFESTS_JSON" = "[]" ] || [ -z "$MANIFESTS_JSON" ]; then
+              echo "  No manifests found"
+              continue
+            fi
+
+            # Parse JSON and process each manifest
+            echo "$MANIFESTS_JSON" | jq -r '.[] | "\(.digest) \(.updated_at) \(.tags // [] | join(","))"' | while read -r DIGEST UPDATED_AT TAGS; do
+              # Skip if no digest or if it doesn't look like a valid digest (sha256:...)
+              if [ -z "$DIGEST" ] || ! echo "$DIGEST" | grep -q '^sha256:'; then
+                continue
+              fi
+
+              # Parse the date (ISO 8601 format from JSON)
+              MANIFEST_DATE=$(date -d "$UPDATED_AT" +%s 2>/dev/null || echo "0")
+
+              # Skip protected tags (latest, arm64-latest)
+              if echo ",$TAGS," | grep -qE ',(latest|arm64-latest),'; then
+                echo "  KEEP: ${DIGEST:0:20}... (protected tag: $TAGS)"
+                continue
+              fi
+
+              # Check if older than cutoff
+              if [ "$MANIFEST_DATE" -lt "$CUTOFF_DATE" ]; then
+                echo "  DELETE: ${DIGEST:0:20}... (updated: $UPDATED_AT, tags: $TAGS)"
+                if [ "$DRY_RUN" != "true" ]; then
+                  doctl registry repository delete-manifest "${REPO}" "$DIGEST" --force
+                fi
+              else
+                echo "  KEEP: ${DIGEST:0:20}... (updated: $UPDATED_AT, tags: $TAGS)"
+              fi
+            done
+
+            echo ""
+          done
+
+      - name: Run garbage collection
+        if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'false')
+        run: |
+          echo "Starting garbage collection..."
+          doctl registry garbage-collection start --force
+          echo "Garbage collection started. It may take a few minutes to complete."

.github/workflows/shardok_arm64_build.yml

@@ -0,0 +1,221 @@
+name: Shardok ARM64 Build and Push
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'src/main/cpp/**'
+      - 'src/main/protobuf/net/eagle0/shardok/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'src/main/resources/net/eagle0/shardok/**'
+      - 'ci/BUILD.bazel'
+      - 'MODULE.bazel'
+      - '.github/workflows/shardok_arm64_build.yml'
+  workflow_dispatch:
+    inputs:
+      push_images:
+        description: 'Push images to container registry'
+        required: true
+        default: 'true'
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build-shardok-arm64:
+    runs-on: [self-hosted, bazel]
+    outputs:
+      image_tag: ${{ steps.push-shardok.outputs.image_tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Build Shardok ARM64 binary (cross-compile for Linux ARM64)
+        run: |
+          set -ex
+
+          echo "=== Building shardok-server binary for linux-aarch64 ==="
+          bazel build \
+            --platforms=//:linux_arm64 \
+            --extra_toolchains=@llvm_toolchain_linux_arm64//:all \
+            //src/main/cpp/net/eagle0/shardok:shardok-server
+
+          LINUX_BIN="bazel-bin/src/main/cpp/net/eagle0/shardok/shardok-server"
+          echo "=== Checking binary at: $LINUX_BIN ==="
+
+          if [ ! -f "$LINUX_BIN" ]; then
+            echo "ERROR: Binary not found at $LINUX_BIN"
+            exit 1
+          fi
+
+          # Verify it's ELF (Linux) not Mach-O (macOS)
+          echo "=== Verifying binary format ==="
+          MAGIC=$(head -c 4 "$LINUX_BIN" | xxd -p)
+          echo "Binary magic bytes: $MAGIC"
+
+          if [ "$MAGIC" = "7f454c46" ]; then
+            echo "SUCCESS: Binary is ELF format (Linux)"
+            # Check if it's ARM64 (e_machine = 0xB7 = 183 for aarch64)
+            E_MACHINE=$(od -An -j18 -N2 -tx2 "$LINUX_BIN" | tr -d ' ')
+            echo "ELF e_machine: $E_MACHINE"
+            if [ "$E_MACHINE" = "b700" ]; then
+              echo "SUCCESS: Binary is ARM64 (aarch64)"
+            else
+              echo "WARNING: Binary e_machine is $E_MACHINE (expected b700 for aarch64)"
+            fi
+          elif [ "$MAGIC" = "cfaeedfe" ] || [ "$MAGIC" = "cffaedfe" ]; then
+            echo "ERROR: Binary is Mach-O format (macOS) - cross-compilation failed!"
+            exit 1
+          else
+            echo "WARNING: Unknown binary format: $MAGIC"
+            file "$LINUX_BIN" || true
+          fi
+
+      - name: Build Shardok ARM64 Docker image
+        id: build-shardok
+        run: |
+          set -ex
+
+          bazel build \
+            --platforms=//:linux_arm64 \
+            --extra_toolchains=@llvm_toolchain_linux_arm64//:all \
+            //ci:shardok_server_image_arm64
+
+          IMAGE_PATH=$(readlink -f bazel-bin/ci/shardok_server_image_arm64)
+          echo "Image path: $IMAGE_PATH"
+          echo "image_path=$IMAGE_PATH" >> $GITHUB_OUTPUT
+
+          # Verify the binary inside the tar layer is ARM64 ELF
+          echo "=== Verifying binary in image tar ==="
+          BINARY_TAR="bazel-bin/ci/shardok_binary_layer_arm64.tar"
+          if [ -f "$BINARY_TAR" ]; then
+            echo "Checking binary in $BINARY_TAR"
+            MAGIC=$(tar -xOf "$BINARY_TAR" app/shardok-server 2>/dev/null | head -c 4 | xxd -p)
+            echo "Binary magic in tar: $MAGIC"
+            if [ "$MAGIC" = "7f454c46" ]; then
+              echo "SUCCESS: Binary in tar is ELF format (Linux)"
+            else
+              echo "ERROR: Binary in tar is NOT ELF format!"
+              exit 1
+            fi
+          else
+            echo "WARNING: Could not find $BINARY_TAR"
+          fi
+
+      - name: Login to DigitalOcean Container Registry
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DO_REGISTRY_TOKEN: ${{ secrets.DO_REGISTRY_TOKEN }}
+        run: |
+          AUTH=$(echo -n "${DO_REGISTRY_TOKEN}:${DO_REGISTRY_TOKEN}" | base64)
+          echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+
+      - name: Push Shardok ARM64 image to DigitalOcean
+        id: push-shardok
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        run: |
+          set -ex
+
+          CROSS_IMAGE="${{ steps.build-shardok.outputs.image_path }}"
+          echo "Using cross-compiled image: $CROSS_IMAGE"
+
+          if [ -z "$CROSS_IMAGE" ] || [ ! -d "$CROSS_IMAGE" ]; then
+            echo "ERROR: Cross-compiled image not found at: $CROSS_IMAGE"
+            exit 1
+          fi
+
+          # Build a push target to get crane in runfiles
+          bazel build //ci:eagle_server_push
+
+          # Find the Darwin crane binary
+          RUNFILES="bazel-bin/ci/push_eagle_server_push.sh.runfiles"
+          CRANE=$(find "$RUNFILES" -path "*darwin*" -name crane 2>/dev/null | head -1)
+          if [ -z "$CRANE" ]; then
+            CRANE=$(find "$RUNFILES" -name crane 2>/dev/null | head -1)
+          fi
+          if [ -z "$CRANE" ] || [ ! -e "$CRANE" ]; then
+            echo "ERROR: crane not found"
+            exit 1
+          fi
+          echo "Using crane: $CRANE"
+
+          # Push with arm64-prefixed SHA tag (same repo as x86, different tag)
+          GIT_SHA=$(git rev-parse --short=8 HEAD)
+          IMAGE_TAG="registry.digitalocean.com/eagle0/shardok-server:arm64-${GIT_SHA}"
+          echo "Pushing shardok ARM64 image: $IMAGE_TAG"
+          $CRANE push "$CROSS_IMAGE" "$IMAGE_TAG"
+
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+
+          # Also update :arm64-latest tag for convenience
+          echo "Copying to :arm64-latest tag"
+          $CRANE copy "$IMAGE_TAG" "registry.digitalocean.com/eagle0/shardok-server:arm64-latest"
+
+          echo "=== Push complete ==="
+          echo "Image: $IMAGE_TAG"
+          echo "Also tagged as: registry.digitalocean.com/eagle0/shardok-server:arm64-latest"
+
+  deploy-hetzner:
+    runs-on: [self-hosted, bazel]
+    needs: [build-shardok-arm64]
+    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+    environment: production
+    env:
+      SHARDOK_IMAGE: ${{ needs.build-shardok-arm64.outputs.image_tag }}
+    steps:
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.HETZNER_SSH_KEY }}" > ~/.ssh/hetzner_deploy
+          chmod 600 ~/.ssh/hetzner_deploy
+          # Add host key to known_hosts to avoid prompt
+          ssh-keyscan -H ${{ secrets.HETZNER_IP }} >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Deploy to Hetzner
+        run: |
+          ssh -i ~/.ssh/hetzner_deploy -o StrictHostKeyChecking=accept-new deploy@${{ secrets.HETZNER_IP }} << 'ENDSSH'
+          set -ex
+          cd /opt/eagle0
+
+          # Login to registry
+          echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
+
+          echo "Deploying Shardok ARM64: ${{ needs.build-shardok-arm64.outputs.image_tag }}"
+
+          # Pull the new image
+          docker pull "${{ needs.build-shardok-arm64.outputs.image_tag }}"
+
+          # Stop and remove any container using port 40042 or named shardok*
+          docker ps -q --filter "publish=40042" | xargs -r docker stop
+          docker ps -aq --filter "name=shardok" | xargs -r docker rm -f
+          docker ps -aq --filter "publish=40042" | xargs -r docker rm -f
+
+          # Run new container
+          docker run -d \
+            --name shardok-ai \
+            --restart unless-stopped \
+            -p 40042:40042 \
+            -v /opt/eagle0/data:/data \
+            -v /etc/shardok:/etc/shardok:ro \
+            -v /etc/letsencrypt:/etc/letsencrypt:ro \
+            -v /usr/local/share/eagle0:/usr/local/share/eagle0:ro \
+            -e SHARDOK_RESOURCES_PATH=/app/resources \
+            -e SHARDOK_MAPS_PATH=/app/resources/maps \
+            "${{ needs.build-shardok-arm64.outputs.image_tag }}"
+
+          # Wait and verify
+          sleep 5
+          docker ps | grep shardok-ai
+
+          # Cleanup old images
+          docker image prune -f
+
+          echo "=== Hetzner deployment complete ==="
+          ENDSSH
+
+      - name: Cleanup SSH key
+        if: always()
+        run: rm -f ~/.ssh/hetzner_deploy

.github/workflows/shardok_build.yml

@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
       - name: Checkout repository

.github/workflows/unity_build.yml

@@ -6,67 +6,105 @@ on:
     paths:
       - ".github/workflows/unity_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "scripts/build_protos.sh"
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
       - "ci/github_actions/restore_library.sh"
       - "ci/github_actions/persist_library.sh"
+      - "ci/github_actions/upload_addressables.sh"
       - "MODULE.bazel"
       - "WORKSPACE"
-      - "src/main/proto/net/eagle0/eagle/**/BUILD.bazel"
+  workflow_dispatch:
   pull_request:
     paths:
       - ".github/workflows/unity_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "scripts/build_protos.sh"
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
       - "ci/github_actions/restore_library.sh"
       - "ci/github_actions/persist_library.sh"
+      - "ci/github_actions/upload_addressables.sh"
       - "MODULE.bazel"
       - "WORKSPACE"
-      - "src/main/proto/**/BUILD.bazel"
 
 permissions:
   contents: read
 
 jobs:
   windows-unity:
-    runs-on: self-hosted
+    runs-on: [self-hosted, macOS, unity-windows]
 
     steps:
       - uses: actions/checkout@v4
         with:
           lfs: true
-          clean: false
+          clean: true  # Remove untracked files from previous builds
       - name: Pull lfs files
         run: git lfs pull
       - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: windows
         run: ./ci/github_actions/restore_library.sh
       - name: Build Windows unity
         run: ./ci/github_actions/build_unity.sh "/tmp/eagle0/eagle0WIN"
       - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: windows
         run: ./ci/github_actions/persist_library.sh
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh StandaloneWindows64
       - name: Deploy Windows unity
-        if: success() #&& github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
         run: bazel run //src/main/go/net/eagle0/build/unity3d_windows_build_handler:unity3d_windows_build_handler -- "/tmp/eagle0/eagle0WIN" "/tmp/unity_manifest.txt"
 
       - name: Update unified manifest
-        if: success() #&& github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
-        run: bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- unity3d /tmp/unity_manifest.txt
+          MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }}
+        run: |
+          # Write signing key to temp file (if available)
+          SIGNING_ARGS=""
+          if [ -n "$MANIFEST_SIGNING_KEY" ]; then
+            echo "$MANIFEST_SIGNING_KEY" > /tmp/manifest_signing_key
+            chmod 600 /tmp/manifest_signing_key
+            SIGNING_ARGS="/tmp/manifest_signing_key"
+            echo "Manifest signing key available"
+          else
+            echo "Warning: MANIFEST_SIGNING_KEY not set, manifest will be unsigned"
+          fi
+
+          # Update the unified manifest (with optional signing)
+          bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- unity3d /tmp/unity_manifest.txt $SIGNING_ARGS
+
+          # Cleanup
+          rm -f /tmp/manifest_signing_key
       - name: Archive build log
         if: success() || failure()
         uses: actions/upload-artifact@v4
         with:
           name: editor_win.log
-          path: /tmp/eagle0/editor_win.log
+          path: /tmp/eagle0/editor_win.log
+          retention-days: 5

.gitignore

@@ -38,3 +38,4 @@ scripts/refresh_name_layers/refresh_name_layers.zip
 api_keys.txt
 
 src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/Packages/com.unity.dedicated-server/
+node_modules/

.pre-commit-config.yaml

@@ -35,10 +35,3 @@ repos:
         entry: ./scripts/pre-commit-gazelle.sh
         files: '(\.go|\.proto|BUILD\.bazel|BUILD|WORKSPACE|WORKSPACE\.bazel|\.bzl)$'
         pass_filenames: false
--   repo: local
-    hooks:
-    -   id: update-action-result-types
-        name: update-action-result-types
-        language: system
-        entry: ./scripts/updateActionResultTypes.sh
-        files: 'src/main/protobuf/net/eagle0/eagle/common/action_result_type.proto'

BUILD.bazel

@@ -12,6 +12,15 @@ platform(
     ],
 )
 
+# Platform for cross-compiling to Linux ARM64
+platform(
+    name = "linux_arm64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:aarch64",
+    ],
+)
+
 gazelle(name = "gazelle")
 
 # gazelle:proto file
@@ -23,3 +32,15 @@ nogo(
     vet = True,
     visibility = ["//visibility:public"],
 )
+
+# Dependency constraint tests
+# These verify architectural boundaries are maintained
+sh_test(
+    name = "build_deps_test",
+    srcs = ["scripts/check_build_deps.sh"],
+    args = ["--ci"],
+    tags = [
+        "local",  # Needs bazel query access
+        "no-sandbox",
+    ],
+)

CLAUDE.md

@@ -1,5 +1,23 @@
 # CLAUDE.md
 
+## CRITICAL GIT RULES (NEVER VIOLATE)
+
+**NEVER push directly to main/master.** No exceptions. Not for "small changes." Not for docs. Not ever.
+
+**NEVER merge PRs.** You create PRs. The user merges them. No exceptions.
+
+**ALWAYS use this workflow:**
+1. Create a feature branch from origin/main
+2. Commit to that branch
+3. Create a PR with `gh pr create`
+4. Wait for user to merge (DO NOT run `gh pr merge`)
+
+If you catch yourself about to run `git push origin main` or `git push origin <branch>:main`, STOP. You are about to violate a critical rule. Create a PR instead.
+
+If you catch yourself about to run `gh pr merge`, STOP. Only the user merges PRs.
+
+---
+
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
 ## Project Overview

MODULE.bazel

@@ -13,8 +13,8 @@ AWS_SDK_VERSION = "2.28.1"
 # Core Build Tools
 #
 
-bazel_dep(name = "bazel_skylib", version = "1.8.1")
-bazel_dep(name = "rules_pkg", version = "1.1.0")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+bazel_dep(name = "rules_pkg", version = "1.2.0")
 
 #
 # Language Support - Scala
@@ -57,32 +57,53 @@ llvm.toolchain(
     llvm_version = "20.1.2",
 )
 
-# Linux sysroot for cross-compilation (Chromium's Debian sysroot)
+# Linux x86_64 sysroot for cross-compilation
 llvm.sysroot(
     name = "llvm_toolchain_linux",
     label = "@linux_sysroot//sysroot",
     targets = ["linux-x86_64"],
 )
 
-use_repo(llvm, "llvm_toolchain", "llvm_toolchain_linux")
+# Cross-compilation toolchain (macOS -> Linux ARM64)
+llvm.toolchain(
+    name = "llvm_toolchain_linux_arm64",
+    llvm_version = "20.1.2",
+)
 
-# Download the Linux sysroot (Ubuntu 24.04 Noble for C++23 support)
+# Linux ARM64 sysroot for cross-compilation
+llvm.sysroot(
+    name = "llvm_toolchain_linux_arm64",
+    label = "@linux_sysroot_arm64//sysroot",
+    targets = ["linux-aarch64"],
+)
+
+use_repo(llvm, "llvm_toolchain", "llvm_toolchain_linux", "llvm_toolchain_linux_arm64")
+
+# Download the Linux sysroots (Ubuntu 24.04 Noble for C++23 support)
 # Built by: .github/workflows/build_sysroot.yml
 # To rebuild: Run the "Build Linux Sysroot" workflow with a new version, then update sha256 and URL
 sysroot = use_repo_rule("@toolchains_llvm//toolchain:sysroot.bzl", "sysroot")
+
+# x86_64 sysroot
 sysroot(
     name = "linux_sysroot",
-    # TODO: Update sha256 after running sysroot build workflow with version v2
-    sha256 = "PLACEHOLDER_RUN_SYSROOT_WORKFLOW_FIRST",
-    urls = ["https://eagle0.sfo3.digitaloceanspaces.com/sysroot/v2/ubuntu_noble_amd64_sysroot.tar.xz"],
+    sha256 = "a06475004fe8003ae7ccb4fe1d5511feb9b27cce4a8826eb1dfd686ed83f3dba",
+    urls = ["https://eagle0-sysroot.sfo3.digitaloceanspaces.com/v3/ubuntu_noble_amd64_sysroot.tar.xz"],
+)
+
+# ARM64 sysroot
+sysroot(
+    name = "linux_sysroot_arm64",
+    sha256 = "87469137737e09bc73855007dab835477eb10a7b3ce3f725f93f64e25747f3f9",
+    urls = ["https://eagle0-sysroot.sfo3.digitaloceanspaces.com/v4/ubuntu_noble_arm64_sysroot.tar.xz"],
 )
 
 #
 # Language Support - Go
 #
 
-bazel_dep(name = "rules_go", version = "0.56.1", repo_name = "io_bazel_rules_go")
-bazel_dep(name = "gazelle", version = "0.45.0", repo_name = "bazel_gazelle")
+bazel_dep(name = "rules_go", version = "0.59.0", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "gazelle", version = "0.47.0", repo_name = "bazel_gazelle")
 
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(version = "1.23.3")
@@ -95,6 +116,8 @@ use_repo(
     "com_github_aws_aws_sdk_go_v2_config",
     "com_github_aws_aws_sdk_go_v2_credentials",
     "com_github_aws_aws_sdk_go_v2_service_s3",
+    "com_github_golang_jwt_jwt_v5",
+    "com_github_google_uuid",
     "org_golang_google_grpc",
     "org_golang_google_protobuf",
 )
@@ -104,8 +127,15 @@ use_repo(
 #
 
 bazel_dep(name = "apple_support", version = "1.21.1", repo_name = "build_bazel_apple_support")
-bazel_dep(name = "rules_apple", version = "3.16.1", repo_name = "build_bazel_rules_apple")
-bazel_dep(name = "rules_swift", version = "2.3.1", repo_name = "build_bazel_rules_swift")
+bazel_dep(name = "rules_apple", version = "4.3.3", repo_name = "build_bazel_rules_apple")
+bazel_dep(name = "rules_swift", version = "2.4.0", repo_name = "build_bazel_rules_swift")
+
+# Register Apple CC toolchain for Objective-C compilation
+apple_cc_configure = use_extension(
+    "@build_bazel_apple_support//crosstool:setup.bzl",
+    "apple_cc_configure_extension",
+)
+use_repo(apple_cc_configure, "local_config_apple_cc")
 
 #
 # Protocol Buffers & RPC
@@ -114,7 +144,7 @@ bazel_dep(name = "rules_swift", version = "2.3.1", repo_name = "build_bazel_rule
 bazel_dep(name = "protobuf", version = "29.2", repo_name = "com_google_protobuf")
 bazel_dep(name = "grpc", version = "1.71.0")
 bazel_dep(name = "grpc-java", version = "1.71.0")
-bazel_dep(name = "flatbuffers", version = "25.2.10")
+bazel_dep(name = "flatbuffers", version = "25.9.23")
 
 #
 # Testing
@@ -126,33 +156,44 @@ bazel_dep(name = "googletest", version = "1.17.0")
 # Container Images (OCI)
 #
 
-bazel_dep(name = "rules_oci", version = "2.2.6")
-bazel_dep(name = "aspect_bazel_lib", version = "2.16.0")
+bazel_dep(name = "rules_oci", version = "2.2.7")
+bazel_dep(name = "aspect_bazel_lib", version = "2.22.4")
 
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 
-# Base image for Eagle (Java 17)
+# Base image for Eagle (Java 17 JDK - includes jcmd for JFR dumps)
 oci.pull(
     name = "eclipse_temurin_17",
-    digest = "sha256:d286b5352d98777bbf727f54038b04f0145cd9b76ca83f38a67aa111d4303748",
     image = "docker.io/library/eclipse-temurin",
     platforms = ["linux/amd64"],
+    tag = "17-jdk",
 )
 
 # Base image for Shardok (Ubuntu 24.04 for C++ runtime)
 oci.pull(
     name = "ubuntu_24_04",
     image = "docker.io/library/ubuntu",
-    platforms = ["linux/amd64"],
+    platforms = [
+        "linux/amd64",
+        "linux/arm64/v8",
+    ],
     tag = "24.04",
 )
-use_repo(oci, "eclipse_temurin_17", "eclipse_temurin_17_linux_amd64", "ubuntu_24_04", "ubuntu_24_04_linux_amd64")
+
+# Base image for Admin Server (Alpine for lightweight Go binary)
+oci.pull(
+    name = "alpine_linux",
+    image = "docker.io/library/alpine",
+    platforms = ["linux/amd64"],
+    tag = "3.21",
+)
+use_repo(oci, "alpine_linux", "alpine_linux_linux_amd64", "eclipse_temurin_17", "eclipse_temurin_17_linux_amd64", "ubuntu_24_04", "ubuntu_24_04_linux_amd64", "ubuntu_24_04_linux_arm64_v8")
 
 #
 # Java/Scala Dependencies
 #
 
-bazel_dep(name = "rules_jvm_external", version = "6.3")
+bazel_dep(name = "rules_jvm_external", version = "6.9")
 
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
@@ -206,9 +247,15 @@ maven.install(
         "org.reactivestreams:reactive-streams:1.0.4",
         "javax.xml.bind:jaxb-api:2.3.1",
 
-        # OkHttp (for SSE with read timeout support)
+        # OkHttp (for SSE with read timeout support, OAuth HTTP calls)
         "com.squareup.okhttp3:okhttp:4.12.0",
         "com.squareup.okhttp3:okhttp-sse:4.12.0",
+
+        # JWT (for OAuth token handling)
+        "com.nimbusds:nimbus-jose-jwt:9.37.3",
+
+        # Error tracking
+        "io.sentry:sentry:7.19.0",
     ],
     duplicate_version_warning = "error",
     fail_if_repin_required = True,
@@ -224,6 +271,7 @@ use_repo(maven, "maven", "unpinned_maven")
 #
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
 # GTL (for parallel_hashmap)
 GTL_VERSION = "1.2.0"
@@ -252,6 +300,42 @@ http_archive(
     ],
 )
 
+# Sparkle framework for macOS auto-updates
+SPARKLE_VERSION = "2.6.4"
+
+http_archive(
+    name = "sparkle",
+    build_file = "@//external:BUILD.sparkle",
+    sha256 = "50612a06038abc931f16011d7903b8326a362c1074dabccb718404ce8e585f0b",
+    strip_prefix = "",
+    url = "https://github.com/sparkle-project/Sparkle/releases/download/%s/Sparkle-%s.tar.xz" % (SPARKLE_VERSION, SPARKLE_VERSION),
+)
+
+# Busybox static binary for Docker health checks (provides nc, wget, etc.)
+# Primary: DigitalOcean Spaces (public, reliable)
+# Fallback: busybox.net (can be unreliable/slow)
+http_file(
+    name = "busybox_x86_64",
+    sha256 = "6e123e7f3202a8c1e9b1f94d8941580a25135382b99e8d3e34fb858bba311348",
+    urls = [
+        "https://eagle0-sysroot.sfo3.digitaloceanspaces.com/busybox/busybox-1.35.0-x86_64-linux-musl",
+        "https://busybox.net/downloads/binaries/1.35.0-x86_64-linux-musl/busybox",
+    ],
+    downloaded_file_path = "busybox",
+    executable = True,
+)
+
+http_file(
+    name = "busybox_aarch64",
+    sha256 = "141adb1b625a6f44c4b114f76b4387b4ea4f7ab802b88eb40e0d2f6adcccb1c3",
+    urls = [
+        # TODO: Upload aarch64 binary to GitHub release when needed
+        "https://busybox.net/downloads/binaries/1.35.0-aarch64-linux-musl/busybox",
+    ],
+    downloaded_file_path = "busybox",
+    executable = True,
+)
+
 #
 # Toolchain Registration
 #
@@ -265,5 +349,6 @@ register_toolchains(
 register_toolchains(
     "@llvm_toolchain//:all",
     "@llvm_toolchain_linux//:all",
+    "@llvm_toolchain_linux_arm64//:all",
     dev_dependency = True,
 )

MODULE.bazel.lock

@@ -27,9 +27,9 @@
     "https://bcr.bazel.build/modules/aspect_bazel_lib/1.40.3/MODULE.bazel": "668e6bcb4d957fc0e284316dba546b705c8d43c857f87119619ee83c4555b859",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.11.0/MODULE.bazel": "cb1ba9f9999ed0bc08600c221f532c1ddd8d217686b32ba7d45b0713b5131452",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.14.0/MODULE.bazel": "2b31ffcc9bdc8295b2167e07a757dbbc9ac8906e7028e5170a3708cecaac119f",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.16.0/MODULE.bazel": "852f9ebbda017572a7c113a2434592dd3b2f55cd9a0faea3d4be5a09a59e4900",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.19.3/MODULE.bazel": "253d739ba126f62a5767d832765b12b59e9f8d2bc88cc1572f4a73e46eb298ca",
-    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.19.3/source.json": "ffab9254c65ba945f8369297ad97ca0dec213d3adc6e07877e23a48624a8b456",
+    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.22.4/MODULE.bazel": "a05cbd9bc16712a58dc27ffe0dceaefd0da59a9bd87a227379b2a934b26a39ab",
+    "https://bcr.bazel.build/modules/aspect_bazel_lib/2.22.4/source.json": "9780bc57f521968ee82b7c3e85b7d0c71518fb7ce83ed7a9e5077ce20923207b",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.7.2/MODULE.bazel": "780d1a6522b28f5edb7ea09630748720721dfe27690d65a2d33aa7509de77e07",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.7.7/MODULE.bazel": "491f8681205e31bb57892d67442ce448cda4f472a8e6b3dc062865e29a64f89c",
     "https://bcr.bazel.build/modules/aspect_bazel_lib/2.8.1/MODULE.bazel": "812d2dd42f65dca362152101fbec418029cc8fd34cbad1a2fde905383d705838",
@@ -39,11 +39,11 @@
     "https://bcr.bazel.build/modules/aspect_rules_js/1.33.1/MODULE.bazel": "db3e7f16e471cf6827059d03af7c21859e7a0d2bc65429a3a11f005d46fc501b",
     "https://bcr.bazel.build/modules/aspect_rules_js/1.39.0/MODULE.bazel": "aece421d479e3c31dc3e5f6d49a12acc2700457c03c556650ec7a0ff23fc0d95",
     "https://bcr.bazel.build/modules/aspect_rules_js/2.0.0/MODULE.bazel": "b45b507574aa60a92796e3e13c195cd5744b3b8aff516a9c0cb5ae6a048161c5",
-    "https://bcr.bazel.build/modules/aspect_rules_js/2.1.3/MODULE.bazel": "47cc48eec374d69dced3cf9b9e5926beac2f927441acfb1a3568bbb709b25666",
-    "https://bcr.bazel.build/modules/aspect_rules_js/2.1.3/source.json": "6b0fe67780c101430be087381b7a79d75eeebe1a1eae6a2cee937713603634ac",
+    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/MODULE.bazel": "74bf20a7a6bd5f2be09607fdb4196cfd6f203422ea271752ec2b1afe95426101",
+    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/source.json": "411ec9d79d6f5fe8a083359588c21d01a5b48d88a2cbd334a4c90365015b7836",
     "https://bcr.bazel.build/modules/aspect_rules_lint/0.12.0/MODULE.bazel": "e767c5dbfeb254ec03275a7701b5cfde2c4d2873676804bc7cb27ddff3728fed",
-    "https://bcr.bazel.build/modules/aspect_rules_ts/3.4.0/MODULE.bazel": "5b554d5de90d96ee14117527c0519037713dd33884f3212eae391beccb2e94ff",
-    "https://bcr.bazel.build/modules/aspect_rules_ts/3.4.0/source.json": "9ada3722b716853b6dccdb7b650d8e776a23bc8a190de0c59bd15f21afea6f8a",
+    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/MODULE.bazel": "d0045b5eabb012be550a609589b3e5e47eba682344b19cfd9365d4d896ed07df",
+    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/source.json": "5593e3f1cd0dd5147f7748e163307fd5c2e1077913d6945b58739ad8d770a290",
     "https://bcr.bazel.build/modules/bazel_features/0.1.0/MODULE.bazel": "47011d645b0f949f42ee67f2e8775188a9cf4a0a1528aa2fa4952f2fd00906fd",
     "https://bcr.bazel.build/modules/bazel_features/1.1.0/MODULE.bazel": "cfd42ff3b815a5f39554d97182657f8c4b9719568eb7fded2b9135f084bf760b",
     "https://bcr.bazel.build/modules/bazel_features/1.1.1/MODULE.bazel": "27b8c79ef57efe08efccbd9dd6ef70d61b4798320b8d3c134fd571f78963dbcd",
@@ -57,12 +57,15 @@
     "https://bcr.bazel.build/modules/bazel_features/1.27.0/MODULE.bazel": "621eeee06c4458a9121d1f104efb80f39d34deff4984e778359c60eaf1a8cb65",
     "https://bcr.bazel.build/modules/bazel_features/1.28.0/MODULE.bazel": "4b4200e6cbf8fa335b2c3f43e1d6ef3e240319c33d43d60cc0fbd4b87ece299d",
     "https://bcr.bazel.build/modules/bazel_features/1.3.0/MODULE.bazel": "cdcafe83ec318cda34e02948e81d790aab8df7a929cec6f6969f13a489ccecd9",
+    "https://bcr.bazel.build/modules/bazel_features/1.30.0/MODULE.bazel": "a14b62d05969a293b80257e72e597c2da7f717e1e69fa8b339703ed6731bec87",
     "https://bcr.bazel.build/modules/bazel_features/1.34.0/MODULE.bazel": "e8475ad7c8965542e0c7aac8af68eb48c4af904be3d614b6aa6274c092c2ea1e",
     "https://bcr.bazel.build/modules/bazel_features/1.38.0/MODULE.bazel": "f9b8a9c890ebd216b4049fd12a31d3c2602e3403c7af636b04fbbd7453edc9c9",
     "https://bcr.bazel.build/modules/bazel_features/1.38.0/source.json": "31ba776c122b54a2885e23651642e32f087a87bf025465f8040751894b571277",
     "https://bcr.bazel.build/modules/bazel_features/1.4.1/MODULE.bazel": "e45b6bb2350aff3e442ae1111c555e27eac1d915e77775f6fdc4b351b758b5d7",
     "https://bcr.bazel.build/modules/bazel_features/1.9.0/MODULE.bazel": "885151d58d90d8d9c811eb75e3288c11f850e1d6b481a8c9f766adee4712358b",
     "https://bcr.bazel.build/modules/bazel_features/1.9.1/MODULE.bazel": "8f679097876a9b609ad1f60249c49d68bfab783dd9be012faf9d82547b14815a",
+    "https://bcr.bazel.build/modules/bazel_lib/3.0.0/MODULE.bazel": "22b70b80ac89ad3f3772526cd9feee2fa412c2b01933fea7ed13238a448d370d",
+    "https://bcr.bazel.build/modules/bazel_lib/3.0.0/source.json": "895f21909c6fba01d7c17914bb6c8e135982275a1b18cdaa4e62272217ef1751",
     "https://bcr.bazel.build/modules/bazel_skylib/1.0.3/MODULE.bazel": "bcb0fd896384802d1ad283b4e4eb4d718eebd8cb820b0a2c3a347fb971afd9d8",
     "https://bcr.bazel.build/modules/bazel_skylib/1.1.1/MODULE.bazel": "1add3e7d93ff2e6998f9e118022c84d163917d912f5afafb3058e3d2f1545b5e",
     "https://bcr.bazel.build/modules/bazel_skylib/1.2.0/MODULE.bazel": "44fe84260e454ed94ad326352a698422dbe372b21a1ac9f3eab76eb531223686",
@@ -77,7 +80,8 @@
     "https://bcr.bazel.build/modules/bazel_skylib/1.7.1/MODULE.bazel": "3120d80c5861aa616222ec015332e5f8d3171e062e3e804a2a0253e1be26e59b",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.1/MODULE.bazel": "88ade7293becda963e0e3ea33e7d54d3425127e0a326e0d17da085a5f1f03ff6",
     "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/MODULE.bazel": "69ad6927098316848b34a9142bcc975e018ba27f08c4ff403f50c1b6e646ca67",
-    "https://bcr.bazel.build/modules/bazel_skylib/1.8.2/source.json": "34a3c8bcf233b835eb74be9d628899bb32999d3e0eadef1947a0a562a2b16ffb",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/MODULE.bazel": "72997b29dfd95c3fa0d0c48322d05590418edef451f8db8db5509c57875fb4b7",
+    "https://bcr.bazel.build/modules/bazel_skylib/1.9.0/source.json": "7ad77c1e8c1b84222d9b3f3cae016a76639435744c19330b0b37c0a3c9da7dc0",
     "https://bcr.bazel.build/modules/bazel_worker_api/0.0.6/MODULE.bazel": "fd1f9432ca04c947e91b500df69ce7c5b6dbfe1bc45ab1820338205dae3383a6",
     "https://bcr.bazel.build/modules/bazel_worker_api/0.0.6/source.json": "5d68545f224904745a3cabd35aea6bc2b6cc5a78b7f49f3f69660eab2eeeb273",
     "https://bcr.bazel.build/modules/boringssl/0.0.0-20211025-d4f1ab9/MODULE.bazel": "6ee6353f8b1a701fe2178e1d925034294971350b6d3ac37e67e5a7d463267834",
@@ -104,8 +108,8 @@
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20241214-918efc9/MODULE.bazel": "24e05f6f52f37be63a795192848555a2c8c855e7814dbc1ed419fb04a7005464",
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/MODULE.bazel": "1fe72489212c530086e3ffb0e018b2bfef4663200ca03571570f9f006bef1d75",
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/source.json": "028519164a2e24563f4b43d810fdedc702daed90e71e7042d45ba82ad807b46f",
-    "https://bcr.bazel.build/modules/flatbuffers/25.2.10/MODULE.bazel": "dab15cafe8512d2c4a8daa44c2d7968c5c79f01e220d40076cdc260bf58605e2",
-    "https://bcr.bazel.build/modules/flatbuffers/25.2.10/source.json": "7eae7ea3eb913b9802426e4d5df11d6c6072a3573a548f8cabf1e965f5cca4d0",
+    "https://bcr.bazel.build/modules/flatbuffers/25.9.23/MODULE.bazel": "32753ba60bf3bacfe7737c0f3e8e3e55624b19af5d398c485580d57492d145d8",
+    "https://bcr.bazel.build/modules/flatbuffers/25.9.23/source.json": "a2116f0017f6896353fd3abf65ef2b89b0a257e8a87f395c5000f53934829f31",
     "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/MODULE.bazel": "cdf8cbe5ee750db04b78878c9633cc76e80dcf4416cbe982ac3a9222f80713c8",
     "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/source.json": "fa7b512dfcb5eafd90ce3959cf42a2a6fe96144ebbb4b3b3928054895f2afac2",
     "https://bcr.bazel.build/modules/gazelle/0.27.0/MODULE.bazel": "3446abd608295de6d90b4a8a118ed64a9ce11dcb3dda2dc3290a22056bd20996",
@@ -115,8 +119,8 @@
     "https://bcr.bazel.build/modules/gazelle/0.34.0/MODULE.bazel": "abdd8ce4d70978933209db92e436deb3a8b737859e9354fb5fd11fb5c2004c8a",
     "https://bcr.bazel.build/modules/gazelle/0.36.0/MODULE.bazel": "e375d5d6e9a6ca59b0cb38b0540bc9a05b6aa926d322f2de268ad267a2ee74c0",
     "https://bcr.bazel.build/modules/gazelle/0.37.0/MODULE.bazel": "d1327ba0907d0275ed5103bfbbb13518f6c04955b402213319d0d6c0ce9839d4",
-    "https://bcr.bazel.build/modules/gazelle/0.45.0/MODULE.bazel": "ecd19ebe9f8e024e1ccffb6d997cc893a974bcc581f1ae08f386bdd448b10687",
-    "https://bcr.bazel.build/modules/gazelle/0.45.0/source.json": "111d182facc5f5e80f0b823d5f077b74128f40c3fd2eccc89a06f34191bd3392",
+    "https://bcr.bazel.build/modules/gazelle/0.47.0/MODULE.bazel": "b61bb007c4efad134aa30ee7f4a8e2a39b22aa5685f005edaa022fbd1de43ebc",
+    "https://bcr.bazel.build/modules/gazelle/0.47.0/source.json": "aeb2e5df14b7fb298625d75d08b9c65bdb0b56014c5eb89da9e5dd0572280ae6",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.2/MODULE.bazel": "a70cf1bba851000ba93b58ae2f6d76490a9feb74192e57ab8e8ff13c34ec50cb",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.4/MODULE.bazel": "c6d54a11dcf64ee63545f42561eda3fd94c1b5f5ebe1357011de63ae33739d5e",
     "https://bcr.bazel.build/modules/google_benchmark/1.8.5/MODULE.bazel": "9ba9b31b984022828a950e3300410977eda2e35df35584c6b0b2d0c2e52766b7",
@@ -176,6 +180,7 @@
     "https://bcr.bazel.build/modules/opentracing-cpp/1.6.0/MODULE.bazel": "b3925269f63561b8b880ae7cf62ccf81f6ece55b62cd791eda9925147ae116ec",
     "https://bcr.bazel.build/modules/opentracing-cpp/1.6.0/source.json": "da1cb1add160f5e5074b7272e9db6fd8f1b3336c15032cd0a653af9d2f484aed",
     "https://bcr.bazel.build/modules/package_metadata/0.0.2/MODULE.bazel": "fb8d25550742674d63d7b250063d4580ca530499f045d70748b1b142081ebb92",
+    "https://bcr.bazel.build/modules/package_metadata/0.0.3/MODULE.bazel": "77890552ecea9e284b5424c9de827a58099348763a4359e975c359a83d4faa83",
     "https://bcr.bazel.build/modules/package_metadata/0.0.5/MODULE.bazel": "ef4f9439e3270fdd6b9fd4dbc3d2f29d13888e44c529a1b243f7a31dfbc2e8e4",
     "https://bcr.bazel.build/modules/package_metadata/0.0.5/source.json": "2326db2f6592578177751c3e1f74786b79382cd6008834c9d01ec865b9126a85",
     "https://bcr.bazel.build/modules/platforms/0.0.10/MODULE.bazel": "8cb8efaf200bdeb2150d93e162c40f388529a25852b332cec879373771e48ed5",
@@ -229,9 +234,9 @@
     "https://bcr.bazel.build/modules/rules_android/0.1.1/MODULE.bazel": "48809ab0091b07ad0182defb787c4c5328bd3a278938415c00a7b69b50c4d3a8",
     "https://bcr.bazel.build/modules/rules_android/0.1.1/source.json": "e6986b41626ee10bdc864937ffb6d6bf275bb5b9c65120e6137d56e6331f089e",
     "https://bcr.bazel.build/modules/rules_apple/3.16.0/MODULE.bazel": "0d1caf0b8375942ce98ea944be754a18874041e4e0459401d925577624d3a54a",
-    "https://bcr.bazel.build/modules/rules_apple/3.16.1/MODULE.bazel": "8294474defa70af2534a558ab905c083d69203344145e6f7d544d5098611ec7d",
-    "https://bcr.bazel.build/modules/rules_apple/3.16.1/source.json": "9190fd9d34a5d048bfbba8a530a57f2c2bf3f61e5634a9ab0b6ab005458857f9",
     "https://bcr.bazel.build/modules/rules_apple/3.5.1/MODULE.bazel": "3d1bbf65ad3692003d36d8a29eff54d4e5c1c5f4bfb60f79e28646a924d9101c",
+    "https://bcr.bazel.build/modules/rules_apple/4.3.3/MODULE.bazel": "c5c2c4adeeac5f3f2f9b7f16abfa8be7ffefa596171d0d92bed4cae9ade0a498",
+    "https://bcr.bazel.build/modules/rules_apple/4.3.3/source.json": "3cb1d69c8243ffcc42ecbf84ae8b9cccd7b1e2f091b0aee5a3e9c9a45267f312",
     "https://bcr.bazel.build/modules/rules_buf/0.1.1/MODULE.bazel": "6189aec18a4f7caff599ad41b851ab7645d4f1e114aa6431acf9b0666eb92162",
     "https://bcr.bazel.build/modules/rules_cc/0.0.1/MODULE.bazel": "cb2aa0747f84c6c3a78dad4e2049c154f08ab9d166b1273835a8174940365647",
     "https://bcr.bazel.build/modules/rules_cc/0.0.10/MODULE.bazel": "ec1705118f7eaedd6e118508d3d26deba2a4e76476ada7e0e3965211be012002",
@@ -246,6 +251,8 @@
     "https://bcr.bazel.build/modules/rules_cc/0.0.8/MODULE.bazel": "964c85c82cfeb6f3855e6a07054fdb159aced38e99a5eecf7bce9d53990afa3e",
     "https://bcr.bazel.build/modules/rules_cc/0.0.9/MODULE.bazel": "836e76439f354b89afe6a911a7adf59a6b2518fafb174483ad78a2a2fde7b1c5",
     "https://bcr.bazel.build/modules/rules_cc/0.1.1/MODULE.bazel": "2f0222a6f229f0bf44cd711dc13c858dad98c62d52bd51d8fc3a764a83125513",
+    "https://bcr.bazel.build/modules/rules_cc/0.1.2/MODULE.bazel": "557ddc3a96858ec0d465a87c0a931054d7dcfd6583af2c7ed3baf494407fd8d0",
+    "https://bcr.bazel.build/modules/rules_cc/0.1.5/MODULE.bazel": "88dfc9361e8b5ae1008ac38f7cdfd45ad738e4fa676a3ad67d19204f045a1fd8",
     "https://bcr.bazel.build/modules/rules_cc/0.2.14/MODULE.bazel": "353c99ed148887ee89c54a17d4100ae7e7e436593d104b668476019023b58df8",
     "https://bcr.bazel.build/modules/rules_cc/0.2.14/source.json": "55d0a4587c5592fad350f6e698530f4faf0e7dd15e69d43f8d87e220c78bea54",
     "https://bcr.bazel.build/modules/rules_foreign_cc/0.10.1/MODULE.bazel": "b9527010e5fef060af92b6724edb3691970a5b1f76f74b21d39f7d433641be60",
@@ -263,8 +270,8 @@
     "https://bcr.bazel.build/modules/rules_go/0.48.0/MODULE.bazel": "d00ebcae0908ee3f5e6d53f68677a303d6d59a77beef879598700049c3980a03",
     "https://bcr.bazel.build/modules/rules_go/0.50.1/MODULE.bazel": "b91a308dc5782bb0a8021ad4330c81fea5bda77f96b9e4c117b9b9c8f6665ee0",
     "https://bcr.bazel.build/modules/rules_go/0.53.0/MODULE.bazel": "a4ed760d3ac0dbc0d7b967631a9a3fd9100d28f7d9fcf214b4df87d4bfff5f9a",
-    "https://bcr.bazel.build/modules/rules_go/0.56.1/MODULE.bazel": "d5b835c548ac917345f1780cd2da52edc1130a908fe091c92096895303ae78a0",
-    "https://bcr.bazel.build/modules/rules_go/0.56.1/source.json": "0c902f7272e8d4e47e459af97be472bc19dadbbe6023a0719d1adce8483ac75a",
+    "https://bcr.bazel.build/modules/rules_go/0.59.0/MODULE.bazel": "b7e43e7414a3139a7547d1b4909b29085fbe5182b6c58cbe1ed4c6272815aeae",
+    "https://bcr.bazel.build/modules/rules_go/0.59.0/source.json": "1df17bb7865cfc029492c30163cee891d0dd8658ea0d5bfdf252c4b6db5c1ef6",
     "https://bcr.bazel.build/modules/rules_java/4.0.0/MODULE.bazel": "5a78a7ae82cd1a33cef56dc578c7d2a46ed0dca12643ee45edbb8417899e6f74",
     "https://bcr.bazel.build/modules/rules_java/5.1.0/MODULE.bazel": "324b6478b0343a3ce7a9add8586ad75d24076d6d43d2f622990b9c1cfd8a1b15",
     "https://bcr.bazel.build/modules/rules_java/5.3.5/MODULE.bazel": "a4ec4f2db570171e3e5eb753276ee4b389bae16b96207e9d3230895c99644b86",
@@ -292,7 +299,8 @@
     "https://bcr.bazel.build/modules/rules_jvm_external/6.0/MODULE.bazel": "37c93a5a78d32e895d52f86a8d0416176e915daabd029ccb5594db422e87c495",
     "https://bcr.bazel.build/modules/rules_jvm_external/6.1/MODULE.bazel": "75b5fec090dbd46cf9b7d8ea08cf84a0472d92ba3585b476f44c326eda8059c4",
     "https://bcr.bazel.build/modules/rules_jvm_external/6.3/MODULE.bazel": "c998e060b85f71e00de5ec552019347c8bca255062c990ac02d051bb80a38df0",
-    "https://bcr.bazel.build/modules/rules_jvm_external/6.3/source.json": "6f5f5a5a4419ae4e37c35a5bb0a6ae657ed40b7abc5a5189111b47fcebe43197",
+    "https://bcr.bazel.build/modules/rules_jvm_external/6.9/MODULE.bazel": "07c5db05527db7744a54fcffd653e1550d40e0540207a7f7e6d0a4de5bef8274",
+    "https://bcr.bazel.build/modules/rules_jvm_external/6.9/source.json": "b12970214f3cc144b26610caeb101fa622d910f1ab3d98f0bae1058edbd00bd4",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.0/MODULE.bazel": "ef85697305025e5a61f395d4eaede272a5393cee479ace6686dba707de804d59",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/MODULE.bazel": "d269a01a18ee74d0335450b10f62c9ed81f2321d7958a2934e44272fe82dcef3",
     "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/source.json": "2faa4794364282db7c06600b7e5e34867a564ae91bda7cae7c29c64e9466b7d5",
@@ -306,12 +314,12 @@
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.0/MODULE.bazel": "45345e4aba35dd6e4701c1eebf5a4e67af4ed708def9ebcdc6027585b34ee52d",
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.3/MODULE.bazel": "b66eadebd10f1f1b25f52f95ab5213a57e82c37c3f656fcd9a57ad04d2264ce7",
     "https://bcr.bazel.build/modules/rules_nodejs/6.3.3/source.json": "45bd343155bdfed2543f0e39b80ff3f6840efc31975da4b5795797f4c94147ad",
-    "https://bcr.bazel.build/modules/rules_oci/2.2.6/MODULE.bazel": "2ba6ddd679269e00aeffe9ca04faa2d0ca4129650982c9246d0d459fe2da47d9",
-    "https://bcr.bazel.build/modules/rules_oci/2.2.6/source.json": "94e7decb8f95d9465b0bbea71c65064cd16083be1350c7468f131818641dc4a5",
+    "https://bcr.bazel.build/modules/rules_oci/2.2.7/MODULE.bazel": "f6150e4b224d459f7f6523ef65967464ca4efdd266c7fbf2f5a2a51011957e0c",
+    "https://bcr.bazel.build/modules/rules_oci/2.2.7/source.json": "b099f02af330f47f19dc67fc9300ef6e1937a8c86882690db0e7a2fcea8c7f6b",
     "https://bcr.bazel.build/modules/rules_pkg/0.7.0/MODULE.bazel": "df99f03fc7934a4737122518bb87e667e62d780b610910f0447665a7e2be62dc",
     "https://bcr.bazel.build/modules/rules_pkg/1.0.1/MODULE.bazel": "5b1df97dbc29623bccdf2b0dcd0f5cb08e2f2c9050aab1092fd39a41e82686ff",
-    "https://bcr.bazel.build/modules/rules_pkg/1.1.0/MODULE.bazel": "9db8031e71b6ef32d1846106e10dd0ee2deac042bd9a2de22b4761b0c3036453",
-    "https://bcr.bazel.build/modules/rules_pkg/1.1.0/source.json": "fef768df13a92ce6067e1cd0cdc47560dace01354f1d921cfb1d632511f7d608",
+    "https://bcr.bazel.build/modules/rules_pkg/1.2.0/MODULE.bazel": "c7db3c2b407e673c7a39e3625dc05dc9f12d6682cbd82a3a5924a13b491eda7e",
+    "https://bcr.bazel.build/modules/rules_pkg/1.2.0/source.json": "9062e00845bf91a4247465d371baa837adf9b6ff44c542f73ba084f07667e1dc",
     "https://bcr.bazel.build/modules/rules_proto/4.0.0/MODULE.bazel": "a7a7b6ce9bee418c1a760b3d84f83a299ad6952f9903c67f19e4edd964894e06",
     "https://bcr.bazel.build/modules/rules_proto/5.3.0-21.7/MODULE.bazel": "e8dff86b0971688790ae75528fe1813f71809b5afd57facb44dad9e8eca631b7",
     "https://bcr.bazel.build/modules/rules_proto/6.0.0-rc1/MODULE.bazel": "1e5b502e2e1a9e825eef74476a5a1ee524a92297085015a052510b09a1a09483",
@@ -334,7 +342,8 @@
     "https://bcr.bazel.build/modules/rules_python/0.4.0/MODULE.bazel": "9208ee05fd48bf09ac60ed269791cf17fb343db56c8226a720fbb1cdf467166c",
     "https://bcr.bazel.build/modules/rules_python/0.40.0/MODULE.bazel": "9d1a3cd88ed7d8e39583d9ffe56ae8a244f67783ae89b60caafc9f5cf318ada7",
     "https://bcr.bazel.build/modules/rules_python/1.0.0/MODULE.bazel": "898a3d999c22caa585eb062b600f88654bf92efb204fa346fb55f6f8edffca43",
-    "https://bcr.bazel.build/modules/rules_python/1.0.0/source.json": "b0162a65c6312e45e7912e39abd1a7f8856c2c7e41ecc9b6dc688a6f6400a917",
+    "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13",
+    "https://bcr.bazel.build/modules/rules_python/1.3.0/source.json": "25932f917cd279c7baefa6cb1d3fa8750a7a29de522024449b19af6eab51f4a0",
     "https://bcr.bazel.build/modules/rules_rust/0.45.1/MODULE.bazel": "a69d0db3a958fab2c6520961e1b2287afcc8b36690fd31bbc4f6f7391397150d",
     "https://bcr.bazel.build/modules/rules_scala/7.1.1/MODULE.bazel": "b1f80c52ae49b27d41b9291d8b328b69247de2b7596d35d09afe6147b82cf562",
     "https://bcr.bazel.build/modules/rules_scala/7.1.1/source.json": "5038cb231d4020c5965c920681cf961a7bf137b40315025e40f3a7b6a0ac1f0f",
@@ -345,8 +354,8 @@
     "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca",
     "https://bcr.bazel.build/modules/rules_swift/1.18.0/MODULE.bazel": "a6aba73625d0dc64c7b4a1e831549b6e375fbddb9d2dde9d80c9de6ec45b24c9",
     "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046",
-    "https://bcr.bazel.build/modules/rules_swift/2.3.1/MODULE.bazel": "0b42093600d9226bcbdb31fb86d25d4204293d716fdbb2e50a1852547032a660",
-    "https://bcr.bazel.build/modules/rules_swift/2.3.1/source.json": "87d28609c37d2061db2f6fc3aae8ab7fbda9adf556cd88fbd0c7d520b8d81391",
+    "https://bcr.bazel.build/modules/rules_swift/2.4.0/MODULE.bazel": "1639617eb1ede28d774d967a738b4a68b0accb40650beadb57c21846beab5efd",
+    "https://bcr.bazel.build/modules/rules_swift/2.4.0/source.json": "a6577f57f9febbdc015a01f2a8f3487422032f134d6c61d18ed8e8ca3b9acc7c",
     "https://bcr.bazel.build/modules/stardoc/0.5.0/MODULE.bazel": "f9f1f46ba8d9c3362648eea571c6f9100680efc44913618811b58cc9c02cd678",
     "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8",
     "https://bcr.bazel.build/modules/stardoc/0.5.3/MODULE.bazel": "c7f6948dae6999bf0db32c1858ae345f112cacf98f174c7a8bb707e41b974f1c",
@@ -360,6 +369,7 @@
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/MODULE.bazel": "5e463fbfba7b1701d957555ed45097d7f984211330106ccd1352c6e0af0dcf91",
     "https://bcr.bazel.build/modules/swift_argument_parser/1.3.1.1/source.json": "32bd87e5f4d7acc57c5b2ff7c325ae3061d5e242c0c4c214ae87e0f1c13e54cb",
     "https://bcr.bazel.build/modules/tar.bzl/0.2.1/MODULE.bazel": "52d1c00a80a8cc67acbd01649e83d8dd6a9dc426a6c0b754a04fe8c219c76468",
+    "https://bcr.bazel.build/modules/tar.bzl/0.5.1/MODULE.bazel": "7c2eb3dcfc53b0f3d6f9acdfd911ca803eaf92aadf54f8ca6e4c1f3aee288351",
     "https://bcr.bazel.build/modules/tar.bzl/0.6.0/MODULE.bazel": "a3584b4edcfafcabd9b0ef9819808f05b372957bbdff41601429d5fd0aac2e7c",
     "https://bcr.bazel.build/modules/tar.bzl/0.6.0/source.json": "4a620381df075a16cb3a7ed57bd1d05f7480222394c64a20fa51bdb636fda658",
     "https://bcr.bazel.build/modules/toolchains_llvm/1.6.0/MODULE.bazel": "39603859cafb1c6830160fcd6370552e836790e6abb2bfb8d13bff53c0c10a64",
@@ -386,7 +396,7 @@
     "@@apple_support~//crosstool:setup.bzl%apple_cc_configure_extension": {
       "general": {
         "bzlTransitiveDigest": "Z3yAd66IJL0GAZUTSeMOjoHiE1SZPPwiIs/XQui5BvE=",
-        "usagesDigest": "TOb4CUri5UsTKxgIDTNzR0ddIc21eYLCRIm+jqQmjlg=",
+        "usagesDigest": "DqQsfZN5lA8z+nLEEY+EpKGzQ8M73mDm/A8lofDSyus=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -413,7 +423,7 @@
     },
     "@@aspect_rules_esbuild~//esbuild:extensions.bzl%esbuild": {
       "general": {
-        "bzlTransitiveDigest": "8jv3p0xDR/oitFeH8y0+Y5xlyrUbfsTRlc9TSwYkwl8=",
+        "bzlTransitiveDigest": "8L5Llfl6uxIWXd5GR+Qmmm04/jxp6TuJH5LFhIZIUCA=",
         "usagesDigest": "iDVoyPxUeADmfK8ssoyG3Ehq1bj6p7A43LpEiE266os=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
@@ -492,6 +502,7 @@
               "extra_build_content": "",
               "generate_bzl_library_targets": false,
               "extract_full_archive": false,
+              "exclude_package_contents": [],
               "system_tar": "auto"
             }
           },
@@ -516,11 +527,17 @@
               "package_visibility": [
                 "//visibility:public"
               ],
-              "replace_package": ""
+              "replace_package": "",
+              "exclude_package_contents": []
             }
           }
         },
         "recordedRepoMappingEntries": [
+          [
+            "aspect_bazel_lib~",
+            "bazel_lib",
+            "bazel_lib~"
+          ],
           [
             "aspect_bazel_lib~",
             "bazel_skylib",
@@ -531,6 +548,11 @@
             "bazel_tools",
             "bazel_tools"
           ],
+          [
+            "aspect_bazel_lib~",
+            "tar.bzl",
+            "tar.bzl~"
+          ],
           [
             "aspect_rules_esbuild~",
             "aspect_rules_js",
@@ -546,6 +568,11 @@
             "aspect_bazel_lib",
             "aspect_bazel_lib~"
           ],
+          [
+            "aspect_rules_js~",
+            "aspect_rules_js",
+            "aspect_rules_js~"
+          ],
           [
             "aspect_rules_js~",
             "bazel_skylib",
@@ -555,6 +582,31 @@
             "aspect_rules_js~",
             "bazel_tools",
             "bazel_tools"
+          ],
+          [
+            "bazel_lib~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "bazel_lib~",
+            "bazel_tools",
+            "bazel_tools"
+          ],
+          [
+            "tar.bzl~",
+            "aspect_bazel_lib",
+            "aspect_bazel_lib~"
+          ],
+          [
+            "tar.bzl~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "tar.bzl~",
+            "tar.bzl",
+            "tar.bzl~"
           ]
         ]
       }
@@ -1162,7 +1214,7 @@
     "@@rules_nodejs~//nodejs:extensions.bzl%node": {
       "general": {
         "bzlTransitiveDigest": "q44Ox2Nwogn6OsO0Xw5lhjkd/xmxkvvpwVOn5P4pmHQ=",
-        "usagesDigest": "WQpLKLujnBfrx9sMWCJgyaK9P04binseT6CGBy3vP4E=",
+        "usagesDigest": "Py5Wgc5kr5fTMe1FKrlFK276B6SodesXp6nw2Fq5XA8=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -1292,8 +1344,8 @@
     },
     "@@rules_oci~//oci:extensions.bzl%oci": {
       "general": {
-        "bzlTransitiveDigest": "FaY+7xb13bB3hmxqwAWaGp3Tf3Q4Nfdlr+F38CP5mcg=",
-        "usagesDigest": "BuciKSozbpJMD9EP+j0RG5ZgrYMeDPsQyiOnLUni2V8=",
+        "bzlTransitiveDigest": "AOLP47LtVHSKSDiukosQymx543OwcgeoQP666wwuj3o=",
+        "usagesDigest": "3Xsv1/UEV8MOARW4BZScPw3Gxtx19OQ5EXOqcL1p9bI=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -1306,7 +1358,7 @@
               "scheme": "https",
               "registry": "index.docker.io",
               "repository": "library/eclipse-temurin",
-              "identifier": "sha256:d286b5352d98777bbf727f54038b04f0145cd9b76ca83f38a67aa111d4303748",
+              "identifier": "17-jdk",
               "platform": "linux/amd64",
               "target_name": "eclipse_temurin_17_linux_amd64",
               "bazel_tags": []
@@ -1321,7 +1373,7 @@
               "scheme": "https",
               "registry": "index.docker.io",
               "repository": "library/eclipse-temurin",
-              "identifier": "sha256:d286b5352d98777bbf727f54038b04f0145cd9b76ca83f38a67aa111d4303748",
+              "identifier": "17-jdk",
               "platforms": {
                 "@@platforms//cpu:x86_64": "@eclipse_temurin_17_linux_amd64"
               },
@@ -1343,6 +1395,20 @@
               "bazel_tags": []
             }
           },
+          "ubuntu_24_04_linux_arm64_v8": {
+            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
+            "ruleClassName": "oci_pull",
+            "attributes": {
+              "www_authenticate_challenges": {},
+              "scheme": "https",
+              "registry": "index.docker.io",
+              "repository": "library/ubuntu",
+              "identifier": "24.04",
+              "platform": "linux/arm64/v8",
+              "target_name": "ubuntu_24_04_linux_arm64_v8",
+              "bazel_tags": []
+            }
+          },
           "ubuntu_24_04": {
             "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
             "ruleClassName": "oci_alias",
@@ -1354,12 +1420,44 @@
               "repository": "library/ubuntu",
               "identifier": "24.04",
               "platforms": {
-                "@@platforms//cpu:x86_64": "@ubuntu_24_04_linux_amd64"
+                "@@platforms//cpu:x86_64": "@ubuntu_24_04_linux_amd64",
+                "@@platforms//cpu:arm64": "@ubuntu_24_04_linux_arm64_v8"
               },
               "bzlmod_repository": "ubuntu_24_04",
               "reproducible": true
             }
           },
+          "alpine_linux_linux_amd64": {
+            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
+            "ruleClassName": "oci_pull",
+            "attributes": {
+              "www_authenticate_challenges": {},
+              "scheme": "https",
+              "registry": "index.docker.io",
+              "repository": "library/alpine",
+              "identifier": "3.21",
+              "platform": "linux/amd64",
+              "target_name": "alpine_linux_linux_amd64",
+              "bazel_tags": []
+            }
+          },
+          "alpine_linux": {
+            "bzlFile": "@@rules_oci~//oci/private:pull.bzl",
+            "ruleClassName": "oci_alias",
+            "attributes": {
+              "target_name": "alpine_linux",
+              "www_authenticate_challenges": {},
+              "scheme": "https",
+              "registry": "index.docker.io",
+              "repository": "library/alpine",
+              "identifier": "3.21",
+              "platforms": {
+                "@@platforms//cpu:x86_64": "@alpine_linux_linux_amd64"
+              },
+              "bzlmod_repository": "alpine_linux",
+              "reproducible": true
+            }
+          },
           "oci_crane_darwin_amd64": {
             "bzlFile": "@@rules_oci~//oci:repositories.bzl",
             "ruleClassName": "crane_repositories",
@@ -1496,7 +1594,10 @@
             "eclipse_temurin_17",
             "eclipse_temurin_17_linux_amd64",
             "ubuntu_24_04",
-            "ubuntu_24_04_linux_amd64"
+            "ubuntu_24_04_linux_amd64",
+            "ubuntu_24_04_linux_arm64_v8",
+            "alpine_linux",
+            "alpine_linux_linux_amd64"
           ],
           "explicitRootModuleDirectDevDeps": [],
           "useAllRepos": "NO",
@@ -1531,6 +1632,43 @@
         ]
       }
     },
+    "@@rules_python~//python/uv:uv.bzl%uv": {
+      "general": {
+        "bzlTransitiveDigest": "Xpqjnjzy6zZ90Es9Wa888ZLHhn7IsNGbph/e6qoxzw8=",
+        "usagesDigest": "qI5PVlIum/YAnGJg5oXGHzDkMFWt2aNSUZY4G8PBbic=",
+        "recordedFileInputs": {},
+        "recordedDirentsInputs": {},
+        "envVariables": {},
+        "generatedRepoSpecs": {
+          "uv": {
+            "bzlFile": "@@rules_python~//python/uv/private:uv_toolchains_repo.bzl",
+            "ruleClassName": "uv_toolchains_repo",
+            "attributes": {
+              "toolchain_type": "'@@rules_python~//python/uv:uv_toolchain_type'",
+              "toolchain_names": [
+                "none"
+              ],
+              "toolchain_implementations": {
+                "none": "'@@rules_python~//python:none'"
+              },
+              "toolchain_compatible_with": {
+                "none": [
+                  "@platforms//:incompatible"
+                ]
+              },
+              "toolchain_target_settings": {}
+            }
+          }
+        },
+        "recordedRepoMappingEntries": [
+          [
+            "rules_python~",
+            "platforms",
+            "platforms"
+          ]
+        ]
+      }
+    },
     "@@rules_scala~//scala/extensions:config.bzl%scala_config": {
       "general": {
         "bzlTransitiveDigest": "TdBxhkZTM7VU6teIFS+KoonKU7wmb5BL7leCWWx7yX8=",
@@ -5007,7 +5145,7 @@
     "@@rules_swift~//swift:extensions.bzl%non_module_deps": {
       "general": {
         "bzlTransitiveDigest": "PAIMhc1bVKfcyoHeg0xO8LMS9KN5yzbsMGwa5O2ifJM=",
-        "usagesDigest": "A3fzk5iHsrLdI3PokT1bHIdeJ2j9tc09H3/3Old6IfU=",
+        "usagesDigest": "l2vIL7SL4tJqHIVLWd78Y/ym+r0II64lmvoX8o+0Bb0=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},

ci/BUILD.bazel

@@ -1,6 +1,34 @@
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load", "oci_push")
 load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 
+#
+# Shared utilities layer (busybox for nc, wget, etc.)
+#
+
+pkg_tar(
+    name = "busybox_layer",
+    srcs = ["@busybox_x86_64//file"],
+    package_dir = "/usr/local/bin",
+    remap_paths = {
+        "file/busybox": "busybox",
+    },
+    symlinks = {
+        "/usr/local/bin/nc": "busybox",
+    },
+)
+
+pkg_tar(
+    name = "busybox_layer_arm64",
+    srcs = ["@busybox_aarch64//file"],
+    package_dir = "/usr/local/bin",
+    remap_paths = {
+        "file/busybox": "busybox",
+    },
+    symlinks = {
+        "/usr/local/bin/nc": "busybox",
+    },
+)
+
 #
 # Eagle Server Docker Image
 #
@@ -35,16 +63,21 @@ oci_image(
     base = "@eclipse_temurin_17_linux_amd64",
     entrypoint = [
         "java",
-        "-Xmx4g",
+        "-Xmx2g",
         "-XX:+UseG1GC",
+        # JFR profiling support
+        "-XX:+UnlockDiagnosticVMOptions",
+        "-XX:+DebugNonSafepoints",  # Required for JFR to see through inlined methods
+        "-XX:FlightRecorderOptions=stackdepth=256",
         "-jar",
         "/app/eagle_server_deploy.jar",
     ],
     env = {
-        "JAVA_OPTS": "-Xmx4g -XX:+UseG1GC",
+        "JAVA_OPTS": "-Xmx2g -XX:+UseG1GC",
     },
     exposed_ports = ["40032/tcp"],
     tars = [
+        ":busybox_layer",
         ":eagle_server_jar_layer",
         ":eagle_resources_layer",
     ],
@@ -59,6 +92,9 @@ oci_load(
 )
 
 # Push to DigitalOcean Container Registry
+# Note: No remote_tags here - DigitalOcean converts OCI to Docker format,
+# changing the digest and breaking oci_push's tag-by-digest logic.
+# Tagging is handled in the CI workflow using crane copy/tag.
 oci_push(
     name = "eagle_server_push",
     image = ":eagle_server_image",
@@ -106,6 +142,7 @@ oci_image(
         "40052/tcp",
     ],
     tars = [
+        ":busybox_layer",
         ":shardok_binary_layer",
         ":shardok_resources_layer",
         ":shardok_maps_layer",
@@ -121,8 +158,190 @@ oci_load(
 )
 
 # Push to DigitalOcean Container Registry
+# Note: No remote_tags here - DigitalOcean converts OCI to Docker format,
+# changing the digest and breaking oci_push's tag-by-digest logic.
+# Tagging is handled in the CI workflow using crane copy/tag.
 oci_push(
     name = "shardok_server_push",
     image = ":shardok_server_image",
     repository = "registry.digitalocean.com/eagle0/shardok-server",
 )
+
+#
+# Shardok Server ARM64 Docker Image (for Hetzner on-demand compute)
+#
+# Build: bazel build //ci:shardok_server_image_arm64 --platforms=//:linux_arm64 --extra_toolchains=@llvm_toolchain_linux_arm64//:all
+# Load:  bazel run //ci:shardok_server_load_arm64
+# Push:  bazel run //ci:shardok_server_push_arm64
+#
+
+# Package the Shardok binary (ARM64 version - must be built with --platforms=//:linux_arm64)
+pkg_tar(
+    name = "shardok_binary_layer_arm64",
+    srcs = ["//src/main/cpp/net/eagle0/shardok:shardok-server"],
+    package_dir = "/app",
+)
+
+oci_image(
+    name = "shardok_server_image_arm64",
+    base = "@ubuntu_24_04_linux_arm64_v8",
+    entrypoint = ["/app/shardok-server"],
+    exposed_ports = [
+        "40042/tcp",
+        "40052/tcp",
+    ],
+    tars = [
+        # Note: busybox_layer_arm64 omitted - busybox.net has SSL issues
+        # Health checks can use the shardok-server binary itself or be added later
+        ":shardok_binary_layer_arm64",
+        ":shardok_resources_layer",
+        ":shardok_maps_layer",
+    ],
+    workdir = "/app",
+)
+
+# Load into Docker locally (ARM64): bazel run //ci:shardok_server_load_arm64
+oci_load(
+    name = "shardok_server_load_arm64",
+    image = ":shardok_server_image_arm64",
+    repo_tags = ["eagle0/shardok-server:latest-arm64"],
+)
+
+# Push to DigitalOcean Container Registry (for Hetzner deployment)
+# Uses same repository as x86 but with arm64- tag prefix
+oci_push(
+    name = "shardok_server_push_arm64",
+    image = ":shardok_server_image_arm64",
+    repository = "registry.digitalocean.com/eagle0/shardok-server",
+)
+
+#
+# Admin Server Docker Image (Go)
+#
+# Build: bazel build //ci:admin_server_image
+# Load:  bazel run //ci:admin_server_load
+# Push:  bazel run //ci:admin_server_push
+#
+
+# Package the Go admin binary (explicit Linux x86_64 target)
+pkg_tar(
+    name = "admin_binary_layer",
+    srcs = ["//src/main/go/net/eagle0/admin_server:admin_server_linux_amd64"],
+    package_dir = "/app",
+)
+
+oci_image(
+    name = "admin_server_image",
+    base = "@alpine_linux_linux_amd64",
+    entrypoint = ["/app/admin_server_linux_amd64"],
+    exposed_ports = ["8080/tcp"],
+    tars = [
+        ":busybox_layer",
+        ":admin_binary_layer",
+    ],
+    workdir = "/app",
+)
+
+# Load into Docker locally: bazel run //ci:admin_server_load
+oci_load(
+    name = "admin_server_load",
+    image = ":admin_server_image",
+    repo_tags = ["eagle0/admin-server:latest"],
+)
+
+# Push to DigitalOcean Container Registry
+oci_push(
+    name = "admin_server_push",
+    image = ":admin_server_image",
+    repository = "registry.digitalocean.com/eagle0/admin-server",
+)
+
+#
+# JFR Sidecar Docker Image (Go + JDK for jcmd)
+#
+# This sidecar runs with shared PID namespace to access the Eagle JVM.
+# Build: bazel build //ci:jfr_sidecar_image
+# Load:  bazel run //ci:jfr_sidecar_load
+# Push:  bazel run //ci:jfr_sidecar_push
+#
+
+# Package the Go JFR server binary
+pkg_tar(
+    name = "jfr_sidecar_binary_layer",
+    srcs = ["//src/main/go/net/eagle0/jfr_server:jfr_server_linux_amd64"],
+    package_dir = "/app",
+)
+
+oci_image(
+    name = "jfr_sidecar_image",
+    # Use JDK base image - we need jcmd to dump JFR recordings
+    base = "@eclipse_temurin_17_linux_amd64",
+    entrypoint = ["/app/jfr_server_linux_amd64"],
+    exposed_ports = ["8081/tcp"],
+    tars = [
+        ":jfr_sidecar_binary_layer",
+    ],
+    workdir = "/app",
+)
+
+# Load into Docker locally: bazel run //ci:jfr_sidecar_load
+oci_load(
+    name = "jfr_sidecar_load",
+    image = ":jfr_sidecar_image",
+    repo_tags = ["eagle0/jfr-sidecar:latest"],
+)
+
+# Push to DigitalOcean Container Registry
+oci_push(
+    name = "jfr_sidecar_push",
+    image = ":jfr_sidecar_image",
+    repository = "registry.digitalocean.com/eagle0/jfr-sidecar",
+)
+
+#
+# Auth Server Docker Image (Go)
+#
+# This is the external OAuth service that handles OAuth flows and JWT creation.
+# Build: bazel build //ci:auth_server_image
+# Load:  bazel run //ci:auth_server_load
+# Push:  bazel run //ci:auth_server_push
+#
+
+# Package the Go auth binary (explicit Linux x86_64 target)
+pkg_tar(
+    name = "auth_binary_layer",
+    srcs = [
+        "//src/main/go/net/eagle0/authcli:authcli_linux_amd64",
+        "//src/main/go/net/eagle0/authservice:authservice_linux_amd64",
+    ],
+    package_dir = "/app",
+)
+
+oci_image(
+    name = "auth_server_image",
+    base = "@alpine_linux_linux_amd64",
+    entrypoint = ["/app/authservice_linux_amd64"],
+    exposed_ports = [
+        "40033/tcp",  # gRPC
+        "8080/tcp",  # HTTP OAuth callback
+    ],
+    tars = [
+        ":busybox_layer",
+        ":auth_binary_layer",
+    ],
+    workdir = "/app",
+)
+
+# Load into Docker locally: bazel run //ci:auth_server_load
+oci_load(
+    name = "auth_server_load",
+    image = ":auth_server_image",
+    repo_tags = ["eagle0/auth-server:latest"],
+)
+
+# Push to DigitalOcean Container Registry
+oci_push(
+    name = "auth_server_push",
+    image = ":auth_server_image",
+    repository = "registry.digitalocean.com/eagle0/auth-server",
+)

ci/github_actions/build_mac.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+. ./ci/unity_version.sh
+
+WORKSPACE=$(pwd)
+UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
+BUILD_DIR=$1
+LOG_PATH=$2
+
+echo "Building Mac in $BUILD_DIR"
+
+echo "Cleaning up $BUILD_DIR"
+/bin/rm -rf "$BUILD_DIR"
+/bin/mkdir -p "$BUILD_DIR"
+
+# Use custom build script that builds Addressables before the player
+${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
+   -nographics \
+   -batchmode \
+   -quit \
+   -executeMethod BuildScript.BuildMacPlayer \
+   -buildPath "$BUILD_DIR/eagle0.app" \
+   -logFile "$LOG_PATH" \
+   -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"

ci/github_actions/build_unity.sh

@@ -9,9 +9,6 @@ COMMIT=$(/usr/bin/git rev-parse --short HEAD)
 /bin/echo "build protos"
 ./scripts/build_protos.sh
 
-/bin/echo "build plugins"
-./scripts/build_windows_plugin.sh
-
 git log -3
 
 /bin/echo "build Windows"

ci/github_actions/build_unity_mac.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+COMMIT=$(/usr/bin/git rev-parse --short HEAD)
+
+/bin/echo "build protos"
+./scripts/build_protos.sh
+
+/bin/echo "build Sparkle plugin"
+./scripts/build_sparkle_plugin.sh
+
+git log -3
+
+/bin/echo "build Mac"
+LOG_PATH="/tmp/eagle0/editor_mac.log"
+BUILD_DIR=$1
+
+./ci/github_actions/build_mac.sh "$BUILD_DIR" "$LOG_PATH"

ci/github_actions/build_windows.sh

@@ -15,10 +15,12 @@ echo "Cleaning up $1"
 /bin/rm -rf $1
 /bin/mkdir -p $1
 
+# Use custom build script that builds Addressables before the player
 ${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
    -nographics \
    -batchmode \
    -quit \
-   -buildWindows64Player $BUILD_DIR/eagle0.exe \
+   -executeMethod BuildScript.BuildWindowsPlayer \
+   -buildPath "$BUILD_DIR/eagle0.exe" \
    -logFile $LOG_PATH \
    -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"

ci/github_actions/persist_library.sh

@@ -1,6 +1,33 @@
 #!/bin/bash
+#
+# Persist Unity Library/ cache to persistent storage
+#
+# Environment variables:
+#   UNITY_CACHE_PLATFORM - Platform identifier (e.g., "mac", "windows")
+#                          Defaults to "mac" if not set
+#
+# Note: Library/Bee/ is excluded because it contains DAG files with hardcoded
+# file paths that become stale when project files change. This prevents
+# "Data at the root level is invalid" XML errors from stale references.
 
-set -euxo pipefail
+set -uxo pipefail
 
-/bin/echo "persist Library/"
-/usr/bin/rsync -rtlDvq src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ /tmp/eagle0/Library/
+PLATFORM="${UNITY_CACHE_PLATFORM:-mac}"
+CACHE_DIR="/tmp/eagle0/Library-${PLATFORM}"
+
+/bin/echo "persist Library/ to $CACHE_DIR (excluding Bee/)"
+
+# rsync may exit with code 23 ("partial transfer due to error") if Unity's
+# temporary files vanish during the copy. This is acceptable for a cache.
+/usr/bin/rsync -rtlDvq --exclude='Bee/' src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ "$CACHE_DIR/"
+rsync_exit=$?
+
+if [ $rsync_exit -eq 0 ]; then
+    exit 0
+elif [ $rsync_exit -eq 23 ]; then
+    echo "Warning: rsync exited with 23 (some files vanished during copy). This is expected for Unity temp files."
+    exit 0
+else
+    echo "Error: rsync failed with exit code $rsync_exit"
+    exit $rsync_exit
+fi

ci/github_actions/restore_library.sh

@@ -1,7 +1,16 @@
 #!/bin/bash
+#
+# Restore Unity Library/ cache from persistent storage
+#
+# Environment variables:
+#   UNITY_CACHE_PLATFORM - Platform identifier (e.g., "mac", "windows")
+#                          Defaults to "mac" if not set
 
 set -euxo pipefail
 
-/bin/echo "restore Library/"
-/bin/mkdir -p /tmp/eagle0/Library
-/usr/bin/rsync -rtlDvq /tmp/eagle0/Library/ src/main/csharp/net/eagle0/clients/unity/eagle0/Library/
+PLATFORM="${UNITY_CACHE_PLATFORM:-mac}"
+CACHE_DIR="/tmp/eagle0/Library-${PLATFORM}"
+
+/bin/echo "restore Library/ from $CACHE_DIR"
+/bin/mkdir -p "$CACHE_DIR"
+/usr/bin/rsync -rtlDvq "$CACHE_DIR/" src/main/csharp/net/eagle0/clients/unity/eagle0/Library/

ci/github_actions/upload_addressables.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Upload Addressables bundles to DigitalOcean Spaces
+# Usage: ./upload_addressables.sh <build_target>
+# Example: ./upload_addressables.sh StandaloneOSX
+#
+# Required environment variables:
+#   ACCESS_KEY_ID - DigitalOcean Spaces access key (same as other deploys)
+#   SECRET_KEY    - DigitalOcean Spaces secret key (same as other deploys)
+
+set -euxo pipefail
+
+BUILD_TARGET=$1
+WORKSPACE=$(pwd)
+UNITY_PROJECT="$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+SERVER_DATA="$UNITY_PROJECT/ServerData/$BUILD_TARGET"
+
+# DigitalOcean Spaces configuration (same region as other eagle0 buckets)
+DO_ENDPOINT="https://sfo3.digitaloceanspaces.com"
+DO_BUCKET="eagle0-assets"
+
+if [ ! -d "$SERVER_DATA" ]; then
+    echo "No Addressables bundles found at $SERVER_DATA"
+    echo "Skipping upload (this is expected if Addressables are bundled locally)"
+    exit 0
+fi
+
+echo "Uploading Addressables bundles from $SERVER_DATA"
+echo "Target: s3://$DO_BUCKET/addressables/$BUILD_TARGET/"
+
+# Configure AWS CLI for DigitalOcean Spaces
+export AWS_ACCESS_KEY_ID="$ACCESS_KEY_ID"
+export AWS_SECRET_ACCESS_KEY="$SECRET_KEY"
+
+# Sync bundles to Spaces
+# --delete removes files in destination that don't exist in source
+# --acl public-read makes files publicly accessible
+aws s3 sync "$SERVER_DATA" "s3://$DO_BUCKET/addressables/$BUILD_TARGET/" \
+    --endpoint-url "$DO_ENDPOINT" \
+    --acl public-read \
+    --delete
+
+echo "Addressables upload complete"
+echo "Files available at: https://assets.eagle0.net/addressables/$BUILD_TARGET/"

ci/mac/eagle0.entitlements

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Allow JIT compilation (required for Mono/IL2CPP) -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <!-- Allow unsigned executable memory (required for Unity) -->
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <!-- Disable library validation (required for plugins) -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <!-- Allow outgoing network connections -->
+    <key>com.apple.security.network.client</key>
+    <true/>
+</dict>
+</plist>

docker-compose.prod.yml

@@ -1,47 +1,296 @@
-# Docker Compose for local testing of production images
-# Build images: bazel run //ci:eagle_server_load && bazel run //ci:shardok_server_load
-# Run: docker compose -f docker-compose.prod.yml up
+# Docker Compose for production deployment
+#
+# Local testing:
+#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:auth_server_load
+#   Run: docker compose -f docker-compose.prod.yml up
+#
+# Production deployment:
+#   Run: docker compose -f docker-compose.prod.yml up -d
+#
+# Note: Shardok runs on Hetzner ARM64 server, deployed via shardok_arm64_build.yml workflow.
 
 services:
-  eagle:
-    image: eagle0/eagle-server:latest
-    container_name: eagle-server
+  # Blue-green deployment: eagle-blue is the primary (production) instance
+  # eagle-green is the staging instance for zero-downtime deployments
+  # See scripts/deploy-blue-green.sh for deployment workflow
+
+  eagle-blue:
+    image: ${EAGLE_IMAGE:-registry.digitalocean.com/eagle0/eagle-server:latest}
+    container_name: eagle-blue
+    command:
+      - "--gpt-model-name"
+      - "${GPT_MODEL_NAME:-gpt-5.1}"
+      - "--shardok-interface-remote-address"
+      - "${SHARDOK_ADDRESS}"
+      - "--auth-service-url"
+      - "auth:40033"
     ports:
       - "40032:40032"
     environment:
-      # Eagle server configuration
-      EAGLE_GRPC_PORT: "40032"
-      SHARDOK_HOST: "shardok"
-      SHARDOK_PORT: "40042"
-      # Resource paths (relative to /app in container)
-      EAGLE_RESOURCES_PATH: "/app/resources"
+      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
+      DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
+      DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
+      DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
+      # JWT public key for token validation (auth service handles signing)
+      # Reads from /etc/eagle0/keys/public.pem via shared volume
+      # Auth token for Shardok on Hetzner (required)
+      SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
+      # Use persistent volume for save data (users, games, etc.)
+      EAGLE_SAVE_DIR: "/app/saves"
+      EAGLE_ARCHIVE_DIR: "/app/archived"
+      SENTRY_DSN: "${SENTRY_DSN:-}"
+      SENTRY_ENVIRONMENT: "production"
     volumes:
-      # Mount saves directory for persistence
-      - ./saves:/app/saves
+      - ./saves:/app/saves           # Game saves and user database
+      - ./archived:/app/archived     # Archived completed games
+      - ./jfr:/app/jfr  # JFR recordings - dump with: docker exec eagle-blue jcmd 1 JFR.dump filename=/app/jfr/profile.jfr
+      - jvm-tmp:/tmp  # Shared with jfr-sidecar for JVM attach socket files
+      - jwt-keys:/etc/eagle0/keys:ro  # JWT public key from auth service (read-only)
     depends_on:
-      - shardok
+      - auth
     restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
     healthcheck:
-      test: ["CMD", "nc", "-z", "localhost", "40032"]
+      test: ["CMD-SHELL", "nc -z localhost 40032 || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 30s
 
-  shardok:
-    image: eagle0/shardok-server:latest
-    container_name: shardok-server
+  eagle-green:
+    image: ${EAGLE_IMAGE_NEW:-registry.digitalocean.com/eagle0/eagle-server:latest}
+    container_name: eagle-green
+    profiles: ["blue-green"]  # Only started during blue-green deployment
+    command:
+      - "--gpt-model-name"
+      - "${GPT_MODEL_NAME:-gpt-5.1}"
+      - "--shardok-interface-remote-address"
+      - "${SHARDOK_ADDRESS}"
+      - "--auth-service-url"
+      - "auth:40033"
     ports:
-      - "40042:40042"
-      - "40052:40052"
+      - "40034:40032"  # Different host port for staging
     environment:
-      # Shardok server configuration
-      SHARDOK_RESOURCES_PATH: "/app/resources"
-      SHARDOK_MAPS_PATH: "/app/resources/maps"
-    restart: unless-stopped
+      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
+      EAGLE_ENABLE_S3: "${EAGLE_ENABLE_S3:-false}"
+      DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
+      DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
+      DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
+      # JWT public key for token validation (auth service handles signing)
+      # Reads from /etc/eagle0/keys/public.pem via shared volume
+      SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
+      EAGLE_SAVE_DIR: "/app/saves"
+      EAGLE_ARCHIVE_DIR: "/app/archived"
+      SENTRY_DSN: "${SENTRY_DSN:-}"
+      SENTRY_ENVIRONMENT: "production"
+    volumes:
+      - ./saves:/app/saves           # Same save directory as blue
+      - ./archived:/app/archived     # Same archive directory as blue
+      - ./jfr:/app/jfr               # JFR recordings (same as blue)
+      - jvm-tmp:/tmp                 # Shared with jfr-sidecar-green for JVM attach socket files
+      - jwt-keys:/etc/eagle0/keys:ro # JWT public key from auth service (read-only)
+    depends_on:
+      - auth
+    restart: "no"  # Don't auto-restart during deployment
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "5"
     healthcheck:
-      test: ["CMD", "nc", "-z", "localhost", "40042"]
+      test: ["CMD-SHELL", "nc -z localhost 40032 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 60s
+
+  # Backward compatibility alias - for scripts that reference 'eagle' service
+  eagle:
+    extends:
+      service: eagle-blue
+
+  auth:
+    image: ${AUTH_IMAGE:-registry.digitalocean.com/eagle0/auth-server:latest}
+    container_name: auth-server
+    environment:
+      # gRPC port for Auth service
+      AUTH_GRPC_PORT: "40033"
+      # HTTP port for OAuth callbacks
+      AUTH_HTTP_PORT: "8080"
+      # User data persistence directory
+      AUTH_DATA_DIR: "/app/data"
+      # Legacy path for migrating users from Eagle (Phase 1 migration)
+      AUTH_LEGACY_DATA_DIR: "/app/saves/auth"
+      # OAuth provider credentials
+      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
+      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
+      GOOGLE_CLIENT_ID: "${GOOGLE_CLIENT_ID:-}"
+      GOOGLE_CLIENT_SECRET: "${GOOGLE_CLIENT_SECRET:-}"
+      GH_OAUTH_CLIENT_ID: "${GH_OAUTH_CLIENT_ID:-}"
+      GH_OAUTH_CLIENT_SECRET: "${GH_OAUTH_CLIENT_SECRET:-}"
+      # Apple Sign-In credentials
+      APPLE_SIGNIN_CLIENT_ID: "${APPLE_SIGNIN_CLIENT_ID:-}"
+      APPLE_TEAM_ID: "${APPLE_TEAM_ID:-}"
+      APPLE_SIGNIN_KEY_ID: "${APPLE_SIGNIN_KEY_ID:-}"
+      APPLE_SIGNIN_PRIVATE_KEY: "${APPLE_SIGNIN_PRIVATE_KEY:-}"
+      # Twitch OAuth credentials
+      TWITCH_CLIENT_ID: "${TWITCH_CLIENT_ID:-}"
+      TWITCH_CLIENT_SECRET: "${TWITCH_CLIENT_SECRET:-}"
+      # Server base URL for OAuth callbacks
+      SERVER_BASE_URL: "${SERVER_BASE_URL:-https://prod.eagle0.net}"
+      # JWT keys - PEM files in volume, bootstrapped from JWK on first run
+      JWT_KEYS_PATH: "/etc/eagle0/keys"
+      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
+      # Fastmail JMAP API for sending invitation emails
+      FASTMAIL_API_TOKEN: "${FASTMAIL_API_TOKEN:-}"
+      FASTMAIL_FROM_EMAIL: "${FASTMAIL_FROM_EMAIL:-}"
+      FASTMAIL_FROM_NAME: "${FASTMAIL_FROM_NAME:-}"
+      # Require invitation codes for new user registration
+      REQUIRE_INVITATION_CODE: "true"
+    # Note: port 40033 is exposed via nginx, not directly
+    volumes:
+      - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with Eagle
+      - ./auth-data:/app/data      # User database persistence
+      - ./saves:/app/saves:ro      # Read-only access to Eagle's saves for migration
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+    healthcheck:
+      test: ["CMD-SHELL", "nc -z localhost 40033 || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
       start_period: 10s
+
+  # Note: Shardok runs on Hetzner ARM64 server, not in this docker-compose.
+  # Configure SHARDOK_ADDRESS to point to the Hetzner instance.
+
+  nginx:
+    image: nginx:alpine
+    container_name: nginx
+    ports:
+      - "443:443"
+      - "80:80"
+      - "40033:40033"  # Go Auth service gRPC (Phase 2 direct client connections)
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./certbot/conf:/etc/letsencrypt:ro
+      - ./certbot/www:/var/www/certbot:ro
+      - ./auth:/etc/nginx/auth:ro
+    depends_on:
+      - admin
+    # Note: nginx connects to eagle via EAGLE_ADDR (default: eagle-blue:40032)
+    # For blue-green deployments, update EAGLE_ADDR in .env before switching
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  admin:
+    image: ${ADMIN_IMAGE:-registry.digitalocean.com/eagle0/admin-server:latest}
+    container_name: admin-server
+    command:
+      - "--eagle-addr"
+      - "${EAGLE_ADDR:-eagle-blue:40032}"  # Can be switched for blue-green
+      - "--auth-addr"
+      - "auth:40033"
+      - "--jfr-sidecar-addr"
+      - "${JFR_SIDECAR_ADDR:-jfr-sidecar:8081}"  # Can be switched for blue-green
+      - "--http-port"
+      - "8080"
+    # No external port - accessed via nginx at admin.eagle0.net
+    depends_on:
+      - auth
+    # Note: admin connects to eagle via EAGLE_ADDR and jfr-sidecar via JFR_SIDECAR_ADDR
+    # For blue-green deployments, set both in .env before switching
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  jfr-sidecar:
+    image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
+    container_name: jfr-sidecar
+    # Share PID namespace with Eagle to access its JVM via jcmd
+    # For blue-green: use JFR_SIDECAR_ADDR=jfr-sidecar-green:8081 when green is active
+    pid: "service:eagle-blue"
+    volumes:
+      - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
+    depends_on:
+      - eagle-blue
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "2"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8081/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  jfr-sidecar-green:
+    image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
+    container_name: jfr-sidecar-green
+    profiles: ["blue-green"]  # Only started during blue-green deployment
+    # Share PID namespace with Eagle green instance
+    pid: "service:eagle-green"
+    volumes:
+      - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
+    depends_on:
+      - eagle-green
+    restart: "no"  # Don't auto-restart during deployment
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "2"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8081/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  certbot:
+    image: certbot/certbot
+    container_name: certbot
+    volumes:
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+volumes:
+  jvm-tmp:
+    # Shared /tmp for JVM attach socket files between Eagle and jfr-sidecar
+  jwt-keys:
+    # Shared JWT RSA keys between Eagle and auth service
+
+networks:
+  default:
+    driver: bridge
+    enable_ipv6: true
+    ipam:
+      config:
+        - subnet: 172.28.0.0/16
+        - subnet: fd00:dead:beef::/48

docs/ADMIN_SERVER_ENHANCEMENTS.md

@@ -0,0 +1,471 @@
+# Admin Server Enhancement Plan
+
+## Overview
+
+This document outlines enhancements to the Go admin server (`src/main/go/net/eagle0/admin_server/`) to provide a proper web UI for game administration.
+
+### Current State
+
+The admin server provides a full web UI with htmx interactivity:
+- `GET /` - Redirect to games list
+- `GET /games` - Game list page (HTML)
+- `GET /games/{id}` - Game detail with action history
+- `GET /games/{id}/history` - History rows (htmx partial, infinite scroll)
+- `GET /games/{id}/action/{index}` - Action detail (htmx partial)
+- `POST /games/{id}/rewind` - Rewind game to target action
+- `GET /settings` - Settings list with live search
+- `POST /settings/update` - Update setting value
+- `GET /health` - Health check (JSON)
+- `GET /api/games` - JSON API for programmatic access
+- `GET /api/games/{id}/history` - JSON API for history
+
+### Goals
+
+1. **Web UI**: Replace raw JSON with an interactive HTML interface
+2. **Settings Management**: View and modify the 275+ game settings at runtime
+3. **Game Rewind**: Restore a game to a previous action count
+
+---
+
+## Architecture
+
+### Technology Choice: Go Templates + htmx
+
+**Rationale:**
+- Single binary deployment (no separate frontend build)
+- htmx provides interactivity without JavaScript framework complexity
+- Familiar HTML/CSS, minimal learning curve
+- Excellent for admin tools where SEO and bundle size don't matter
+
+**Alternatives Considered:**
+- React/Vue SPA: Adds build complexity, separate deployment artifact
+- Server-side only: Less interactive, full page reloads
+
+### Directory Structure
+
+```
+src/main/go/net/eagle0/admin_server/
+├── admin_server.go         # Main entry point, HTTP routes
+├── handlers/
+│   ├── games.go            # Game list and detail handlers
+│   ├── settings.go         # Settings list and update handlers
+│   └── rewind.go           # Game rewind handlers
+├── templates/
+│   ├── layout.html         # Base layout with nav, htmx includes
+│   ├── games/
+│   │   ├── list.html       # Game list page
+│   │   ├── detail.html     # Single game view with history
+│   │   └── history.html    # Partial for history table (htmx)
+│   ├── settings/
+│   │   ├── list.html       # Settings list with search/filter
+│   │   └── edit.html       # Inline edit partial (htmx)
+│   └── rewind/
+│       └── confirm.html    # Rewind confirmation modal
+├── static/
+│   ├── style.css           # Minimal CSS (Pico CSS or similar)
+│   └── htmx.min.js         # htmx library
+└── BUILD.bazel
+```
+
+---
+
+## Feature 1: Web UI
+
+### Routes
+
+| Route | Method | Description |
+|-------|--------|-------------|
+| `/` | GET | Redirect to `/games` |
+| `/games` | GET | Game list page (HTML) |
+| `/games/{id}` | GET | Game detail page with history |
+| `/games/{id}/history` | GET | History partial (htmx, for infinite scroll) |
+| `/api/games` | GET | JSON API (existing, keep for programmatic access) |
+| `/api/games/{id}/history` | GET | JSON API (existing) |
+
+### Game List Page
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  Eagle Admin                          [Settings] [Health]   │
+├─────────────────────────────────────────────────────────────┤
+│                                                             │
+│  Running Games (3)                                          │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ Game abc123f                          Round 45       │   │
+│  │ Players: Liu Bei (Human), Cao Cao (AI), Sun Quan    │   │
+│  │ Actions: 1,234                        [View] [Rewind]│   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ Game def456a                          Round 12       │   │
+│  │ Players: Test Player (Human)                         │   │
+│  │ Actions: 456                          [View] [Rewind]│   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Game Detail Page
+
+Shows game info and scrollable action history:
+- **Reverse chronological order**: Most recent actions displayed first
+- Each action shows: index, type, round ID
+- **Clickable actions**: Clicking an action row expands to show JSON representation of the full action data
+- "Rewind to here" button on each action row
+- Infinite scroll loads more history via htmx (loading older actions as user scrolls down)
+
+### Implementation Notes
+
+1. **Embed static files**: Use `//go:embed` to bundle templates and static files
+2. **Template functions**: Add helpers for formatting (hex IDs, timestamps, action summaries)
+3. **CSS framework**: Use Pico CSS (~10KB) for clean defaults without classes
+
+---
+
+## Feature 2: Settings Management
+
+### New gRPC Endpoints (Eagle Server)
+
+Add to `eagle.proto`:
+
+```protobuf
+message Setting {
+  string name = 1;
+  string type = 2;           // "Int" or "Double"
+  string value = 3;          // Current value as string
+  string default_value = 4;  // Default from BUILD.bazel
+  string description = 5;    // Optional, for UI hints
+}
+
+message GetSettingsRequest {
+  string filter = 1;         // Optional name filter (substring match)
+}
+
+message GetSettingsResponse {
+  repeated Setting settings = 1;
+}
+
+message UpdateSettingRequest {
+  string name = 1;
+  string value = 2;
+}
+
+message UpdateSettingResponse {
+  Setting setting = 1;       // Updated setting
+  string error = 2;          // Empty on success
+}
+
+service Eagle {
+  // ... existing methods ...
+  rpc GetSettings(GetSettingsRequest) returns (GetSettingsResponse);
+  rpc UpdateSetting(UpdateSettingRequest) returns (UpdateSettingResponse);
+}
+```
+
+### Eagle Server Implementation
+
+Create a settings registry that:
+1. Discovers all `IntSetting` and `DoubleSetting` instances via reflection or explicit registration
+2. Provides get/set by name
+3. Validates types on update
+
+```scala
+// src/main/scala/net/eagle0/eagle/library/settings/SettingsRegistry.scala
+object SettingsRegistry {
+  private val settings: Map[String, Either[IntSetting, DoubleSetting]] = Map(
+    "ActionVigorCost" -> Left(ActionVigorCost),
+    "BaseFoodBuyPrice" -> Right(BaseFoodBuyPrice),
+    // ... register all 275 settings
+  )
+
+  def getAll(filter: Option[String]): Seq[Setting] = ...
+  def get(name: String): Option[Setting] = ...
+  def update(name: String, value: String): Either[String, Setting] = ...
+}
+```
+
+**Alternative: Code generation**
+
+Rather than manually registering 275 settings, modify `setting_rule.bzl` to generate a registry file during build.
+
+### Admin Server Routes
+
+| Route | Method | Description |
+|-------|--------|-------------|
+| `/settings` | GET | Settings list page with search |
+| `/settings/{name}` | GET | Single setting detail (htmx partial) |
+| `/settings/{name}` | PUT | Update setting value |
+| `/api/settings` | GET | JSON API |
+| `/api/settings/{name}` | PUT | JSON API |
+
+### Settings UI
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  Eagle Admin                          [Games] [Health]       │
+├─────────────────────────────────────────────────────────────┤
+│                                                             │
+│  Settings                    [Search: __________ ]          │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ ActionVigorCost (Int)                                │   │
+│  │ Current: [15    ] Default: 15              [Save]    │   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │ BaseFoodBuyPrice (Double)                            │   │
+│  │ Current: [0.5   ] Default: 0.5             [Save]    │   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ... (275 settings, virtualized/paginated) ...              │
+│                                                             │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Considerations
+
+1. **Persistence**: Settings changes are in-memory only. Document that restarts reset to defaults.
+2. **Validation**: Validate numeric ranges where applicable (e.g., percentages 0-100)
+3. **Categories**: Consider grouping settings by prefix (AI*, Combat*, Economy*, etc.)
+4. **Audit log**: Log setting changes with timestamp for debugging
+
+---
+
+## Feature 3: Game Rewind
+
+### Concept
+
+Restore a game to a previous point in its action history. This is useful for:
+- Debugging issues that occurred at a specific point
+- Testing "what if" scenarios
+- Recovering from bugs that corrupted state
+
+### New gRPC Endpoint
+
+Add to `eagle.proto`:
+
+```protobuf
+message RewindGameRequest {
+  int64 game_id = 1;
+  int32 target_action_count = 2;  // Rewind to state after this many actions
+}
+
+message RewindGameResponse {
+  bool success = 1;
+  string error = 2;
+  int32 new_action_count = 3;
+  int32 disconnected_clients = 4;  // Number of clients that were disconnected
+}
+
+service Eagle {
+  // ... existing methods ...
+  rpc RewindGame(RewindGameRequest) returns (RewindGameResponse);
+}
+```
+
+### Eagle Server Implementation
+
+The `GameHistory` already stores `ActionWithResultingState` for each action, which includes the `GameState` after that action. Rewinding means:
+
+1. **Validate**: Check that `target_action_count` is within valid range (0 to current count)
+2. **Get target state**: Retrieve `GameState` at target action count from history
+3. **Disconnect clients**: Close all human player connections (they'll need to reconnect)
+4. **Replace engine**: Create new `EngineImpl` with target state and truncated history
+5. **Reset AI state**: Clear any cached AI state that depends on current game state
+
+```scala
+// GameController.scala (pseudocode)
+def rewindTo(targetActionCount: Int): Either[String, RewindResult] = {
+  if (targetActionCount < 0 || targetActionCount > engine.history.count)
+    return Left(s"Invalid action count: $targetActionCount")
+
+  // Get state at target point
+  val targetState = engine.history.stateAt(targetActionCount)
+  val truncatedHistory = engine.history.truncateTo(targetActionCount)
+
+  // Disconnect all human clients
+  val disconnectedCount = humanClients.length
+  humanClients.foreach(_.disconnect("Game rewound by admin"))
+
+  // Create new engine at target state
+  val newEngine = EngineImpl(
+    gameId = engine.gameId,
+    currentState = targetState,
+    history = truncatedHistory,
+    // ... other fields
+  )
+
+  // Replace controller's engine
+  this.engine = newEngine
+
+  Right(RewindResult(targetActionCount, disconnectedCount))
+}
+```
+
+### GameHistory Enhancement
+
+Add method to get state at a specific action count:
+
+```scala
+trait GameHistory {
+  // ... existing methods ...
+
+  def stateAt(actionCount: Int): GameState = {
+    if (actionCount == 0) initialState
+    else all(actionCount - 1).resultingState
+  }
+
+  def truncateTo(actionCount: Int): GameHistory = {
+    GameHistoryImpl(
+      initialState = initialState,
+      actions = all.take(actionCount)
+    )
+  }
+}
+```
+
+### Admin Server Route
+
+| Route | Method | Description |
+|-------|--------|-------------|
+| `/games/{id}/rewind` | POST | Rewind game (form: `target_action_count`) |
+| `/games/{id}/rewind/confirm` | GET | Confirmation modal (htmx partial) |
+
+### Rewind UI Flow
+
+1. User views game history
+2. User clicks "Rewind to here" on an action row
+3. Confirmation modal appears via htmx:
+   ```
+   ┌─────────────────────────────────────────┐
+   │  Rewind Game abc123f?                   │
+   │                                         │
+   │  This will:                             │
+   │  • Restore to action 456 (Round 23)     │
+   │  • Discard 778 subsequent actions       │
+   │  • Disconnect 2 connected players       │
+   │                                         │
+   │  This cannot be undone.                 │
+   │                                         │
+   │            [Cancel]  [Rewind]           │
+   └─────────────────────────────────────────┘
+   ```
+4. On confirm, POST to `/games/{id}/rewind`
+5. Success: redirect to game detail showing new state
+6. Error: show error message
+
+### Safety Considerations
+
+1. **No undo**: Rewinding discards history. Consider optional backup before rewind.
+2. **Client disconnect**: All connected clients are forcibly disconnected.
+3. **AI state**: Ensure AI clients restart cleanly after rewind.
+4. **Concurrent access**: Lock game during rewind to prevent race conditions.
+5. **Authorization**: In production, require admin authentication.
+
+---
+
+## Implementation Phases
+
+### Phase 1: Web UI Foundation
+
+**Status: Complete**
+
+1. ✅ Set up Go templates with `embed`
+2. ✅ Add Pico CSS and htmx
+3. ✅ Create base layout with navigation
+4. ✅ Convert `/games` to HTML with styling
+5. ✅ Add game detail page with history table
+6. ✅ Implement htmx infinite scroll for history
+7. ✅ Reverse history order (most recent first)
+8. ✅ Clickable action rows that expand to show JSON representation
+9. ✅ Add `/games/{id}/action/{index}` endpoint for fetching action details
+
+**Deliverable**: Browsable game list and history in HTML with clickable action details
+
+### Phase 2: Settings Management
+
+**Status: Complete**
+
+1. ✅ Add `GetSettings` to `eagle.proto` (uses existing `AddSettings` for updates)
+2. ✅ Add `getAllSettings` method to auto-generated `SettingsLoader`
+3. ✅ Implement `getSettings` in `EagleServiceImpl`
+4. ✅ Create settings list page with live search
+5. ✅ Add inline editing with htmx
+6. ✅ Modified settings are highlighted
+
+**Deliverable**: View and edit settings via admin UI
+
+### Phase 3: Game Rewind
+
+**Status: Complete**
+
+1. ✅ Add `RewindGame` to `eagle.proto`
+2. ✅ Implement `stateAt` and `truncateTo` in `GameHistory`
+3. ✅ Implement rewind logic in `Engine` and `GameController`
+4. ✅ Add rewind confirmation (htmx `hx-confirm` dialog)
+5. ✅ Handle client disconnection gracefully
+6. ✅ Add rewind button to history rows
+7. ✅ Implement `rewindGame` in `GamesManager` and `EagleServiceImpl`
+8. ✅ Add admin server `/games/{id}/rewind` POST handler
+9. ✅ Add success/error feedback UI
+
+**Deliverable**: Rewind games to any previous action
+
+### Phase 4: Polish
+
+**Status: Not Started**
+
+#### High Priority
+1. **Add tests for rewind functionality**
+   - `PersistedHistory.truncateTo` (handles complex persisted vs recent logic)
+   - `InMemoryHistory.truncateTo`
+   - `EngineImpl.rewindTo`
+   - `GameController.rewindTo`
+   - `GamesManager.rewindGame`
+
+2. **Improve action history display**
+   - Human-readable action type names (e.g., "New Round" instead of "NewRoundAction")
+   - Show acting faction/province when available
+   - Action summaries from the `summary` field in `GameHistoryEntry`
+
+#### Medium Priority
+3. **Settings improvements**
+   - Group settings by category prefix (AI*, Combat*, Economy*, etc.)
+   - Show setting descriptions where available
+   - Pagination for large settings lists
+
+4. **Error handling improvements**
+   - Better error messages on failed operations
+   - Retry logic for transient gRPC failures
+
+#### Low Priority (Nice to Have)
+5. **Basic auth** - HTTP Basic Auth or OAuth for production use
+6. **Audit logging** - Log admin actions with timestamps
+7. **Documentation** - Usage guide, deployment notes
+
+#### Future Considerations
+- Game creation from admin UI
+- Player management (view connected players, force disconnect)
+- Export game history to file
+- Metrics/stats dashboard
+
+---
+
+## Security Notes
+
+The admin server is intended for local/trusted network use only. For production:
+
+1. **Do not expose to public internet** without authentication
+2. Consider adding HTTP Basic Auth or OAuth
+3. Run on internal network or behind VPN
+4. Log all admin actions for audit trail
+
+---
+
+## Open Questions
+
+1. **Settings persistence**: Should we add optional persistence to disk/database?
+2. **Game snapshots**: Should rewind create a backup first?
+3. **Multi-admin**: Need locking if multiple admins access simultaneously?
+4. **Shardok settings**: Are there Shardok (C++) settings to expose too?

docs/ASSET_AUDIT.md

@@ -0,0 +1,239 @@
+# Eagle0 Media Asset Audit
+
+This document catalogs all media assets in the Unity project for licensing review.
+
+**Total Assets:** ~12,500 files | **Size:** 1.4 GB
+
+---
+
+## Summary by Category
+
+| Category | Count | Notes |
+|----------|-------|-------|
+| Images | 10,637 | Mostly PNG icons and UI sprites |
+| Audio | 1,778 | 26 music tracks + 1,752 sound effects |
+| 3D Models | 52 | Bridge pack only |
+| Fonts | 16 | TTF files |
+
+---
+
+## 1. Purchased Asset Store Packages
+
+These are commercial Unity Asset Store purchases tied to your account:
+
+### 4000_Fantasy_Icons
+- **Location:** `Assets/4000_Fantasy_Icons/`
+- **Size:** 495 MB (5,621 PNG files)
+- **Contents:** Icons for armor, weapons, skills, resources
+- **License:** Unity Asset Store (check invoice/account)
+
+### GUI Pro Kit Fantasy RPG
+- **Location:** `Assets/GUI Pro Kit Fantasy RPG/`
+- **Size:** 117 MB (3,755 PNG files)
+- **Contents:** UI sprites, animations, prefabs
+- **Includes fonts:** Alata-Regular.ttf, JosefinSans-Bold.ttf
+- **License:** Unity Asset Store
+
+### Modern UI Pack v4.2.0
+- **Location:** `Assets/Modern UI Pack/`
+- **Size:** 40 MB (191 PNG files)
+- **Author:** Michsky (support@michsky.com)
+- **Website:** https://www.michsky.com
+- **Includes fonts:** Open Sans family (12 variants)
+- **License:** Unity Asset Store
+
+### Pixel Fonts Megapack
+- **Location:** `Assets/Pixel Fonts Megapack/`
+- **Publisher ID:** 17384
+- **Author:** @pixelmush_ on Twitter
+- **Asset Store Link:** http://u3d.as/w4v
+- **License:** Unity Asset Store
+
+### TileableBridgePack
+- **Location:** `Assets/TileableBridgePack/`
+- **Size:** 3.1 MB (52 FBX models)
+- **Contents:** Bridge construction pieces
+- **License:** Unity Asset Store
+
+### Fantasy Interface Sounds
+- **Location:** `Assets/Fantasy Interface Sounds/`
+- **Count:** 320 WAV files
+- **Contents:** UI sounds (bag, book, coins, dice, etc.)
+- **License:** Unity Asset Store (verify)
+
+### Medieval Combat Sounds
+- **Location:** `Assets/Medieval Combat Sounds/`
+- **Count:** 1,072 WAV files
+- **Contents:** Footsteps, swings, shields, weapons, magic
+- **License:** Unity Asset Store (verify)
+
+### Magic Spells Sound Effects LITE
+- **Location:** `Assets/Magic Spells Sound Effects LITE/`
+- **Count:** 254 WAV files
+- **Contents:** Spell casting, element effects
+- **Note:** "LITE" version - check if restrictions apply
+- **License:** Unity Asset Store (verify)
+
+---
+
+## 2. Creative Commons Music (Properly Licensed)
+
+**Location:** `Assets/Resources/Music/`
+**Documentation:** `Music Credits.txt` (attribution file exists)
+
+All 26 tracks have CC licenses with proper attribution:
+
+| Track | Artist | License |
+|-------|--------|---------|
+| A Robust Crew | Darren Curtis | CC BY 3.0 |
+| Asian Graveyard | Darren Curtis | CC BY 3.0 |
+| Fall From Grace | Darren Curtis | CC BY 3.0 |
+| Samurai Sake Showdown | Darren Curtis | CC BY 3.0 |
+| Deflector | Ghostrifter Official | CC BY-SA 3.0 |
+| Chase | Alexander Nakarada | CC BY 4.0 |
+| Wintersong | Alexander Nakarada | CC BY 4.0 |
+| One Bard Band | Alexander Nakarada | CC BY 4.0 |
+| Now We Ride | Alexander Nakarada | CC BY 4.0 |
+| The Northern Path | Alexander Nakarada | CC BY 4.0 |
+| Victory | MaxKoMusic | CC BY-SA 3.0 |
+| Sakuya2 | PeriTune | CC BY 3.0 |
+| Under The Sun | Keys of Moon | CC BY 4.0 |
+| One Piece of Summer | Keys of Moon | CC BY 4.0 |
+| Fluffing a Duck | Kevin MacLeod | CC BY 3.0 |
+| Space Jazz | Kevin MacLeod | CC BY 3.0 |
+| The Ice Giants | Kevin MacLeod | CC BY 4.0 |
+| Epic Cinematic Trailer ELITE | Alex-Productions | CC BY 3.0 |
+| Push | Alex-Productions | CC BY 3.0 |
+| Virus | Alex-Productions | CC BY 3.0 |
+| Duel | Makai Symphony | CC BY-SA 3.0 |
+| Dragon Castle | Makai Symphony | CC BY-SA 3.0 |
+| Durandal | Makai Symphony | CC BY-SA 3.0 |
+
+**Tracks with non-CC licenses:**
+
+| Track | Artist | License | Source |
+|-------|--------|---------|--------|
+| Market Day | RandomMind | Free without attribution | [Chosic](https://www.chosic.com/download-audio/27016/) |
+| Shopping List | Komiku | Free without attribution | [Chosic](https://www.chosic.com/download-audio/24714/) |
+| Medieval: Victory Theme | Unknown | **NEEDS VERIFICATION** | Unknown |
+| No Time for Greatness | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Warriors of Demacia | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Forest Queen Tale | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Valor | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Clouds | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+
+**Note on Dima Koltsov tracks:** Audius uses an "Open Music License" by default, which is not the same as Creative Commons. These should eventually be replaced with CC-licensed alternatives.
+
+---
+
+## 3. CC0 / Public Domain Assets
+
+### SimpleFileBrowser Icons
+- **Location:** `Assets/Plugins/SimpleFileBrowser/Sprites/FileIcons/`
+- **License:** CC0 (documented in LICENSE.txt)
+- **Source:** pngrepo.com
+- **Items:** Archive, Audio, Default, Drive, Folder, Image, PDF, Text, Video icons
+
+---
+
+## 4. Potentially Problematic Assets (Review Needed)
+
+### Clip Art (Unknown License)
+| File | Concern |
+|------|---------|
+| `Assets/Shardok/commandImages/bridge.png` | Clip art style wooden bridge, unknown source - **needs replacement** |
+| `Assets/Images/startFire.png` | Icon, unknown source - **needs verification or replacement** |
+
+### Shardok Sound Effects
+- **Location:** `Assets/Shardok/soundEffects/`
+- **Count:** 56 MP3 files
+- **Contents:** Spell effects, movement, combat sounds
+- **Status:** Unknown origin - may be custom or need verification
+
+### Free Icons
+- **Location:** `Assets/free_icons/`
+- **Count:** 8 PNG weather icons
+- **Status:** Verify "free" means commercially usable
+
+### Terrain Hexes
+- **Location:** `Assets/Terrain Hexes/`
+- **Count:** 85 PNG files
+- **Status:** Unknown source - verify licensing
+
+### StrategyGameIcons
+- **Location:** `Assets/StrategyGameIcons/`
+- **Count:** 138 PNG files
+- **Status:** Unknown source - verify licensing
+
+---
+
+## 5. Fonts
+
+| Font | Location | License |
+|------|----------|---------|
+| Open Sans (12 variants) | Modern UI Pack | Apache 2.0 (Google Font) |
+| Alata-Regular | GUI Pro Kit | SIL OFL (Google Font) |
+| JosefinSans-Bold | GUI Pro Kit | SIL OFL (Google Font) |
+| LiberationSans | TextMesh Pro | SIL OFL |
+| NotoColorEmoji | Assets root | SIL OFL (Google) |
+| Stoke-Light, Stoke-Regular | Assets root | SIL OFL (Google Font) |
+
+All fonts appear to be open-source Google Fonts or Liberation fonts - should be fine.
+
+---
+
+## 6. Third-Party Code Packages
+
+NuGet packages in `Assets/Packages/` all include LICENSE.TXT files:
+- Microsoft.Extensions.* - MIT License
+- System.* - MIT License
+- Grpc.* - Apache 2.0
+
+---
+
+## Action Items
+
+### Must Verify Before Opening Public Access:
+
+1. **Clip art images** - Unknown license, need replacement with properly licensed alternatives:
+   - `Assets/Shardok/commandImages/bridge.png` - wooden bridge icon
+   - `Assets/Images/startFire.png` - fire icon
+
+2. **Shardok sound effects** - 56 MP3 files of unknown origin. Either:
+   - Document their source
+   - Replace with known-licensed alternatives
+   - Confirm they were custom-created
+
+3. **Terrain Hexes** - 85 hex tiles of unknown source
+   - **TODO:** Confirm if this is a Unity Asset Store purchase (owner believes it is)
+
+4. **StrategyGameIcons** - 138 icons of unknown source
+   - **TODO:** Investigate origin - check Unity Asset Store purchase history
+
+5. **Medieval: Victory Theme** - Cannot find source or license. Either verify origin or replace.
+
+6. **Dima Koltsov (Audius) tracks** - 5 tracks under Audius "Open Music License" (not Creative Commons). Replace with CC-licensed alternatives eventually.
+
+7. **Discord logo** (`Eagle/Discord-Logo-Blurple.png`) - Likely fine for "Login with Discord" button per Discord brand guidelines, but verify usage complies with their terms
+
+### Already Safe:
+
+- All Asset Store purchases (license tied to your account)
+- CC-licensed music (attribution in Music Credits.txt)
+- CC0 SimpleFileBrowser icons
+- Google Fonts / Liberation fonts
+- NuGet packages
+
+---
+
+## Recommendation
+
+Before public release:
+
+1. Replace clip art images (`bridge.png`, `startFire.png`) with properly licensed alternatives (e.g., from [game-icons.net](https://game-icons.net) CC BY 3.0)
+2. Verify source of `Assets/Shardok/soundEffects/` MP3s
+3. Verify source of `Assets/Terrain Hexes/` and `Assets/StrategyGameIcons/`
+4. Replace Dima Koltsov Audius tracks with CC-licensed alternatives
+5. Find source of Medieval: Victory Theme or replace
+
+The bulk of your assets (95%+) are properly licensed Asset Store purchases or CC content.

docs/DEPROTO_PLAN.md

@@ -33,302 +33,147 @@
 
 ---
 
-## Current State
+## Current State (January 2026)
 
-### Completed Phases
-
-| Phase | Status | Summary |
-|-------|--------|---------|
-| Phase 1: GameStateC | **Complete** | Scala `GameState` model with 22 fields |
-| Phase 2: EngineImpl | **Complete** | Holds Scala `GameState` internally |
-| Phase 3: GameHistory | **Complete** | `stateAfter` returns Scala GameState |
-| Phase 4: ActionResultT | **Complete** | All 59 actions return `ActionResultT` |
-| Phase 5: Action Base Classes | **Complete** | All `RandomSequentialResultsAction` and `DeterministicSingleResultAction` converted to T-type base classes |
-| Phase 5b: Base Class Cleanup | **Complete** | `RandomSequentialResultsAction` and `DeterministicSingleResultAction` deleted |
-| Phase 5c: RoundPhaseAdvancer Actions | **Complete** | All actions called by RoundPhaseAdvancer accept Scala GameState |
-| Phase 5d: RoundPhaseAdvancer Itself | **Complete** | RoundPhaseAdvancer.checkForPhaseAdvancement takes Scala GameState |
-
-### Phase 5c/5d Progress (Complete)
-
-`RoundPhaseAdvancer.checkForPhaseAdvancement` now accepts Scala `GameState` and `ActionResultApplier` directly (PR #4677).
-
-| Action | PR | Status |
-|--------|-----|--------|
-| `PrisonerExchangeAction` | #4670 | ✅ Merged |
-| `PerformForcedTurnBackAction` | #4671 | ✅ Merged |
-| `PerformHeroDeparturesAction` | #4672 | ✅ Merged |
-| `RequestFreeForAllBattlesAction` | #4673 | ✅ Merged |
-| `EndPlayerCommandsPhaseAction` | #4674 | ✅ Merged |
-| `EndDiplomacyResolutionPhaseAction` | #4675 | ✅ Merged |
-| `RoundPhaseAdvancer` itself | #4677 | ✅ Merged |
-
-### EngineImpl Progress
-
-| Change | PR | Status |
-|--------|-----|--------|
-| `recursiveTransform` deleted | #4677 | ✅ Merged |
-| `recursiveTransformT` uses `RandomStateTSequencer` | #4677 | ✅ Merged |
-
-### Current Architecture
-
-**ActionResultT Production (100% Complete):**
-- All actions produce `ActionResultT`
-- Conversion to `ActionResultProto` happens via `ActionResultProtoConverter.toProto()`
-- No direct `ActionResultProto` construction outside the converter
-
-**ActionResultProto Consumption (Next Target):**
-- `ActionResultProtoApplierImpl` - applies proto results to proto GameState
-- `RoundPhaseAdvancer` - calls converter, passes protos to applier
-- `InMemoryHistory` / `PersistedHistory` - stores proto results
-- Service layer (`GameController`, `GamesManager`, etc.) - uses proto for client communication
-
----
-
-## Phase 6: Migrate to ActionResultT Consumers
-
-### Objective
-
-Eliminate internal consumption of `ActionResultProto`. Everything inside the engine should work with `ActionResultT`.
-
-### Current Flow (Proto-Heavy)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultProtoConverter.toProto()
-    → ActionResultProto
-    → ActionResultProtoApplierImpl.applyActionResults()
-    → GameStateProto
-    → GameStateConverter.fromProto()
-    → GameStateC
-```
-
-### Target Flow (T-Types Throughout)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultApplier.applyActionResults()
-    → GameStateC
-
-    (Proto conversion only at boundaries)
-```
-
-### Key Files to Convert
-
-**Tier 1 - Core Applier:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/actions/applier/ActionResultApplierImpl.scala
-```
-`ActionResultApplier` applies `ActionResultT` directly to Scala `GameState`. The legacy `ActionResultTApplierImpl` wraps it and converts to/from proto for callers that still need proto types.
-
-**Tier 2 - RoundPhaseAdvancer:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/RoundPhaseAdvancer.scala
-```
-Now accepts Scala `GameState` and `ActionResultApplier`. Only converts to proto lazily for `AvailableCommandsFactory` calls.
-
-**Tier 3 - Sequencers:**
-```
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateTSequencer.scala
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateProtoSequencer.scala
-```
-Modify `RandomStateTSequencer` to thread Scala `GameState` throughout (currently converts to proto internally). Then evaluate whether `RandomStateProtoSequencer` is still needed at all.
-
-**Current State**: `RandomStateTSequencer` accepts Scala `GameState` via its `apply()` method but internally converts to proto. All callback methods (`withRandomActionResult`, `withActionResults`, etc.) pass `GameStateProto` to callers, forcing actions that use the sequencer to work with proto types internally.
-
-**Target State**: Create a fully protoless sequencer where:
-1. `lastState` returns Scala `GameState` (not `lastStateProto`)
-2. All callback methods pass Scala `GameState` to callers
-3. Actions using the sequencer can be fully protoless
-
-**Migration Path**:
-1. Add `lastState: GameState` method alongside `lastStateProto` (non-breaking)
-2. Add parallel callback methods that pass Scala GameState (e.g., `withScalaActionResult`)
-3. Migrate actions one by one to use the new Scala-based callbacks
-4. Once all actions migrated, deprecate/remove proto-based callbacks
-5. Remove `lastStateProto` once no longer used
-
-**RandomStateSequencer Migration Progress** (PR #4679 introduced protoless `RandomStateSequencer`):
-
-| Action | Status |
-|--------|--------|
-| `TruceTurnBackPhaseAction` | ✅ Migrated (PR #4680) |
-| `EndHandleRiotsPhaseAction` | ✅ Migrated (PR #4684) |
-| `PerformVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformVassalDefenseDecisionsAction` | ✅ Migrated |
-| `EndVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformReconResolutionAction` | ✅ Migrated |
-| `NewRoundAction` | ✅ Migrated (PR #4698) |
-| `EndBattleAftermathPhaseAction` | ✅ Migrated (PR #4699) |
-| `EndDiplomacyResolutionPhaseAction` | ✅ Migrated |
-| `PerformUnaffiliatedHeroesAction` | ✅ Migrated |
-| `EngineImpl.recursiveTransformT` | ✅ Migrated (PR #4704) |
-| `ProtolessSequentialResultsActionWrapper` | ✅ Migrated (PR #4705) |
-| `LegacyRandomStateTSequencer` | ✅ **Deleted** (PR #4705) |
-
-**TCommandFactory Extraction** (PR #4684):
-
-To enable lightweight mocking of command creation in tests, `TCommandFactory` trait was extracted from `CommandFactory`. This allows tests to mock just the `makeTCommand` method without pulling in all 40+ command dependencies that `CommandFactory` requires.
-
-- `TCommandFactory` - lightweight trait with just `makeTCommand`
-- `CommandFactory extends TCommandFactory` - maintains backward compatibility
-- Actions accepting command factories now use `TCommandFactory` type for better testability
-
-**Tier 4 - History APIs:**
-```
-src/main/scala/net/eagle0/eagle/service/InMemoryHistory.scala
-src/main/scala/net/eagle0/eagle/service/PersistedHistory.scala
-```
-Change APIs to vend Scala `GameState` and `ActionResultT` instead of proto versions. `PersistedHistory` converts to proto internally for disk persistence; `InMemoryHistory` doesn't need proto at all.
-
-### ActionResultProto Consumer Inventory
-
-| File | Usage | Status |
-|------|-------|--------|
-| `ActionResultApplierImpl.scala` | Applies ActionResultT to Scala GameState | ✅ **Complete** |
-| `ActionResultTApplierImpl.scala` | Legacy wrapper - converts to/from proto | Keep until all callers migrated |
-| `RoundPhaseAdvancer.scala` | Uses Scala GameState | ✅ **Complete** |
-| `RandomStateSequencer.scala` | Threads Scala GameState | ✅ **Complete** |
-| `VigorXPApplier.scala` | Has both proto and Scala methods | Scala method exists, delete proto method when unused |
-| `PerformForcedTurnBackAction.scala` | Fully protoless | ✅ **Complete** |
-| `ResolveBattleAction.scala` | Heavy proto usage | Blocked by proto dependencies |
-| `InMemoryHistory.scala` | Stores proto results | Pending - vend Scala types |
-| `PersistedHistory.scala` | Stores proto results | Pending - vend Scala types, convert for disk |
-| `GameController.scala` | Uses proto for client communication | Keep proto (gRPC boundary) |
-
-### Remaining Proto Usage in Actions
-
-**Progress: 46 of 52 action files (88%) are fully protoless.**
-
-The following 6 actions still have proto usage:
-
-| Action | Proto Usages | Blocker | Effort |
-|--------|--------------|---------|--------|
-| `ResolveBattleAction` | 24 | Shardok interface, complex battle logic | High |
-| `PerformVassalCommandsPhaseAction` | 3 | `CommandChoiceHelpers` takes proto GameState | Medium |
-| `EndHandleRiotsPhaseAction` | 2 | `CommandChoiceHelpers` takes proto GameState | Medium |
-| `PerformVassalDefenseDecisionsAction` | 2 | `CommandChoiceHelpers` takes proto GameState | Medium |
-| `EndVassalCommandsPhaseAction` | 1 | `CommandChoiceHelpers` takes proto GameState | Medium |
-| `NewRoundAction` | 1 | `ChronicleEventGenerator` returns proto | Medium |
-
-**Deleted Dead Code:**
-- `UnaffiliatedHeroMovedAction` - Was never called; `PerformUnaffiliatedHeroesAction.heroMovedResult` constructs `ActionResultC` directly
-- `HeroBackstoryUpdateActionGenerator.fromGameState` - Dead method that converted proto to Scala; only `apply(GameState)` is used
-
-**Note**: `PerformReconResolutionAction` and `EndBattleAftermathPhaseAction` are now fully protoless after:
-1. Migrating `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` to use Scala `ProvinceView`
-2. Adding Scala overload of `ProvinceViewFilter.withdrawnFromProvinceView`
-
-### Estimated Effort (Remaining)
-
-| Component | Lines | Complexity | Blocks |
-|-----------|-------|------------|--------|
-| `CommandChoiceHelpers` to Scala | ~2000 | High | 4 vassal actions |
-| `ResolveBattleAction` refactor | ~500 | High | 1 action (complex) |
-| `ChronicleEventGenerator` to Scala | ~400 | Medium | 1 action |
-| History API updates | ~100 | Low | - |
-| **Total Remaining** | **~3000** | | |
-
-### Progress Summary
-
-| Metric | Value |
-|--------|-------|
-| Action files fully protoless | 46 / 52 (88%) |
-| Proto usages in remaining actions | 33 total |
-| Biggest blocker | `ResolveBattleAction` (24 usages) |
-| Second biggest blocker | `CommandChoiceHelpers` (blocks 4 actions) |
-
-### Validation
-- [x] `ActionResultApplier` created and tested
-- [x] `RandomStateSequencer` threads Scala GameState throughout
-- [x] `RoundPhaseAdvancer` uses T-types internally
-- [x] `ProvinceViewFilter` has Scala overload for server-side use (PR #4752)
-- [x] `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` use Scala `ProvinceView`
-- [x] `ProvinceViewFilter.withdrawnFromProvinceView` has Scala overload
-- [ ] `ProvinceViewFilter` faction-filtered views use Scala types
-- [ ] `CommandChoiceHelpers` uses Scala types
-- [ ] History APIs vend Scala types
-- [ ] No `ActionResultProtoConverter.toProto()` calls except at persistence/gRPC boundaries
-- [ ] All tests pass
-
----
-
-## Phase 7: Clean Up Legacy Utilities
-
-### Objective
-Remove remaining direct proto imports from utility classes.
-
-### Files to Modify
-
-| File | Status |
+| Area | Status |
 |------|--------|
-| `CommandChoiceHelpers.scala` | Accepts proto `GameState`; blocks full deproto of `PerformVassalCommandsPhaseAction` and `PerformVassalDefenseDecisionsAction` |
-| `LegacyProvinceUtils.scala` | Replace with `ProvinceUtils.scala` - `hasImminentRiot` added (PR #4683) |
-| `LegacyFactionUtils.scala` | Replace proto imports with `FactionT` |
-| `LegacyUnaffiliatedHeroUtils.scala` | Replace proto imports with Scala models |
-| `BattalionTypeLoader.scala` | Keep proto for file loading, convert immediately after |
-| `BeastUtils.scala` | **Complete** - now uses Scala `BeastInfo` only |
+| Production code (`src/main/scala/.../library/`) | ✅ **Complete** - zero proto imports |
+| Test code (`src/test/scala/.../library/`) | ✅ **Complete** - 20 migrated, 6 deferred, 1 deleted |
+| Hostility proto migration | ✅ **Complete** - all 4 files migrated to Scala enum |
 
-### View Filters (Partially Complete)
-
-The view filter utilities now have Scala overloads for server-side use:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `ProvinceViewFilter.scala` | **Partial** | `filteredProvinceView(ProvinceT, ScalaGameState)` added (PR #4752) |
-| `ArmyFilter.scala` | **Partial** | `filterArmy(ScalaArmy, Map[BattalionId, BattalionT], Option[FactionId])` added |
-| `BattalionViewFilter.scala` | **Complete** | Uses Scala `BattalionT` throughout |
-| `GameStateViewFilter.scala` | Pending | Uses proto types throughout |
-| `GameStateViewDiffer.scala` | Pending | Works with view protos |
-
-**Unblocked Actions** (PR #4752):
-- `EndBattleAftermathPhaseAction` - can now use `filteredProvinceView(province, scalaGameState)`
-- `PerformReconResolutionAction` - can now use Scala overload
-- `GameStateFactionExtensions` - can now use `updatedReconnedProvinces` with Scala types
-
-**Remaining Work**:
-- Faction-filtered `filteredProvinceView(Province, GameState, FactionId)` still uses proto types
-- `withdrawnFromProvinceView` still uses proto types
-- These are needed for client-facing views with visibility restrictions
+**Note:** The `bazel query` for proto dependencies still shows ~26 targets, but these are transitive build-graph dependencies from map data generation (C++/Go tools), not Scala code imports.
 
 ---
 
-## Phase 8: Verify Boundaries
+## Phase 10: Library Test Migration ✅ Complete
 
-### Objective
-Confirm protos are used correctly at boundaries — and ONLY there.
+### Overview
+
+27 test files in `src/test/scala/.../library/` were reviewed for proto type usage. 20 files were successfully migrated to use Scala model types exclusively.
+
+### Migration Results
+
+#### Successfully Migrated (20 files)
+
+| File | PR | Notes |
+|------|-----|-------|
+| `QuestFulfillmentUtilsTest.scala` | Merged | Light migration |
+| `FeastCommandTest.scala` | Merged | Light migration |
+| `FriendlyMoveActionTest.scala` | Merged | Light migration |
+| `DeclineQuestCommandTest.scala` | Merged | Light migration |
+| `PerformHostileArmySetupActionTest.scala` | Merged | Medium migration |
+| `NewYearActionTest.scala` | Merged | Medium migration |
+| `ProvinceHeldActionTest.scala` | Merged | Medium migration |
+| `AvailableMarchCommandFactoryTest.scala` | Merged | Medium migration |
+| `AvailableCommandsFactoryTest.scala` | Merged | Heavy migration |
+| `AvailablePleaseRecruitMeCommandFactoryTest.scala` | Merged | Heavy migration |
+| `PerformReconResolutionActionTest.scala` | Merged | Heavy migration |
+| `AttackDecisionCommandChooserTest.scala` | Merged | Heavy migration |
+| `PerformProvinceEventsActionTest.scala` | #5499 | Heavy migration |
+| `PerformFoodConsumptionPhaseActionTest.scala` | #5500 | Heavy migration |
+| `AvailableDiplomacyCommandsFactoryTest.scala` | #5502 | Heavy migration |
+| `EndPlayerCommandsPhaseActionTest.scala` | #5504 | Heavy migration |
+| `ProvinceConqueredActionTest.scala` | #5505 | Heavy migration |
+| `NewRoundActionTest.scala` | #5506 | Heavy migration (22 imports) |
+| `EngineImplTest.scala` | #5488 | Added InMemoryHistory.fromScalaResults |
+| `GameStateViewFilterTest.scala` | #5510 | Heavy migration with view types |
+
+#### Deferred - Shared Test Utilities (4 files)
+
+These files provide shared test utilities used by multiple tests. They retain proto types for now as migrating them requires coordinating with all dependent tests:
+
+| File | Reason |
+|------|--------|
+| `BattalionTypesTestData.scala` | Shared utility, used by multiple tests |
+| `impl/package.scala` | Shared utility with cascading dependencies |
+| `IDable.scala` | Shared utility with cascading dependencies |
+| `availability/package.scala` | Shared utility with cascading dependencies |
+
+#### Deferred - Complex Proto Integration (2 files)
+
+These tests use `ProtoMatchers` with `equalProto` for complex object comparisons. Migrating them would require significant rewriting:
+
+| File | Reason |
+|------|--------|
+| `EndBattleAftermathPhaseActionTest.scala` | Deep ProtoMatchers/equalProto integration |
+| `ResolveBattleActionTest.scala` | 34+ proto imports, heavy equalProto usage |
+
+#### Deleted (1 file)
+
+| File | Reason |
+|------|--------|
+| `RansomCommandTest.scala` | Orphaned test with no corresponding implementation |
+
+### Key Migration Patterns Used
+
+**Import aliasing to avoid naming conflicts:**
+```scala
+import net.eagle0.eagle.model.action_result.types.ActionResultType.{
+  NewRoundAction as NewRoundActionType,
+  NewYearAction as NewYearActionType
+}
+```
+
+**Using `inside()` for concrete type access:**
+```scala
+inside(result.changedProvinces.head) { case cp: ChangedProvinceC =>
+  cp.foodDelta shouldBe Some(-258)
+}
+```
+
+**Scala model construction:**
+```scala
+HeroC(id = 9, vigor = 50, factionId = Some(actingFactionId))
+ProvinceC(id = 7, rulingFactionId = Some(5), food = 2987)
+FactionC(id = 5, factionHeadId = 9, name = "Test Faction")
+```
+
+### Key Conversions Reference
+
+| Proto Type | Scala Equivalent |
+|------------|------------------|
+| `GameState` | `GameState` (model/state/game_state) |
+| `Province` | `ProvinceC` |
+| `Hero` | `HeroC` |
+| `Faction` | `FactionC` |
+| `Battalion` | `BattalionC` |
+| `Army` | `Army` (already Scala) |
+| `Date` | `Date` (model/state/date) |
+| `ChangedHero` | `ChangedHeroC` |
+| `ChangedProvince` | `ChangedProvinceC` |
+| `ActionResultType.*` | `ActionResultType.*` (Scala enum) |
+
+### Success Criteria
+
+- [x] 20 test files fully migrated to Scala types
+- [x] All tests pass
+- [x] Deferred files documented with clear rationale
+- [ ] Zero proto imports in `src/test/scala/.../library/` (6 files deferred)
+
+---
+
+## Architecture Summary
+
+### Fully Protoless ✅
+
+- **Production library code** (`src/main/scala/.../library/`)
+- **AI layer** (`/ai/`)
+- **Actions** (`/library/actions/impl/action/`)
+- **Commands** (`/library/actions/impl/command/`)
+- **Availability** (`/library/actions/availability/`)
+- **Command helpers** (`/library/util/command_choice_helpers/`)
+- **View filters** (`/library/util/view_filters/`)
+- **LLM generators** (`/library/actions/llm_prompt_generators/`)
+- **Most library tests** (`src/test/scala/.../library/`) - 20 files migrated
+
+### Proto at Boundaries (Expected) ✅
 
-### Expected Proto Usage (Keep)
 - `EagleServiceImpl.scala` - gRPC boundary
-- `InMemoryHistory.scala` / `PersistedHistory.scala` - Persistence boundary
+- `GameController.scala` - Client communication
 - `*Converter.scala` - Explicit conversion utilities
-- `*Loader.scala` - File loading utilities
+- `PersistedHistory.scala` - Disk persistence
 
-### Expected No Proto Usage (Verify)
-- `/library/actions/impl/` - Pure Scala models
-- `/library/util/` - Pure Scala models (except loaders)
-- `/model/state/` - Pure Scala models
+### Deferred (Documented) 📋
 
----
-
-## Open Questions
-
-1. **Persistence Format**: Currently game state is persisted as proto. Should we keep proto for persistence (good for schema evolution) or switch to a different format?
-
-2. **Shardok Integration**: `ResolveBattleAction` communicates with Shardok. Should the Shardok interface use protos (external service) or Scala models?
-
-3. **View Generation**: `GameStateViewDiffer` works with view protos for client updates. Views need Scala models (`ProvinceViewT`, etc.) to allow actions like `EndBattleAftermathPhaseAction` to be fully protoless. The Scala views would be converted to proto only at the gRPC boundary when sending updates to clients.
-
----
-
-## Success Criteria
-
-### Code Quality
-- [ ] Zero proto imports in `/library/actions/` (except boundaries)
-- [ ] Zero proto imports in `/library/` utilities (except loaders)
-- [ ] `GameStateT` used throughout engine internals
-- [ ] Proto usage limited to: `EagleServiceImpl`, loaders, converters, persistence
-
-### Architecture
-- [ ] Clear separation: Scala models (internal) vs Proto (boundaries)
-- [ ] Converters as the only bridge between domains
-- [ ] No "proto creep" into business logic
+- **Shared test utilities** - 4 files (BattalionTypesTestData, IDable, package objects)
+- **Complex proto tests** - 2 files (EndBattleAftermathPhaseActionTest, ResolveBattleActionTest)

docs/HETZNER_SETUP.md

@@ -0,0 +1,159 @@
+# Hetzner Setup Guide
+
+This guide walks through setting up Hetzner Cloud infrastructure for running Shardok on-demand compute.
+
+## Prerequisites
+
+- All code PRs merged (#4990, #4996, #4998, #5001, #5009)
+- Access to DigitalOcean Container Registry (for pulling Shardok ARM64 image)
+
+---
+
+## Step 1: Create Hetzner Cloud Account
+
+1. Go to https://console.hetzner.cloud/
+2. Sign up and add payment method
+3. Create a new project (e.g., "eagle0")
+
+---
+
+## Step 2: Generate Hetzner API Token
+
+1. In Hetzner Console → Security → API Tokens
+2. Click "Generate API Token"
+3. Give it **Read & Write** permissions
+4. Copy the token (you'll only see it once)
+
+---
+
+## Step 3: Generate Shardok Auth Token
+
+Generate a 256-bit random token for Eagle-Shardok authentication:
+
+```bash
+openssl rand -hex 32
+```
+
+Save this output - it's the shared secret between Eagle and Shardok.
+
+---
+
+## Step 4: Store Secrets in GitHub Actions
+
+Add these secrets in GitHub → Settings → Secrets and variables → Actions:
+
+| Secret Name | Description |
+|-------------|-------------|
+| `HETZNER_API_TOKEN` | From Step 2 - for Hetzner API calls |
+| `SHARDOK_AUTH_TOKEN` | From Step 3 - shared secret for gRPC auth |
+
+Note: `DO_REGISTRY_TOKEN` already exists and will be used for Hetzner to pull container images.
+
+These secrets will be passed to Eagle at runtime via `docker_build.yml`, similar to how `OPENAI_API_KEY` and other secrets are handled.
+
+---
+
+## Step 5: DNS Setup (for Let's Encrypt)
+
+You need a domain pointing to the Shardok instance for TLS certificates.
+
+### Option A: Floating IP (Recommended)
+
+1. In Hetzner Console → Networking → Floating IPs
+2. Create a **Floating IPv6** in **Hillsboro, Oregon (hil)** region
+   - IPv6 costs €1/month vs €3/month for IPv4
+   - Hillsboro has better latency to DigitalOcean SFO than Ashburn
+   - Server-to-server communication works fine with IPv6-only
+3. Point `shardok.prod.eagle0.net` to this IP via AAAA record
+4. The ShardokInstanceManager will attach this IP to instances on spin-up
+
+**Location choice**: Hillsboro, OR (`hil`) is recommended for US West Coast. Same pricing as Ashburn (`ash`).
+
+### Option B: Dynamic DNS
+
+Update DNS programmatically when instance spins up. More complex but avoids floating IP cost.
+
+---
+
+## Step 6: Upload SSH Key to Hetzner
+
+For debugging access to instances:
+
+1. In Hetzner Console → Security → SSH Keys
+2. Click "Add SSH Key"
+3. Paste your public key (e.g., `~/.ssh/id_rsa.pub`)
+4. Give it a name (e.g., "eagle-deploy")
+
+---
+
+## Step 7: Wire Security Config into Eagle
+
+Update Eagle's startup code to use the security config when connecting to remote Shardok:
+
+```scala
+val securityConfig = ShardokSecurityConfig(
+  useTls = true,
+  authToken = Some(sys.env("SHARDOK_AUTH_TOKEN"))
+)
+
+val channel = ServerSetupHelpers.newChannel(
+  "shardok.prod.eagle0.net",
+  50051,
+  securityConfig
+)
+```
+
+---
+
+## Testing
+
+### Manual Instance Spin-up
+
+Test the Hetzner integration by triggering instance creation:
+
+```scala
+val manager = new ShardokInstanceManager(
+  hetznerApiToken = sys.env("HETZNER_API_TOKEN"),
+  // ... other config
+)
+
+manager.ensureInstanceRunning()
+```
+
+### Verify TLS and Auth
+
+1. Instance spins up and gets Let's Encrypt certificate
+2. Eagle connects via TLS
+3. Auth token is validated on each request
+
+---
+
+## Cost Estimate
+
+| Component | Cost |
+|-----------|------|
+| CAX41 (16 ARM cores) | ~$0.04/hour |
+| Floating IP | ~$4/month |
+| Typical usage (20 hrs/week) | ~$3.50/month compute |
+
+**Total: ~$7-8/month** for typical usage.
+
+---
+
+## Troubleshooting
+
+### Instance won't start
+- Check Hetzner API token has Read & Write permissions
+- Verify you're using the correct region (`hil` for Hillsboro OR, or `ash` for Ashburn VA)
+
+### TLS certificate fails
+- Ensure DNS points to the instance IP before certbot runs
+- Check port 80 is open for Let's Encrypt HTTP-01 challenge
+
+### Auth failures
+- Verify `SHARDOK_AUTH_TOKEN` matches on both Eagle and Shardok
+- Check the token file is readable by Shardok container
+
+### Can't pull container image
+- Ensure `DO_REGISTRY_TOKEN` is passed to cloud-init
+- Verify the ARM64 image exists: `registry.digitalocean.com/eagle0/shardok-server:arm64-latest`

docs/OAUTH_GO_SERVICE_PLAN.md

@@ -0,0 +1,383 @@
+# Plan: Extract OAuth to Go Service
+
+## Goal
+Move OAuth authentication handling from the Eagle Scala server into a separate Go service. This simplifies Eagle (gRPC-only, no HTTP), reduces complexity, and sets up for potentially moving JWT validation outside Eagle too.
+
+## Architecture Decision: Sidecar Service (Not DO Functions)
+
+**Recommendation: Go sidecar service on the same droplet, in a separate container**
+
+**Why not DO Functions:**
+- OAuth requires **stateful sessions** (pendingOAuth/completedOAuth maps with 10-min TTL)
+- Client polling pattern (every 2 seconds) would incur high function invocation costs
+- Cold start latency problematic for auth flows
+- State would require external store (Redis), adding complexity
+
+**Why sidecar (separate container):**
+- Simple process on same droplet, minimal network latency
+- In-memory state management (like current Scala impl)
+- Easy to monitor/debug alongside Eagle
+- Can share filesystem for key files (RSA keys) via volume mounts
+- **Independent deployment**: Deploying Eagle doesn't restart auth service (and vice versa)
+- **Independent scaling**: Could move to separate droplet later if needed
+
+## Current Architecture (What Exists)
+
+```
+Unity Client
+    ├── GetOAuthUrl RPC → Eagle AuthServiceImpl → OAuthService.getAuthUrl()
+    ├── [User browser auth] → HTTP callback → OAuthHttpHandler → OAuthService.handleCallback()
+    ├── CheckOAuthStatus RPC (polling) → AuthServiceImpl → OAuthService.checkStatus()
+    └── All other RPCs include JWT → AuthorizationInterceptor validates
+```
+
+**Key files:**
+- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth flow, state management
+- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation
+- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD (persisted)
+- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC Auth service
+- `src/main/scala/net/eagle0/eagle/service/OAuthHttpHandler.scala` - HTTP callback handler
+
+## Target Architecture (Phase 1)
+
+```
+Unity Client
+    ├── GetOAuthUrl RPC ──────────────┐
+    ├── CheckOAuthStatus RPC (polling)├──→ Eagle (port 40032) ──proxy──→ Go Auth Container (port 40033)
+    ├── RefreshToken RPC ─────────────┘                                        │
+    ├── [User browser] → HTTP callback ────────────────────────────────────────┤
+    │                                                                          ↓
+    │                                            (Internal gRPC: GetOrCreateUser, GetUser)
+    │                                                                          ↓
+    └── Game RPCs with JWT ─────────────────────→ Eagle (port 40032) ← JWT validation stays here
+
+[Same Droplet]
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                                                                             │
+│  ┌──────────────────────┐          ┌────────────────────────────────────┐  │
+│  │  Go Auth Container   │◄────────►│       Eagle Container              │  │
+│  │  (eagle0-auth)       │ internal │       (eagle0-server)              │  │
+│  │                      │  gRPC    │                                    │  │
+│  │  - OAuth flow        │          │  - JWT validation                  │  │
+│  │  - JWT creation      │          │  - UserService (persistence)       │  │
+│  │  - HTTP callback     │          │  - Game logic                      │  │
+│  └──────────────────────┘          └────────────────────────────────────┘  │
+│           │                                        │                        │
+│           └────────────────┬───────────────────────┘                        │
+│                            ▼                                                │
+│                    /etc/eagle0/keys/ (shared volume)                        │
+│                    - private.pem                                            │
+│                    - public.pem                                             │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+## Component Responsibilities
+
+### Go Auth Service (NEW - separate container)
+- **OAuth flow**: getAuthUrl, handleCallback (HTTP), checkStatus
+- **State management**: pendingOAuth, completedOAuth maps with TTL
+- **JWT creation**: Issue access/refresh tokens (shares RSA private key with Eagle)
+- **Token refresh**: Validate refresh token, issue new access token
+- Calls Eagle's internal UserService gRPC to find/create users
+
+### Eagle Server (SIMPLIFIED)
+- **JWT validation**: AuthorizationInterceptor stays (validates tokens on game RPCs)
+- **UserService**: Stays in Eagle (user persistence, display name logic)
+- **New internal gRPC**: Expose GetOrCreateUser, GetUser for Go service to call
+- **Proxy (Phase 1)**: Forward OAuth RPCs to Go service
+- **Remove (Phase 2)**: OAuthService, OAuthHttpHandler, HTTP server setup
+
+### Unity Client (NO CHANGES in Phase 1)
+- Eagle proxies Auth RPCs to Go service
+- Client still connects to Eagle on port 40032
+
+## Implementation Phases
+
+### Phase 1: Go Auth Service with Eagle Proxy (Zero Client Changes)
+
+1. **Create Go service structure**
+   ```
+   src/main/go/net/eagle0/authservice/
+   ├── main.go           # Entry point, starts gRPC + HTTP servers
+   ├── oauth.go          # OAuth state management, provider configs
+   ├── jwt.go            # JWT creation (copy logic from Scala)
+   ├── handlers.go       # gRPC handlers for Auth service
+   ├── http_callback.go  # HTTP handler for OAuth callback
+   └── BUILD.bazel
+   ```
+
+2. **Internal gRPC proto for Eagle UserService**
+   ```protobuf
+   // src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto
+
+   service InternalUserService {
+     rpc GetOrCreateUser(GetOrCreateUserRequest) returns (GetOrCreateUserResponse);
+     rpc GetUser(GetUserRequest) returns (GetUserResponse);
+   }
+
+   message GetOrCreateUserRequest {
+     string provider = 1;        // "discord" or "google"
+     string provider_user_id = 2;
+     string email = 3;
+     string avatar_url = 4;
+   }
+
+   message GetOrCreateUserResponse {
+     string user_id = 1;
+     string display_name = 2;
+     string avatar_url = 3;
+     bool is_admin = 4;
+     bool is_new_user = 5;
+   }
+   ```
+
+3. **Eagle: Expose InternalUserService**
+   - New `InternalUserServiceImpl.scala` wrapping UserService
+   - Bind to same port, different service name (internal only)
+
+4. **Eagle: Proxy Auth RPCs to Go**
+   - AuthServiceImpl delegates GetOAuthUrl, CheckOAuthStatus, RefreshToken to Go service
+   - SetDisplayName, GetCurrentUser, Logout stay in Eagle
+
+5. **Share RSA keys via volume mount**
+   - Go service reads same key files as Eagle
+   - Both can create valid JWTs
+   - Eagle continues to validate JWTs
+
+6. **Docker/Container setup**
+   - New Dockerfile for Go auth service
+   - docker-compose or Kubernetes config for both containers
+   - Shared volume for /etc/eagle0/keys/
+   - Internal network for container-to-container gRPC
+
+### Phase 2: Client Direct to Go Service (Future)
+
+1. **Update Unity client**
+   - Connect to Go Auth service directly for OAuth RPCs
+   - Keep connecting to Eagle for game RPCs
+
+2. **Remove Eagle proxy code**
+   - Delete AuthServiceImpl OAuth delegation
+   - AuthServiceImpl only handles SetDisplayName, GetCurrentUser, Logout
+
+### Phase 3: Move JWT Validation to Go (Optional Future)
+
+1. **Go service validates JWTs**
+   - Add ValidateToken RPC or use shared middleware pattern
+
+2. **Eagle calls Go for validation**
+   - AuthorizationInterceptor calls Go to validate tokens
+   - OR: Use stateless validation (both share public key)
+
+## Files to Create
+
+### Go Service
+- `src/main/go/net/eagle0/authservice/main.go`
+- `src/main/go/net/eagle0/authservice/oauth.go`
+- `src/main/go/net/eagle0/authservice/jwt.go`
+- `src/main/go/net/eagle0/authservice/handlers.go`
+- `src/main/go/net/eagle0/authservice/http_callback.go`
+- `src/main/go/net/eagle0/authservice/BUILD.bazel`
+
+### Protos
+- `src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto`
+
+### Scala
+- `src/main/scala/net/eagle0/eagle/service/InternalUserServiceImpl.scala`
+
+### Docker/Deployment
+- `ci/auth_service.Dockerfile`
+- Update `docker-compose.yml` (or equivalent)
+
+## Files to Modify
+
+### Scala (Phase 1)
+- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - Proxy OAuth RPCs to Go
+- `src/main/scala/net/eagle0/eagle/Main.scala` - Start internal user service, add auth-service-url flag
+
+### Scala (Phase 2 - Removal)
+- Delete `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala`
+- Delete `src/main/scala/net/eagle0/eagle/service/OAuthHttpHandler.scala`
+- Simplify `src/main/scala/net/eagle0/eagle/Main.scala` - Remove HTTP server
+
+### Unity (Phase 2)
+- `Assets/Auth/OAuthManager.cs` - Point OAuth RPCs to Go service port
+- `Assets/EagleConnection.cs` - Add second channel for auth service
+
+## Key Implementation Details
+
+### State Management in Go
+```go
+type OAuthState struct {
+    Provider  string
+    CreatedAt time.Time
+}
+
+type OAuthResult struct {
+    Success  bool
+    UserInfo *ProviderUserInfo
+    Provider string
+    Error    string
+}
+
+var pendingOAuth   = sync.Map{} // state -> OAuthState
+var completedOAuth = sync.Map{} // state -> OAuthResult
+
+const stateExpiration = 10 * time.Minute
+
+// Background goroutine cleans expired states every minute
+func cleanupExpiredStates() {
+    ticker := time.NewTicker(1 * time.Minute)
+    for range ticker.C {
+        cutoff := time.Now().Add(-stateExpiration)
+        pendingOAuth.Range(func(key, value any) bool {
+            if value.(OAuthState).CreatedAt.Before(cutoff) {
+                pendingOAuth.Delete(key)
+            }
+            return true
+        })
+        // Similar for completedOAuth
+    }
+}
+```
+
+### JWT Creation in Go
+```go
+import "github.com/golang-jwt/jwt/v5"
+
+type EagleClaims struct {
+    jwt.RegisteredClaims
+    UserId      string `json:"userId"`
+    DisplayName string `json:"displayName"`
+    IsAdmin     bool   `json:"isAdmin"`
+}
+
+func CreateAccessToken(userId, displayName string, isAdmin bool) (string, error) {
+    claims := EagleClaims{
+        RegisteredClaims: jwt.RegisteredClaims{
+            ExpiresAt: jwt.NewNumericDate(time.Now().Add(7 * 24 * time.Hour)),
+            IssuedAt:  jwt.NewNumericDate(time.Now()),
+        },
+        UserId:      userId,
+        DisplayName: displayName,
+        IsAdmin:     isAdmin,
+    }
+
+    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+    return token.SignedString(privateKey)
+}
+```
+
+### OAuth Provider Configs
+- Read from environment variables (same as current OAuthConfig.scala)
+- DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET
+- GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+- OAUTH_CALLBACK_URL (e.g., https://eagle0.shardok.games/oauth/callback)
+
+### Container Networking
+```yaml
+# docker-compose.yml example
+services:
+  eagle0-auth:
+    build:
+      context: .
+      dockerfile: ci/auth_service.Dockerfile
+    ports:
+      - "40033:40033"  # gRPC
+      - "8080:8080"    # HTTP callback
+    volumes:
+      - ./keys:/etc/eagle0/keys:ro
+    environment:
+      - DISCORD_CLIENT_ID
+      - DISCORD_CLIENT_SECRET
+      - GOOGLE_CLIENT_ID
+      - GOOGLE_CLIENT_SECRET
+      - EAGLE_INTERNAL_URL=eagle0-server:40034
+
+  eagle0-server:
+    build:
+      context: .
+      dockerfile: ci/eagle_run.Dockerfile
+    ports:
+      - "40032:40032"  # Public gRPC
+    expose:
+      - "40034"        # Internal gRPC (container-to-container only)
+    volumes:
+      - ./keys:/etc/eagle0/keys:ro
+      - ./data:/var/lib/eagle0
+    environment:
+      - AUTH_SERVICE_URL=eagle0-auth:40033
+```
+
+## Deployment
+
+### Development
+```bash
+# Terminal 1: Go Auth Service
+bazel run //src/main/go/net/eagle0/authservice:authservice -- \
+  --grpc-port=40033 \
+  --http-port=8080 \
+  --eagle-internal-url=localhost:40034
+
+# Terminal 2: Eagle Server
+bazel run //src/main/scala/net/eagle0/eagle:eagle_server -- \
+  --eagle-grpc-port=40032 \
+  --internal-grpc-port=40034 \
+  --auth-service-url=localhost:40033
+```
+
+### Production
+- Both containers on same droplet via docker-compose
+- Shared volume for RSA keys at /etc/eagle0/keys/
+- Internal Docker network for container-to-container communication
+- External access: 40032 (Eagle gRPC), 8080 (OAuth HTTP callback)
+
+## Testing Strategy
+
+1. **Unit tests for Go service**
+   - OAuth state management (expiration, cleanup)
+   - JWT creation matches Scala output (test with same keys)
+   - HTTP callback parsing
+
+2. **Integration tests**
+   - Go service ↔ Eagle internal gRPC
+   - Full OAuth flow with mock provider
+
+3. **Existing tests continue to pass**
+   - All Scala tests (JWT validation, user service)
+
+4. **End-to-end test**
+   - Spin up both containers
+   - Run OAuth flow through proxy
+
+## Risks and Mitigations
+
+| Risk | Mitigation |
+|------|------------|
+| Key file permissions | Shared volume with read-only mount |
+| State loss on Go restart | Document this (same as current Scala behavior); consider Redis later |
+| Clock skew affecting JWT | Both on same machine |
+| OAuth callback race | HTTP callback completes before gRPC poll |
+| Container networking | Use docker-compose for reliable internal DNS |
+| Proxy adds latency | Minimal (same machine), remove in Phase 2 |
+
+## Estimated Scope
+
+- **Phase 1**: ~500-700 lines Go, ~100 lines Scala changes, ~50 lines Docker config
+- **Phase 2**: ~50 lines Unity, deletion of ~300 lines Scala
+- **Phase 3**: Optional, separate decision
+
+## Alternative Considered: Move Everything to Go
+
+Could move UserService to Go as well, but:
+- UserService is tightly integrated with game persistence
+- Would require duplicating persistence layer
+- Not worth the complexity for now
+
+Keep UserService in Eagle, expose via internal gRPC.
+
+## Open Questions
+
+1. **HTTP callback routing**: Does the OAuth callback URL need to change, or can we route traffic from the existing URL to the new Go service?
+2. **Health checks**: Should we add health check endpoints for container orchestration?
+3. **Logging**: Should Go service log to same format/destination as Eagle?

docs/OAUTH_IMPLEMENTATION_PLAN.md

@@ -0,0 +1,189 @@
+# Discord + Google OAuth Implementation Plan
+
+## Overview
+
+Replace HTTP Basic Auth with OAuth 2.0 (Discord + Google) for Eagle0. Users authenticate via system browser, receive JWT tokens, and choose their own display names.
+
+## Architecture
+
+```
+Unity Client                                          Eagle Server
+     |                                                      |
+     |  1. Click "Login with Discord/Google"                |
+     |  ------------------------------------------------->  |
+     |     GetOAuthUrl(provider) -> auth_url + state        |
+     |                                                      |
+     |  2. Open system browser -> OAuth consent             |
+     |  3. User authenticates with provider                 |
+     |  4. Redirect to eagle0://auth/callback?code=xxx      |
+     |                                                      |
+     |  5. ExchangeCode(code, state)                        |
+     |  ------------------------------------------------->  |
+     |     Exchange code with provider                      |
+     |     Fetch user info (id, email, avatar)              |
+     |     Create/update user record                        |
+     |     Issue JWT + refresh token                        |
+     |  <-------------------------------------------------  |
+     |     (jwt, refresh_token, user_info, is_new_user)     |
+     |                                                      |
+     |  6. [If new user] SetDisplayName(name)               |
+     |  ------------------------------------------------->  |
+     |                                                      |
+     |  7. Subsequent gRPC calls                            |
+     |     Authorization: Bearer <jwt>                      |
+     |  ------------------------------------------------->  |
+```
+
+## Key Design Decisions
+
+| Decision | Choice | Rationale |
+|----------|--------|-----------|
+| OAuth flow | System browser + deep link | Secure, supports password managers |
+| Code exchange | Eagle server directly | No separate auth service needed |
+| JWT signing | RS256 (asymmetric) | Future flexibility for token verification |
+| User storage | Protobuf file via Persister | Consistent with existing patterns |
+| Token expiry | 7-day access, 30-day refresh | Balance security and gaming UX |
+
+## Implementation Phases
+
+### Phase 1: Proto Definitions & Infrastructure
+
+**New files:**
+- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth API messages
+- `src/main/protobuf/net/eagle0/eagle/internal/user.proto` - User storage schema
+
+**Key proto messages:**
+```protobuf
+// API
+GetOAuthUrlRequest/Response     // Get OAuth URL to open in browser
+ExchangeCodeRequest/Response    // Exchange auth code for JWT
+SetDisplayNameRequest/Response  // Set user's display name
+RefreshTokenRequest/Response    // Refresh expired access token
+
+// Internal storage
+User                           // user_id, display_name, oauth_identities
+UserDatabase                   // All users + indexes for lookup
+```
+
+### Phase 2: Eagle Server Auth Services
+
+**New Scala files:**
+- `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` - Discord/Google config from env vars
+- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - JWT creation/validation (RS256)
+- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD, display name validation
+- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth code exchange
+- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC service implementation
+
+**Modify:**
+- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala`
+  - Replace Basic Auth parsing with JWT validation
+  - Skip auth for public endpoints (GetOAuthUrl, ExchangeCode, RefreshToken)
+- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala`
+  - Change context keys from `userName` to `userId` + `displayName`
+- `src/main/scala/net/eagle0/eagle/service/Main.scala`
+  - Wire up new auth services and JWT key loading
+
+### Phase 3: Unity Client OAuth Flow
+
+**New C# files:**
+- `Assets/Auth/OAuthManager.cs` - OAuth flow + deep link handling
+- `Assets/Auth/TokenStorage.cs` - Secure token persistence
+- `Assets/Auth/AuthClient.cs` - gRPC client for auth service
+
+**Modify:**
+- `Assets/EagleConnection.cs`
+  - Replace `AuthInterceptor` (Basic Auth) with `JwtAuthInterceptor` (Bearer token)
+- `Assets/ConnectionHandler/ConnectionHandler.cs`
+  - Replace username/password UI with Discord/Google login buttons
+  - Add display name setup flow for new users
+
+### Phase 4: Platform Configuration
+
+**Deep link registration:**
+- iOS: Add `eagle0://` to CFBundleURLSchemes in Info.plist
+- Android: Add intent-filter for `eagle0://auth` in AndroidManifest.xml
+- Desktop: Register URL scheme (Windows registry / macOS plist)
+
+**OAuth provider setup:**
+1. Discord Developer Portal: Create app, add redirect URI `eagle0://auth/callback`
+2. Google Cloud Console: Create OAuth client, add redirect URI
+
+**Environment variables (server):**
+```
+DISCORD_CLIENT_ID
+DISCORD_CLIENT_SECRET
+GOOGLE_CLIENT_ID
+GOOGLE_CLIENT_SECRET
+JWT_PRIVATE_KEY_PATH
+JWT_PUBLIC_KEY_PATH
+```
+
+### Phase 5: Testing
+
+**Unit tests:**
+- `JwtServiceSpec.scala` - Token creation/validation
+- `UserServiceSpec.scala` - Display name validation, uniqueness
+- `OAuthServiceSpec.scala` - OAuth flow with mocked providers
+
+**Integration tests:**
+- Full OAuth flow with mock provider
+- JWT validation in AuthorizationInterceptor
+- gRPC calls with valid/invalid tokens
+
+**Manual testing:**
+- [ ] Discord login (Windows, macOS)
+- [ ] Google login (Windows, macOS)
+- [ ] Deep link callback works
+- [ ] Display name validation
+- [ ] Session persistence across restarts
+- [ ] Token refresh
+
+## Files Summary
+
+### Create
+| File | Purpose |
+|------|---------|
+| `src/main/protobuf/net/eagle0/eagle/api/auth.proto` | Auth API definitions |
+| `src/main/protobuf/net/eagle0/eagle/internal/user.proto` | User storage schema |
+| `src/main/scala/net/eagle0/eagle/auth/OAuthConfig.scala` | Provider config |
+| `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` | JWT handling |
+| `src/main/scala/net/eagle0/eagle/auth/UserService.scala` | User management |
+| `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` | OAuth flow |
+| `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` | gRPC service |
+| `Assets/Auth/OAuthManager.cs` | Unity OAuth manager |
+| `Assets/Auth/TokenStorage.cs` | Token storage |
+| `Assets/Auth/AuthClient.cs` | Auth gRPC client |
+
+### Modify
+| File | Changes |
+|------|---------|
+| `AuthorizationInterceptor.scala` | Basic Auth -> JWT validation |
+| `AuthorizationUtils.scala` | userName -> userId + displayName |
+| `Main.scala` | Wire auth services |
+| `EagleConnection.cs` | AuthInterceptor -> JwtAuthInterceptor |
+| `ConnectionHandler.cs` | Login UI -> OAuth buttons + display name |
+
+### Delete
+- nginx htpasswd configuration (no longer needed)
+
+## Security Considerations
+
+1. **State parameter** - CSRF protection in OAuth flow
+2. **PKCE** - Consider adding for mobile (enhancement)
+3. **Secure storage** - Use Keychain (iOS) / Keystore (Android) for tokens
+4. **Token refresh** - 7-day access tokens with 30-day refresh
+5. **Rate limiting** - Limit login attempts per IP
+
+## Dependencies to Add
+
+**Scala (MODULE.bazel):**
+- JWT library (e.g., `jwt-scala` or `nimbus-jose-jwt`)
+- HTTP client (e.g., `sttp` for OAuth requests)
+
+**Unity:**
+- Deep linking is built-in (Unity 2021+)
+- No additional packages required
+
+## Rollback Plan
+
+Keep Basic Auth code in a feature branch. Both auth methods can coexist during transition via feature flag if needed.

docs/OAUTH_NEXT_STEPS.md

@@ -0,0 +1,350 @@
+# OAuth Implementation: Next Steps and Design
+
+## Executive Summary
+
+The OAuth implementation is functional but has several gaps that need addressing before it's production-ready. This document outlines the known issues, proposes a comprehensive user identity model, and provides a prioritized implementation plan.
+
+## Current State (Updated January 2026)
+
+### What Works ✅
+- Discord OAuth flow (server-mediated polling)
+- Google OAuth flow
+- JWT token generation and validation
+- User creation and display name setting
+- Auto-login with stored tokens
+- Basic game creation and play with OAuth users
+- Headshot fetching via public CDN (no auth required)
+- Logout button in lobby (preserves tokens for quick reconnect)
+- Environment (prod/qa) and user display in lobby
+- Game identity with userName = displayName (PR #4964 merged)
+
+### Known Issues
+
+#### 1. Game Identity Model Fragility (Deferred)
+**Status**: Accepted for now. PR #4964 merged with `userName = displayName`.
+
+**Current behavior**:
+- Games store `userNameToFactionId: Map[String, Int]`
+- For JWT users, this maps displayName → factionId
+- displayName is technically mutable (users could change it)
+- No migration path when displayName changes
+
+**Why this is acceptable**:
+1. We don't currently have a "change display name" feature
+2. The alternative (using userId) requires more extensive changes
+3. Can migrate to userId-based identity later if needed
+
+#### 2. In-Game Headshot Fetching ✅ FIXED
+**Solution**: Made the `eagle0-headshots` S3 bucket public and enabled CDN.
+- Client now fetches directly from `https://eagle0-headshots.sfo3.cdn.digitaloceanspaces.com/`
+- No authentication required
+- Works for both OAuth and Basic Auth users
+- Simpler architecture, no dependency on home Mac server
+
+#### 3. Logout from Lobby ✅ FIXED
+**Solution**: Added logout button to lobby UI (PR #4967).
+- Button disconnects from server and returns to connection screen
+- Intentionally does NOT clear OAuth tokens
+- Allows quick reconnect with same account without full OAuth flow
+
+#### 4. Display Name Uniqueness Not Enforced (Medium) - OPEN
+**Problem**: User was able to set displayName "nolen" when that name was already taken.
+
+**Root cause**: Unknown - needs investigation. Either:
+- The uniqueness check is buggy
+- The displayNameIndex wasn't populated correctly during user creation
+- Race condition during concurrent registrations
+
+#### 5. Admin Server Crashes ✅ FIXED
+**Solution**: PR #4964 sets `userName = displayName` for JWT users.
+
+#### 6. Intermittent "Expired" Errors During Login (Medium) - INVESTIGATING
+**Problem**: Users occasionally get "OAuth session expired" errors even when server logs show the callback succeeded.
+
+**Status**: Added diagnostic logging in PR #4974 to trace:
+- State creation in `getAuthUrl`
+- State lookup in `handleCallback`
+- Result lookup in `checkStatus`
+
+**Possible causes**:
+- State mismatch between client and server
+- Race condition in polling
+- Cleanup running at wrong time
+
+#### 7. Token Expiry Field Bug ✅ FIXED
+**Problem**: `CheckOAuthStatusResponse.expiresAt` was returning refresh token expiry (30 days) instead of access token expiry (7 days).
+
+**Solution**: Fixed in PR #4974 to calculate correct access token expiry.
+
+---
+
+## Proposed User Identity Model
+
+### Design Principles
+
+1. **Stable Internal Identity**: `userId` (UUID) is the only key used for persistent associations
+2. **Display Name is Cosmetic**: Can change without breaking game associations
+3. **Backwards Compatibility**: Basic Auth continues to work for local development
+4. **Multi-Provider Support**: Users can link Discord, Google, and future providers
+5. **Avatar Flexibility**: Use OAuth avatar by default, support custom uploads later
+
+### Data Model
+
+```
+User {
+  userId: String (UUID)           // Primary key, immutable, used for all internal references
+  displayName: String             // Unique, user-visible, mutable with migration
+  displayNameLower: String        // Case-insensitive uniqueness
+  email: String                   // Primary email for account recovery/linking
+  avatarUrl: String               // Current avatar URL
+  avatarData: bytes               // Cached avatar for offline/fast access (future)
+  oauthIdentities: [OAuthIdentity]
+  createdAt: Timestamp
+  lastLoginAt: Timestamp
+  isAdmin: Boolean
+}
+
+OAuthIdentity {
+  provider: String                // "discord", "google", etc.
+  providerUserId: String          // Provider's user ID
+  providerEmail: String           // Email from this provider
+  avatarUrl: String               // Avatar from this provider
+  linkedAt: Timestamp
+}
+```
+
+### Identity Resolution Strategy
+
+The key question: **What should `AuthorizationUtils.userName` return?**
+
+#### Option A: userName = displayName (Current PR #4964)
+- **Pro**: Human-readable in logs, game saves, debugging
+- **Con**: Breaks if displayName changes
+- **Migration**: None needed now, complex later
+
+#### Option B: userName = userId (Recommended)
+- **Pro**: Stable identity, displayName changes are safe
+- **Con**: UUIDs in logs are ugly, need display name lookup for UI
+- **Migration**: Cleaner long-term, but breaking change for any existing OAuth games
+
+#### Option C: Hybrid with Migration Support
+- **userName** = userId for new games
+- **Legacy lookup** for old games by displayName
+- **Display layer** resolves userId → displayName for UI
+
+**Recommendation**: Option B with a display name resolution layer. The ugliness in logs is acceptable for the stability it provides. Implement a `UserService.resolveDisplayName(identifier: String): String` that returns displayName for UUIDs or the identifier itself for legacy usernames.
+
+### Account Linking Strategy
+
+#### Automatic Linking (Future)
+When a user logs in with a new OAuth provider:
+1. Check if the provider email matches an existing user's email
+2. If match found, prompt: "An account exists with this email. Link accounts?"
+3. If confirmed, add new OAuthIdentity to existing user
+4. If declined, create separate account (different email required)
+
+#### Manual Linking (MVP)
+1. User logs in with primary account
+2. User goes to Settings → Linked Accounts
+3. User clicks "Link Discord" or "Link Google"
+4. OAuth flow adds new identity to current user
+
+### Avatar/Headshot Strategy
+
+#### Phase 1: OAuth Avatars (MVP)
+- Store `avatarUrl` from OAuth provider during login
+- Server proxies avatar requests to avoid CORS issues
+- Cache avatars locally with TTL
+
+#### Phase 2: Avatar Caching
+- Download avatar to local storage on login
+- Serve from local storage for reliability
+- Refresh periodically or on login
+
+#### Phase 3: Custom Avatars (Future)
+- Allow users to upload custom avatar
+- Store in S3/DO Spaces
+- Custom avatar overrides OAuth avatar
+
+---
+
+## Implementation Plan
+
+### Phase 1: Stabilization ✅ COMPLETE
+
+#### 1.1 Fix Display Name Uniqueness Bug - OPEN
+- [ ] Investigate why "nolen" was allowed when it existed
+- [ ] Add logging to `setDisplayName` to trace the issue
+- [ ] Ensure `displayNameIndex` is correctly maintained
+- [ ] Add unit tests for uniqueness enforcement
+
+#### 1.2 Add Logout Button to Lobby ✅ DONE
+- [x] Add "Logout" button to lobby UI
+- [x] Disconnect from server
+- [x] Navigate to connection screen
+- [x] Preserve OAuth tokens for quick reconnect (intentional change from original plan)
+
+#### 1.3 Merge PR #4964 (userName = displayName) ✅ DONE
+- [x] Merged - games work with OAuth users
+- [x] Documented limitation (games break if displayName changes)
+
+#### 1.4 Fix Headshot Fetching ✅ DONE
+- [x] Made eagle0-headshots bucket public
+- [x] Client fetches directly from CDN
+- [x] No authentication required
+
+#### 1.5 Add Lobby Status Display ✅ DONE
+- [x] Show environment (prod/qa) in lobby
+- [x] Show current user in lobby (OAuth displayName or classic username)
+
+### Phase 2: Remaining Work (Priority Order)
+
+#### 2.1 Diagnose Intermittent "Expired" Errors - IN PROGRESS
+- [x] Add diagnostic logging (PR #4974)
+- [ ] Deploy and reproduce the issue
+- [ ] Analyze logs to identify root cause
+- [ ] Implement fix based on findings
+
+#### 2.2 Fix Display Name Uniqueness
+- [ ] Investigate UserService.setDisplayName logic
+- [ ] Check displayNameIndex population
+- [ ] Add logging to trace the issue
+- [ ] Fix the bug and add tests
+
+#### 2.3 Wire Up Lobby UI in Unity
+- [ ] Connect `lobbyEnvironmentText` to TextMeshProUGUI in scene
+- [ ] Connect `lobbyUserText` to TextMeshProUGUI in scene
+
+#### 2.4 Implement Token Refresh During Gameplay
+- [ ] Implement `RefreshToken` RPC on server (currently throws UNIMPLEMENTED)
+- [ ] Store refresh tokens server-side for validation
+- [ ] Add proactive refresh in client before token expires
+- [ ] Handle refresh during reconnection attempts
+
+### Phase 3: Nice-to-Haves (Future)
+
+#### 3.1 Proactive Token Refresh
+- [ ] Monitor token expiry in client
+- [ ] Refresh automatically when < 5 minutes remaining
+- [ ] Update TokenStorage with new access token
+
+#### 3.2 Better Error Messages
+- [ ] Distinguish between network errors and auth errors
+- [ ] Show user-friendly messages for OAuth failures
+- [ ] Add retry suggestions
+
+#### 3.3 Session Persistence Across Server Restarts
+- [ ] Move pendingOAuth from in-memory TrieMap to Redis/database
+- [ ] Move completedOAuth to Redis with TTL
+- [ ] Server can restart without breaking in-flight OAuth flows
+
+#### 3.4 Migrate to userId-based Game Identity (Deferred)
+- [ ] Change `AuthorizationUtils.userName` to return `userId` for JWT users
+- [ ] Add `UserService.resolveDisplayName(id: String): String` for UI display
+- [ ] Update game UI to resolve userIds to displayNames
+- [ ] Existing Basic Auth games continue to work (userName is literal)
+
+#### 3.5 Display Name Change Support (Requires 3.4)
+- [ ] Add `ChangeDisplayName` RPC
+- [ ] Validate new name is unique
+- [ ] Update user record
+- [ ] No game migration needed (games use userId)
+
+### Phase 3: Multi-Provider Support (Future)
+
+#### 3.1 Account Linking UI
+- [ ] Add Settings page with "Linked Accounts" section
+- [ ] Show currently linked providers
+- [ ] "Link Another Account" button triggers OAuth flow
+- [ ] `LinkOAuthProvider` RPC adds identity to current user
+
+#### 3.2 Login Provider Selection
+- [ ] If user has multiple providers, any can be used to login
+- [ ] All resolve to same userId
+- [ ] Session shows which provider was used
+
+#### 3.3 Account Merging (Complex)
+- [ ] Handle case where user created separate accounts
+- [ ] Merge game history, stats, etc.
+- [ ] Delete duplicate user record
+- [ ] This is complex - may defer or not implement
+
+### Phase 4: Enhanced Avatars (Future)
+
+#### 4.1 Avatar Caching
+- [ ] Download avatars to S3/DO Spaces on login
+- [ ] Serve from our CDN
+- [ ] Refresh on login if changed
+
+#### 4.2 Custom Avatar Upload
+- [ ] Upload endpoint with size/format validation
+- [ ] Store in S3/DO Spaces
+- [ ] Custom avatar overrides OAuth avatar
+
+---
+
+## Technical Debt to Address
+
+1. **Context Propagation in Futures**: PR #4960 fixed `setDisplayName` and `getCurrentUser`, but audit all `Future` blocks that access `AuthorizationUtils`
+
+2. **Dual Auth Support**: The system supports both Basic Auth and JWT. Consider:
+   - Should Basic Auth be deprecated for production?
+   - Should it remain for local development only?
+   - How do Basic Auth users interact with OAuth users in the same game?
+
+3. **Token Refresh**: `RefreshToken` RPC throws UNIMPLEMENTED. Need to:
+   - Implement refresh token storage and validation
+   - Handle token refresh in client
+   - Consider refresh token rotation for security
+
+4. **Session Management**: No server-side session tracking. Consider:
+   - Track active sessions per user
+   - Allow "logout all devices"
+   - Detect concurrent logins
+
+---
+
+## Open Questions
+
+1. **What happens when a Basic Auth user and OAuth user have the same name?**
+   - Currently possible - Basic Auth doesn't check UserService
+   - Could cause confusion in games
+   - Solution: Require OAuth for multiplayer? Or namespace Basic Auth names?
+
+2. **Should displayName changes be allowed?**
+   - With userId-based identity, it's safe
+   - But could cause confusion ("who is this new player?")
+   - Consider: rate limit changes, show "formerly known as" temporarily
+
+3. **How to handle OAuth provider account deletion?**
+   - User deletes their Discord account
+   - Their Eagle0 account still exists
+   - They can't login unless they linked another provider
+   - Solution: Encourage linking multiple providers, or add email/password fallback
+
+4. **Admin impersonation with OAuth**
+   - Currently works via X-Impersonate-User header
+   - Should this use userId or displayName?
+   - Probably userId for stability
+
+---
+
+## Appendix: File Locations
+
+### Server (Scala)
+- `src/main/scala/net/eagle0/eagle/auth/UserService.scala` - User CRUD
+- `src/main/scala/net/eagle0/eagle/auth/JwtService.scala` - Token generation/validation
+- `src/main/scala/net/eagle0/eagle/auth/OAuthService.scala` - OAuth flow
+- `src/main/scala/net/eagle0/eagle/service/AuthServiceImpl.scala` - gRPC Auth service
+- `src/main/scala/net/eagle0/eagle/service/AuthorizationInterceptor.scala` - Auth middleware
+- `src/main/scala/net/eagle0/eagle/service/AuthorizationUtils.scala` - Context accessors
+
+### Client (C#)
+- `Assets/Auth/AuthClient.cs` - gRPC client for Auth service
+- `Assets/Auth/OAuthManager.cs` - OAuth flow orchestration
+- `Assets/Auth/TokenStorage.cs` - Persistent token storage
+- `Assets/Auth/JwtAuthInterceptor.cs` - Attaches JWT to requests
+
+### Protos
+- `src/main/protobuf/net/eagle0/eagle/api/auth.proto` - Auth service definition
+- `src/main/protobuf/net/eagle0/eagle/internal/user/user.proto` - User data model

docs/PRODUCTIONIZATION.md

@@ -348,6 +348,68 @@ services:
 
 ---
 
+## Docker Networking & Resource Configuration
+
+### Container Network Binding
+
+In Docker, each container has its own network namespace. When a server binds to `localhost` (127.0.0.1), it only accepts connections from within the same container. Other containers on the Docker bridge network cannot connect, even if they can resolve the hostname.
+
+**Shardok must bind to `0.0.0.0:40042`** to accept connections from Eagle running in a separate container. This is configured in `ServerConfiguration.cpp`:
+
+```cpp
+// Default to 0.0.0.0 for container networking (accepts connections from any interface)
+{ServerConfiguration::kEagleInterfaceGrpcAddress, "0.0.0.0:40042"}
+```
+
+This still works on the local Mac because `0.0.0.0` means "all interfaces", which includes the loopback interface that localhost uses.
+
+### gRPC Plaintext for Internal Communication
+
+By default, gRPC's `ManagedChannelBuilder` attempts TLS connections. Since Shardok runs in plaintext mode, Eagle must use `.usePlaintext()` for internal container-to-container communication:
+
+```scala
+// ServerSetupHelpers.scala
+val channelBuilder = ManagedChannelBuilder
+  .forAddress(shardokInterfaceAddress, shardokInterfacePort)
+  .usePlaintext()  // Required for internal Docker communication
+```
+
+TLS termination happens at nginx for external clients. Internal traffic between Eagle and Shardok stays within the Docker network and doesn't need encryption.
+
+**Future consideration:** If Shardok moves to a separate droplet, traffic would traverse the network. Options:
+1. Enable TLS between Eagle and Shardok (configure Shardok with certificates)
+2. Use DigitalOcean VPC (private network, still unencrypted but isolated)
+3. Use WireGuard/VPN tunnel between hosts
+
+### Bazel Runfiles in Docker
+
+Bazel's runfiles system locates resources relative to the executable using a manifest or directory structure that Bazel sets up at runtime. This doesn't exist in Docker containers.
+
+**Solution:** Environment variable fallbacks in `FilesystemUtils.cpp`:
+
+```cpp
+// Check for Docker deployment env vars first
+const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
+if (resourcesPath != nullptr) {
+    return string(resourcesPath) + "/";
+}
+// Fall back to Bazel runfiles for local development
+return rLocation + "/src/main/resources/net/eagle0/shardok/";
+```
+
+The Docker Compose configuration sets these:
+```yaml
+environment:
+  SHARDOK_RESOURCES_PATH: "/app/resources"
+  SHARDOK_MAPS_PATH: "/app/resources/maps"
+```
+
+This allows the same binary to work in both environments:
+- **Local dev:** No env var → uses Bazel runfiles
+- **Docker:** Env var set → uses `/app/resources/` directly
+
+---
+
 ## Build Pipeline
 
 ### Build Artifacts

docs/SHARDOK_LATENCY_HIDING.md

@@ -0,0 +1,216 @@
+# Shardok Latency Hiding Strategies
+
+## Problem Statement
+
+With Shardok running on Hetzner (Helsinki) and Eagle on DigitalOcean (US), the round-trip latency for human commands is ~200-400ms:
+
+```
+Human posts command:
+Unity → Eagle (DO) → Shardok (Hetzner) → Eagle (DO) → Unity
+         ~10ms         ~100ms              ~100ms        ~10ms
+                    Total: ~220ms round-trip
+```
+
+This latency is acceptable for AI turns (users watch animations anyway), but creates noticeable lag when humans post commands.
+
+---
+
+## Strategy 1: Client-Side Animation Masking
+
+### Concept
+
+Start animations immediately when the user clicks, before server confirmation arrives. The animation duration masks the network latency.
+
+### Implementation by Command Type
+
+**Movement Commands** (deterministic):
+- Client knows the destination hex and movement path
+- Start movement animation immediately on click
+- Server confirms the move (should always match)
+- If server rejects (invalid state), snap unit back to origin
+
+**Attack Commands** (RNG-dependent):
+- Show attack animation immediately (unit swings sword, fires arrow)
+- Wait for server to return dice roll result
+- Show damage numbers / hit effects when server responds
+- Animation typically takes 300-500ms, masking most of the latency
+
+**End Turn**:
+- Latency not noticeable (user expects transition delay)
+
+### Unity Implementation Sketch
+
+```csharp
+// In CommandHandler.cs
+public void OnCommandSelected(Command command) {
+    // Start animation immediately
+    if (command.Type == CommandType.Move) {
+        unitController.StartMoveAnimation(command.TargetHex);
+    } else if (command.Type == CommandType.Attack) {
+        unitController.StartAttackAnimation(command.TargetUnit);
+    }
+
+    // Send to server in parallel
+    connection.SendCommand(command, (response) => {
+        if (response.Success) {
+            // Animation continues, apply result
+            ApplyCommandResult(response);
+        } else {
+            // Rollback animation
+            unitController.CancelAnimation();
+            ShowError(response.ErrorMessage);
+        }
+    });
+}
+```
+
+### Pros
+- Simple implementation
+- No server-side changes
+- Works with existing architecture
+
+### Cons
+- Doesn't eliminate latency for attacks with RNG (must wait for dice roll)
+- Rollback needed if server rejects command (rare but possible)
+
+### Estimated Improvement
+- Movement: ~200ms latency hidden (feels instant)
+- Attacks: ~100-200ms hidden by animation, ~100ms visible wait for dice result
+
+---
+
+## Strategy 2: Split Shardok Architecture
+
+### Concept
+
+Run two Shardok instances:
+- **Shardok-Primary (DigitalOcean)**: Handles command processing, source of truth
+- **Shardok-AI (Hetzner)**: AI computation only
+
+Human commands go to the nearby Primary for low latency. AI computation uses the powerful Hetzner instance.
+
+### Architecture
+
+```
+                    Human commands (low latency ~20ms)
+Unity ←→ Eagle ←→ Shardok-Primary (DigitalOcean)
+                         ↓ state sync (when AI turn starts)
+                    Shardok-AI (Hetzner)
+                         ↑ AI command response
+```
+
+### How It Works
+
+**Human Turn:**
+1. Human posts command → Eagle → Shardok-Primary (DO)
+2. Primary processes command immediately (~10ms local)
+3. Primary streams result to client via Eagle (~10ms)
+4. **Total latency: ~20ms** (vs ~220ms current)
+
+**AI Turn:**
+1. When AI's turn starts, Primary sends game state snapshot to Hetzner
+2. Shardok-AI computes best command using full CPU power
+3. Shardok-AI returns command index to Primary
+4. Primary executes command locally and streams to client
+5. Repeat until AI turn ends
+
+### Protocol Changes
+
+```protobuf
+// New service for AI-only computation
+service ShardokAIService {
+    // Send game state, receive AI's chosen command
+    rpc GetAICommand(AICommandRequest) returns (AICommandResponse);
+}
+
+message AICommandRequest {
+    bytes game_state = 1;           // Serialized game state
+    int32 player_id = 2;            // Which AI player
+    repeated bytes available_commands = 3;  // Available command descriptors
+}
+
+message AICommandResponse {
+    int32 command_index = 1;        // Index into available_commands
+    int32 search_depth = 2;         // For debugging
+    double best_score = 3;          // For debugging
+}
+```
+
+### Shardok-Primary Requirements
+
+Shardok-Primary on DigitalOcean needs to:
+- Process all commands (human and AI)
+- Maintain authoritative game state
+- Serialize/deserialize game state for AI requests
+- Run on minimal CPU (command processing is fast)
+
+This is essentially the current Shardok, but without running the AI search.
+
+### Shardok-AI Requirements
+
+Shardok-AI on Hetzner needs to:
+- Receive game state snapshots
+- Run AI evaluation (IterativeDeepeningAI or MCTS)
+- Return best command index
+- No persistent state (stateless worker)
+
+### AI Turn Latency
+
+Each AI command has ~200ms network latency. This is acceptable because:
+1. User is watching animations anyway
+2. Natural pacing lets user observe AI decisions
+3. AI computation is fast on Hetzner's 16 cores
+
+For a typical AI turn with 5 commands: 5 × 200ms = 1 second network overhead, plus AI thinking time. With animations, this feels natural.
+
+### Implementation Phases
+
+**Phase 1: Add Shardok-Primary (minimal)**
+- Deploy existing Shardok container to DigitalOcean
+- Configure Eagle to use local Shardok for all commands
+- Human latency immediately improves
+
+**Phase 2: Add AI offload**
+- Implement `ShardokAIService` RPC
+- Shardok-Primary calls Hetzner for AI commands
+- Shardok-AI processes requests statelessly
+
+**Phase 3: Optimize**
+- Batch multiple AI actions if possible
+- Pre-warm Shardok-AI connection
+- Add fallback if Hetzner unavailable
+
+### Pros
+- Human command latency drops from ~220ms to ~20ms
+- AI still gets Hetzner's CPU power
+- Clear separation of concerns
+- Shardok-Primary can fall back to local AI if Hetzner unavailable
+
+### Cons
+- Two Shardok instances to maintain
+- State serialization overhead for AI requests
+- Each AI action has network round-trip (acceptable with animations)
+
+---
+
+## Comparison
+
+| Approach | Human Latency | AI Throughput | Complexity | Changes Required |
+|----------|---------------|---------------|------------|------------------|
+| Current | ~220ms | High | - | - |
+| Animation masking | ~220ms (perceived ~50ms) | High | Low | Unity only |
+| Split architecture | ~20ms | High | Medium | New RPC, two deployments |
+
+---
+
+## Recommendation
+
+**Phase 1 (now)**: Implement animation masking in Unity client
+- Quick win, no server changes
+- Improves perceived latency significantly for movement
+- Attacks still show dice animation while waiting
+
+**Phase 2 (future)**: Split architecture if animation masking insufficient
+- Only needed if users complain about attack latency
+- More complex but provides true low latency
+- Natural evolution of current architecture

docs/SMALL_EAGLE_TODO.md

@@ -0,0 +1,78 @@
+# The Small Eagle TODO
+
+## Goals
+
+Be able to support a small (10-50 user) private alpha, including with strangers.
+
+Larger set of goals in [The Big Eagle TODO](https://docs.google.com/document/d/17RTt3-4Wl2AAVMRLodaC3a84E4de6xuQTWBPvCRM484/edit?pli=1&tab=t.0), but most of that is not necessary for MVP.
+
+## Required
+
+### Gameplay Productionization
+
+- [x] ~~All functionality works on production eagle / shardok servers~~
+- [x] ~~Acceptable latency in all regions~~
+- [x] ~~Shardok performance similar to QA~~
+- [x] ~~Error logging & alerting~~
+- [x] ~~Fix long disconnects on deployments~~
+- [ ] Fix the Mac installer
+- [x] ~~Still not reconnecting after deployments~~
+- [ ] Notify about client updates, button to come directly back
+- [ ] Generatedtext healing
+- [ ] Kill outstanding shardok requests when game is deleted
+
+### Other Productionization
+
+- [x] ~~Oauth sign-in~~
+  - [x] ~~Add Google, others?~~
+- [ ] User management
+  - [x] ~~Invite codes~~
+  - [ ] Link accounts
+  - [x] ~~Choose display name~~
+  - [x] ~~Just do account setup from the landing page?~~
+- [x] ~~Download client directly from DO, avoid basic auth/my home network~~
+- [ ] "Message of the day"
+- [ ] Support plan
+
+### Alpha Tester Support
+
+- [ ] Feedback channel (Discord server? Bug report form?)
+- [ ] Crash reporting from Unity client
+- [ ] Known issues doc (so testers don't report the same things)
+
+### IP / Legal
+
+- [ ] Document and make available licenses for art & music
+- [ ] Required open source disclosures
+- [ ] Audit assets for anything we don't have rights to and replace it
+- [ ] Replace heroes that are based on real 20th or 21st century people or IP
+- [ ] Privacy policy (collecting accounts, OAuth data, gameplay data)
+- [ ] Terms of service (basic liability protection)
+- [ ] Data deletion capability (user requests account removal)
+
+### Basic Gameplay
+
+- [ ] Tutorial
+  - [ ] In the Your Warlord panel, say what the profession is
+  - [x] ~~And separate panels for each profession when you encounter one~~
+  - [x] ~~Command tutorial for each command the first time it's clicked~~
+  - [x] ~~Time to recruit / expand~~
+    - [x] ~~And how expansion works~~
+  - [ ] Province events
+  - [ ] Running low on food
+  - [x] ~~Time to swear brotherhood~~
+    - [x] ~~When you get large, or~~
+    - [x] ~~When you get a good candidate~~
+  - [ ] Shardok tutorial!
+- [ ] Basic Shardok AI stuff fixed
+- [ ] Lobby fixes
+- [ ] Have goals / ending
+- [ ] First-session onboarding (beyond mechanics tutorial)
+  - [ ] Narrative hook in first few minutes - why should I care about my warlord?
+  - [ ] Clear first-session goal ("try to capture your first province" or similar)
+  - [ ] Early small victory to build momentum
+  - [ ] Guided first scenario vs. overwhelming sandbox?
+
+## Nice to have
+
+<!-- Add nice-to-have items here as they come up -->

docs/SPARKLE_DELTA_UPDATES.md

@@ -0,0 +1,568 @@
+# Sparkle Delta Updates Implementation Plan
+
+## Overview
+
+This document outlines the implementation plan for adding delta update support to the Eagle0 macOS auto-update system using Sparkle's BinaryDelta feature.
+
+### Current State
+- Full DMG downloads (~200MB) for every update
+- `mac_build_handler.go` creates DMG, signs it, uploads to S3, updates appcast.xml
+- Keeps last 10 versions in appcast, deletes older DMGs
+- Users must download full app even for small changes
+
+### Goals
+- Reduce update download size from ~200MB to ~10-30MB (85% reduction)
+- Maintain backward compatibility with full DMG downloads
+- Automatic fallback for users who are many versions behind
+
+## Sparkle Delta Update Architecture
+
+Sparkle supports binary delta updates through the `<sparkle:deltas>` element in the appcast. When a user updates, Sparkle:
+1. Checks if a delta patch exists from their current version to the new version
+2. If found, downloads the smaller delta patch instead of the full DMG
+3. Applies the patch locally to create the new app version
+4. Falls back to full DMG if no matching delta exists
+
+### Appcast XML Structure with Deltas
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
+  <channel>
+    <title>Eagle0</title>
+    <link>https://assets.eagle0.net/mac/appcast.xml</link>
+    <description>Eagle0 game updates</description>
+    <language>en</language>
+    <item>
+      <title>Version 1.0.9615</title>
+      <pubDate>Sun, 19 Jan 2026 12:00:00 -0800</pubDate>
+      <sparkle:version>9615</sparkle:version>
+      <sparkle:shortVersionString>1.0.9615</sparkle:shortVersionString>
+      <enclosure
+        url="https://assets.eagle0.net/mac/builds/eagle0-1.0.9615.dmg"
+        length="200000000"
+        type="application/octet-stream"
+        sparkle:edSignature="..." />
+      <sparkle:deltas>
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9614-9615.delta"
+          sparkle:deltaFrom="9614"
+          length="15000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9613-9615.delta"
+          sparkle:deltaFrom="9613"
+          length="18000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9612-9615.delta"
+          sparkle:deltaFrom="9612"
+          length="22000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+      </sparkle:deltas>
+    </item>
+    <!-- older versions... -->
+  </channel>
+</rss>
+```
+
+## Implementation Plan
+
+### Phase 1: Add S3 Utility Functions
+
+**File:** `src/main/go/net/eagle0/util/aws/bucket_basics.go`
+
+Add two new functions to support delta generation:
+
+```go
+// ListObjectsWithPrefix returns all object keys matching the given prefix
+func (bb BucketBasics) ListObjectsWithPrefix(bucket, prefix string) ([]string, error) {
+    var keys []string
+    paginator := s3.NewListObjectsV2Paginator(bb.S3Client, &s3.ListObjectsV2Input{
+        Bucket: aws.String(bucket),
+        Prefix: aws.String(prefix),
+    })
+
+    for paginator.HasMorePages() {
+        page, err := paginator.NextPage(context.TODO())
+        if err != nil {
+            return nil, err
+        }
+        for _, obj := range page.Contents {
+            keys = append(keys, *obj.Key)
+        }
+    }
+    return keys, nil
+}
+
+// DownloadFile downloads an object to a local file path
+func (bb BucketBasics) DownloadFile(bucket, key, localPath string) error {
+    result, err := bb.S3Client.GetObject(context.TODO(), &s3.GetObjectInput{
+        Bucket: aws.String(bucket),
+        Key:    aws.String(key),
+    })
+    if err != nil {
+        return err
+    }
+    defer result.Body.Close()
+
+    file, err := os.Create(localPath)
+    if err != nil {
+        return err
+    }
+    defer file.Close()
+
+    _, err = io.Copy(file, result.Body)
+    return err
+}
+```
+
+### Phase 2: Store App Bundles for Delta Generation
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Add storage paths:
+```go
+var appsRoot = "mac/apps/"      // Zipped app bundles for delta generation
+var deltasRoot = "mac/deltas/"  // Delta patches
+```
+
+After DMG creation, upload the zipped app bundle:
+```go
+func uploadAppBundle(bb aws.BucketBasics, appPath string, buildNumber string) error {
+    appZipPath := filepath.Join("/tmp", fmt.Sprintf("eagle0-%s.app.zip", buildNumber))
+
+    // Create zip of app bundle using ditto (preserves metadata)
+    cmd := exec.Command("ditto", "-c", "-k", "--keepParent", appPath, appZipPath)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return fmt.Errorf("failed to zip app: %s: %w", string(output), err)
+    }
+    defer os.Remove(appZipPath)
+
+    // Upload to S3
+    remotePath := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", buildNumber)
+    log.Printf("Uploading app bundle to S3: %s", remotePath)
+    return bb.UploadFilePublic(bucketName, remotePath, appZipPath)
+}
+```
+
+### Phase 3: Add Delta XML Structures
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Add new structs for delta representation:
+```go
+// Delta represents a delta patch from a previous version
+type Delta struct {
+    XMLName   xml.Name `xml:"enclosure"`
+    URL       string   `xml:"url,attr"`
+    DeltaFrom string   `xml:"sparkle:deltaFrom,attr"`
+    Length    int64    `xml:"length,attr"`
+    Type      string   `xml:"type,attr"`
+    EdSig     string   `xml:"sparkle:edSignature,attr"`
+}
+
+// Deltas wraps the sparkle:deltas element
+type Deltas struct {
+    XMLName xml.Name `xml:"sparkle:deltas"`
+    Items   []Delta  `xml:"enclosure"`
+}
+
+// Update Item struct to include Deltas
+type Item struct {
+    Title               string     `xml:"title"`
+    PubDate             string     `xml:"pubDate"`
+    SparkleVersion      string     `xml:"sparkle:version"`
+    SparkleShortVersion string     `xml:"sparkle:shortVersionString"`
+    Description         string     `xml:"description,omitempty"`
+    Enclosure           Enclosure  `xml:"enclosure"`
+    Deltas              *Deltas    `xml:"sparkle:deltas,omitempty"`
+}
+```
+
+### Phase 4: Generate Delta Patches
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+```go
+// Maximum number of versions to generate deltas from
+const maxDeltaVersions = 5
+
+// generateDeltas creates delta patches from previous versions to the new version
+func generateDeltas(bb aws.BucketBasics, newBuildNumber string, newAppPath string, privateKeyPath string) ([]Delta, error) {
+    var deltas []Delta
+
+    // Ensure BinaryDelta tool is available
+    binaryDeltaPath, err := ensureBinaryDelta()
+    if err != nil {
+        return nil, fmt.Errorf("failed to get BinaryDelta: %w", err)
+    }
+
+    // List available app bundles
+    appKeys, err := bb.ListObjectsWithPrefix(bucketName, appsRoot+"eagle0-")
+    if err != nil {
+        log.Printf("Warning: failed to list app bundles: %v", err)
+        return deltas, nil // Continue without deltas
+    }
+
+    // Parse build numbers from keys and sort descending
+    var buildNumbers []string
+    for _, key := range appKeys {
+        // Extract build number from "mac/apps/eagle0-9614.app.zip"
+        base := filepath.Base(key)
+        if strings.HasPrefix(base, "eagle0-") && strings.HasSuffix(base, ".app.zip") {
+            bn := strings.TrimSuffix(strings.TrimPrefix(base, "eagle0-"), ".app.zip")
+            if bn != newBuildNumber {
+                buildNumbers = append(buildNumbers, bn)
+            }
+        }
+    }
+
+    // Sort descending (most recent first) and limit to maxDeltaVersions
+    sort.Sort(sort.Reverse(sort.StringSlice(buildNumbers)))
+    if len(buildNumbers) > maxDeltaVersions {
+        buildNumbers = buildNumbers[:maxDeltaVersions]
+    }
+
+    // Generate delta from each previous version
+    for _, oldBuild := range buildNumbers {
+        delta, err := generateSingleDelta(bb, binaryDeltaPath, oldBuild, newBuildNumber, newAppPath, privateKeyPath)
+        if err != nil {
+            log.Printf("Warning: failed to generate delta from %s: %v", oldBuild, err)
+            continue // Skip this delta but continue with others
+        }
+        deltas = append(deltas, delta)
+    }
+
+    return deltas, nil
+}
+
+func generateSingleDelta(bb aws.BucketBasics, binaryDeltaPath, oldBuild, newBuild, newAppPath, privateKeyPath string) (Delta, error) {
+    // Download old app bundle
+    oldAppZipKey := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", oldBuild)
+    oldAppZipLocal := filepath.Join("/tmp", fmt.Sprintf("eagle0-%s.app.zip", oldBuild))
+    defer os.Remove(oldAppZipLocal)
+
+    if err := bb.DownloadFile(bucketName, oldAppZipKey, oldAppZipLocal); err != nil {
+        return Delta{}, fmt.Errorf("failed to download old app: %w", err)
+    }
+
+    // Unzip old app
+    oldAppDir := filepath.Join("/tmp", fmt.Sprintf("old-app-%s", oldBuild))
+    defer os.RemoveAll(oldAppDir)
+
+    cmd := exec.Command("ditto", "-x", "-k", oldAppZipLocal, oldAppDir)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return Delta{}, fmt.Errorf("failed to unzip old app: %s: %w", string(output), err)
+    }
+
+    oldAppPath := filepath.Join(oldAppDir, "eagle0.app")
+
+    // Generate delta
+    deltaPath := filepath.Join("/tmp", fmt.Sprintf("%s-%s.delta", oldBuild, newBuild))
+    defer os.Remove(deltaPath)
+
+    cmd = exec.Command(binaryDeltaPath, "create", oldAppPath, newAppPath, deltaPath)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return Delta{}, fmt.Errorf("failed to create delta: %s: %w", string(output), err)
+    }
+
+    // Get delta size
+    deltaSize, err := getFileSize(deltaPath)
+    if err != nil {
+        return Delta{}, fmt.Errorf("failed to get delta size: %w", err)
+    }
+    log.Printf("Delta %s->%s size: %d bytes (%.1f MB)", oldBuild, newBuild, deltaSize, float64(deltaSize)/1024/1024)
+
+    // Sign delta
+    signature, err := signWithSparkle(deltaPath, privateKeyPath)
+    if err != nil {
+        return Delta{}, fmt.Errorf("failed to sign delta: %w", err)
+    }
+
+    // Upload delta
+    deltaKey := deltasRoot + fmt.Sprintf("%s-%s.delta", oldBuild, newBuild)
+    if err := bb.UploadFilePublic(bucketName, deltaKey, deltaPath); err != nil {
+        return Delta{}, fmt.Errorf("failed to upload delta: %w", err)
+    }
+
+    deltaURL := fmt.Sprintf("https://assets.eagle0.net/%s", deltaKey)
+    return Delta{
+        URL:       deltaURL,
+        DeltaFrom: oldBuild,
+        Length:    deltaSize,
+        Type:      "application/octet-stream",
+        EdSig:     signature,
+    }, nil
+}
+
+func ensureBinaryDelta() (string, error) {
+    binaryDeltaPath := "/tmp/sparkle-cache/Sparkle-2.6.4/bin/BinaryDelta"
+
+    if _, err := os.Stat(binaryDeltaPath); os.IsNotExist(err) {
+        log.Println("Sparkle BinaryDelta not found, downloading...")
+        cmd := exec.Command("bash", "-c", `
+            mkdir -p /tmp/sparkle-cache
+            curl -sL https://github.com/sparkle-project/Sparkle/releases/download/2.6.4/Sparkle-2.6.4.tar.xz | tar -xJ -C /tmp/sparkle-cache
+        `)
+        if output, err := cmd.CombinedOutput(); err != nil {
+            return "", fmt.Errorf("failed to download Sparkle: %s: %w", string(output), err)
+        }
+    }
+
+    return binaryDeltaPath, nil
+}
+```
+
+### Phase 5: Update Main Deploy Flow
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Modify `main()` to integrate delta generation:
+
+```go
+func main() {
+    // ... existing argument parsing ...
+
+    // Create DMG (existing)
+    if err := createDMG(appPath, dmgPath, "Eagle0"); err != nil {
+        log.Fatalf("Failed to create DMG: %v", err)
+    }
+
+    // ... existing DMG upload ...
+
+    if privateKeyPath != "" {
+        // Upload app bundle for future delta generation (NEW)
+        log.Println("Uploading app bundle for delta generation...")
+        if err := uploadAppBundle(bb, appPath, buildNumber); err != nil {
+            log.Printf("Warning: failed to upload app bundle: %v", err)
+            // Continue - delta generation is optional
+        }
+
+        // Generate deltas from previous versions (NEW)
+        log.Println("Generating delta patches...")
+        deltas, err := generateDeltas(bb, buildNumber, appPath, privateKeyPath)
+        if err != nil {
+            log.Printf("Warning: failed to generate deltas: %v", err)
+        } else {
+            log.Printf("Generated %d delta patches", len(deltas))
+        }
+
+        // Update appcast with deltas
+        log.Println("Updating appcast.xml...")
+        appcast, err := fetchAppcast(bb)
+        if err != nil {
+            log.Fatalf("Failed to fetch appcast: %v", err)
+        }
+
+        // Create new item with deltas
+        newItem := Item{
+            Title:               fmt.Sprintf("Version %s", version),
+            PubDate:             time.Now().Format(time.RFC1123Z),
+            SparkleVersion:      buildNumber,
+            SparkleShortVersion: version,
+            Description:         "",
+            Enclosure: Enclosure{
+                URL:    downloadURL,
+                Length: fileSize,
+                Type:   "application/octet-stream",
+                EdSig:  signature,
+            },
+        }
+
+        // Add deltas if any were generated
+        if len(deltas) > 0 {
+            newItem.Deltas = &Deltas{Items: deltas}
+        }
+
+        // ... rest of appcast handling ...
+    }
+}
+```
+
+### Phase 6: Cleanup Old Artifacts
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+When pruning old versions from appcast, also delete associated artifacts:
+
+```go
+// In the appcast pruning section, after removing old items:
+if len(appcast.Channel.Items) > 10 {
+    oldItems := appcast.Channel.Items[10:]
+    for _, item := range oldItems {
+        oldBuild := item.SparkleVersion
+
+        // Delete old DMG (existing)
+        dmgKey := strings.TrimPrefix(item.Enclosure.URL, "https://assets.eagle0.net/")
+        log.Printf("Deleting old build: %s", dmgKey)
+        bb.DeleteObject(bucketName, dmgKey)
+
+        // Delete old app bundle (NEW)
+        appKey := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", oldBuild)
+        log.Printf("Deleting old app bundle: %s", appKey)
+        bb.DeleteObject(bucketName, appKey)
+
+        // Delete deltas TO this version (NEW)
+        deltaKeys, _ := bb.ListObjectsWithPrefix(bucketName, deltasRoot)
+        for _, key := range deltaKeys {
+            if strings.HasSuffix(key, fmt.Sprintf("-%s.delta", oldBuild)) {
+                log.Printf("Deleting old delta: %s", key)
+                bb.DeleteObject(bucketName, key)
+            }
+        }
+    }
+    appcast.Channel.Items = appcast.Channel.Items[:10]
+}
+```
+
+## S3 Storage Structure
+
+After implementation, the S3 bucket will have this structure:
+
+```
+eagle0-windows/
+├── mac/
+│   ├── appcast.xml                    # Update feed with delta info
+│   ├── builds/                        # Full DMG downloads
+│   │   ├── eagle0-1.0.9620.dmg
+│   │   ├── eagle0-1.0.9619.dmg
+│   │   ├── ...
+│   │   └── eagle0-latest.dmg          # Symlink to latest
+│   ├── apps/                          # Zipped app bundles (NEW)
+│   │   ├── eagle0-9620.app.zip
+│   │   ├── eagle0-9619.app.zip
+│   │   ├── eagle0-9618.app.zip
+│   │   ├── eagle0-9617.app.zip
+│   │   └── eagle0-9616.app.zip        # Keep last 5 for delta gen
+│   └── deltas/                        # Delta patches (NEW)
+│       ├── 9619-9620.delta
+│       ├── 9618-9620.delta
+│       ├── 9617-9620.delta
+│       ├── 9616-9620.delta
+│       ├── 9615-9620.delta
+│       ├── 9618-9619.delta
+│       ├── 9617-9619.delta
+│       └── ...
+```
+
+## Storage Impact Analysis
+
+### Current Storage (without deltas)
+- 10 DMGs × 200MB = **~2GB**
+
+### Estimated Storage (with deltas)
+- 10 DMGs × 200MB = 2GB
+- 5 app bundles × 150MB = 0.75GB (zip compression)
+- ~25 delta files × 20MB avg = 0.5GB
+- **Total: ~3.25GB**
+
+### Trade-offs
+- **+1.25GB storage** (~60% increase)
+- **-170MB per user update** (~85% bandwidth savings)
+- Break-even: ~8 user updates to recoup storage cost
+
+## Bandwidth Savings
+
+| Scenario | Without Deltas | With Deltas | Savings |
+|----------|---------------|-------------|---------|
+| 1 version behind | 200MB | ~15MB | 92% |
+| 2 versions behind | 200MB | ~20MB | 90% |
+| 3 versions behind | 200MB | ~25MB | 87% |
+| 5 versions behind | 200MB | ~35MB | 82% |
+| 6+ versions behind | 200MB | 200MB (full) | 0% |
+
+## Migration Strategy
+
+The implementation is backward-compatible and requires no changes to existing clients:
+
+1. **First deploy after implementation:**
+   - Stores app bundle for the first time
+   - No deltas generated (no previous app bundles exist)
+   - Appcast has no `<sparkle:deltas>` element
+
+2. **Second deploy:**
+   - Generates delta from previous version
+   - Appcast now has `<sparkle:deltas>` with one entry
+   - Users on previous version get delta update
+
+3. **Subsequent deploys:**
+   - Generate deltas from last 5 versions
+   - Users within 5 versions get delta updates
+   - Users more than 5 versions behind get full DMG
+
+4. **Client behavior:**
+   - Sparkle automatically checks for matching delta
+   - Falls back to full DMG if no delta matches
+   - No client code changes required
+
+## Error Handling
+
+The implementation handles failures gracefully:
+
+1. **S3 list/download fails:** Skip delta generation, use full DMG
+2. **BinaryDelta fails for one version:** Log warning, continue with other versions
+3. **Signing fails:** Skip that delta, continue with others
+4. **Upload fails:** Skip that delta, continue with others
+
+The deploy never fails due to delta issues - deltas are optional enhancements.
+
+## Verification Plan
+
+### Manual Testing
+
+1. **Deploy version N:**
+   - Verify app bundle uploaded to `mac/apps/eagle0-N.app.zip`
+   - Verify appcast has no deltas (first deploy)
+
+2. **Deploy version N+1:**
+   - Verify delta generated at `mac/deltas/N-(N+1).delta`
+   - Verify appcast contains `<sparkle:deltas>` element
+   - Verify delta signature is valid
+
+3. **Test update from N to N+1:**
+   - Install version N manually
+   - Check for updates
+   - Monitor download size in Player.log (should be ~15-30MB, not 200MB)
+   - Verify app updated successfully
+
+4. **Test fresh install:**
+   - Download latest DMG directly
+   - Verify installation works normally
+
+5. **Test fallback scenario:**
+   - Install a version more than 5 versions behind
+   - Update should download full DMG
+
+### Automated Verification
+
+Add to CI workflow (optional):
+```yaml
+- name: Verify delta generation
+  run: |
+    # Check app bundle exists
+    aws s3 ls s3://eagle0-windows/mac/apps/ | grep eagle0-${BUILD_NUMBER}.app.zip
+
+    # Check deltas exist (after second deploy)
+    aws s3 ls s3://eagle0-windows/mac/deltas/ | head -5
+
+    # Verify appcast has deltas
+    curl -s https://assets.eagle0.net/mac/appcast.xml | grep "sparkle:deltas"
+```
+
+## Security Considerations
+
+1. **All deltas are EdDSA signed:** Same signature verification as full DMG
+2. **BinaryDelta is Sparkle's official tool:** Well-audited, production-ready
+3. **App bundles in S3 are public:** Same as DMGs, no additional exposure
+4. **Cleanup removes old artifacts:** No indefinite storage of old versions
+
+## Future Enhancements
+
+1. **Parallel delta generation:** Generate multiple deltas concurrently
+2. **Delta size threshold:** Skip uploading deltas larger than X% of full DMG
+3. **Delta metrics:** Track delta download rates vs full DMG
+4. **Configurable delta count:** Allow adjusting how many versions to keep

docs/TUTORIAL_CONTENT.md

@@ -0,0 +1,181 @@
+# Tutorial Content Guide
+
+This document defines all tutorial content. Edit this to refine the text, then update `TutorialContentDefinitions.cs` to match.
+
+---
+
+## Onboarding Sequence
+
+Shown to first-time players. Guides them through the basics of strategic and tactical gameplay.
+
+| Step | ID | Display | Trigger | Title | Description |
+|------|-----|---------|---------|-------|-------------|
+| 1 | `welcome` | Modal | Auto (game start) | Welcome to Eagle0 | Command your armies, recruit heroes, and conquer provinces in this turn-based strategy game.<br><br>Let's walk through the basics! |
+| 2 | `select_province` | Overlay | Completes on: `province_selected` | The Strategic Map | This is your kingdom. Each colored region is a province.<br><br>Tap a province you control (shown in your color) to see what you can do there. |
+| 3 | `province_panel` | Modal | Button click | Province Information | This panel shows province details: its name, terrain, any armies present, and the commands available to you.<br><br>Commands let you move troops, recruit heroes, and more. |
+| 4 | `try_march` | Overlay | Completes on: `command_issued` | Issue a Command | Try issuing a March command to move your army to an adjacent province.<br><br>Select a destination and confirm the order. |
+| 5 | `turn_cycle` | Modal | Button click | The Turn Cycle | Eagle0 uses simultaneous turns. All players give orders at the same time, then turns resolve together.<br><br>When all players are ready, the server processes everyone's commands and shows the results. |
+| 6 | `wait_for_battle` | Hidden | Completes on: `first_battle_available` | *(none)* | *(Invisible step - waits for a battle to become available)* |
+| 7 | `battle_intro` | Modal | Button click | Battle Time! | When armies collide, you'll fight tactical battles on a hex grid.<br><br>You command individual units - infantry, cavalry, archers, and heroes with special abilities. |
+| 8 | `enter_battle` | Overlay | Completes on: `battle_entered` | Enter the Battle | Tap the Battle button to enter tactical combat. |
+| 9 | `tactical_overview` | Modal | Button click | Tactical Combat | Each unit has movement points and attack power. Position your troops wisely!<br><br>Units attack adjacent enemies. Flanking (attacking from multiple sides) deals bonus damage. |
+| 10 | `move_unit` | Overlay | Completes on: `battle_action` | Move Your Units | Tap one of your units to select it, then tap a highlighted hex to move there.<br><br>Blue hexes show where you can move. |
+| 11 | `attack_enemy` | Overlay | Completes on: `battle_action` | Attack! | Move next to an enemy unit, then tap the enemy to attack.<br><br>Red highlights show valid attack targets. |
+| 12 | `end_turn` | Overlay | Completes on: `turn_ended` | End Your Turn | When you've moved all units or want to pass, tap End Turn.<br><br>The enemy will then take their turn. |
+| 13 | `complete` | Modal | Button click (no skip) | You're Ready! | You now know the basics of Eagle0!<br><br>Explore diplomacy, recruit powerful heroes, and conquer the realm. Good luck, commander! |
+
+### Notes on Onboarding Flow
+
+- Steps 1-5 cover strategic gameplay
+- Step 6 is invisible - just waits for a battle
+- Steps 7-12 cover tactical combat
+- Step 13 celebrates completion
+
+**Questions to consider:**
+- Should we skip tactical tutorial if player skips to first battle themselves?
+- Should there be a "skip all" option visible from step 1?
+- Is the step order correct for typical first-game flow?
+
+---
+
+## Strategic Contextual Tutorials
+
+Triggered when players encounter features for the first time.
+
+### Diplomacy Introduction
+| Field | Value |
+|-------|-------|
+| ID | `diplomacy_intro` |
+| Trigger | `diplomacy_available` (diplomacy commands appear) |
+| Display | Modal |
+| Title | Diplomacy |
+| Description | You can negotiate with other factions!<br><br>Offer alliances, declare war, or propose tribute. Your diplomatic choices shape the realm. |
+
+### Hero Recruitment
+| Field | Value |
+|-------|-------|
+| ID | `hero_recruitment` |
+| Trigger | `hero_recruitment_available` (free heroes detected) |
+| Display | Modal |
+| Title | Heroes Available |
+| Description | Free heroes wander the realm seeking a lord to serve.<br><br>Recruit them to lead your armies! Heroes have unique abilities and grow stronger with experience. |
+
+### Weather Control
+| Field | Value |
+|-------|-------|
+| ID | `weather_control` |
+| Trigger | `weather_control_available` (weather command appears) |
+| Display | Overlay |
+| Title | Weather Magic |
+| Description | Your mages can influence the weather!<br><br>Rain slows movement, storms disrupt enemies, and clear skies speed your march. |
+
+### Prisoner Management
+| Field | Value |
+|-------|-------|
+| ID | `prisoner_management` |
+| Trigger | `prisoner_command_issued` (player uses prisoner command) |
+| Display | Modal |
+| Title | Prisoners Captured |
+| Description | You've captured enemy soldiers!<br><br>You can ransom them for gold, recruit them into your army, or execute them as a warning. |
+
+---
+
+## Tactical Contextual Tutorials
+
+Triggered during battles when players encounter spells, terrain, or abilities.
+
+### Lightning Bolt Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_lightning` |
+| Trigger | `spell_lightning_available` |
+| Display | Tooltip |
+| Title | Lightning Bolt |
+| Description | Your mage can cast Lightning Bolt!<br><br>This spell strikes a single target for heavy damage. Great for eliminating key enemy units. |
+
+### Meteor Strike Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_meteor` |
+| Trigger | `spell_meteor_available` |
+| Display | Modal |
+| Title | Meteor Strike |
+| Description | Meteor is a devastating area spell!<br><br>It takes a turn to cast: first select target, then it lands next turn. Plan ahead! |
+
+### Holy Wave Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_holywave` |
+| Trigger | `spell_holywave_available` |
+| Display | Tooltip |
+| Title | Holy Wave |
+| Description | Holy Wave heals your units and damages undead!<br><br>Position your troops carefully to maximize its effect. |
+
+### Raise Dead Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_raisedead` |
+| Trigger | `spell_raisedead_available` |
+| Display | Modal |
+| Title | Raise Dead |
+| Description | Dark magic can raise fallen soldiers as undead!<br><br>They fight for you, but beware - they may crumble if your necromancer falls. |
+
+### Fire Terrain
+| Field | Value |
+|-------|-------|
+| ID | `terrain_fire` |
+| Trigger | `terrain_fire_encountered` (fire damage occurs) |
+| Display | Tooltip |
+| Title | Fire Hazard |
+| Description | Fire spreads across the battlefield!<br><br>Units in burning hexes take damage. Use fire to block enemy routes or avoid it yourself. |
+
+### Water Crossing
+| Field | Value |
+|-------|-------|
+| ID | `terrain_water` |
+| Trigger | `terrain_water_encountered` (water crossing attempted) |
+| Display | Tooltip |
+| Title | Water Crossing |
+| Description | Units can cross shallow water, but it's risky.<br><br>Crossing takes extra movement and may fail. Some units swim better than others. |
+
+### Cavalry Charge
+| Field | Value |
+|-------|-------|
+| ID | `ability_charge` |
+| Trigger | `ability_charge_available` |
+| Display | Overlay |
+| Title | Cavalry Charge |
+| Description | Your cavalry can Charge!<br><br>Charging deals bonus damage based on distance traveled. Use open terrain for maximum impact. |
+
+---
+
+## Display Modes
+
+| Mode | Description | Use For |
+|------|-------------|---------|
+| **Modal** | Full popup with dimmed background, blocks interaction | Important concepts, multi-paragraph explanations |
+| **Overlay** | Semi-transparent overlay, can highlight UI elements | Guiding player to interact with specific UI |
+| **Tooltip** | Small popup near target element | Quick tips, less important info |
+| **Hint** | Pulsing dot indicator only | Subtle suggestions |
+| **None** | Invisible, just waits for event | Transition steps |
+
+---
+
+## Adding New Tutorials
+
+1. Add entry to this document
+2. Update `TutorialContentDefinitions.cs`:
+   - For onboarding: add to `CreateOnboardingSequence()`
+   - For contextual: add to `RegisterStrategicTutorials()` or `RegisterTacticalTutorials()`
+3. Ensure trigger event exists in `TutorialTriggerRegistry.cs`
+4. Test the flow
+
+---
+
+## Content Guidelines
+
+- Keep descriptions to 2-3 short paragraphs max
+- Use `<br><br>` for paragraph breaks (renders as newlines in Unity)
+- Avoid jargon - explain game terms when first introduced
+- Be encouraging, not condescending
+- Focus on "what to do" not exhaustive "how it works"

external/BUILD.sparkle

@@ -0,0 +1,8 @@
+load("@build_bazel_rules_apple//apple:apple.bzl", "apple_dynamic_framework_import")
+
+# Import pre-built Sparkle framework
+apple_dynamic_framework_import(
+    name = "Sparkle",
+    framework_imports = glob(["Sparkle.framework/**"]),
+    visibility = ["//visibility:public"],
+)

go.mod

@@ -9,6 +9,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.28.10
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.51
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.72.2
+	github.com/golang-jwt/jwt/v5 v5.2.1
+	github.com/google/uuid v1.6.0
 	google.golang.org/grpc v1.68.0
 	google.golang.org/protobuf v1.36.3
 )

go.sum

@@ -34,9 +34,13 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.33.6 h1:VwhTrsTuVn52an4mXx29PqRzs2Dv
 github.com/aws/aws-sdk-go-v2/service/sts v1.33.6/go.mod h1:+8h7PZb3yY5ftmVLD7ocEoE98hdc8PoKS0H3wfx1dlc=
 github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
 github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
 golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

maven_install.json

@@ -1,7 +1,7 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": 289080209,
-  "__RESOLVED_ARTIFACTS_HASH": -131178107,
+  "__INPUT_ARTIFACTS_HASH": -2049857450,
+  "__RESOLVED_ARTIFACTS_HASH": -1728186926,
   "conflict_resolution": {
     "com.google.guava:failureaccess:1.0.1": "com.google.guava:failureaccess:1.0.2",
     "com.squareup.okio:okio:2.10.0": "com.squareup.okio:okio:3.6.0",
@@ -48,6 +48,12 @@
       },
       "version": "2.12.7"
     },
+    "com.github.stephenc.jcip:jcip-annotations": {
+      "shasums": {
+        "jar": "4fccff8382aafc589962c4edb262f6aa595e34f1e11e61057d1c6a96e8fc7323"
+      },
+      "version": "1.0-1"
+    },
     "com.google.android:annotations": {
       "shasums": {
         "jar": "ba734e1e84c09d615af6a09d33034b4f0442f8772dec120efb376d86a565ae15"
@@ -156,6 +162,12 @@
       },
       "version": "1.4.2"
     },
+    "com.nimbusds:nimbus-jose-jwt": {
+      "shasums": {
+        "jar": "12ae4a3a260095d7aeba2adea7ae396e8b9570db8b7b409e09a824c219cc0444"
+      },
+      "version": "9.37.3"
+    },
     "com.squareup.okhttp3:okhttp": {
       "shasums": {
         "jar": "b1050081b14bb7a3a7e55a4d3ef01b5dcfabc453b4573a4fc019767191d5f4e0"
@@ -401,6 +413,12 @@
       },
       "version": "0.27.0"
     },
+    "io.sentry:sentry": {
+      "shasums": {
+        "jar": "740a118182fc089d307830f4e508372e01ad94639b00b4e1b1d83762298a5f35"
+      },
+      "version": "7.19.0"
+    },
     "javax.activation:javax.activation-api": {
       "shasums": {
         "jar": "43fdef0b5b6ceb31b0424b208b930c74ab58fac2ceeb7b3f6fd3aeb8b5ca4393"
@@ -810,6 +828,9 @@
       "org.checkerframework:checker-qual",
       "org.ow2.asm:asm"
     ],
+    "com.nimbusds:nimbus-jose-jwt": [
+      "com.github.stephenc.jcip:jcip-annotations"
+    ],
     "com.squareup.okhttp3:okhttp": [
       "com.squareup.okio:okio",
       "org.jetbrains.kotlin:kotlin-stdlib-jdk8"
@@ -1355,6 +1376,9 @@
       "com.fasterxml.jackson.databind.type",
       "com.fasterxml.jackson.databind.util"
     ],
+    "com.github.stephenc.jcip:jcip-annotations": [
+      "net.jcip.annotations"
+    ],
     "com.google.android:annotations": [
       "android.annotation"
     ],
@@ -1500,6 +1524,38 @@
     "com.google.truth:truth": [
       "com.google.common.truth"
     ],
+    "com.nimbusds:nimbus-jose-jwt": [
+      "com.nimbusds.jose",
+      "com.nimbusds.jose.crypto",
+      "com.nimbusds.jose.crypto.bc",
+      "com.nimbusds.jose.crypto.factories",
+      "com.nimbusds.jose.crypto.impl",
+      "com.nimbusds.jose.crypto.opts",
+      "com.nimbusds.jose.crypto.utils",
+      "com.nimbusds.jose.jca",
+      "com.nimbusds.jose.jwk",
+      "com.nimbusds.jose.jwk.gen",
+      "com.nimbusds.jose.jwk.source",
+      "com.nimbusds.jose.mint",
+      "com.nimbusds.jose.proc",
+      "com.nimbusds.jose.produce",
+      "com.nimbusds.jose.shaded.gson",
+      "com.nimbusds.jose.shaded.gson.annotations",
+      "com.nimbusds.jose.shaded.gson.internal",
+      "com.nimbusds.jose.shaded.gson.internal.bind",
+      "com.nimbusds.jose.shaded.gson.internal.bind.util",
+      "com.nimbusds.jose.shaded.gson.internal.reflect",
+      "com.nimbusds.jose.shaded.gson.internal.sql",
+      "com.nimbusds.jose.shaded.gson.reflect",
+      "com.nimbusds.jose.shaded.gson.stream",
+      "com.nimbusds.jose.util",
+      "com.nimbusds.jose.util.cache",
+      "com.nimbusds.jose.util.events",
+      "com.nimbusds.jose.util.health",
+      "com.nimbusds.jwt",
+      "com.nimbusds.jwt.proc",
+      "com.nimbusds.jwt.util"
+    ],
     "com.squareup.okhttp3:okhttp": [
       "okhttp3",
       "okhttp3.internal",
@@ -1735,6 +1791,30 @@
     "io.perfmark:perfmark-api": [
       "io.perfmark"
     ],
+    "io.sentry:sentry": [
+      "io.sentry",
+      "io.sentry.backpressure",
+      "io.sentry.cache",
+      "io.sentry.clientreport",
+      "io.sentry.config",
+      "io.sentry.exception",
+      "io.sentry.hints",
+      "io.sentry.instrumentation.file",
+      "io.sentry.internal.debugmeta",
+      "io.sentry.internal.gestures",
+      "io.sentry.internal.modules",
+      "io.sentry.internal.viewhierarchy",
+      "io.sentry.metrics",
+      "io.sentry.profilemeasurements",
+      "io.sentry.protocol",
+      "io.sentry.rrweb",
+      "io.sentry.transport",
+      "io.sentry.util",
+      "io.sentry.util.thread",
+      "io.sentry.vendor",
+      "io.sentry.vendor.gson.internal.bind.util",
+      "io.sentry.vendor.gson.stream"
+    ],
     "javax.activation:javax.activation-api": [
       "javax.activation"
     ],
@@ -2337,6 +2417,7 @@
       "com.fasterxml.jackson.core:jackson-annotations",
       "com.fasterxml.jackson.core:jackson-core",
       "com.fasterxml.jackson.core:jackson-databind",
+      "com.github.stephenc.jcip:jcip-annotations",
       "com.google.android:annotations",
       "com.google.api.grpc:proto-google-common-protos",
       "com.google.auth:google-auth-library-credentials",
@@ -2355,6 +2436,7 @@
       "com.google.protobuf:protobuf-java",
       "com.google.re2j:re2j",
       "com.google.truth:truth",
+      "com.nimbusds:nimbus-jose-jwt",
       "com.squareup.okhttp3:okhttp",
       "com.squareup.okhttp3:okhttp-sse",
       "com.squareup.okhttp:okhttp",
@@ -2400,6 +2482,7 @@
       "io.opencensus:opencensus-contrib-grpc-metrics",
       "io.opencensus:opencensus-contrib-http-util",
       "io.perfmark:perfmark-api",
+      "io.sentry:sentry",
       "javax.activation:javax.activation-api",
       "javax.xml.bind:jaxb-api",
       "joda-time:joda-time",

nginx/nginx.conf

@@ -0,0 +1,265 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    # Allow large request bodies for game uploads (default is 1MB)
+    client_max_body_size 50M;
+
+    # Logging
+    log_format grpc_json escape=json '{'
+        '"time":"$time_iso8601",'
+        '"client":"$remote_addr",'
+        '"uri":"$uri",'
+        '"status":$status,'
+        '"grpc_status":"$sent_http_grpc_status",'
+        '"request_time":$request_time,'
+        '"upstream_time":"$upstream_response_time"'
+    '}';
+
+    access_log /var/log/nginx/access.log grpc_json;
+    error_log /var/log/nginx/error.log warn;
+
+    # Rate limiting zone
+    limit_req_zone $binary_remote_addr zone=grpc_limit:10m rate=100r/s;
+
+    # Docker DNS resolver - re-resolve hostnames every 10s
+    # This prevents stale IP caching when containers restart
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
+    # Eagle backend - blue-green deployment with variable-based routing
+    # Uses a variable so nginx only resolves the configured backend (not all backends).
+    # This allows nginx to start/reload even when the inactive backend is stopped.
+    # The deploy script updates this map, then recreates nginx.
+    map $host $eagle_backend {
+        default "eagle-blue:40032";
+    }
+
+    # HTTP server for Let's Encrypt challenge and redirect
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name prod.eagle0.net;
+
+        # Let's Encrypt challenge
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        # Redirect all other HTTP to HTTPS
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    # HTTPS server for gRPC
+    server {
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on;
+        server_name prod.eagle0.net;
+
+        # SSL certificates (managed by certbot)
+        ssl_certificate /etc/letsencrypt/live/prod.eagle0.net/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/prod.eagle0.net/privkey.pem;
+
+        # SSL configuration
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+        ssl_prefer_server_ciphers off;
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+
+        # gRPC proxy for Eagle service
+        location /net.eagle0.eagle.api.Eagle {
+            # Rate limiting
+            limit_req zone=grpc_limit burst=50 nodelay;
+
+            # gRPC proxy - uses variable for blue-green deployment
+            grpc_pass grpc://$eagle_backend;
+
+            # Timeouts for long-running streams
+            grpc_read_timeout 1200s;
+            grpc_send_timeout 1200s;
+            grpc_socket_keepalive on;
+
+            # Error handling
+            error_page 502 = /error502grpc;
+        }
+
+        # gRPC proxy for Auth service (routes to Go auth service, not Eagle)
+        location /net.eagle0.eagle.api.auth.Auth {
+            # Rate limiting
+            limit_req zone=grpc_limit burst=50 nodelay;
+
+            # Route to auth service directly (not through Eagle)
+            set $auth_backend "auth:40033";
+            grpc_pass grpc://$auth_backend;
+
+            # Timeouts
+            grpc_read_timeout 30s;
+            grpc_send_timeout 30s;
+
+            # Error handling
+            error_page 502 = /error502grpc;
+        }
+
+        # OAuth callback endpoint (proxied to Go auth service)
+        location /oauth/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Apple OAuth callback (Apple uses POST with form_post response mode)
+        location /oauth/apple/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Steam OAuth callback (Steam uses OpenID 2.0)
+        location /oauth/steam/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Invitation landing page (proxied to Go auth service)
+        location /invite/ {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Health check endpoint
+        location /health {
+            access_log off;
+            return 200 "OK\n";
+            add_header Content-Type text/plain;
+        }
+
+        # gRPC error handling
+        location = /error502grpc {
+            internal;
+            default_type application/grpc;
+            add_header grpc-status 14;
+            add_header grpc-message "unavailable";
+            return 204;
+        }
+    }
+
+    # HTTPS server for Go Auth service (port 40033)
+    # Clients connect here directly for OAuth RPCs in Phase 2
+    server {
+        listen 40033 ssl;
+        listen [::]:40033 ssl;
+        http2 on;
+        server_name prod.eagle0.net;
+
+        # SSL certificates (same as main server)
+        ssl_certificate /etc/letsencrypt/live/prod.eagle0.net/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/prod.eagle0.net/privkey.pem;
+
+        # SSL configuration
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+        ssl_prefer_server_ciphers off;
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+
+        # gRPC proxy for Auth service
+        # Uses variable-based resolution so nginx can start even if auth isn't ready yet
+        # DNS is cached by the resolver directive (valid=10s)
+        location /net.eagle0.eagle.api.auth.Auth {
+            # Rate limiting
+            limit_req zone=grpc_limit burst=50 nodelay;
+
+            # Dynamic upstream resolution (doesn't block nginx startup)
+            set $auth_backend "auth:40033";
+            grpc_pass grpc://$auth_backend;
+
+            # Timeouts
+            grpc_read_timeout 30s;
+            grpc_send_timeout 30s;
+
+            # Error handling
+            error_page 502 = /error502grpc;
+        }
+
+        # gRPC proxy for Admin service
+        location /net.eagle0.eagle.api.admin.Admin {
+            # Rate limiting
+            limit_req zone=grpc_limit burst=50 nodelay;
+
+            # Dynamic upstream resolution (doesn't block nginx startup)
+            set $auth_backend "auth:40033";
+            grpc_pass grpc://$auth_backend;
+
+            # Timeouts
+            grpc_read_timeout 30s;
+            grpc_send_timeout 30s;
+
+            # Error handling
+            error_page 502 = /error502grpc;
+        }
+
+        # Health check endpoint
+        location /health {
+            access_log off;
+            return 200 "OK\n";
+            add_header Content-Type text/plain;
+        }
+
+        # gRPC error handling
+        location = /error502grpc {
+            internal;
+            default_type application/grpc;
+            add_header grpc-status 14;
+            add_header grpc-message "unavailable";
+            return 204;
+        }
+    }
+
+    # HTTP server for Admin Console (Let's Encrypt + redirect)
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name admin.prod.eagle0.net admin.eagle0.net;
+
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+
+    # HTTPS server for Admin Console
+    server {
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        server_name admin.prod.eagle0.net admin.eagle0.net;
+
+        ssl_certificate /etc/letsencrypt/live/admin.eagle0.net/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/admin.eagle0.net/privkey.pem;
+
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+        ssl_prefer_server_ciphers off;
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+
+        location / {
+            proxy_pass http://admin:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}

scripts/build_deps_baseline.txt

@@ -0,0 +1,3 @@
+# BUILD dependency baseline - updated Tue Jan 20 21:22:24 PST 2026
+# Do not increase these numbers - only decrease!
+library_proto_deps=26

scripts/build_mac_plugin.sh

@@ -8,3 +8,6 @@ ZIP_LOCATION=$(bazel cquery --config=mactools --output=files @net_eagle0_unity_g
 /usr/bin/unzip -o $ZIP_LOCATION -d src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/
 
 /usr/bin/plutil -convert xml1 src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/DarwinGodiceBundle.bundle/Contents/Info.plist
+
+/bin/echo "building sparkle plugin"
+./scripts/build_sparkle_plugin.sh

scripts/build_sparkle_plugin.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Build the SparklePlugin native library for Unity using Bazel
+#
+# Usage: build_sparkle_plugin.sh [output_dir]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+OUTPUT_DIR="${1:-$PROJECT_ROOT/src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/macOS}"
+
+echo "=== Building SparklePlugin with Bazel ==="
+
+bazel build --config=mactools //src/main/objc/net/eagle0/sparkle:SparklePlugin
+
+# Get the zip path from bazel
+ZIP_PATH=$(bazel cquery --config=mactools --output=files //src/main/objc/net/eagle0/sparkle:SparklePlugin 2>/dev/null)
+
+echo "=== Extracting SparklePlugin.bundle ==="
+mkdir -p "$OUTPUT_DIR"
+rm -rf "$OUTPUT_DIR/SparklePlugin.bundle"
+unzip -o "$ZIP_PATH" -d "$OUTPUT_DIR/"
+
+# Convert Info.plist from binary to XML format (Unity requires XML)
+/usr/bin/plutil -convert xml1 "$OUTPUT_DIR/SparklePlugin.bundle/Contents/Info.plist"
+
+echo "=== SparklePlugin built successfully ==="
+ls -la "$OUTPUT_DIR/SparklePlugin.bundle/"

scripts/check_build_deps.sh

@@ -0,0 +1,182 @@
+#!/bin/bash
+# Check BUILD.bazel dependency constraints
+# This script enforces architectural boundaries in the codebase.
+#
+# Usage:
+#   ./scripts/check_build_deps.sh           # Check all rules
+#   ./scripts/check_build_deps.sh --ci      # CI mode (fail on any violation)
+#   ./scripts/check_build_deps.sh --count   # Just count current violations (for tracking progress)
+#   ./scripts/check_build_deps.sh --strict  # Fail if proto deps in library/ exceed baseline
+#
+# The baseline for proto deps is stored in scripts/build_deps_baseline.txt
+# Update it with: ./scripts/check_build_deps.sh --update-baseline
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BASELINE_FILE="$SCRIPT_DIR/build_deps_baseline.txt"
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+MODE="${1:-check}"
+EXIT_CODE=0
+
+# Get baseline proto count (default to a high number if no baseline exists)
+get_baseline() {
+    if [ -f "$BASELINE_FILE" ]; then
+        grep "^library_proto_deps=" "$BASELINE_FILE" | cut -d= -f2
+    else
+        echo "999999"  # No baseline = don't fail
+    fi
+}
+
+# Rule 1: src/main should not depend on src/test
+check_main_depends_on_test() {
+    echo -e "${YELLOW}Checking: src/main should not depend on src/test...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/...) intersect //src/test/...' 2>/dev/null || true)
+
+    if [ -n "$violations" ]; then
+        echo -e "${RED}VIOLATION: src/main depends on src/test:${NC}"
+        echo "$violations"
+        return 1
+    else
+        echo -e "${GREEN}✓ No violations${NC}"
+        return 0
+    fi
+}
+
+# Rule 2: library/ should not depend on src/main/protobuf
+# Note: This rule is aspirational - there are currently many violations as part of ongoing deproto effort
+check_library_depends_on_proto() {
+    echo -e "${YELLOW}Checking: library/ should not depend on src/main/protobuf...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null || true)
+    count=$(echo "$violations" | grep -c "^//" || echo "0")
+
+    if [ "$count" -gt 0 ]; then
+        echo -e "${YELLOW}Found $count proto dependencies in library/ (deproto in progress)${NC}"
+        if [ "$MODE" == "--count" ]; then
+            echo "$violations" | head -20
+            if [ "$count" -gt 20 ]; then
+                echo "... and $((count - 20)) more"
+            fi
+        fi
+        # Don't fail on this rule yet - it's aspirational
+        return 0
+    else
+        echo -e "${GREEN}✓ No proto dependencies in library/${NC}"
+        return 0
+    fi
+}
+
+# Rule 3: library/ should not depend on proto_converters
+# Proto conversions should happen at service boundaries, not in library code
+check_library_depends_on_proto_converters() {
+    echo -e "${YELLOW}Checking: library/ should not depend on proto_converters...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/scala/net/eagle0/eagle/model/proto_converters/...' 2>/dev/null | grep "^//" || true)
+
+    if [ -n "$violations" ]; then
+        count=$(echo "$violations" | wc -l | tr -d ' ')
+        echo -e "${RED}VIOLATION: library/ depends on $count proto_converters targets:${NC}"
+        echo "$violations"
+        echo ""
+        echo "Proto conversions should happen at service boundaries (ShardokInterfaceGrpcClient,"
+        echo "EagleServiceImpl, etc.), not in library code."
+        return 1
+    else
+        echo -e "${GREEN}✓ No proto_converters dependencies in library/${NC}"
+        return 0
+    fi
+}
+
+# Count proto deps for tracking deproto progress
+count_proto_deps() {
+    echo -e "${YELLOW}=== Proto dependency counts ===${NC}"
+
+    library_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep -c "^//" || echo "0")
+    echo "library/: $library_count proto dependencies"
+
+    baseline=$(get_baseline)
+    if [ "$baseline" != "999999" ]; then
+        echo "baseline: $baseline"
+        if [ "$library_count" -lt "$baseline" ]; then
+            echo -e "${GREEN}↓ Reduced by $((baseline - library_count)) from baseline${NC}"
+        elif [ "$library_count" -gt "$baseline" ]; then
+            echo -e "${RED}↑ Increased by $((library_count - baseline)) from baseline${NC}"
+        fi
+    fi
+}
+
+# Check if proto deps exceed baseline (for strict mode)
+check_proto_baseline() {
+    library_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep -c "^//" || echo "0")
+    baseline=$(get_baseline)
+
+    echo -e "${YELLOW}Checking: proto deps in library/ should not exceed baseline...${NC}"
+    echo "Current: $library_count, Baseline: $baseline"
+
+    if [ "$library_count" -gt "$baseline" ]; then
+        echo -e "${RED}VIOLATION: Proto dependencies increased from $baseline to $library_count${NC}"
+        echo "Run './scripts/check_build_deps.sh --count' to see which protos are used"
+        return 1
+    else
+        echo -e "${GREEN}✓ Proto deps at or below baseline${NC}"
+        return 0
+    fi
+}
+
+# Update baseline file
+update_baseline() {
+    library_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep -c "^//" || echo "0")
+
+    echo "# BUILD dependency baseline - updated $(date)" > "$BASELINE_FILE"
+    echo "# Do not increase these numbers - only decrease!" >> "$BASELINE_FILE"
+    echo "library_proto_deps=$library_count" >> "$BASELINE_FILE"
+
+    echo -e "${GREEN}Updated baseline: library_proto_deps=$library_count${NC}"
+}
+
+echo "=== BUILD.bazel Dependency Check ==="
+echo ""
+
+case "$MODE" in
+    --count)
+        count_proto_deps
+        ;;
+    --ci)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_library_depends_on_proto || EXIT_CODE=1
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        ;;
+    --strict)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_proto_baseline || EXIT_CODE=1
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        ;;
+    --update-baseline)
+        update_baseline
+        ;;
+    *)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_library_depends_on_proto
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        echo ""
+        count_proto_deps
+        ;;
+esac
+
+echo ""
+if [ $EXIT_CODE -eq 0 ]; then
+    echo -e "${GREEN}=== All checks passed ===${NC}"
+else
+    echo -e "${RED}=== Some checks failed ===${NC}"
+fi
+
+exit $EXIT_CODE

scripts/codesign_mac_app.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+#
+# Code sign a macOS .app bundle for distribution
+# Usage: codesign_mac_app.sh <app_path> [entitlements_path]
+#
+# Environment variables:
+#   SIGNING_IDENTITY - The signing identity (default: "Developer ID Application")
+#   KEYCHAIN_PASSWORD - Password to unlock the build keychain (optional)
+
+set -euxo pipefail
+
+APP_PATH="$1"
+ENTITLEMENTS_PATH="${2:-}"
+SIGNING_IDENTITY="${SIGNING_IDENTITY:-Developer ID Application}"
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH"
+    exit 1
+fi
+
+# Unlock keychain if password provided
+if [ -n "${KEYCHAIN_PASSWORD:-}" ]; then
+    security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain || true
+fi
+
+echo "=== Signing nested components first ==="
+
+# Sign all dylibs
+find "$APP_PATH" -name "*.dylib" -print0 | while IFS= read -r -d '' item; do
+    echo "Signing dylib: $item"
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --sign "$SIGNING_IDENTITY" "$item"
+done
+
+# Sign all bundles (plugins)
+find "$APP_PATH" -name "*.bundle" -print0 | while IFS= read -r -d '' item; do
+    echo "Signing bundle: $item"
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --sign "$SIGNING_IDENTITY" "$item"
+done
+
+# Sign XPC services (but skip ones inside Sparkle.framework - they're already signed)
+find "$APP_PATH" -name "*.xpc" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle XPC service (pre-signed): $item"
+        continue
+    fi
+    echo "Signing XPC service: $item"
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --sign "$SIGNING_IDENTITY" "$item"
+done
+
+# Sign nested apps (but skip ones inside Sparkle.framework - they're already signed)
+find "$APP_PATH" -path "*/Frameworks/*.app" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle nested app (pre-signed): $item"
+        continue
+    fi
+    echo "Signing nested app: $item"
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --sign "$SIGNING_IDENTITY" "$item"
+done
+
+# Sign standalone executables inside frameworks (but skip Sparkle.framework internals)
+find "$APP_PATH" -path "*/Frameworks/*/Versions/*/Autoupdate" -type f -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle executable (pre-signed): $item"
+        continue
+    fi
+    echo "Signing executable: $item"
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --sign "$SIGNING_IDENTITY" "$item"
+done
+
+# Sign all frameworks (after their contents are signed)
+# Use --deep for Sparkle.framework to handle its XPC services
+find "$APP_PATH" -name "*.framework" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework" ]]; then
+        echo "Signing Sparkle framework with --deep: $item"
+        codesign --deep --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    else
+        echo "Signing framework: $item"
+        codesign --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    fi
+done
+
+echo "=== Signing main app bundle ==="
+
+if [ -n "$ENTITLEMENTS_PATH" ] && [ -f "$ENTITLEMENTS_PATH" ]; then
+    echo "Using entitlements: $ENTITLEMENTS_PATH"
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --entitlements "$ENTITLEMENTS_PATH" \
+        --sign "$SIGNING_IDENTITY" "$APP_PATH"
+else
+    codesign --force --verify --verbose --timestamp --options runtime \
+        --sign "$SIGNING_IDENTITY" "$APP_PATH"
+fi
+
+echo "=== Verifying signature ==="
+codesign --verify --verbose=4 "$APP_PATH"
+
+echo "=== Checking Gatekeeper assessment ==="
+spctl --assess --type exec -v "$APP_PATH" || echo "Note: Gatekeeper may reject until notarized"
+
+echo "Code signing complete: $APP_PATH"

scripts/deploy-blue-green.sh

@@ -0,0 +1,385 @@
+#!/bin/bash
+#
+# Blue-Green Deployment Script for Eagle Server
+#
+# This script performs a zero-downtime deployment with state consistency:
+# 1. Create .deployment_in_progress marker (signals deployment started)
+# 2. Start the staging instance (green) with new image
+# 3. Run warmup/smoke tests against staging (warms JIT)
+# 4. Switch nginx to staging (zero downtime - users immediately route to staging)
+# 5. Stop the active instance (blue) - blocks until flush completes
+# 6. Create .flush_complete marker (signals disk state is fresh)
+#
+# The flush marker coordination ensures green never serves stale game data:
+# - When users reconnect to green and trigger lazy-load, the code checks for markers
+# - If .deployment_in_progress exists, lazy-load WAITS for .flush_complete
+# - Once blue's flush completes and marker is created, lazy-load proceeds with fresh data
+#
+# Key insight: nginx switches to green BEFORE blue stops, achieving zero downtime.
+# Users who trigger lazy-load during blue's shutdown will wait for the flush marker.
+#
+# Usage: ./deploy-blue-green.sh [NEW_IMAGE_TAG]
+#
+# Example:
+#   ./deploy-blue-green.sh latest
+#   ./deploy-blue-green.sh sha-abc123
+#
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+APP_DIR="${APP_DIR:-/opt/eagle0}"
+NGINX_CONF="${APP_DIR}/nginx/nginx.conf"
+COMPOSE_FILE="${APP_DIR}/docker-compose.prod.yml"
+WARMUP_SCRIPT="${SCRIPT_DIR}/warmup-eagle.sh"
+SAVES_DIR="${APP_DIR}/saves"
+FLUSH_MARKER="${SAVES_DIR}/.flush_complete"
+DEPLOYMENT_IN_PROGRESS="${SAVES_DIR}/.deployment_in_progress"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+
+# Marker file operations use docker exec because saves directory is owned by root (Docker).
+# We run commands inside a container that has the saves directory mounted.
+create_deployment_marker() {
+    local deploy_id=$1
+    local container=$2  # Container to use for file operations
+    docker exec "${container}" rm -f /app/saves/.flush_complete
+    docker exec "${container}" sh -c "echo '${deploy_id}' > /app/saves/.deployment_in_progress"
+}
+
+create_flush_marker() {
+    local deploy_id=$1
+    local container=$2  # Container to use for file operations
+    docker exec "${container}" sh -c "echo '${deploy_id}' > /app/saves/.flush_complete"
+    docker exec "${container}" rm -f /app/saves/.deployment_in_progress
+}
+
+cleanup_markers_on_failure() {
+    local container=$1  # Container to use for file operations
+    docker exec "${container}" rm -f /app/saves/.deployment_in_progress 2>/dev/null || true
+    docker exec "${container}" touch /app/saves/.flush_complete 2>/dev/null || true
+}
+
+remove_stale_deployment_marker() {
+    # Try any running eagle container
+    local container
+    container=$(docker ps --filter "name=eagle-" --format "{{.Names}}" | head -1)
+    if [ -n "${container}" ]; then
+        docker exec "${container}" rm -f /app/saves/.deployment_in_progress 2>/dev/null || true
+    fi
+}
+
+# Determine which instance is currently running (not from nginx config)
+get_running_instance() {
+    local blue_running green_running
+    blue_running=$(docker inspect --format='{{.State.Running}}' eagle-blue 2>/dev/null || echo "false")
+    green_running=$(docker inspect --format='{{.State.Running}}' eagle-green 2>/dev/null || echo "false")
+
+    if [ "$blue_running" = "true" ] && [ "$green_running" = "true" ]; then
+        # Both running - use nginx config to determine primary
+        if grep -q "server eagle-blue:40032;" "${NGINX_CONF}" | head -1 | grep -qv backup; then
+            echo "blue"
+        else
+            echo "green"
+        fi
+    elif [ "$blue_running" = "true" ]; then
+        echo "blue"
+    elif [ "$green_running" = "true" ]; then
+        echo "green"
+    else
+        # Neither running - default to blue (first deploy or recovery)
+        echo "none"
+    fi
+}
+
+# Pull image with retry using crane (handles OCI/Docker digest mismatch)
+pull_with_retry() {
+    local image=$1
+    local max_attempts=${2:-3}
+    local attempt=1
+
+    # Skip pull if image already exists locally (e.g., CI already pulled it)
+    if docker image inspect "${image}" &>/dev/null; then
+        log_info "Image ${image} already exists locally, skipping pull"
+        return 0
+    fi
+
+    # Use crane if available (handles OCI format correctly)
+    if [ -x "${APP_DIR}/crane" ]; then
+        while [ $attempt -le $max_attempts ]; do
+            log_info "Pulling image with crane (attempt ${attempt}/${max_attempts})..."
+            if "${APP_DIR}/crane" pull "${image}" /tmp/image.tar && docker load -i /tmp/image.tar; then
+                rm -f /tmp/image.tar
+                log_info "Image pulled and loaded successfully"
+                return 0
+            fi
+            rm -f /tmp/image.tar
+            log_warn "Pull failed, retrying in 5 seconds..."
+            sleep 5
+            attempt=$((attempt + 1))
+        done
+    else
+        # Fallback to docker pull if crane not available
+        log_warn "crane not found at ${APP_DIR}/crane, falling back to docker pull"
+        while [ $attempt -le $max_attempts ]; do
+            log_info "Pulling image (attempt ${attempt}/${max_attempts})..."
+            if docker pull "${image}"; then
+                log_info "Image pulled successfully"
+                return 0
+            fi
+            log_warn "Pull failed, retrying in 5 seconds..."
+            sleep 5
+            attempt=$((attempt + 1))
+        done
+    fi
+    log_error "Failed to pull image after ${max_attempts} attempts"
+    return 1
+}
+
+# Wait for a container to be healthy
+wait_for_healthy() {
+    local container=$1
+    local max_attempts=${2:-60}
+    local attempt=1
+
+    log_info "Waiting for ${container} to become healthy..."
+    while [ $attempt -le $max_attempts ]; do
+        health=$(docker inspect --format='{{.State.Health.Status}}' "${container}" 2>/dev/null || echo "unknown")
+        if [ "$health" = "healthy" ]; then
+            log_info "${container} is healthy"
+            return 0
+        fi
+        echo -n "."
+        sleep 2
+        attempt=$((attempt + 1))
+    done
+    echo ""
+    log_error "${container} did not become healthy after $((max_attempts * 2)) seconds"
+    return 1
+}
+
+# Main deployment logic
+main() {
+    local new_tag="${1:-latest}"
+    local registry="registry.digitalocean.com/eagle0/eagle-server"
+    local new_image="${registry}:${new_tag}"
+
+    # Generate deployment ID for log correlation with server logs
+    local deploy_id
+    deploy_id=$(date +%s)
+    local deploy_start_time=$deploy_id
+
+    log_info "========================================="
+    log_info "Starting blue-green deployment"
+    log_info "Deployment ID: ${deploy_id}"
+    log_info "New image: ${new_image}"
+    log_info "========================================="
+
+    cd "${APP_DIR}"
+
+    # Determine current active instance (need this before creating marker)
+    local active=$(get_running_instance)
+    local staging
+    if [ "$active" = "blue" ] || [ "$active" = "none" ]; then
+        staging="green"
+        active="blue"  # Normalize "none" to "blue" for first deploy
+    else
+        staging="blue"
+    fi
+
+    # Step 1: Signal deployment in progress
+    log_info "[DEPLOY:${deploy_id}] Step 1: Signaling deployment in progress..."
+    # Use active container for marker operations (it's the one currently running)
+    if [ "$active" != "none" ] && docker ps --filter "name=eagle-${active}" --format "{{.Names}}" | grep -q .; then
+        create_deployment_marker "${deploy_id}" "eagle-${active}"
+        log_info "[DEPLOY:${deploy_id}] Deployment marker created via eagle-${active}"
+    else
+        log_warn "[DEPLOY:${deploy_id}] No running container to create marker (first deploy?)"
+    fi
+
+    # Pull the new image (with retry for intermittent registry issues)
+    if ! pull_with_retry "${new_image}" 3; then
+        log_error "Failed to pull new image, aborting deployment"
+        cleanup_markers_on_failure "eagle-${active}"
+        exit 1
+    fi
+
+    # Step 2: Start staging instance with new image
+    log_info "Step 2: Starting eagle-${staging} with new image..."
+    if [ "$staging" = "green" ]; then
+        EAGLE_IMAGE_NEW="${new_image}" docker compose -f "${COMPOSE_FILE}" --profile blue-green up -d eagle-green jfr-sidecar-green
+    else
+        EAGLE_IMAGE="${new_image}" docker compose -f "${COMPOSE_FILE}" up -d eagle-blue jfr-sidecar
+    fi
+
+    # Wait for staging to be healthy
+    if ! wait_for_healthy "eagle-${staging}" 90; then
+        log_error "Staging instance failed health check, aborting deployment"
+        docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
+        cleanup_markers_on_failure "eagle-${active}"
+        exit 1
+    fi
+
+    # Step 3: Run warmup/smoke test
+    local staging_port
+    if [ "$staging" = "green" ]; then
+        staging_port=40034
+    else
+        staging_port=40032
+    fi
+
+    log_info "Step 3: Running warmup against eagle-${staging}..."
+    if [ -x "${WARMUP_SCRIPT}" ]; then
+        if ! "${WARMUP_SCRIPT}" "localhost:${staging_port}"; then
+            log_error "Warmup/smoke test failed, aborting deployment"
+            docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
+            cleanup_markers_on_failure "eagle-${active}"
+            exit 1
+        fi
+    else
+        log_warn "Warmup script not found at ${WARMUP_SCRIPT}, skipping warmup"
+        log_warn "JIT will be cold on first requests"
+    fi
+
+    # Step 4: Switch nginx to staging BEFORE stopping active
+    # This achieves zero downtime - users immediately route to staging.
+    # Any lazy-loads will wait for the flush marker (created in step 6).
+    local nginx_switch_start
+    nginx_switch_start=$(date +%s)
+    log_info "[DEPLOY:${deploy_id}] Step 4: Switching nginx to eagle-${staging}..."
+
+    # Update nginx config (variable-based routing)
+    if [ "$staging" = "green" ]; then
+        sed -i.bak 's/eagle-blue:40032/eagle-green:40032/g' "${NGINX_CONF}"
+    else
+        sed -i.bak 's/eagle-green:40032/eagle-blue:40032/g' "${NGINX_CONF}"
+    fi
+
+    # Recreate nginx to pick up new config
+    # Use --no-deps to prevent cascading to auth (which has secrets not available here)
+    docker compose -f "${COMPOSE_FILE}" up -d --force-recreate --no-deps nginx
+
+    # Verify nginx picked up the correct config
+    local nginx_backend
+    nginx_backend=$(docker exec nginx grep -o 'eagle-[a-z]*:40032' /etc/nginx/nginx.conf | head -1 || echo "unknown")
+    if [ "$nginx_backend" = "eagle-${staging}:40032" ]; then
+        log_info "[DEPLOY:${deploy_id}] Verified: nginx routing to eagle-${staging}"
+    else
+        log_error "[DEPLOY:${deploy_id}] nginx config mismatch! Expected eagle-${staging}:40032, got ${nginx_backend}"
+        exit 1
+    fi
+    log_info "[DEPLOY:${deploy_id}] Traffic switched to eagle-${staging} (lazy-loads will wait for flush marker)"
+    local nginx_switch_end
+    nginx_switch_end=$(date +%s)
+
+    # Step 5: Stop active instance (blocks until exit, ensuring flush completes)
+    # Users may be lazy-loading on staging during this time - they'll wait for the marker.
+    local flush_start
+    flush_start=$(date +%s)
+    log_info "[DEPLOY:${deploy_id}] Step 5: Stopping eagle-${active} (waiting for flush)..."
+    docker compose -f "${COMPOSE_FILE}" stop "eagle-${active}"
+    local flush_end
+    flush_end=$(date +%s)
+    local flush_duration=$((flush_end - flush_start))
+    log_info "[DEPLOY:${deploy_id}] eagle-${active} stopped, flush completed in ${flush_duration}s"
+
+    # Step 6: Create flush marker - signals that disk state is fresh
+    # Any waiting lazy-loads on staging will now proceed with fresh data.
+    # The Eagle server automatically detects the flush marker update and invalidates any stale cached games.
+    log_info "[DEPLOY:${deploy_id}] Step 6: Creating flush marker..."
+    create_flush_marker "${deploy_id}" "eagle-${staging}"
+    log_info "[DEPLOY:${deploy_id}] Flush marker created - server will auto-invalidate stale cache"
+
+    # Update .env for admin service
+    local env_file="${APP_DIR}/.env"
+    if [ "$staging" = "green" ]; then
+        log_info "Updating .env for green instance..."
+        sed -i.bak '/^EAGLE_ADDR=/d; /^JFR_SIDECAR_ADDR=/d' "${env_file}" 2>/dev/null || true
+        echo "EAGLE_ADDR=eagle-green:40032" >> "${env_file}"
+        echo "JFR_SIDECAR_ADDR=jfr-sidecar-green:8081" >> "${env_file}"
+    else
+        log_info "Updating .env for blue instance..."
+        sed -i.bak '/^EAGLE_ADDR=/d; /^JFR_SIDECAR_ADDR=/d' "${env_file}" 2>/dev/null || true
+        echo "EAGLE_ADDR=eagle-blue:40032" >> "${env_file}"
+        echo "JFR_SIDECAR_ADDR=jfr-sidecar:8081" >> "${env_file}"
+    fi
+
+    # Restart admin to pick up new .env
+    # Use --no-deps to prevent cascading to auth (which has secrets not available here)
+    log_info "Restarting admin service..."
+    docker compose -f "${COMPOSE_FILE}" up -d --force-recreate --no-deps admin
+
+    # Clean up old instance
+    log_info "Cleaning up old eagle-${active}..."
+    docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${active}" 2>/dev/null || true
+
+    # Stop the old jfr-sidecar (it can't attach to removed container anyway)
+    if [ "$active" = "green" ]; then
+        docker compose -f "${COMPOSE_FILE}" stop "jfr-sidecar-green" 2>/dev/null || true
+        docker compose -f "${COMPOSE_FILE}" rm -f "jfr-sidecar-green" 2>/dev/null || true
+    else
+        docker compose -f "${COMPOSE_FILE}" stop "jfr-sidecar" 2>/dev/null || true
+        docker compose -f "${COMPOSE_FILE}" rm -f "jfr-sidecar" 2>/dev/null || true
+    fi
+
+    local deploy_end_time
+    deploy_end_time=$(date +%s)
+    local total_duration=$((deploy_end_time - deploy_start_time))
+    local user_wait_window=$((flush_end - nginx_switch_end))
+
+    log_info ""
+    log_info "========================================="
+    log_info "[DEPLOY:${deploy_id}] Deployment complete!"
+    log_info "  Active instance: eagle-${staging}"
+    log_info "  Total duration: ${total_duration}s"
+    log_info "  Flush duration: ${flush_duration}s"
+    log_info "  Max user wait window: ${user_wait_window}s"
+    log_info "========================================="
+}
+
+# Check for required tools
+check_requirements() {
+    if ! command -v docker &> /dev/null; then
+        log_error "docker is required but not installed"
+        exit 1
+    fi
+
+    if ! command -v sed &> /dev/null; then
+        log_error "sed is required but not installed"
+        exit 1
+    fi
+
+    if [ ! -f "${NGINX_CONF}" ]; then
+        log_error "nginx config not found at ${NGINX_CONF}"
+        exit 1
+    fi
+
+    if [ ! -f "${COMPOSE_FILE}" ]; then
+        log_error "docker-compose file not found at ${COMPOSE_FILE}"
+        exit 1
+    fi
+
+    # Ensure saves directory exists
+    if [ ! -d "${SAVES_DIR}" ]; then
+        log_info "Creating saves directory at ${SAVES_DIR}"
+        mkdir -p "${SAVES_DIR}"
+    fi
+
+    # Clean up any stale deployment-in-progress marker from a previous failed deploy
+    if [ -f "${DEPLOYMENT_IN_PROGRESS}" ]; then
+        log_warn "Found stale deployment-in-progress marker, removing it"
+        remove_stale_deployment_marker
+    fi
+}
+
+# Run
+check_requirements
+main "$@"

scripts/generate_changelog.sh

@@ -3,10 +3,25 @@
 # generate_changelog.sh
 #
 # Generates a weekly changelog from merged PRs, uses Claude to create a synopsis,
-# and opens an email draft in Mac Mail.
+# and sends an HTML email via Fastmail JMAP API.
 #
 # Usage: ./scripts/generate_changelog.sh [--dry-run]
 #
+# Configuration files (in ~/.config/eagle0/):
+#   fastmail_token      - API token (required)
+#   changelog_recipient - Email addresses, one per line (optional, defaults to sender)
+#
+# To set up:
+#   mkdir -p ~/.config/eagle0
+#   echo 'your-token' > ~/.config/eagle0/fastmail_token
+#   chmod 600 ~/.config/eagle0/fastmail_token
+#
+#   # Optional: configure recipients (one per line, # for comments)
+#   cat > ~/.config/eagle0/changelog_recipient << EOF
+#   alice@example.com
+#   bob@example.com
+#   EOF
+#
 # The script tracks its last run using a git tag 'changelog-last-run'.
 # On first run (no tag), it defaults to the previous Friday at 4pm.
 
@@ -19,6 +34,56 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TAG_NAME="changelog-last-run"
 DRY_RUN=false
+FASTMAIL_API="https://api.fastmail.com/jmap/api/"
+CONFIG_DIR="$HOME/.config/eagle0"
+TOKEN_FILE="$CONFIG_DIR/fastmail_token"
+RECIPIENT_FILE="$CONFIG_DIR/changelog_recipient"
+
+# Load API token from file or environment
+load_api_token() {
+    # Environment variable takes precedence
+    if [[ -n "${FASTMAIL_API_TOKEN:-}" ]]; then
+        return 0
+    fi
+
+    # Try loading from config file
+    if [[ -f "$TOKEN_FILE" ]]; then
+        FASTMAIL_API_TOKEN=$(cat "$TOKEN_FILE" | tr -d '[:space:]')
+        if [[ -n "$FASTMAIL_API_TOKEN" ]]; then
+            echo "Loaded API token from $TOKEN_FILE"
+            export FASTMAIL_API_TOKEN
+            return 0
+        fi
+    fi
+
+    return 1
+}
+
+# Load recipient emails from config file (one per line)
+# Returns JSON array fragment like: {"email": "a@b.com"}, {"email": "c@d.com"}
+load_recipients_json() {
+    local recipients=""
+    if [[ -f "$RECIPIENT_FILE" ]]; then
+        while IFS= read -r line || [[ -n "$line" ]]; do
+            # Skip empty lines and comments
+            line=$(echo "$line" | tr -d '[:space:]')
+            [[ -z "$line" || "$line" == \#* ]] && continue
+
+            if [[ -n "$recipients" ]]; then
+                recipients="$recipients, "
+            fi
+            recipients="$recipients{\"email\": \"$line\"}"
+        done < "$RECIPIENT_FILE"
+    fi
+    echo "$recipients"
+}
+
+# Get human-readable list of recipients
+load_recipients_display() {
+    if [[ -f "$RECIPIENT_FILE" ]]; then
+        grep -v '^#' "$RECIPIENT_FILE" | grep -v '^[[:space:]]*$' | tr '\n' ', ' | sed 's/, $//'
+    fi
+}
 
 # Parse arguments
 while [[ $# -gt 0 ]]; do
@@ -118,23 +183,30 @@ generate_synopsis() {
 
     # Create a prompt file to avoid shell escaping issues
     local prompt_file="/tmp/eagle0_prompt_$$.txt"
-    cat > "$prompt_file" <<'PROMPT_HEADER'
+    # Get repo URL for PR links
+    local repo_url=$(gh repo view --json url -q '.url')
+
+    cat > "$prompt_file" <<PROMPT_HEADER
 You are summarizing changes for a weekly engineering update email.
 
 Read the following list of merged PRs and create a concise synopsis grouped by theme/feature/area of the codebase.
 
-Guidelines:
-- Group related changes together under clear headings (ALL CAPS with a blank line before)
-- Use "- " bullet points for individual changes
+Structure:
+1. <h1> title (e.g., "Eagle0 Weekly Update")
+2. <h2>BLUF</h2> (Bottom Line Up Front) - A short prose paragraph (2-4 sentences) highlighting the 1-3 most important changes this week and what to look for when testing. This should be conversational and help readers quickly understand what matters most.
+3. Synopsis sections (<h2> headings with bullet point summaries)
+4. <hr> divider
+5. <h2>PR Details</h2> with the same groupings, but smaller (<h3> headings) and listing PR links
+   - Format each PR as: <a href="${repo_url}/pull/NUMBER">#NUMBER</a>: Title
+
+Guidelines for the SYNOPSIS sections:
+- Group related changes together under clear headings (use <h2> tags)
+- Use bullet points (<ul><li>) for individual changes
 - Highlight any significant new features, breaking changes, or important fixes
 - Keep the tone professional but accessible
-- Aim for a summary that takes 1-2 minutes to read
-- Don't include PR numbers in the summary - focus on what changed and why it matters
+- Don't include PR numbers in the synopsis - focus on what changed and why it matters
 
-IMPORTANT: Output plain text only. No markdown, no HTML. Use simple formatting:
-- ALL CAPS for section headers
-- Dashes (-) for bullet points
-- Blank lines between sections
+IMPORTANT: Output valid HTML that can be used directly in an email body. Do NOT wrap in \`\`\`html code blocks - just output the raw HTML.
 
 Here are the merged PRs:
 
@@ -144,32 +216,161 @@ PROMPT_HEADER
     echo "" >> "$prompt_file"
     echo "Generate the synopsis now:" >> "$prompt_file"
 
-    # Use Claude CLI to generate the synopsis (read from stdin)
-    cat "$prompt_file" | claude --print > "$output_file"
+    # Use Claude CLI to generate the synopsis, wrapped in proper HTML with charset
+    local raw_output="/tmp/eagle0_raw_$$.html"
+    cat "$prompt_file" | claude --print > "$raw_output"
 
-    rm -f "$prompt_file"
+    # Wrap in HTML document with UTF-8 charset
+    cat > "$output_file" <<'HTML_HEAD'
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+HTML_HEAD
+    cat "$raw_output" >> "$output_file"
+    echo "</body></html>" >> "$output_file"
+
+    rm -f "$prompt_file" "$raw_output"
     echo "Synopsis generated at: $output_file"
 }
 
-# Create email in Mac Mail
-create_email() {
+# Get Fastmail session info (account ID, identity ID, drafts mailbox ID)
+get_fastmail_session() {
+    echo "Fetching Fastmail session info..." >&2
+
+    # Get session
+    local session=$(curl -s \
+        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
+        "https://api.fastmail.com/jmap/session")
+
+    # Extract account ID (first account)
+    FASTMAIL_ACCOUNT_ID=$(echo "$session" | jq -r '.primaryAccounts["urn:ietf:params:jmap:mail"]')
+
+    if [[ -z "$FASTMAIL_ACCOUNT_ID" || "$FASTMAIL_ACCOUNT_ID" == "null" ]]; then
+        echo "Error: Could not get Fastmail account ID. Check your API token." >&2
+        return 1
+    fi
+    echo "Account ID: $FASTMAIL_ACCOUNT_ID" >&2
+
+    # Get identity ID
+    local identity_response=$(curl -s \
+        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
+        -H "Content-Type: application/json" \
+        -X POST \
+        -d "{
+            \"using\": [\"urn:ietf:params:jmap:core\", \"urn:ietf:params:jmap:mail\", \"urn:ietf:params:jmap:submission\"],
+            \"methodCalls\": [
+                [\"Identity/get\", {\"accountId\": \"$FASTMAIL_ACCOUNT_ID\"}, \"0\"]
+            ]
+        }" \
+        "$FASTMAIL_API")
+
+    FASTMAIL_IDENTITY_ID=$(echo "$identity_response" | jq -r '.methodResponses[0][1].list[0].id')
+    FASTMAIL_FROM_EMAIL=$(echo "$identity_response" | jq -r '.methodResponses[0][1].list[0].email')
+
+    if [[ -z "$FASTMAIL_IDENTITY_ID" || "$FASTMAIL_IDENTITY_ID" == "null" ]]; then
+        echo "Error: Could not get Fastmail identity ID." >&2
+        return 1
+    fi
+    echo "Identity ID: $FASTMAIL_IDENTITY_ID (${FASTMAIL_FROM_EMAIL})" >&2
+
+    # Get drafts mailbox ID
+    local mailbox_response=$(curl -s \
+        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
+        -H "Content-Type: application/json" \
+        -X POST \
+        -d "{
+            \"using\": [\"urn:ietf:params:jmap:core\", \"urn:ietf:params:jmap:mail\"],
+            \"methodCalls\": [
+                [\"Mailbox/query\", {\"accountId\": \"$FASTMAIL_ACCOUNT_ID\", \"filter\": {\"role\": \"drafts\"}}, \"0\"]
+            ]
+        }" \
+        "$FASTMAIL_API")
+
+    FASTMAIL_DRAFTS_ID=$(echo "$mailbox_response" | jq -r '.methodResponses[0][1].ids[0]')
+
+    if [[ -z "$FASTMAIL_DRAFTS_ID" || "$FASTMAIL_DRAFTS_ID" == "null" ]]; then
+        echo "Error: Could not get Fastmail drafts mailbox ID." >&2
+        return 1
+    fi
+    echo "Drafts mailbox ID: $FASTMAIL_DRAFTS_ID" >&2
+
+    return 0
+}
+
+# Send email via Fastmail JMAP API
+send_email_fastmail() {
     local synopsis_file="$1"
-    local since_date="$2"
+    local recipients_json="$2"  # JSON array fragment: {"email": "a@b.com"}, {"email": "c@d.com"}
 
     local subject="Eagle0 Weekly Changelog - $(date +%Y-%m-%d)"
+    local html_body=$(cat "$synopsis_file" | jq -Rs .)
 
-    echo "Creating email draft in Mac Mail..."
+    echo "Sending email via Fastmail JMAP API..."
 
-    osascript <<EOF
-set textContent to read POSIX file "$synopsis_file" as «class utf8»
+    # Create the email and send it in one request
+    local response=$(curl -s \
+        -H "Authorization: Bearer $FASTMAIL_API_TOKEN" \
+        -H "Content-Type: application/json" \
+        -X POST \
+        -d "{
+            \"using\": [
+                \"urn:ietf:params:jmap:core\",
+                \"urn:ietf:params:jmap:mail\",
+                \"urn:ietf:params:jmap:submission\"
+            ],
+            \"methodCalls\": [
+                [\"Email/set\", {
+                    \"accountId\": \"$FASTMAIL_ACCOUNT_ID\",
+                    \"create\": {
+                        \"draft\": {
+                            \"from\": [{\"email\": \"$FASTMAIL_FROM_EMAIL\"}],
+                            \"to\": [$recipients_json],
+                            \"subject\": \"$subject\",
+                            \"mailboxIds\": {\"$FASTMAIL_DRAFTS_ID\": true},
+                            \"keywords\": {\"\$draft\": true},
+                            \"htmlBody\": [{\"partId\": \"body\", \"type\": \"text/html\"}],
+                            \"bodyValues\": {
+                                \"body\": {
+                                    \"charset\": \"utf-8\",
+                                    \"value\": $html_body
+                                }
+                            }
+                        }
+                    }
+                }, \"0\"],
+                [\"EmailSubmission/set\", {
+                    \"accountId\": \"$FASTMAIL_ACCOUNT_ID\",
+                    \"onSuccessDestroyEmail\": [\"#sendIt\"],
+                    \"create\": {
+                        \"sendIt\": {
+                            \"emailId\": \"#draft\",
+                            \"identityId\": \"$FASTMAIL_IDENTITY_ID\"
+                        }
+                    }
+                }, \"1\"]
+            ]
+        }" \
+        "$FASTMAIL_API")
 
-tell application "Mail"
-    set newMessage to make new outgoing message with properties {subject:"$subject", content:textContent, visible:true}
-    activate
-end tell
-EOF
+    # Check for errors
+    local error=$(echo "$response" | jq -r '.methodResponses[0][1].notCreated.draft.description // empty')
+    if [[ -n "$error" ]]; then
+        echo "Error creating email: $error" >&2
+        echo "Full response: $response" >&2
+        return 1
+    fi
 
-    echo "Email draft created"
+    local send_error=$(echo "$response" | jq -r '.methodResponses[1][1].notCreated.sendIt.description // empty')
+    if [[ -n "$send_error" ]]; then
+        echo "Error sending email: $send_error" >&2
+        echo "Full response: $response" >&2
+        return 1
+    fi
+
+    echo "Email sent successfully"
 }
 
 # Update the tag to mark this run
@@ -192,13 +393,34 @@ main() {
     echo "=== Eagle0 Weekly Changelog Generator ==="
     echo ""
 
+    # Load API token (only required for actual send)
+    if [[ "$DRY_RUN" != "true" ]]; then
+        if ! load_api_token; then
+            echo "Error: No Fastmail API token found."
+            echo ""
+            echo "To create a token:"
+            echo "1. Go to Fastmail Settings -> Password & Security -> API tokens"
+            echo "2. Create a new token with 'Email submission' scope"
+            echo "3. Save it using one of these methods:"
+            echo ""
+            echo "   Option A (recommended): Store in config file"
+            echo "     mkdir -p ~/.config/eagle0"
+            echo "     echo 'your-token' > ~/.config/eagle0/fastmail_token"
+            echo "     chmod 600 ~/.config/eagle0/fastmail_token"
+            echo ""
+            echo "   Option B: Set environment variable"
+            echo "     export FASTMAIL_API_TOKEN='your-token'"
+            exit 1
+        fi
+    fi
+
     # Get cutoff date
     local cutoff_date=$(get_cutoff_date)
     echo "Cutoff date: $cutoff_date"
 
     # Create temp files
     local pr_file="/tmp/eagle0_prs_$(date +%s).md"
-    local synopsis_file="/tmp/eagle0_synopsis_$(date +%s).txt"
+    local synopsis_file="/tmp/eagle0_synopsis_$(date +%s).html"
 
     # Fetch PRs
     if ! fetch_merged_prs "$cutoff_date" "$pr_file"; then
@@ -217,10 +439,26 @@ main() {
         echo "=== DRY RUN - Synopsis content ==="
         cat "$synopsis_file"
         echo ""
-        echo "=== DRY RUN - Skipping email creation and tag update ==="
+        echo "=== DRY RUN - Skipping email send and tag update ==="
     else
-        # Create email
-        create_email "$synopsis_file" "$cutoff_date"
+        # Get Fastmail session info
+        if ! get_fastmail_session; then
+            echo "Failed to get Fastmail session info. Exiting."
+            exit 1
+        fi
+
+        # Determine recipients (from config file, or default to sender)
+        local recipients_json=$(load_recipients_json)
+        if [[ -z "$recipients_json" ]]; then
+            recipients_json="{\"email\": \"$FASTMAIL_FROM_EMAIL\"}"
+            echo "No recipients configured, sending to self ($FASTMAIL_FROM_EMAIL)"
+        else
+            local recipients_display=$(load_recipients_display)
+            echo "Sending to: $recipients_display"
+        fi
+
+        # Send email
+        send_email_fastmail "$synopsis_file" "$recipients_json"
 
         # Update tag for next run
         update_tag

scripts/generate_manifest_keys.go

@@ -0,0 +1,41 @@
+// +build ignore
+
+// Script to generate Ed25519 key pair for manifest signing.
+// Run with: go run scripts/generate_manifest_keys.go
+//
+// This will output:
+// - Private key (base64): Store as MANIFEST_SIGNING_KEY GitHub secret
+// - Public key (base64): Embed in EagleInstaller for verification
+
+package main
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"log"
+)
+
+func main() {
+	// Generate Ed25519 key pair
+	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		log.Fatalf("Failed to generate key pair: %v", err)
+	}
+
+	// Encode keys as base64
+	privateKeyB64 := base64.StdEncoding.EncodeToString(privateKey)
+	publicKeyB64 := base64.StdEncoding.EncodeToString(publicKey)
+
+	fmt.Println("=== Ed25519 Key Pair for Manifest Signing ===")
+	fmt.Println()
+	fmt.Println("PRIVATE KEY (store as GitHub secret MANIFEST_SIGNING_KEY):")
+	fmt.Println(privateKeyB64)
+	fmt.Println()
+	fmt.Println("PUBLIC KEY (embed in EagleInstaller.cs for verification):")
+	fmt.Println(publicKeyB64)
+	fmt.Println()
+	fmt.Printf("Private key size: %d bytes\n", len(privateKey))
+	fmt.Printf("Public key size: %d bytes\n", len(publicKey))
+}

scripts/inject_sparkle.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+#
+# Inject Sparkle framework into a macOS .app bundle for auto-updates
+# Usage: inject_sparkle.sh <app_path>
+#
+# Environment variables (required):
+#   SPARKLE_EDDSA_PUBLIC_KEY - EdDSA public key for verifying updates
+#
+# Optional environment variables:
+#   SPARKLE_FEED_URL - Appcast URL (default: https://assets.eagle0.net/mac/appcast.xml)
+#   SPARKLE_VERSION - Sparkle version to use (default: 2.6.4)
+
+set -euxo pipefail
+
+APP_PATH="$1"
+SPARKLE_VERSION="${SPARKLE_VERSION:-2.6.4}"
+SPARKLE_FEED_URL="${SPARKLE_FEED_URL:-https://assets.eagle0.net/mac/appcast.xml}"
+SPARKLE_CACHE_DIR="/tmp/sparkle-cache"
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH"
+    exit 1
+fi
+
+if [ -z "${SPARKLE_EDDSA_PUBLIC_KEY:-}" ]; then
+    echo "ERROR: SPARKLE_EDDSA_PUBLIC_KEY environment variable not set"
+    exit 1
+fi
+
+# Always use a fresh Sparkle download to avoid cache corruption issues
+SPARKLE_DIR="$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION"
+echo "=== Clearing Sparkle cache and downloading fresh copy ==="
+rm -rf "$SPARKLE_DIR"
+mkdir -p "$SPARKLE_DIR"
+
+SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
+echo "Downloading from: $SPARKLE_URL"
+curl -L "$SPARKLE_URL" -o /tmp/sparkle.tar.xz
+tar -xJf /tmp/sparkle.tar.xz -C "$SPARKLE_DIR"
+rm /tmp/sparkle.tar.xz
+
+# Show what was extracted
+echo "=== Extracted contents ==="
+ls -la "$SPARKLE_DIR/"
+
+# The tarball extracts files directly, not into a subdirectory
+# Verify the framework has proper symlink structure
+echo "=== Verifying Sparkle.framework structure ==="
+ls -la "$SPARKLE_DIR/Sparkle.framework/"
+
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Sparkle.framework/Sparkle is not a symlink"
+    file "$SPARKLE_DIR/Sparkle.framework/Sparkle"
+    exit 1
+fi
+
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Versions/Current" ]; then
+    echo "ERROR: Sparkle.framework/Versions/Current is not a symlink"
+    ls -la "$SPARKLE_DIR/Sparkle.framework/Versions/"
+    exit 1
+fi
+
+echo "Sparkle framework structure verified OK"
+
+echo "=== Injecting Sparkle framework ==="
+FRAMEWORKS_DIR="$APP_PATH/Contents/Frameworks"
+mkdir -p "$FRAMEWORKS_DIR"
+
+# Remove any existing Sparkle.framework in the app
+rm -rf "$FRAMEWORKS_DIR/Sparkle.framework"
+
+# Copy Sparkle framework (use ditto to preserve symlinks and bundle structure)
+ditto "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/Sparkle.framework"
+
+# Verify the copied framework still has proper structure
+echo "=== Verifying copied Sparkle.framework structure ==="
+ls -la "$FRAMEWORKS_DIR/Sparkle.framework/"
+if [ ! -L "$FRAMEWORKS_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Copied framework lost symlink structure"
+    exit 1
+fi
+echo "Copied framework structure OK"
+
+echo "=== Updating Info.plist ==="
+PLIST_PATH="$APP_PATH/Contents/Info.plist"
+
+# Add Sparkle configuration to Info.plist
+/usr/libexec/PlistBuddy -c "Delete :SUFeedURL" "$PLIST_PATH" 2>/dev/null || true
+/usr/libexec/PlistBuddy -c "Add :SUFeedURL string '$SPARKLE_FEED_URL'" "$PLIST_PATH"
+
+/usr/libexec/PlistBuddy -c "Delete :SUPublicEDKey" "$PLIST_PATH" 2>/dev/null || true
+/usr/libexec/PlistBuddy -c "Add :SUPublicEDKey string '$SPARKLE_EDDSA_PUBLIC_KEY'" "$PLIST_PATH"
+
+/usr/libexec/PlistBuddy -c "Delete :SUEnableAutomaticChecks" "$PLIST_PATH" 2>/dev/null || true
+/usr/libexec/PlistBuddy -c "Add :SUEnableAutomaticChecks bool true" "$PLIST_PATH"
+
+# Set bundle version from git for Sparkle version comparison
+# Use commit count for automatic incrementing versions (e.g., 1.0.9548)
+BUILD_NUMBER=$(git rev-list --count HEAD 2>/dev/null || echo "1")
+VERSION="1.0.${BUILD_NUMBER}"
+
+echo "Setting version: $VERSION (build $BUILD_NUMBER)"
+/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" "$PLIST_PATH" 2>/dev/null || \
+    /usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string '$VERSION'" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_NUMBER" "$PLIST_PATH" 2>/dev/null || \
+    /usr/libexec/PlistBuddy -c "Add :CFBundleVersion string '$BUILD_NUMBER'" "$PLIST_PATH"
+
+# Add URL scheme for invitation codes (eagle0://invite?code=XXXX)
+echo "=== Adding URL scheme for invitation codes ==="
+/usr/libexec/PlistBuddy -c "Delete :CFBundleURLTypes" "$PLIST_PATH" 2>/dev/null || true
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes array" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0 dict" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLName string 'net.eagle0.eagle0'" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes array" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes:0 string 'eagle0'" "$PLIST_PATH"
+
+echo "=== Sparkle injection complete ==="
+echo "App: $APP_PATH"
+echo "Feed URL: $SPARKLE_FEED_URL"
+echo "Version: $VERSION (build $BUILD_NUMBER)"

scripts/notarize_mac_app.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+#
+# Notarize a macOS .app bundle with Apple
+# Usage: notarize_mac_app.sh <app_path>
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euxo pipefail
+
+APP_PATH="$1"
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH"
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set"
+    echo "  APPLE_ID: ${APPLE_ID:-<not set>}"
+    echo "  APP_SPECIFIC_PASSWORD: ${APP_SPECIFIC_PASSWORD:+<set>}"
+    echo "  TEAM_ID: ${TEAM_ID:-<not set>}"
+    exit 1
+fi
+
+# Create ZIP for notarization submission
+ZIP_PATH="${APP_PATH%.app}.zip"
+echo "=== Creating ZIP for notarization: $ZIP_PATH ==="
+ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+
+echo "=== Submitting to Apple for notarization ==="
+SUBMIT_OUTPUT=$(xcrun notarytool submit "$ZIP_PATH" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" \
+    --wait 2>&1) || true
+
+echo "$SUBMIT_OUTPUT"
+
+# Extract submission ID and status (look for "  status:" to avoid matching "Current status:")
+SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
+STATUS=$(echo "$SUBMIT_OUTPUT" | grep "^  status:" | awk '{print $2}')
+
+echo "Submission ID: $SUBMISSION_ID"
+echo "Status: $STATUS"
+
+# Clean up the zip (use -f to avoid failure if already deleted)
+rm -f "$ZIP_PATH"
+
+if [ "$STATUS" != "Accepted" ]; then
+    echo "=== Notarization failed! Fetching log for details ==="
+    xcrun notarytool log "$SUBMISSION_ID" \
+        --apple-id "$APPLE_ID" \
+        --password "$APP_SPECIFIC_PASSWORD" \
+        --team-id "$TEAM_ID"
+    exit 1
+fi
+
+echo "=== Stapling notarization ticket to app ==="
+# Retry stapling - Apple's CloudKit can have a brief delay after notarization completes
+MAX_STAPLE_ATTEMPTS=5
+STAPLE_ATTEMPT=1
+while [ $STAPLE_ATTEMPT -le $MAX_STAPLE_ATTEMPTS ]; do
+    echo "Stapling attempt $STAPLE_ATTEMPT/$MAX_STAPLE_ATTEMPTS..."
+    if xcrun stapler staple "$APP_PATH"; then
+        echo "Stapling successful"
+        break
+    fi
+    if [ $STAPLE_ATTEMPT -eq $MAX_STAPLE_ATTEMPTS ]; then
+        echo "ERROR: Stapling failed after $MAX_STAPLE_ATTEMPTS attempts"
+        exit 1
+    fi
+    echo "Stapling failed, waiting 10 seconds before retry..."
+    sleep 10
+    STAPLE_ATTEMPT=$((STAPLE_ATTEMPT + 1))
+done
+
+echo "=== Verifying notarization ==="
+xcrun stapler validate "$APP_PATH"
+spctl --assess --type exec -v "$APP_PATH"
+
+echo "Notarization complete: $APP_PATH"

scripts/notarize_submit.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# Submit a macOS .app bundle to Apple for notarization (no waiting)
+# Usage: notarize_submit.sh <app_path>
+# Outputs: submission_id=<id> to stdout (for GitHub Actions)
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euo pipefail
+
+APP_PATH="$1"
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH" >&2
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set" >&2
+    echo "  APPLE_ID: ${APPLE_ID:-<not set>}" >&2
+    echo "  APP_SPECIFIC_PASSWORD: ${APP_SPECIFIC_PASSWORD:+<set>}" >&2
+    echo "  TEAM_ID: ${TEAM_ID:-<not set>}" >&2
+    exit 1
+fi
+
+# Create ZIP for notarization submission
+ZIP_PATH="${APP_PATH%.app}.zip"
+echo "=== Creating ZIP for notarization: $ZIP_PATH ===" >&2
+ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+
+echo "=== Submitting to Apple for notarization ===" >&2
+SUBMIT_OUTPUT=$(xcrun notarytool submit "$ZIP_PATH" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" 2>&1)
+
+echo "$SUBMIT_OUTPUT" >&2
+
+# Extract submission ID
+SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
+
+if [ -z "$SUBMISSION_ID" ]; then
+    echo "ERROR: Failed to get submission ID" >&2
+    exit 1
+fi
+
+# Clean up the zip
+rm "$ZIP_PATH"
+
+echo "Submission ID: $SUBMISSION_ID" >&2
+
+# Output for GitHub Actions
+echo "submission_id=$SUBMISSION_ID"

scripts/notarize_wait.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+#
+# Wait for Apple notarization to complete and staple the ticket
+# Usage: notarize_wait.sh <submission_id> <app_path>
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euo pipefail
+
+SUBMISSION_ID="$1"
+APP_PATH="$2"
+
+if [ -z "$SUBMISSION_ID" ]; then
+    echo "ERROR: submission_id is required" >&2
+    exit 1
+fi
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH" >&2
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set" >&2
+    exit 1
+fi
+
+echo "=== Waiting for notarization of submission $SUBMISSION_ID ==="
+WAIT_OUTPUT=$(xcrun notarytool wait "$SUBMISSION_ID" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" 2>&1) || true
+
+echo "$WAIT_OUTPUT"
+
+# Extract status (look for "  status:" to avoid matching "Current status:")
+STATUS=$(echo "$WAIT_OUTPUT" | grep "^  status:" | awk '{print $2}')
+
+echo "Status: $STATUS"
+
+if [ "$STATUS" != "Accepted" ]; then
+    echo "=== Notarization failed! Fetching log for details ==="
+    xcrun notarytool log "$SUBMISSION_ID" \
+        --apple-id "$APPLE_ID" \
+        --password "$APP_SPECIFIC_PASSWORD" \
+        --team-id "$TEAM_ID"
+    exit 1
+fi
+
+echo "=== Verifying code signature before stapling ==="
+if ! codesign --verify --deep --strict "$APP_PATH" 2>&1; then
+    echo "ERROR: Code signature verification failed - app may have been damaged during transfer"
+    echo "Attempting to show signature details:"
+    codesign -dvvv "$APP_PATH" 2>&1 || true
+    exit 1
+fi
+echo "Code signature verified successfully"
+
+echo "=== Stapling notarization ticket to app ==="
+# Retry stapling - Apple's CloudKit can take several minutes to propagate the ticket
+MAX_STAPLE_ATTEMPTS=10
+STAPLE_WAIT_SECONDS=30
+STAPLE_ATTEMPT=1
+while [ $STAPLE_ATTEMPT -le $MAX_STAPLE_ATTEMPTS ]; do
+    echo "Stapling attempt $STAPLE_ATTEMPT/$MAX_STAPLE_ATTEMPTS..."
+    if STAPLE_OUTPUT=$(xcrun stapler staple "$APP_PATH" 2>&1); then
+        echo "$STAPLE_OUTPUT"
+        echo "Stapling successful"
+        break
+    fi
+    echo "Stapler output: $STAPLE_OUTPUT"
+    if [ $STAPLE_ATTEMPT -eq $MAX_STAPLE_ATTEMPTS ]; then
+        echo "ERROR: Stapling failed after $MAX_STAPLE_ATTEMPTS attempts (total wait: $((MAX_STAPLE_ATTEMPTS * STAPLE_WAIT_SECONDS)) seconds)"
+        exit 1
+    fi
+    echo "Stapling failed, waiting $STAPLE_WAIT_SECONDS seconds before retry..."
+    sleep $STAPLE_WAIT_SECONDS
+    STAPLE_ATTEMPT=$((STAPLE_ATTEMPT + 1))
+done
+
+echo "=== Verifying notarization ==="
+xcrun stapler validate "$APP_PATH"
+spctl --assess --type exec -v "$APP_PATH"
+
+echo "Notarization complete: $APP_PATH"

scripts/setup_droplet.sh

@@ -0,0 +1,149 @@
+#!/bin/bash
+#
+# Setup script for Eagle0 production droplet
+# Run this on a fresh DigitalOcean droplet (Ubuntu 24.04)
+#
+# Usage: curl -sSL https://raw.githubusercontent.com/nolen777/eagle0/main/scripts/setup_droplet.sh | sudo bash
+#
+
+set -euo pipefail
+
+DOMAIN="${DOMAIN:-eagle0.net}"
+DEPLOY_USER="${DEPLOY_USER:-deploy}"
+APP_DIR="/opt/eagle0"
+
+echo "=== Eagle0 Production Server Setup ==="
+echo "Domain: ${DOMAIN}"
+echo "Deploy user: ${DEPLOY_USER}"
+echo ""
+
+# Check if running as root
+if [[ $EUID -ne 0 ]]; then
+   echo "This script must be run as root (use sudo)"
+   exit 1
+fi
+
+echo "=== Updating system ==="
+apt-get update
+apt-get upgrade -y
+
+echo "=== Installing Docker ==="
+if ! command -v docker &> /dev/null; then
+    curl -fsSL https://get.docker.com | sh
+    systemctl enable docker
+    systemctl start docker
+else
+    echo "Docker already installed"
+fi
+
+echo "=== Installing Docker Compose plugin ==="
+apt-get install -y docker-compose-plugin
+
+echo "=== Installing additional utilities ==="
+apt-get install -y \
+    curl \
+    wget \
+    git \
+    netcat-openbsd \
+    jq \
+    htop \
+    unattended-upgrades
+
+echo "=== Configuring automatic security updates ==="
+cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::AutocleanInterval "7";
+EOF
+
+echo "=== Creating deploy user ==="
+if ! id "${DEPLOY_USER}" &>/dev/null; then
+    useradd -m -s /bin/bash -G docker "${DEPLOY_USER}"
+    mkdir -p "/home/${DEPLOY_USER}/.ssh"
+    chmod 700 "/home/${DEPLOY_USER}/.ssh"
+    chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "/home/${DEPLOY_USER}/.ssh"
+    echo ""
+    echo "*** IMPORTANT: Add your SSH public key to /home/${DEPLOY_USER}/.ssh/authorized_keys ***"
+    echo ""
+else
+    echo "User ${DEPLOY_USER} already exists"
+    # Ensure user is in docker group
+    usermod -aG docker "${DEPLOY_USER}"
+fi
+
+echo "=== Creating application directory ==="
+mkdir -p "${APP_DIR}"/{nginx,certbot/conf,certbot/www,saves}
+chown -R "${DEPLOY_USER}:${DEPLOY_USER}" "${APP_DIR}"
+
+echo "=== Configuring Docker registry authentication ==="
+echo ""
+echo "*** IMPORTANT: Run the following command to authenticate with DigitalOcean Container Registry: ***"
+echo "  docker login registry.digitalocean.com"
+echo ""
+
+echo "=== Creating systemd service ==="
+cat > /etc/systemd/system/eagle0.service << EOF
+[Unit]
+Description=Eagle0 Game Servers
+Requires=docker.service
+After=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=${APP_DIR}
+ExecStart=/usr/bin/docker compose -f docker-compose.prod.yml up -d
+ExecStop=/usr/bin/docker compose -f docker-compose.prod.yml down
+User=${DEPLOY_USER}
+Group=${DEPLOY_USER}
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable eagle0
+
+echo "=== Configuring firewall (UFW) ==="
+if ! command -v ufw &> /dev/null; then
+    apt-get install -y ufw
+fi
+
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow ssh
+ufw allow 80/tcp
+ufw allow 443/tcp
+ufw --force enable
+
+echo "=== Setting up log rotation ==="
+cat > /etc/logrotate.d/eagle0 << EOF
+/var/log/eagle0/*.log {
+    daily
+    missingok
+    rotate 14
+    compress
+    delaycompress
+    notifempty
+    create 0640 ${DEPLOY_USER} ${DEPLOY_USER}
+    sharedscripts
+}
+EOF
+
+mkdir -p /var/log/eagle0
+chown "${DEPLOY_USER}:${DEPLOY_USER}" /var/log/eagle0
+
+echo ""
+echo "=== Setup Complete ==="
+echo ""
+echo "Next steps:"
+echo "1. Add SSH public key to /home/${DEPLOY_USER}/.ssh/authorized_keys"
+echo "2. Copy docker-compose.prod.yml to ${APP_DIR}/"
+echo "3. Copy nginx/nginx.conf to ${APP_DIR}/nginx/"
+echo "4. Create .env file in ${APP_DIR}/ with OPENAI_API_KEY"
+echo "5. Run: docker login registry.digitalocean.com"
+echo "6. Get SSL certificate: (see init_ssl.sh)"
+echo "7. Start services: systemctl start eagle0"
+echo ""
+echo "Server IP: $(curl -s ifconfig.me)"
+echo ""

scripts/updateActionResultTypes.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-bazel run //src/main/go/net/eagle0/build/action_result_type_build_file_generator \
-  ${PWD}/src/main/scala/net/eagle0/eagle/model/action_result/types/

scripts/warmup-eagle.sh

@@ -0,0 +1,143 @@
+#!/bin/bash
+#
+# Warmup Script for Eagle Server
+#
+# This script warms up the JIT compiler before switching traffic to a new instance.
+# It uses the Go warmup tool which:
+# 1. Creates a test game via bidirectional streaming
+# 2. Posts an Improve command
+# 3. Verifies action results and new commands
+# 4. Cleans up the test game
+#
+# Usage: ./warmup-eagle.sh HOST:PORT
+#
+# Example:
+#   ./warmup-eagle.sh localhost:40032
+#   ./warmup-eagle.sh localhost:40034
+#
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+
+HOST="${1:-localhost:40032}"
+
+log_info "Warming up Eagle server at ${HOST}..."
+
+# Try to find the Go warmup tool
+WARMUP_TOOL=""
+
+# Check if we're in the project directory with bazel
+if [ -f "${PROJECT_ROOT}/WORKSPACE" ] || [ -f "${PROJECT_ROOT}/WORKSPACE.bazel" ]; then
+    # Try to find the pre-built binary
+    BAZEL_BIN="${PROJECT_ROOT}/bazel-bin/src/main/go/net/eagle0/warmup/warmup_/warmup"
+    if [ -x "${BAZEL_BIN}" ]; then
+        WARMUP_TOOL="${BAZEL_BIN}"
+    fi
+fi
+
+# Check for the warmup tool in common locations (for deployed environments)
+if [ -z "${WARMUP_TOOL}" ]; then
+    for path in \
+        "${SCRIPT_DIR}/bin/warmup" \
+        "/opt/eagle0/scripts/bin/warmup" \
+        "/opt/eagle0/bin/warmup" \
+        "/usr/local/bin/eagle-warmup" \
+        "${SCRIPT_DIR}/warmup"; do
+        if [ -x "${path}" ]; then
+            WARMUP_TOOL="${path}"
+            break
+        fi
+    done
+fi
+
+# If we found the Go tool, use it
+if [ -n "${WARMUP_TOOL}" ]; then
+    log_info "Using Go warmup tool: ${WARMUP_TOOL}"
+    # Use 5 minute timeout to allow for slow operations on cold JVM
+    if "${WARMUP_TOOL}" --address="${HOST}" --timeout=300s; then
+        log_info "Warmup complete!"
+        exit 0
+    else
+        log_error "Go warmup tool failed"
+        exit 1
+    fi
+fi
+
+# Fallback to grpcurl-based warmup
+log_warn "Go warmup tool not found, falling back to grpcurl"
+
+# Check for grpcurl
+if ! command -v grpcurl &> /dev/null; then
+    log_error "Neither Go warmup tool nor grpcurl is available"
+    log_error "Build the warmup tool with: bazel build //src/main/go/net/eagle0/warmup"
+    log_error "Or install grpcurl: brew install grpcurl (macOS)"
+    exit 1
+fi
+
+# Warmup iterations
+WARMUP_ITERATIONS=3
+
+# 1. Call GetRunningGames multiple times - this exercises the gRPC layer and basic game access
+log_info "Warming up GetRunningGames..."
+for i in $(seq 1 ${WARMUP_ITERATIONS}); do
+    RESULT=$(grpcurl -plaintext -d '{}' "${HOST}" net.eagle0.eagle.api.Eagle/GetRunningGames 2>&1) || true
+    if echo "$RESULT" | grep -q "games\|{}"; then
+        echo -n "."
+    else
+        log_error "GetRunningGames failed on iteration $i"
+        exit 1
+    fi
+done
+echo " done"
+
+# 2. Call GetSettings - exercises settings loading
+log_info "Warming up GetSettings..."
+for i in $(seq 1 ${WARMUP_ITERATIONS}); do
+    if grpcurl -plaintext -d '{}' "${HOST}" net.eagle0.eagle.api.Eagle/GetSettings > /dev/null 2>&1; then
+        echo -n "."
+    else
+        log_warn "GetSettings failed on iteration $i (non-fatal)"
+    fi
+done
+echo " done"
+
+# 3. Call AddSettings with empty list - exercises settings path
+log_info "Warming up AddSettings..."
+for i in $(seq 1 ${WARMUP_ITERATIONS}); do
+    if grpcurl -plaintext -d '{"settings": []}' "${HOST}" net.eagle0.eagle.api.Eagle/AddSettings > /dev/null 2>&1; then
+        echo -n "."
+    else
+        log_warn "AddSettings failed on iteration $i (non-fatal)"
+    fi
+done
+echo " done"
+
+# Final health check
+log_info "Verifying server health..."
+if grpcurl -plaintext -d '{}' "${HOST}" net.eagle0.eagle.api.Eagle/GetRunningGames > /dev/null 2>&1; then
+    log_info "Health check passed"
+else
+    log_error "Health check failed"
+    exit 1
+fi
+
+log_info ""
+log_info "Warmup complete (basic mode - bidirectional streaming warmup not available)!"
+log_info "The JIT should be warmed for:"
+log_info "  - gRPC layer and protobuf parsing"
+log_info "  - Settings loading and management"
+log_info ""
+log_warn "Note: For full warmup including game creation and command processing,"
+log_warn "      build and use the Go warmup tool: bazel build //src/main/go/net/eagle0/warmup"

src/main/cpp/net/eagle0/common/FilesystemUtils.cpp

@@ -26,6 +26,13 @@ namespace fs = std::filesystem;
 static string rLocation;
 
 auto rloc(const string& execPath) -> string {
+    // First check for environment variable override for Docker deployment
+    const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
+    if (resourcesPath != nullptr) {
+        return "";  // Return empty so StaticShardokFilesDirectory uses env var directly
+    }
+
+    // Fall back to Bazel runfiles for development
     string error;
     const std::unique_ptr<Runfiles> runfiles(Runfiles::Create(execPath, &error));
 
@@ -58,10 +65,14 @@ auto FilesystemUtils::FileExistsAtPath(const string& path) -> bool { return fs::
 auto FilesystemUtils::StaticEagle0FilesDirectory() -> string { return "/usr/local/share/eagle0/"; }
 
 auto FilesystemUtils::StaticShardokFilesDirectory() -> string {
+    const char* resourcesPath = getenv("SHARDOK_RESOURCES_PATH");
+    if (resourcesPath != nullptr) { return string(resourcesPath) + "/"; }
     return rLocation + "/src/main/resources/net/eagle0/shardok/";
 }
 
 auto FilesystemUtils::MapFilesDirectory() -> string {
+    const char* mapsPath = getenv("SHARDOK_MAPS_PATH");
+    if (mapsPath != nullptr) { return string(mapsPath) + "/"; }
     return StaticShardokFilesDirectory() + "maps/";
 }
 

src/main/cpp/net/eagle0/common/IterableBitset.hpp

@@ -7,6 +7,7 @@
 
 #include <algorithm>
 #include <bit>
+#include <cstdint>
 #include <cstdlib>
 
 #define ITERABLE_BITSET_INDEX_CHECKS false

src/main/cpp/net/eagle0/common/MapUtils.cpp

@@ -9,6 +9,7 @@
 #include "MapUtils.hpp"
 
 #include <algorithm>
+#include <stdexcept>
 
 static inline std::string StringForKey(
         const std::unordered_map<std::string, std::string>& map,

src/main/cpp/net/eagle0/common/byte_vector.hpp

@@ -9,6 +9,7 @@
 #ifndef byte_vector_h
 #define byte_vector_h
 
+#include <cstdint>
 #include <cstring>
 #include <fstream>
 #include <sstream>

src/main/cpp/net/eagle0/shardok/BUILD.bazel

@@ -14,6 +14,7 @@ cc_library(
         "//src/main/cpp/net/eagle0/shardok/library:engine",
         "//src/main/cpp/net/eagle0/shardok/server:eagle_interface_grpc_server",
         "//src/main/cpp/net/eagle0/shardok/server:server_configuration",
+        "//src/main/cpp/net/eagle0/shardok/server:token_auth",
         "//src/main/protobuf/net/eagle0/common:common_unit_cc_proto",
         "@grpc//:grpc++",
     ],

src/main/cpp/net/eagle0/shardok/ai/AIAttackerStrategySelector.cpp

@@ -107,6 +107,23 @@ auto AIAttackerStrategySelector::BestAttackerStrategy(
                 alCache,
                 battalionTypeGetter,
                 braveWaterCost));
+    } else if (!defenderPositions.empty()) {
+        // Defenders exist but none are on castles - they're scattering/fleeing.
+        // Chase them down rather than holding empty castles, since eliminating
+        // all defenders also wins the battle via LAST_PLAYER_STANDING.
+        chosenStrategy = AttackUnitsStrategy(GenerateTargetPriorities(
+                Occupants(
+                        *gameState->units(),
+                        gameState->hex_map()->row_count(),
+                        gameState->hex_map()->column_count()),
+                gameState->hex_map(),
+                defenderPositions,
+                attackerPid,
+                attackerUnits,
+                apdCache,
+                alCache,
+                battalionTypeGetter,
+                braveWaterCost));
     } else {
         chosenStrategy = HoldCastlesStrategy;
     }

src/main/cpp/net/eagle0/shardok/ai/AIHeuristicWeighting.cpp

@@ -222,7 +222,6 @@ double AIHeuristicWeighting::GetCommandWeight(
         case CommandType::RELEASE_UNIT_COMMAND: return 0.0;
 
         case CommandType::REINFORCE_COMMAND: return 10.0;
-        case CommandType::MANAGE_PRISONER: return 1.0;
 
         // === ZERO WEIGHT - NEVER SELECT (0.0) ===
         // Explicitly bad actions

src/main/cpp/net/eagle0/shardok/ai/AITimeBudget.cpp

@@ -25,7 +25,8 @@ auto CalculateTimeBudget(
         const PlayerId playerId,
         const GameSettingsSPtr &settings,
         const GameStateW &state,
-        const size_t numCommands) -> AITimeBudget {
+        const size_t numCommands,
+        const bool isAllAiBattle) -> AITimeBudget {
     const auto settingsGetter = settings->GetGetter();
     const auto castleCoords = AllCastleCoords(state->hex_map());
 
@@ -34,8 +35,10 @@ auto CalculateTimeBudget(
                               net::eagle0::shardok::storage::fb::GameStatus_::State_SET_UP;
 
     // Get maximum budget cap from settings (in seconds)
+    // For all-AI battles, use the faster budget limit
     const double maxBudgetSeconds =
-            settingsGetter.Backing().lookahead_time_budget_maximum_seconds();
+            isAllAiBattle ? settingsGetter.Backing().all_ai_battle_time_budget_maximum()
+                          : settingsGetter.Backing().lookahead_time_budget_maximum_seconds();
     const double maxBudgetMs = maxBudgetSeconds * 1000.0;
 
     // During setup, use the setup-specific time budget

src/main/cpp/net/eagle0/shardok/ai/AITimeBudget.hpp

@@ -38,11 +38,13 @@ struct AITimeBudget {
 // Calculate time budget based on proximity to enemies and castles
 // Time budget is calculated dynamically based on number of available commands:
 //   budget = msPerCommand × numCommands (clamped to 200-5000ms)
+// If isAllAiBattle is true, uses allAiBattleTimeBudgetMaximum instead of the normal maximum.
 auto CalculateTimeBudget(
         PlayerId playerId,
         const GameSettingsSPtr &settings,
         const GameStateW &state,
-        size_t numCommands) -> AITimeBudget;
+        size_t numCommands,
+        bool isAllAiBattle) -> AITimeBudget;
 
 }  // namespace shardok
 

src/main/cpp/net/eagle0/shardok/ai/AIWaterCrossingCalculator.cpp

@@ -20,8 +20,9 @@ auto UnitIdsRequiringWaterCrossing(
     fb::HexMapW mapCopy = fb::CopyHexMap(gameState->hex_map());
     for (uint32_t index = 0; index < mapCopy->terrain()->size(); index++) {
         if (IsWater(mapCopy->terrain()->Get(index)->type())) continue;
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
+        // const_cast is safe because we own the mutable buffer (mapCopy)
+        const_cast<net::eagle0::shardok::storage::fb::Terrain *>(
+                mapCopy->mutable_terrain()->GetMutableObject(index))
                 ->mutable_modifier()
                 .mutable_fire()
                 .mutate_present(false);
@@ -164,16 +165,11 @@ auto WaterCrossingTiles(
         if (modifier.ice().present() && !modifier.fire().present()) continue;
 
         // Now try adding a bridge to the tile to see if it helps
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_bridge()
-                .mutate_present(true);
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_fire()
-                .mutate_present(false);
+        // const_cast is safe because we own the mutable buffer (mapCopy)
+        auto *terr = const_cast<net::eagle0::shardok::storage::fb::Terrain *>(
+                mapCopy->mutable_terrain()->GetMutableObject(index));
+        terr->mutable_modifier().mutable_bridge().mutate_present(true);
+        terr->mutable_modifier().mutable_fire().mutate_present(false);
 
         auto hash = ActionPointDistancesCache::GetMapId(mapCopy);
 
@@ -183,11 +179,7 @@ auto WaterCrossingTiles(
         }
 
         // Undo the new bridge for the next iteration of the loop
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_bridge()
-                .mutate_present(false);
+        terr->mutable_modifier().mutable_bridge().mutate_present(false);
     }
 
     return returnCoords;

src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.cpp

@@ -53,6 +53,7 @@ auto RoundsRemaining(const GameSettingsSPtr &settings, const GameStateView &gsv)
 ShardokAIClient::ShardokAIClient(
         const PlayerId playerId,
         const bool isDefender,
+        const bool isAllAiBattle,
         const HexMap *hexMap,
         const SettingsGetter &settings,
         const AIAlgorithmType aiAlgorithmType,
@@ -60,6 +61,7 @@ ShardokAIClient::ShardokAIClient(
         const mcts::MCTSConfig &mctsConfig)
     : playerId(playerId),
       isDefender(isDefender),
+      isAllAiBattle(isAllAiBattle),
       aiAlgorithmType(aiAlgorithmType),
       scoringCalculatorType(scoringCalculatorType),
       alCache(std::make_unique<AttackLocationsCache>(hexMap, settings)),
@@ -135,7 +137,8 @@ auto ShardokAIClient::StandardChooseCommandIndex(
     const auto commandCount = guessedCommands->size();
 
     // Calculate time budget based on game situation using new dynamic per-command settings
-    const auto timeBudget = CalculateTimeBudget(playerId, settings, guessedState, commandCount);
+    const auto timeBudget =
+            CalculateTimeBudget(playerId, settings, guessedState, commandCount, isAllAiBattle);
 
     // Configure MCTS based on proximity to enemy
     // When far from enemy: use AVERAGING with maxPlayerFlips=0 (single-player lookahead)

src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.hpp

@@ -41,6 +41,7 @@ class ShardokAIClient {
 private:
     const PlayerId playerId;
     const bool isDefender;
+    const bool isAllAiBattle;  // Whether this battle has only AI players (for faster time budgets)
     const AIAlgorithmType aiAlgorithmType;
     const ScoringCalculatorType scoringCalculatorType;
 
@@ -69,6 +70,7 @@ public:
     explicit ShardokAIClient(
             PlayerId playerId,
             bool isDefender,
+            bool isAllAiBattle,
             const HexMap* hexMap,
             const SettingsGetter& settings,
             AIAlgorithmType aiAlgorithmType,

src/main/cpp/net/eagle0/shardok/ai/TranspositionTable.cpp

@@ -4,6 +4,7 @@
 
 #include "TranspositionTable.hpp"
 
+#include <cinttypes>
 #include <cstdio>
 #include <cstring>
 
@@ -101,10 +102,10 @@ void TranspositionTable::clear() {
 
 void TranspositionTable::printStats() const {
     printf("TranspositionTable Stats:\n");
-    printf("  Probes: %llu\n", stats.probes.load());
-    printf("  Hits: %llu (%.1f%%)\n", stats.hits.load(), stats.hitRate());
-    printf("  Stores: %llu\n", stats.stores.load());
-    printf("  Collisions: %llu\n", stats.collisions.load());
+    printf("  Probes: %" PRIu64 "\n", stats.probes.load());
+    printf("  Hits: %" PRIu64 " (%.1f%%)\n", stats.hits.load(), stats.hitRate());
+    printf("  Stores: %" PRIu64 "\n", stats.stores.load());
+    printf("  Collisions: %" PRIu64 "\n", stats.collisions.load());
     printf("  Table size: %zu entries (%.1f MB)\n",
            TABLE_SIZE,
            (TABLE_SIZE * sizeof(TTEntry)) / (1024.0 * 1024.0));

src/main/cpp/net/eagle0/shardok/ai_battle_simulator/ai_battle_simulator_main.cpp

@@ -10,7 +10,6 @@
 #include "AiBattleConfig.hpp"
 #include "AiBattleSimulator.hpp"
 #include "src/main/cpp/net/eagle0/common/FilesystemUtils.hpp"
-#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 
 using shardok::ai_battle_simulator::AiBattleConfigLoader;
 using shardok::ai_battle_simulator::AiBattleSimulator;
@@ -109,10 +108,6 @@ int main(int argc, char* argv[]) {
     // Set exec path for FilesystemUtils
     FilesystemUtils::SetExecPath(argv[0]);
 
-    // Set cache directory for ActionPointDistances
-    shardok::FixedActionPointDistances::SetCacheDirectory(
-            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
-
     try {
         if (argc < 2) {
             PrintUsage(argv[0]);

src/main/cpp/net/eagle0/shardok/ai_performance_runner/AIPerformanceRunner.cpp

@@ -16,7 +16,6 @@
 #include "src/main/cpp/net/eagle0/shardok/ai_testing_common/AIClientFactory.hpp"
 #include "src/main/cpp/net/eagle0/shardok/ai_testing_common/GamePhaseRunner.hpp"
 #include "src/main/cpp/net/eagle0/shardok/library/ShardokEngine.hpp"
-#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 #include "src/main/protobuf/net/eagle0/shardok/common/command_type.pb.h"
 
 using namespace shardok;
@@ -84,10 +83,6 @@ int main(int argc, char* argv[]) {
     // Set exec path so FilesystemUtils can find resource files
     FilesystemUtils::SetExecPath(argv[0]);
 
-    // Set cache directory for ActionPointDistances
-    FixedActionPointDistances::SetCacheDirectory(
-            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
-
     try {
         std::cout << "Shardok AI Performance Runner\n";
         std::cout << "==============================\n";

src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.cpp

@@ -24,9 +24,6 @@ using std::scoped_lock;
 using std::string;
 using std::unique_lock;
 using std::weak_ptr;
-using std::chrono::duration;
-
-static constexpr duration kWaitForUpdatesDuration = std::chrono::milliseconds(5000);
 
 using net::eagle0::shardok::common::GameStatus;
 
@@ -74,15 +71,21 @@ vector<shared_ptr<ShardokAIClient>> ShardokGameController::MakeAIClients(
     mctsConfig.maxSimulationFlips = 1;
     mctsConfig.simulationPolicy = mcts::MCTSSimulationPolicy::WEIGHTED_HEURISTIC;
 
-    for (const auto &pi : e->GetPlayerInfos()) {
+    // Check if all players are AI - if so, use faster time budgets
+    const auto &playerInfos = e->GetPlayerInfos();
+    const bool isAllAiBattle =
+            std::ranges::all_of(playerInfos, [](const auto &pi) { return pi.is_ai(); });
+
+    for (const auto &pi : playerInfos) {
         if (pi.is_ai()) {
             auto newClient = std::make_shared<ShardokAIClient>(
                     pi.player_id(),
                     pi.is_defender(),
+                    isAllAiBattle,
                     e->GetCurrentGameState()->hex_map(),
                     e->GetGameSettings()->GetGetter(),
                     AIAlgorithmType::ITERATIVE_DEEPENING,
-                    ScoringCalculatorType::MCTS_OPTIMIZED,
+                    ScoringCalculatorType::STANDARD,
                     mctsConfig);
 
             // MCTS config is dynamically adjusted in ShardokAIClient based on proximity:
@@ -278,15 +281,9 @@ auto ShardokGameController::GetUpdates(const int64_t startingActionId) -> AllUpd
         awrs = engine->GetGameHistory(startingActionId);
         incomingRegistrations--;
 
-        // If the current player is an AI, wait for some results to post. Otherwise go ahead and
-        // return, we might be telling the caller about available commands.
-        if (awrs.empty() && !engine->GameIsOver() &&
-            engine->GetPlayerInfos()[engine->GetCurrentPlayerId()].is_ai()) {
-            updateCondition.wait_for(guard, kWaitForUpdatesDuration);
-            incomingRegistrations++;
-            awrs = engine->GetGameHistory(startingActionId);
-            incomingRegistrations--;
-        }
+        // Note: Previously this had a 5-second wait for AI players to support long-polling.
+        // With streaming (WaitForUpdatesAndPush), the caller already waits for updates,
+        // so this wait is no longer needed. GetGameStatus is deprecated in favor of streaming.
 
         updates.mainResults.reserve(awrs.size());
         std::ranges::transform(
@@ -406,12 +403,10 @@ auto ShardokGameController::WaitForUpdatesAndPush(
         }
         // Lock released - GetUpdates will acquire its own lock
 
-        if (gameOver) {
-            subscriber->OnGameOver(gameOverInfo);
-            return true;
-        }
-
-        // Get updates outside the lock (GetUpdates acquires masterLock internally)
+        // IMPORTANT: Send any pending updates FIRST, including the final actions
+        // that caused the game to end. Previously, we returned early on gameOver
+        // without sending these final updates, causing the client to never see
+        // the last few battle actions.
         AllUpdates updates = GetUpdates(lastPushedActionId);
         lastPushedActionId = updates.newUnfilteredCount;
 
@@ -422,6 +417,12 @@ auto ShardokGameController::WaitForUpdatesAndPush(
                     updates.newUnfilteredCount,
                     updates.currentGameState);
         }
+
+        // Now send gameOver notification after all updates have been sent
+        if (gameOver) {
+            subscriber->OnGameOver(gameOverInfo);
+            return true;
+        }
     }
 
     return false;  // Subscriber disconnected

src/main/cpp/net/eagle0/shardok/library/action_point_distances/ActionPointDistancesCache.cpp

@@ -29,8 +29,6 @@ thread_local struct {
     int localMisses = 0;
     int sharedAccesses = 0;
     int evictionEvents = 0;
-    int apdLoadedFromFile = 0;
-    int apdGeneratedFresh = 0;
     std::chrono::steady_clock::time_point lastReportTime = std::chrono::steady_clock::now();
 } cacheStats;
 
@@ -40,16 +38,13 @@ static void MaybePrintCacheStats() {
     if (std::chrono::duration_cast<std::chrono::seconds>(now - cacheStats.lastReportTime).count() >=
         CACHE_STATS_FREQUENCY_SECONDS_) {
         printf("Thread cache stats: %d persistent hits, %d persistent misses, %d local hits, "
-               "%d local misses, %d shared accesses, %d eviction events, "
-               "%d APD loaded from file, %d APD generated fresh\n",
+               "%d local misses, %d shared accesses, %d eviction events\n",
                cacheStats.persistentHits,
                cacheStats.persistentMisses,
                cacheStats.localHits,
                cacheStats.localMisses,
                cacheStats.sharedAccesses,
-               cacheStats.evictionEvents,
-               cacheStats.apdLoadedFromFile,
-               cacheStats.apdGeneratedFresh);
+               cacheStats.evictionEvents);
         cacheStats.lastReportTime = now;
     }
 }
@@ -81,11 +76,13 @@ static auto CreateIceClearedMap(const HexMap* map) -> fb::HexMapW {
 
     // Now modify the ice on the mutable copy
     auto* mutableMap = mapCopy.Get();
-    const auto* terrainVec = mutableMap->mutable_terrain();
+    auto* terrainVec = mutableMap->mutable_terrain();
 
     for (size_t i = 0; i < terrainVec->size(); i++) {
         // Only process tiles with ice
-        if (auto* terrain = terrainVec->GetMutableObject(i); terrain->modifier().ice().present()) {
+        // const_cast is safe here because we own the mutable buffer (mapCopy)
+        if (auto* terrain = const_cast<Terrain*>(terrainVec->GetMutableObject(i));
+            terrain->modifier().ice().present()) {
             terrain->mutable_modifier().mutable_ice().mutate_present(false);
             terrain->mutable_modifier().mutable_ice().mutate_integrity(0.0f);
         }
@@ -195,25 +192,12 @@ auto ActionPointDistancesCache::GetRaw(
     }
 
     // Create new pathfinding result using factory method
-    auto creationResult = FixedActionPointDistances::Create(
+    auto result = FixedActionPointDistances::Create(
             mapToUse,
-            mapId.terrainTypesId,
-            mapId.modifierId,
             battalionType,
             includeBravingWater,
             braveWaterActionPointCost);
 
-#if CACHE_STATS_LOGGING_
-    // Track whether this was loaded from file or generated fresh
-    if (creationResult.loadedFromFile) {
-        cacheStats.apdLoadedFromFile++;
-    } else {
-        cacheStats.apdGeneratedFresh++;
-    }
-#endif
-
-    auto result = creationResult.apd;
-
     // Store in shared cache
     sharedDistances.lazy_emplace_l(
             cacheKey,

src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.cpp

@@ -22,110 +22,56 @@ static const int ASYNC_COUNT = []() {
 
 namespace shardok {
 
-void FixedActionPointDistances::SetCacheDirectory(const string& newDir) {
-    cacheDirectory = newDir;
-    FilesystemUtils::MakeDirectoryIfNecessary(cacheDirectory);
-}
-
-static thread_local byte_vector _scratch;
-
 FixedActionPointDistances::FixedActionPointDistances(const HexMap* /*map*/, int columnCount)
     : ActionPointDistances(columnCount) {}
 
 auto FixedActionPointDistances::Create(
         const HexMap* map,
-        int64_t terrainTypesHash,
-        int64_t modifierHash,
         const BattalionTypeSPtr& battalionType,
         bool includeBravingWater,
-        int braveWaterActionPointCost) -> CreationResult {
+        int braveWaterActionPointCost) -> std::shared_ptr<FixedActionPointDistances> {
     // Create the object using private constructor
     auto apd = std::shared_ptr<FixedActionPointDistances>(
             new FixedActionPointDistances(map, map->column_count()));
 
-    CreationResult result;
-    result.apd = apd;
-    result.loadedFromFile = false;
-
-    string path = "";
-
-    if (!cacheDirectory.empty()) {
-        std::stringstream stream;
-        stream << cacheDirectory;
-        stream << std::hex << terrainTypesHash << '/';
-
-        if (auto directoryPath = stream.str(); !FilesystemUtils::FileExistsAtPath(directoryPath)) {
-            FilesystemUtils::MakeDirectoryIfNecessary(stream.str());
-        }
-
-        stream << std::hex << modifierHash;
-        stream << " " << battalionType->typeId;
-        if (includeBravingWater) { stream << " " << braveWaterActionPointCost; }
-        stream << ".apd";
-        path = stream.str();
-    }
-
     const int indexCount = map->row_count() * map->column_count();
 
-    if (!path.empty() && FilesystemUtils::FileExistsAtPath(path)) {
-        apd->distances.resize(indexCount);
-        // load from file
-        const auto& bytes = _scratch.ReplaceWithPath(path);
-        const auto* ptr = reinterpret_cast<const DIST_T*>(bytes.data());
+    vector<std::future<vector<vector<DIST_T>>>> futures(indexCount);
 
-        for (int fromIndex = 0; fromIndex < indexCount; fromIndex++) {
-            apd->distances[fromIndex].insert(
-                    apd->distances[fromIndex].end(),
-                    &(ptr[0]),
-                    &(ptr[indexCount]));
-            ptr += indexCount;
-        }
-        result.loadedFromFile = true;
-    } else {
-        _scratch.reserve(indexCount * indexCount * sizeof(DIST_T));
+    auto braveWaterPossibleCoords =
+            includeBravingWater ? apd->BraveWaterPossibleCoords(map) : nullptr;
 
-        vector<std::future<vector<vector<DIST_T>>>> futures(indexCount);
+    int chunkSize = (indexCount + ASYNC_COUNT - 1) / ASYNC_COUNT;
+    // Break into chunks for async
+    for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
+        futures[chunkIdx] = std::async(std::launch::async, [=]() -> vector<vector<DIST_T>> {
+            vector<vector<DIST_T>> chunkVec;
+            chunkVec.reserve(chunkSize);
+            const int chunkStartIndex = chunkIdx * chunkSize;
 
-        auto braveWaterPossibleCoords =
-                includeBravingWater ? apd->BraveWaterPossibleCoords(map) : nullptr;
-
-        int chunkSize = (indexCount + ASYNC_COUNT - 1) / ASYNC_COUNT;
-        // Break into chunks for async
-        for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
-            futures[chunkIdx] = std::async(std::launch::async, [=]() -> vector<vector<DIST_T>> {
-                vector<vector<DIST_T>> chunkVec;
-                chunkVec.reserve(chunkSize);
-                const int chunkStartIndex = chunkIdx * chunkSize;
-
-                for (int i = 0; i < chunkSize; i++) {
-                    const auto fromIndex = chunkStartIndex + i;
-                    if (fromIndex >= indexCount) { continue; }
-                    chunkVec.push_back(ActionPointDistances::GenerateDistances(
-                            fromIndex,
-                            map,
-                            includeBravingWater,
-                            braveWaterActionPointCost,
-                            battalionType,
-                            braveWaterPossibleCoords));
-                }
-                return chunkVec;
-            });
-        }
-
-        apd->distances.reserve(indexCount);
-        _scratch.clear();
-        _scratch.reserve(indexCount * indexCount * sizeof(DIST_T));
-
-        for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
-            auto resultsVec = futures[chunkIdx].get();
-            apd->distances.insert(apd->distances.end(), resultsVec.begin(), resultsVec.end());
-            for (const auto& r : resultsVec) { _scratch.append(r); }
-        }
-
-        if (!path.empty()) { FilesystemUtils::AtomicallySaveToPath(path, _scratch); }
+            for (int i = 0; i < chunkSize; i++) {
+                const auto fromIndex = chunkStartIndex + i;
+                if (fromIndex >= indexCount) { continue; }
+                chunkVec.push_back(ActionPointDistances::GenerateDistances(
+                        fromIndex,
+                        map,
+                        includeBravingWater,
+                        braveWaterActionPointCost,
+                        battalionType,
+                        braveWaterPossibleCoords));
+            }
+            return chunkVec;
+        });
     }
 
-    return result;
+    apd->distances.reserve(indexCount);
+
+    for (int chunkIdx = 0; chunkIdx < ASYNC_COUNT; chunkIdx++) {
+        auto resultsVec = futures[chunkIdx].get();
+        apd->distances.insert(apd->distances.end(), resultsVec.begin(), resultsVec.end());
+    }
+
+    return apd;
 }
 
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp

@@ -17,31 +17,19 @@ using std::vector;
 using BattalionTypeSPtr = std::shared_ptr<const BattalionType>;
 
 class FixedActionPointDistances final : public ActionPointDistances {
-public:
-    struct CreationResult {
-        std::shared_ptr<FixedActionPointDistances> apd;
-        bool loadedFromFile;
-    };
-
 private:
     vector<vector<DIST_T>> distances;
 
-    inline static string cacheDirectory = "";
-
     // Private constructor - use Create factory method instead
     explicit FixedActionPointDistances(const HexMap *map, int columnCount);
 
 public:
-    static void SetCacheDirectory(const string &newDir);
-
-    // Factory method to create FixedActionPointDistances with metadata
+    // Factory method to create FixedActionPointDistances
     static auto Create(
             const HexMap *map,
-            int64_t terrainTypesHash,
-            int64_t modifierHash,
             const BattalionTypeSPtr &battalionType,
             bool includeBravingWater,
-            int braveWaterActionPointCost = -1) -> CreationResult;
+            int braveWaterActionPointCost = -1) -> std::shared_ptr<FixedActionPointDistances>;
 
     ~FixedActionPointDistances() override = default;
 
@@ -52,8 +40,6 @@ public:
     [[nodiscard]] auto Distance(const Coords &from, const Coords &to) const -> DIST_T override {
         return Distance(ToIndex(from), ToIndex(to));
     }
-
-    friend struct CreationResult;
 };
 
 }  // namespace shardok

src/main/cpp/net/eagle0/shardok/library/action_result_applier/ActionResultApplier.cpp

@@ -22,6 +22,13 @@ using std::unique_ptr;
 using ResolvedUnitProto = net::eagle0::shardok::storage::ResolvedUnit;
 using GameState = net::eagle0::shardok::storage::fb::GameState;
 using GameStateT = net::eagle0::shardok::storage::fb::GameStateT;
+using Unit = net::eagle0::shardok::storage::fb::Unit;
+
+// Helper to get a mutable unit from the units vector.
+// const_cast is safe because we're accessing through a mutable GameState pointer.
+inline auto GetMutableUnit(GameState *state, UnitId unitId) -> Unit * {
+    return const_cast<Unit *>(state->mutable_units()->GetMutableObject(unitId));
+}
 using net::eagle0::shardok::storage::fb::DrawType;
 using net::eagle0::shardok::storage::fb::VictoryCondition;
 using net::eagle0::shardok::storage::fb::VictoryType;
@@ -37,7 +44,7 @@ void ApplyResolvedUnit(
     if (unit.has_attached_hero() &&
         unit.attached_hero().control_info().controlled_unit_id() != -1) {
         const UnitId controlledUnitId = unit.attached_hero().control_info().controlled_unit_id();
-        auto *controlledUnit = inoutState->mutable_units()->GetMutableObject(controlledUnitId);
+        auto *controlledUnit = GetMutableUnit(inoutState, controlledUnitId);
         internalAssert(controlledUnit->unit_id() == controlledUnitId);
         internalAssert(controlledUnit->commanding_unit_id() == unitId);
         controlledUnit->mutate_commanding_unit_id(-1);
@@ -47,7 +54,7 @@ void ApplyResolvedUnit(
     if (unit.commanding_unit_id() != -1) {
         const UnitId commandingUnitId = unit.commanding_unit_id();
 
-        auto *commandingUnit = inoutState->mutable_units()->GetMutableObject(commandingUnitId);
+        auto *commandingUnit = GetMutableUnit(inoutState, commandingUnitId);
         internalAssert(commandingUnit->unit_id() == commandingUnitId);
         internalAssert(
                 commandingUnit->attached_hero().control_info().controlled_unit_id() == unitId);
@@ -58,7 +65,7 @@ void ApplyResolvedUnit(
     if (status == net::eagle0::shardok::storage::fb::UnitStatus_CAPTURED_UNIT &&
         unit.has_attached_hero() && unit.attached_hero().is_vip()) {
         for (uint32_t i = 0; i < inoutState->units()->size(); i++) {
-            auto *playerUnit = inoutState->mutable_units()->GetMutableObject(i);
+            auto *playerUnit = GetMutableUnit(inoutState, i);
             if (playerUnit->player_id() != unit.player_id()) continue;
             if (playerUnit->unit_id() == unit.unit_id()) continue;
 
@@ -70,7 +77,7 @@ void ApplyResolvedUnit(
         }
     }
 
-    inoutState->mutable_units()->GetMutableObject(unitId)->mutate_status(status);
+    GetMutableUnit(inoutState, unitId)->mutate_status(status);
 }
 
 void ApplyResolvedUnit(
@@ -189,7 +196,7 @@ void MutatingAddUnits(GameStateW &mutatingState, const ActionResultProto &result
         // We only need to process the units that are being changed
         for (const auto &unitBytes : result.changed_units_fb()) {
             const auto *unit = (Unit *)unitBytes.data();
-            auto *mutableUnit = mutatingState->mutable_units()->GetMutableObject(unit->unit_id());
+            auto *mutableUnit = GetMutableUnit(mutatingState.Get(), unit->unit_id());
             if (mutableUnit->status() ==
                 net::eagle0::shardok::storage::fb::UnitStatus_RESERVED_SLOT) {
                 // Convert this reserved slot to a real unit
@@ -340,7 +347,7 @@ void MutatingApplyResult(
         }
 
         // Capture old position before applying changes
-        auto *mutableUnit = mutatingGameState->units()->GetMutableObject(changedUnit->unit_id());
+        auto *mutableUnit = GetMutableUnit(mutatingGameState.Get(), changedUnit->unit_id());
         const auto oldLocation = mutableUnit->location();
 
         fb::ApplyUnit(mutableUnit, changedUnit, status);

src/main/cpp/net/eagle0/shardok/library/commands/MoveCommand.cpp

@@ -191,6 +191,7 @@ auto MoveCommand::GetCommandProto() const -> CommandProto {
     proto.mutable_action_points()->set_value(pointCost);
     proto.mutable_actor()->set_value(moverId);
     *proto.mutable_target() = ToCoordsProto(interimTargets.back());
+    for (const auto& coords : interimTargets) { *proto.add_path() = ToCoordsProto(coords); }
     for (const auto& fup : followUpCommandTypes) { proto.add_follow_up_command_types(fup); }
     proto.set_will_unhide(willUnhide);
 

src/main/cpp/net/eagle0/shardok/library/util/HexMapUtils.cpp

@@ -64,8 +64,16 @@ auto GetTerrain(const HexMap *map, const Coords &coords) -> const Terrain * {
     return map->terrain()->Get(coords.row() * map->column_count() + coords.column());
 }
 
+auto GetMutableTerrain(HexMap *map, const Coords &coords) -> Terrain * {
+    // const_cast is safe because we're accessing through a mutable HexMap pointer
+    return const_cast<Terrain *>(map->mutable_terrain()->GetMutableObject(
+            coords.row() * map->column_count() + coords.column()));
+}
+
 auto GetMutableTerrain(const HexMap *map, const Coords &coords) -> Terrain * {
-    return map->terrain()->GetMutableObject(coords.row() * map->column_count() + coords.column());
+    // const_cast is safe when the underlying buffer is known to be mutable
+    return const_cast<Terrain *>(
+            map->terrain()->Get(coords.row() * map->column_count() + coords.column()));
 }
 
 auto HasForestAccess(
@@ -597,7 +605,9 @@ void MutatingSetTileModifier(
         const int row,
         const int column,
         const TileModifierProto &TileModifierProto) {
-    auto *terr = hexMap->mutable_terrain()->GetMutableObject(row * hexMap->column_count() + column);
+    // const_cast is safe because we're accessing through a mutable HexMap pointer
+    auto *terr = const_cast<Terrain *>(
+            hexMap->mutable_terrain()->GetMutableObject(row * hexMap->column_count() + column));
 
     if (TileModifierProto.has_bridge()) {
         terr->mutable_modifier().mutable_bridge().mutate_present(true);

src/main/cpp/net/eagle0/shardok/library/util/HexMapUtils.hpp

@@ -82,6 +82,9 @@ auto HasForestAccess(
         PlayerId player) -> bool;
 
 auto GetTerrain(const HexMap *map, const Coords &coords) -> const Terrain *;
+auto GetMutableTerrain(HexMap *map, const Coords &coords) -> Terrain *;
+// Overload for const HexMap - uses const_cast internally. Safe when the underlying buffer is
+// mutable.
 auto GetMutableTerrain(const HexMap *map, const Coords &coords) -> Terrain *;
 
 auto CoordsAreValid(const HexMap *map, const Coords &coords) -> bool;

src/main/cpp/net/eagle0/shardok/library/view_filters/GameStateGuesser.cpp

@@ -29,6 +29,13 @@ using UnitViewProto = net::eagle0::shardok::api::UnitView;
 
 using Coords = net::eagle0::shardok::storage::fb::Coords;
 using Unit = net::eagle0::shardok::storage::fb::Unit;
+using GameState = net::eagle0::shardok::storage::fb::GameState;
+
+// Helper to get a mutable unit from the units vector.
+// const_cast is safe because we're accessing through a mutable GameState pointer.
+inline auto GetMutableUnit(GameState *state, UnitId unitId) -> Unit * {
+    return const_cast<Unit *>(state->mutable_units()->GetMutableObject(unitId));
+}
 
 constexpr int8_t kGuessedHeroStat = 75;
 constexpr int8_t kGuessedBattalionStat = 0;
@@ -412,16 +419,13 @@ auto GameStateGuesser::GuessedState(
         if (unit->has_attached_hero()) {
             UnitId controlledUnitId = unit->attached_hero().control_info().controlled_unit_id();
             if (controlledUnitId != -1) {
-                gsw->mutable_units()
-                        ->GetMutableObject(controlledUnitId)
-                        ->mutate_commanding_unit_id(unitId);
+                GetMutableUnit(gsw.Get(), controlledUnitId)->mutate_commanding_unit_id(unitId);
             }
         }
 
         UnitId commandingUnitId = unit->commanding_unit_id();
         if (unit->commanding_unit_id() != -1) {
-            gsw->mutable_units()
-                    ->GetMutableObject(commandingUnitId)
+            GetMutableUnit(gsw.Get(), commandingUnitId)
                     ->mutable_attached_hero()
                     .mutable_control_info()
                     .mutate_controlled_unit_id(unitId);

src/main/cpp/net/eagle0/shardok/server/BUILD.bazel

@@ -34,6 +34,17 @@ cc_library(
     ],
 )
 
+cc_library(
+    name = "token_auth",
+    hdrs = ["TokenAuthInterceptor.hpp"],
+    copts = COPTS,
+    visibility = ["//src/main/cpp/net/eagle0/shardok:__subpackages__"],
+    deps = [
+        "//src/main/cpp/net/eagle0/common:protobuf_warning_suppression",
+        "@grpc//:grpc++",
+    ],
+)
+
 cc_library(
     name = "eagle_interface_grpc_server",
     srcs = ["EagleInterfaceGrpcServer.cpp"],
@@ -42,6 +53,7 @@ cc_library(
     visibility = ["//src/main/cpp/net/eagle0/shardok:__subpackages__"],
     deps = [
         ":games_manager",
+        ":token_auth",
         "//src/main/cpp/net/eagle0/common:unit_conversions",
         "//src/main/protobuf/net/eagle0/common:shardok_internal_interface_cc_grpc",
         "//src/main/protobuf/net/eagle0/common:victory_condition_cc_proto",

src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.cpp

@@ -81,8 +81,17 @@ static auto FromInternalStatus(
 
 const std::string &kShardokGameRequestExtension = *(new string(".e0gr"));
 
-EagleInterfaceImpl::EagleInterfaceImpl(shared_ptr<ShardokGamesManager> manager)
-    : gamesManager(std::move(manager)) {}
+EagleInterfaceImpl::EagleInterfaceImpl(
+        shared_ptr<ShardokGamesManager> manager,
+        std::string authToken)
+    : gamesManager(std::move(manager)),
+      tokenValidator_(std::move(authToken)) {
+    if (tokenValidator_.IsEnabled()) {
+        std::cout << "Token authentication enabled" << std::endl;
+    } else {
+        std::cout << "Token authentication disabled (no token configured)" << std::endl;
+    }
+}
 
 auto ConvertPlayerInfo(
         const google::protobuf::RepeatedPtrField<net::eagle0::common::PlayerSetupInfo> &allPis,
@@ -188,9 +197,12 @@ void EagleInterfaceImpl::StartGame(const NewGameRequest &request) {
 }
 
 auto EagleInterfaceImpl::PostCommand(
-        ServerContext * /*context*/,
+        ServerContext *context,
         const PostCommandRequest *request,
         GameStatusResponse *response) -> Status {
+    // Validate auth token
+    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
+
     shared_ptr<ShardokGameController> controller;
     try {
         controller = ControllerForGame(request->game_id(), request->game_setup_info());
@@ -229,9 +241,12 @@ auto EagleInterfaceImpl::PostCommand(
 }
 
 auto EagleInterfaceImpl::PostPlacementCommands(
-        ServerContext * /*context*/,
+        ServerContext *context,
         const PlacementCommandsRequest *request,
         GameStatusResponse *response) -> Status {
+    // Validate auth token
+    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
+
     shared_ptr<ShardokGameController> controller;
     try {
         controller = ControllerForGame(request->game_id(), request->game_setup_info());
@@ -322,27 +337,13 @@ void EagleInterfaceImpl::PopulateGameStatusResponse(
     }
 }
 
-auto EagleInterfaceImpl::GetGameStatus(
-        ServerContext * /*context*/,
-        const GameStatusRequest *request,
-        GameStatusResponse *response) -> Status {
-    shared_ptr<ShardokGameController> controller;
-    try {
-        controller = ControllerForGame(request->game_id(), request->game_setup_info());
-    } catch (NewGameException &e) { return e.GetStatus(); }
-
-    PopulateGameStatusResponse(
-            controller,
-            request->game_setup_info().known_result_count(),
-            response);
-
-    return Status::OK;
-}
-
 auto EagleInterfaceImpl::GetHexMap(
-        ServerContext * /*context*/,
+        ServerContext *context,
         const HexMapRequest *request,
         HexMapResponse *response) -> Status {
+    // Validate auth token
+    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
+
     // TODO: return appropriate status code if a bad map name is sent
     *response->mutable_map() = LoadMap(request->map_name());
 
@@ -350,9 +351,12 @@ auto EagleInterfaceImpl::GetHexMap(
 }
 
 auto EagleInterfaceImpl::GetHexMapNames(
-        ServerContext * /*context*/,
+        ServerContext *context,
         const HexMapNamesRequest * /*request*/,
         HexMapNamesResponse *response) -> Status {
+    // Validate auth token
+    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
+
     for (const string &mapName : GetMapNames()) { response->add_map_names(mapName); }
 
     return Status::OK;
@@ -533,6 +537,9 @@ auto EagleInterfaceImpl::SubscribeToGame(
         ServerContext *context,
         const GameSubscriptionRequest *request,
         grpc::ServerWriter<GameStatusResponse> *writer) -> Status {
+    // Validate auth token
+    if (auto authStatus = tokenValidator_.ValidateOrStatus(context)) { return *authStatus; }
+
     shared_ptr<ShardokGameController> controller;
     try {
         controller = ControllerForGame(request->game_id(), request->game_setup_info());

src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.hpp

@@ -13,8 +13,9 @@
 #include <string>
 #include <thread>
 
-#include "ShardokGamesManager.hpp"
 #include "src/main/cpp/net/eagle0/common/ProtobufWarningSuppression.hpp"
+#include "src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.hpp"
+#include "src/main/cpp/net/eagle0/shardok/server/TokenAuthInterceptor.hpp"
 #pragma GCC diagnostic push
 SUPPRESS_PROTOBUF_WARNINGS
 #include <grpc/grpc.h>
@@ -31,7 +32,6 @@ namespace shardok {
 using grpc::ServerContext;
 using grpc::Status;
 using net::eagle0::common::GameSetupInfo;
-using net::eagle0::common::GameStatusRequest;
 using net::eagle0::common::GameStatusResponse;
 using net::eagle0::common::GameSubscriptionRequest;
 using net::eagle0::common::HexMapNamesRequest;
@@ -47,6 +47,7 @@ using std::shared_ptr;
 class EagleInterfaceImpl final : public ShardokInternalInterface::Service {
 private:
     std::shared_ptr<ShardokGamesManager> gamesManager;
+    TokenValidator tokenValidator_;
 
     auto ControllerForGame(const GameId& gameId, const GameSetupInfo& setupInfo)
             -> std::shared_ptr<ShardokGameController>;
@@ -58,7 +59,14 @@ private:
             GameStatusResponse* response);
 
 public:
-    explicit EagleInterfaceImpl(std::shared_ptr<ShardokGamesManager> manager);
+    /**
+     * Create the service.
+     *
+     * @param manager Games manager
+     * @param authToken Optional auth token. If non-empty, all requests must include
+     *                  "authorization: Bearer <token>" metadata.
+     */
+    EagleInterfaceImpl(std::shared_ptr<ShardokGamesManager> manager, std::string authToken = "");
 
     auto PostCommand(
             ServerContext* context,
@@ -68,10 +76,6 @@ public:
             ServerContext* context,
             const PlacementCommandsRequest* request,
             GameStatusResponse* response) -> Status override;
-    auto GetGameStatus(
-            ServerContext* context,
-            const GameStatusRequest* request,
-            GameStatusResponse* response) -> Status override;
 
     auto GetHexMap(ServerContext* context, const HexMapRequest* request, HexMapResponse* response)
             -> Status override;

src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.cpp

@@ -8,6 +8,7 @@
 
 #include "ServerConfiguration.hpp"
 
+#include <cstdlib>
 #include <cstring>
 #include <fstream>
 #include <iostream>
@@ -23,6 +24,7 @@ const string ServerConfiguration::kEagleInterfaceGrpcAddress = "eagleInterfaceGr
 const string ServerConfiguration::kEagleGrpcAddress = "eagleGrpcAddress";
 const string ServerConfiguration::kSslCertPath = "sslCertPath";
 const string ServerConfiguration::kSslPrivateKeyPath = "sslPrivateKeyPath";
+const string ServerConfiguration::kAuthTokenPath = "authTokenPath";
 #pragma GCC diagnostic pop
 
 using std::unordered_map;
@@ -30,9 +32,16 @@ using std::unordered_map;
 unordered_map<string, string> DefaultValues();
 
 unordered_map<string, string> DefaultValues() {
+    // Check environment variables for Docker deployment
+    // Docker containers should set SHARDOK_EAGLE_INTERFACE_ADDRESS=0.0.0.0:40042
+    // to listen on all interfaces for container networking
+    const char* eagleInterfaceAddr = getenv("SHARDOK_EAGLE_INTERFACE_ADDRESS");
+    const char* shardokAddr = getenv("SHARDOK_GRPC_ADDRESS");
+
     return unordered_map<string, string>{
-            {ServerConfiguration::kShardokGrpcAddress, "localhost"},
-            {ServerConfiguration::kEagleInterfaceGrpcAddress, "localhost"}};
+            {ServerConfiguration::kShardokGrpcAddress, shardokAddr ? shardokAddr : "localhost"},
+            {ServerConfiguration::kEagleInterfaceGrpcAddress,
+             eagleInterfaceAddr ? eagleInterfaceAddr : "localhost:40042"}};
 }
 
 ServerConfiguration::ServerConfiguration(const string& filePath) {

src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.hpp

@@ -29,6 +29,7 @@ public:
     const static string kEagleGrpcAddress;
     const static string kSslCertPath;
     const static string kSslPrivateKeyPath;
+    const static string kAuthTokenPath;
 };
 
 #endif /* ServerConfiguration_hpp */

src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.cpp

@@ -15,7 +15,6 @@
 #include "ServerConfiguration.hpp"
 #include "src/main/cpp/net/eagle0/shardok/ai/ShardokAIClient.hpp"
 #include "src/main/cpp/net/eagle0/shardok/controller/ShardokGameController.hpp"
-#include "src/main/cpp/net/eagle0/shardok/library/action_point_distances/FixedActionPointDistances.hpp"
 #include "src/main/cpp/net/eagle0/shardok/library/settings_loader/SettingsLoader.hpp"
 #include "src/main/cpp/net/eagle0/shardok/util/MapLoader.hpp"
 #include "src/main/flatbuffer/net/eagle0/shardok/storage/unit.hpp"
@@ -45,9 +44,6 @@ ShardokGamesManager::ShardokGamesManager(const std::vector<std::string> &extraSe
         std::cerr << "NOT SETTING" << std::endl;
         //        setter.SetRaw(key, value);
     }
-
-    FixedActionPointDistances::SetCacheDirectory(
-            FilesystemUtils::CacheFilesDirectory() + "apdCache/");
 }
 
 auto ShardokGamesManager::GetController(const GameId &gameId)

src/main/cpp/net/eagle0/shardok/server/TokenAuthInterceptor.hpp

@@ -0,0 +1,119 @@
+//
+//  TokenAuthInterceptor.hpp
+//  eagle0
+//
+//  Token-based authentication for gRPC.
+//  Validates Bearer tokens in the 'authorization' metadata header.
+//
+
+#ifndef TokenAuthInterceptor_hpp
+#define TokenAuthInterceptor_hpp
+
+#include <fstream>
+#include <iostream>
+#include <optional>
+#include <sstream>
+#include <string>
+
+#include "src/main/cpp/net/eagle0/common/ProtobufWarningSuppression.hpp"
+#pragma GCC diagnostic push
+SUPPRESS_PROTOBUF_WARNINGS
+#include <grpcpp/server_context.h>
+#include <grpcpp/support/status.h>
+#pragma GCC diagnostic pop
+
+namespace shardok {
+
+/**
+ * Validates Bearer tokens in gRPC request metadata.
+ *
+ * Usage:
+ *   TokenValidator validator(expectedToken);
+ *   if (!validator.Validate(context)) {
+ *       return grpc::Status(grpc::UNAUTHENTICATED, "Invalid token");
+ *   }
+ */
+class TokenValidator {
+public:
+    /**
+     * Create a validator with the expected token.
+     * If expectedToken is empty, all requests are allowed (no auth required).
+     */
+    explicit TokenValidator(std::string expectedToken) : expectedToken_(std::move(expectedToken)) {}
+
+    /**
+     * Validate the authorization header in the server context.
+     *
+     * Expects: "authorization" metadata with value "Bearer <token>"
+     *
+     * @return true if valid (or no auth configured), false otherwise
+     */
+    [[nodiscard]] auto Validate(grpc::ServerContext* context) const -> bool {
+        // If no auth token is configured, allow all requests
+        if (expectedToken_.empty()) { return true; }
+
+        const auto& metadata = context->client_metadata();
+        auto it = metadata.find("authorization");
+        if (it == metadata.end()) {
+            std::cerr << "Auth failed: no authorization header" << std::endl;
+            return false;
+        }
+
+        std::string authHeader(it->second.begin(), it->second.end());
+        std::string expectedHeader = "Bearer " + expectedToken_;
+
+        if (authHeader != expectedHeader) {
+            std::cerr << "Auth failed: invalid token" << std::endl;
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Validate and return appropriate Status.
+     *
+     * @return std::nullopt if valid, Status(UNAUTHENTICATED) if invalid
+     */
+    [[nodiscard]] auto ValidateOrStatus(grpc::ServerContext* context) const
+            -> std::optional<grpc::Status> {
+        if (Validate(context)) { return std::nullopt; }
+        return grpc::Status(grpc::UNAUTHENTICATED, "Invalid or missing authentication token");
+    }
+
+    /**
+     * Check if authentication is enabled.
+     */
+    [[nodiscard]] auto IsEnabled() const -> bool { return !expectedToken_.empty(); }
+
+private:
+    std::string expectedToken_;
+};
+
+/**
+ * Read auth token from a file, stripping whitespace.
+ * Returns empty string if file doesn't exist or is empty.
+ */
+inline auto ReadAuthTokenFromFile(const std::string& filePath) -> std::string {
+    if (filePath.empty()) { return ""; }
+
+    std::ifstream file(filePath);
+    if (!file.is_open()) {
+        std::cerr << "Warning: Could not open auth token file: " << filePath << std::endl;
+        return "";
+    }
+
+    std::stringstream buffer;
+    buffer << file.rdbuf();
+    std::string token = buffer.str();
+
+    // Trim whitespace
+    auto start = token.find_first_not_of(" \t\n\r");
+    if (start == std::string::npos) { return ""; }
+    auto end = token.find_last_not_of(" \t\n\r");
+    return token.substr(start, end - start + 1);
+}
+
+}  // namespace shardok
+
+#endif /* TokenAuthInterceptor_hpp */

src/main/cpp/net/eagle0/shardok/shardok_server_main.cpp

@@ -7,7 +7,9 @@
 //
 
 #include <cstddef>
+#include <fstream>
 #include <memory>
+#include <sstream>
 #include <thread>
 
 #include "src/main/cpp/net/eagle0/common/ProtobufWarningSuppression.hpp"
@@ -17,14 +19,16 @@ SUPPRESS_PROTOBUF_WARNINGS
 
 #include <execinfo.h>
 #include <grpcpp/channel.h>
+#include <grpcpp/security/server_credentials.h>
 #include <signal.h>
 #include <unistd.h>
 
 #pragma GCC diagnostic pop
 
-#include "server/EagleInterfaceGrpcServer.hpp"
-#include "server/ServerConfiguration.hpp"
-#include "server/ShardokGamesManager.hpp"
+#include "src/main/cpp/net/eagle0/shardok/server/EagleInterfaceGrpcServer.hpp"
+#include "src/main/cpp/net/eagle0/shardok/server/ServerConfiguration.hpp"
+#include "src/main/cpp/net/eagle0/shardok/server/ShardokGamesManager.hpp"
+#include "src/main/cpp/net/eagle0/shardok/server/TokenAuthInterceptor.hpp"
 
 using ::GameStatePersister;
 using shardok::EagleInterfaceImpl;
@@ -41,12 +45,15 @@ struct ServerThreadInfo {
 
 auto StartInThread(grpc::ServerBuilder *serverBuilder) -> ServerThreadInfo;
 
-auto CreateServerBuilder(const string &serverAddress) -> grpc::ServerBuilder *;
+auto CreateServerBuilder(const string &serverAddress, const string &certPath, const string &keyPath)
+        -> grpc::ServerBuilder *;
 
 auto CreateEagleInterfaceService(
         const std::shared_ptr<ServerConfiguration> &config,
         std::shared_ptr<ShardokGamesManager> shardokGamesManager) -> ServerThreadInfo;
 
+auto ReadFileContents(const string &path) -> string;
+
 void handler(const int sig) {
     void *array[10];
     size_t size;
@@ -82,11 +89,46 @@ auto main(const int argc, char **argv) -> int {
     eagleInterfaceInfo.thread.join();
 }
 
-auto CreateServerBuilder(const string &serverAddress) -> grpc::ServerBuilder * {
+auto ReadFileContents(const string &path) -> string {
+    std::ifstream file(path);
+    if (!file.is_open()) { return ""; }
+    std::stringstream buffer;
+    buffer << file.rdbuf();
+    return buffer.str();
+}
+
+auto CreateServerBuilder(const string &serverAddress, const string &certPath, const string &keyPath)
+        -> grpc::ServerBuilder * {
     auto *serverBuilder = new grpc::ServerBuilder;
 
-    const auto credentials = grpc::InsecureServerCredentials();
-    std::cout << "Creating insecure connection" << std::endl;
+    std::shared_ptr<grpc::ServerCredentials> credentials;
+
+    // Check if TLS is configured
+    if (!certPath.empty() && !keyPath.empty()) {
+        const string certContents = ReadFileContents(certPath);
+        const string keyContents = ReadFileContents(keyPath);
+
+        if (certContents.empty() || keyContents.empty()) {
+            std::cerr << "Error: Could not read TLS certificate or key file" << std::endl;
+            std::cerr << "  cert path: " << certPath << std::endl;
+            std::cerr << "  key path: " << keyPath << std::endl;
+            std::cerr << "Falling back to insecure connection" << std::endl;
+            credentials = grpc::InsecureServerCredentials();
+        } else {
+            grpc::SslServerCredentialsOptions::PemKeyCertPair keyCert;
+            keyCert.private_key = keyContents;
+            keyCert.cert_chain = certContents;
+
+            grpc::SslServerCredentialsOptions sslOpts;
+            sslOpts.pem_key_cert_pairs.push_back(keyCert);
+
+            credentials = grpc::SslServerCredentials(sslOpts);
+            std::cout << "TLS enabled with certificate from: " << certPath << std::endl;
+        }
+    } else {
+        credentials = grpc::InsecureServerCredentials();
+        std::cout << "Creating insecure connection (no TLS configured)" << std::endl;
+    }
 
     serverBuilder->AddListeningPort(serverAddress, credentials);
     return serverBuilder;
@@ -98,9 +140,19 @@ auto CreateEagleInterfaceService(
     const string eagleInterfaceServerAddress =
             config->stringForKey(ServerConfiguration::kEagleInterfaceGrpcAddress);
 
-    auto *eagleInterfaceServerBuilder = CreateServerBuilder(eagleInterfaceServerAddress);
+    // TLS configuration
+    const string certPath = config->stringForKey(ServerConfiguration::kSslCertPath);
+    const string keyPath = config->stringForKey(ServerConfiguration::kSslPrivateKeyPath);
 
-    const auto eagleInterfaceService = std::make_shared<EagleInterfaceImpl>(shardokGamesManager);
+    auto *eagleInterfaceServerBuilder =
+            CreateServerBuilder(eagleInterfaceServerAddress, certPath, keyPath);
+
+    // Auth token configuration
+    const string authTokenPath = config->stringForKey(ServerConfiguration::kAuthTokenPath);
+    const string authToken = shardok::ReadAuthTokenFromFile(authTokenPath);
+
+    const auto eagleInterfaceService =
+            std::make_shared<EagleInterfaceImpl>(shardokGamesManager, authToken);
     eagleInterfaceServerBuilder->RegisterService(eagleInterfaceService.get());
 
     ServerThreadInfo eagleInterfaceThreadInfo = StartInThread(eagleInterfaceServerBuilder);

src/main/csharp/net/eagle0/clients/unity/eagle0/Assembly-CSharp.csproj

@@ -64,10 +64,12 @@
     <Compile Include="Assets/common/CommonExtensions.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Modal Window/ModalWindowTabs.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/CapturedHeroImprisonedDetailsNotificationGenerator.cs" />
+    <Compile Include="Assets/Shardok/MoveAnimator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/SuppressBeastsCommandSelector.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveInvitationCommandSelector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/SliderManager.cs" />
     <Compile Include="Assets/common/GUIUtils/TableRowHoverDetector.cs" />
+    <Compile Include="Assets/ConnectionHandler/DropGameConfirmationPanel.cs" />
     <Compile Include="Assets/Eagle/Table Rows/DynamicHeroTextUpdater.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/util/HeroDropdownController.cs" />
     <Compile Include="Assets/Eagle/Notifications/PrisonerReturnedNotificationGenerator.cs" />
@@ -85,17 +87,16 @@
     <Compile Include="Assets/Modern UI Pack/Scripts/Demo/LaunchURL.cs" />
     <Compile Include="Assets/Shardok/HexCoordinates.cs" />
     <Compile Include="Assets/Eagle/Table Rows/OrganizeTroopsTableRow.cs" />
-    <Compile Include="Assets/Bluetooth/PickerRowController.cs" />
     <Compile Include="Assets/TouchHandler.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/TravelCommandSelector.cs" />
     <Compile Include="Assets/Eagle/ConnectionStatusUI.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerIconEditor.cs" />
     <Compile Include="Assets/Eagle/NotificationPanel.cs" />
+    <Compile Include="Assets/Shardok/FreezeAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Demo/DemoListShadow.cs" />
     <Compile Include="Assets/HoveringTooltipTextProvider.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/util/KeyModifiedAmount.cs" />
     <Compile Include="Assets/HoveringTooltip.cs" />
-    <Compile Include="Assets/Bluetooth/DiceInterface.cs" />
     <Compile Include="Assets/ButtonColors.cs" />
     <Compile Include="Assets/Eagle/MapController.cs" />
     <Compile Include="Assets/common/DisclosureTriangle.cs" />
@@ -105,31 +106,38 @@
     <Compile Include="Assets/Eagle/CommandSelectors/FreeForAllDecisionCommandSelector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerButtonEditor.cs" />
     <Compile Include="Assets/Eagle/CommandWarningPanelController.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialModalPanel.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Context Menu/ContextMenuManager.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerProgressBarLoopEditor.cs" />
     <Compile Include="Assets/Eagle/BattalionUtils.cs" />
+    <Compile Include="Assets/Shardok/ArrowVolleyAnimator.cs" />
     <Compile Include="Assets/Eagle/Table Rows/UnaffiliatedHeroRowController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Tooltip/TooltipContent.cs" />
     <Compile Include="Assets/Eagle/ConnectionCircuitBreaker.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerHSelector.cs" />
     <Compile Include="Assets/Shardok/Grid.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ArmTroopsCommandSelector.cs" />
+    <Compile Include="Assets/Shardok/RaiseDeadAnimator.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/PrisonerExiledDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerProgressBar.cs" />
     <Compile Include="Assets/Eagle/Table Rows/OrganizeTroopsComponentRow.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Notification/NotificationManagerEditor.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerBasicEditor.cs" />
     <Compile Include="Assets/ConnectionHandler/RunningGameItem.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialCanvasBuilder.cs" />
     <Compile Include="Assets/Shardok/Table Rows/ArmyRowController.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/PrisonerExchangeDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/Notification.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/QuestFailedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/QuestFulfilledDetailsNotificationGenerator.cs" />
+    <Compile Include="Assets/Auth/OAuthManager.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ProfessionGainedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/TextureList.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Modal Window/ModalWindowManager.cs" />
     <Compile Include="Assets/Eagle/Table Rows/BattalionRowController.cs" />
+    <Compile Include="Assets/Shardok/DismissAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Toggle/ToggleAnim.cs" />
+    <Compile Include="Assets/Shardok/HolyWaveAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerInputField.cs" />
     <Compile Include="Assets/Shardok/ActionResultTypeManager.cs" />
     <Compile Include="Assets/MainQueue.cs" />
@@ -141,18 +149,19 @@
     <Compile Include="Assets/Eagle/GeneratedTextUpdater.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/OutlawApprehendedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/HexMetrics.cs" />
-    <Compile Include="Assets/Bluetooth/OneDiceRollController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Switch/SwitchManager.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ProvinceHeldDetailsNotificationGenerator.cs" />
-    <Compile Include="Assets/Bluetooth/DieInfo.cs" />
     <Compile Include="Assets/common/ResourceFetcher.cs" />
+    <Compile Include="Assets/Tutorial/Content/TutorialStep.cs" />
+    <Compile Include="Assets/Auth/AuthClient.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/TruceRejectedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/RiotSuppressedNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Modal Window/ModalWindowManagerEditor.cs" />
     <Compile Include="Assets/common/GUIUtils/AutoScrollingText.cs" />
-    <Compile Include="Assets/Bluetooth/NativeDiceInterfaceImports.cs" />
     <Compile Include="Assets/Eagle/Notifications/ProvinceConqueredNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Table Rows/ExtraTroopsRowController.cs" />
+    <Compile Include="Assets/Auth/JwtAuthInterceptor.cs" />
+    <Compile Include="Assets/Tutorial/Content/TutorialContentDefinitions.cs" />
     <Compile Include="Assets/Eagle/CommandPanelController.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ShatteredArmyDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/TurnHistoryPanelController.cs" />
@@ -176,6 +185,7 @@
     <Compile Include="Assets/Shardok/Table Rows/ReserveRowController.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/OutlawSpottedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Fixes/UIElementInFront.cs" />
+    <Compile Include="Assets/Shardok/MeleeAnimator.cs" />
     <Compile Include="Assets/ConnectionHandler/WaitingGameItem.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerBasicIcon.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerSlider.cs" />
@@ -189,12 +199,14 @@
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/TruceAcceptedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Progress Bar/ProgressBarEditor.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Dropdown/CustomDropdownEditor.cs" />
+    <Compile Include="Assets/Shardok/WaterEffectAnimator.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/RansomRejectedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/FactionsTableController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/RangeSlider.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialOverlayBuilder.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ExileVassalCommandSelector.cs" />
+    <Compile Include="Assets/Tutorial/TutorialState.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerBasicWithIconEditor.cs" />
-    <Compile Include="Assets/Bluetooth/DiceVectors.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerProgressBarLoop.cs" />
     <Compile Include="Assets/Eagle/MovingArmiesTableController.cs" />
     <Compile Include="Assets/ConnectionHandler/ConnectionHandler.cs" />
@@ -210,16 +222,21 @@
     <Compile Include="Assets/GUI Pro Kit Fantasy RPG/Extensions/UIParticle/UIParticleSystem.cs" />
     <Compile Include="Assets/Shardok/SoundManager.cs" />
     <Compile Include="Assets/Shardok/HexMesh.cs" />
+    <Compile Include="Assets/Tutorial/Content/TutorialSequence.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/InvitationRejectedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/DiplomacyCommandSelector.cs" />
+    <Compile Include="Assets/Tutorial/Triggers/TutorialTriggerRegistry.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveBreakAllianceCommandSelector.cs" />
+    <Compile Include="Assets/common/WindowFocusManager.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveAllianceCommandSelector.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/WithdrewForTruceDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/MarchCommandSelector.cs" />
+    <Compile Include="Assets/Tutorial/TutorialTargetRegistry.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/TrainCommandSelector.cs" />
     <Compile Include="Assets/Eagle/CustomFileLogger.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/InvitationAcceptedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/ProvinceEventsNotificationGenerator.cs" />
+    <Compile Include="Assets/Tutorial/TutorialManager.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/FeastCommandSelector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Animated Icon/AnimatedIconHandler.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/GenericNotificationGenerator.cs" />
@@ -228,6 +245,7 @@
     <Compile Include="Assets/ConnectionKiller.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/RadialSliderEditor.cs" />
     <Compile Include="Assets/Eagle/Table Rows/MovingArmyPopupRowController.cs" />
+    <Compile Include="Assets/Shardok/DuelAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Dropdown/CustomDropdown.cs" />
     <Compile Include="Assets/Eagle/Notifications/NotificationDispatcher.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Demo/DemoTopButton.cs" />
@@ -244,9 +262,10 @@
     <Compile Include="Assets/Eagle/CommandButtonPanelController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/RangeMinSlider.cs" />
     <Compile Include="Assets/Eagle/Notifications/WeatherForcedSuppliesBackNotificationGenerator.cs" />
+    <Compile Include="Assets/Shardok/AnimationTestController.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/TradeCommandSelector.cs" />
     <Compile Include="Assets/Eagle/Table Rows/DominionTableRowController.cs" />
-    <Compile Include="Assets/Bluetooth/RollPanelController.cs" />
+    <Compile Include="Assets/Shardok/ChargeAnimator.cs" />
     <Compile Include="Assets/Eagle/ClientTextProvider.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManager.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Progress Bar/ProgressBar.cs" />
@@ -254,10 +273,12 @@
     <Compile Include="Assets/UI/Scripts/GameSceneManager.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/RansomCommandSelector.cs" />
     <Compile Include="Assets/Eagle/Notifications/WeatherForcedSuppliesLostNotificationGenerator.cs" />
+    <Compile Include="Assets/Shardok/MeteorAnimator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ReturnCommandSelector.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveTruceCommandSelector.cs" />
     <Compile Include="Assets/Eagle/ClientPregeneratedText.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/SwearBrotherhoodCommandSelector.cs" />
+    <Compile Include="Assets/Auth/TokenStorage.cs" />
     <Compile Include="Assets/Eagle/Table Rows/TableRowController.cs" />
     <Compile Include="Assets/Eagle/DisplayNames.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerSliderEditor.cs" />
@@ -266,6 +287,8 @@
     <Compile Include="Assets/Modern UI Pack/Scripts/Fixes/LayoutGroupPositionFix.cs" />
     <Compile Include="Assets/common/Logger.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/AllianceAcceptedNotificationGenerator.cs" />
+    <Compile Include="Assets/Shardok/ToolAnimator.cs" />
+    <Compile Include="Assets/Shardok/ScoutAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerModalWindow.cs" />
     <Compile Include="Assets/Eagle/HeroDetailsController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerEditor.cs" />
@@ -273,8 +296,10 @@
     <Compile Include="Assets/Eagle/Table Rows/UnitSelectorHeroRowController.cs" />
     <Compile Include="Assets/ConnectionHandler/CustomBattleHandler.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/RansomPaidDetailsNotificationGenerator.cs" />
+    <Compile Include="Assets/Shardok/ControlAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Horizontal Selector/HorizontalSelector.cs" />
     <Compile Include="Assets/Eagle/Table Rows/OrganizeTroopsResultRow.cs" />
+    <Compile Include="Assets/Eagle/SparkleUpdater.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/SliderManagerEditor.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/SwearBrotherhoodDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/PersistentClientConnection.cs" />
@@ -288,14 +313,17 @@
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/CapturedHeroReturnedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/DivineCommandSelector.cs" />
     <Compile Include="Assets/Shardok/Unit.cs" />
+    <Compile Include="Assets/Shardok/FearAnimator.cs" />
     <Compile Include="Assets/Eagle/ProvinceInfoPanelController.cs" />
     <Compile Include="Assets/Shardok/ShardokGameModel.cs" />
     <Compile Include="Assets/common/GUIUtils/GeneralClickDetector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerContextMenu.cs" />
+    <Compile Include="Assets/Eagle/SparkleInitializer.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/TruceAmbassadorImprisonedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerBasicWithIcon.cs" />
-    <Compile Include="Assets/Bluetooth/UnityDieColors.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialHintIndicator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/OrganizeTroopsCommandSelector.cs" />
+    <Compile Include="Assets/Shardok/ExtinguishAnimator.cs" />
     <Compile Include="Assets/Eagle/PanelPositions.cs" />
     <Compile Include="Assets/Eagle/Notifications/NotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/DynamicTextNotification.cs" />
@@ -306,7 +334,6 @@
     <Compile Include="Assets/EagleConnection.cs" />
     <Compile Include="Assets/GUI Pro Kit Fantasy RPG/Scripts/CtrPanel.cs" />
     <Compile Include="Assets/UI/Scripts/SceneLoadTester.cs" />
-    <Compile Include="Assets/Bluetooth/RollFetcher.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/HandleRiotGiveCommandSelector.cs" />
     <Compile Include="Assets/Eagle/ProvinceUtils.cs" />
     <Compile Include="Assets/common/GUIUtils/ProvinceStatUtils.cs" />
@@ -322,6 +349,7 @@
     <Compile Include="Assets/Eagle/CommandSelectors/ControlWeatherCommandSelector.cs" />
     <Compile Include="Assets/Shardok/ShardokGameController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Rendering/UIGradientEditor.cs" />
+    <Compile Include="Assets/Shardok/LightningAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Progress Bar/PBFilled.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Rendering/UIGradient.cs" />
     <Compile Include="Assets/Eagle/DominionPanelController.cs" />
@@ -330,6 +358,7 @@
     <Compile Include="Assets/Eagle/IClientConnectionSubscriber.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/AlmsCommandSelector.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveDiplomacyCommandSelector.cs" />
+    <Compile Include="Assets/Shardok/FleeAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerWithIcon.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Horizontal Selector/HorizontalSelectorEditor.cs" />
     <Compile Include="Assets/Eagle/PopupPanelController.cs" />
@@ -338,6 +367,8 @@
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/SuppressBeastsFailedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Terrain Hexes/Example Scene/BasicHexArranger.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ManagePrisonersCommandSelector.cs" />
+    <Compile Include="Assets/ConnectionHandler/StoredAccountButton.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialUIManager.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/SendSuppliesCommandSelector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Window/WindowManager.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/CapturedHeroExiledDetailsNotificationGenerator.cs" />
@@ -345,26 +376,30 @@
     <Compile Include="Assets/Shardok/ReservesTableController.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/CommandSelector.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/RestCommandSelector.cs" />
-    <Compile Include="Assets/Bluetooth/DiceConfigurationPanelController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerDropdown.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerButton.cs" />
     <Compile Include="Assets/common/GUIUtils/GUIUtils.cs" />
     <Compile Include="Assets/Eagle/Table Rows/IncomingArmyTableRow.cs" />
     <Compile Include="Assets/ConnectionHandler/CreateGameItem.cs" />
     <Compile Include="Assets/Eagle/EagleGameController.cs" />
+    <Compile Include="Assets/Tutorial/TutorialTestSetup.cs" />
     <Compile Include="Assets/Eagle/Notifications/FailedSwearBrotherhoodNotificationGenerator.cs" />
+    <Compile Include="Assets/Shardok/FireEffectAnimator.cs" />
     <Compile Include="Assets/common/GUIUtils/EventBasedTable.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Window/WindowManagerEditor.cs" />
     <Compile Include="Assets/Eagle/Notifications/FactionDestroyedNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerNotification.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/HandleCapturedHeroesCommandSelector.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialOverlayController.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ARNNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/AttackDecisionCommandSelector.cs" />
     <Compile Include="Assets/Eagle/Table Rows/AvailableHeroTableRow.cs" />
     <Compile Include="Assets/Eagle/Table Rows/HeroRowController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerTooltip.cs" />
+    <Compile Include="Assets/Eagle/Notifications/ARNNotifications/NewFactionHeadDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/HexGrid.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Tooltip/TooltipManager.cs" />
+    <Compile Include="Assets/Shardok/CatapultAnimator.cs" />
     <None Include="Assets/TextMesh Pro/Resources/Shaders/TMPro.cginc" />
     <None Include="Assets/TextMesh Pro/Resources/Shaders/TMP_SDF-Mobile Overlay.shader" />
     <None Include="Assets/Packages/System.IO.Pipelines.8.0.0/lib/netstandard2.0/System.IO.Pipelines.xml" />
@@ -409,7 +444,7 @@
     <None Include="Assets/Packages/System.ComponentModel.Annotations.5.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/Packages/System.Runtime.CompilerServices.Unsafe.6.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/TextMesh Pro/Resources/Shaders/TMP_SDF-Mobile Masking.shader" />
-    <None Include="Assets/Resources/Music/Music Credits.txt" />
+    <None Include="Assets/Music/Music Credits.txt" />
     <None Include="Assets/Packages/System.Diagnostics.DiagnosticSource.8.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/Packages/Microsoft.Extensions.Logging.8.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/Packages/Microsoft.Extensions.DependencyInjection.Abstractions.8.0.0/useSharedDesignerContext.txt" />
@@ -1271,6 +1306,9 @@
     <Reference Include="Unity.TextMeshPro">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.TextMeshPro.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.ResourceManager">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.ResourceManager.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.VisualStudio.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.VisualStudio.Editor.dll</HintPath>
     </Reference>
@@ -1283,9 +1321,15 @@
     <Reference Include="Unity.AI.Navigation">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.AI.Navigation.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.Profiling.Core">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Profiling.Core.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.Timeline.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Timeline.Editor.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.ScriptableBuildPipeline">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.ScriptableBuildPipeline.dll</HintPath>
+    </Reference>
     <Reference Include="Cysharp.Net.Http.YetAnotherHttpHandler">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Cysharp.Net.Http.YetAnotherHttpHandler.dll</HintPath>
     </Reference>
@@ -1313,9 +1357,15 @@
     <Reference Include="Unity.Multiplayer.Center.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Multiplayer.Center.Editor.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.ScriptableBuildPipeline.Editor">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.ScriptableBuildPipeline.Editor.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.PlasticSCM.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.PlasticSCM.Editor.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.Addressables">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Addressables.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.Services.Core.Components">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Services.Core.Components.dll</HintPath>
     </Reference>
@@ -1331,6 +1381,9 @@
     <Reference Include="Unity.AI.Navigation.Editor.ConversionSystem">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.AI.Navigation.Editor.ConversionSystem.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.Addressables.Editor">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Addressables.Editor.dll</HintPath>
+    </Reference>
     <Reference Include="UnityEditor.UI">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/UnityEditor.UI.dll</HintPath>
     </Reference>

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/4000_Fantasy_Icons/InUse.meta

@@ -1,5 +1,5 @@
 fileFormatVersion: 2
-guid: 6ddb90d3140384d50a98a19e72539b62
+guid: fb38e3be95e9247c5a451d60236def15
 folderAsset: yes
 DefaultImporter:
   externalObjects: {}