Skip to content
Descent Docs

The Core Engines Go Closed — ADR-111

The Core Engines Go Closed — ADR-111

One ruling, by executive decision. It changes who may read three codebases, where they live in the tree, and which door third parties integrate through. It changes nothing about what the engines do: no wire format moves, no threshold changes value, no API is added or removed, and the parity corpus is untouched.

It supersedes ADR-107, and the supersession is worth reading even after the rule it retires is gone: ADR-107’s diagnosis — an undeclared fork is indistinguishable from an intention to contribute that never happened — was correct, and the alternative it rejected is now the decision, overturned by a business mandate rather than by a technical argument. Recording which kind of force overturned it is the point of writing this down.

ADR-111 — The Core Engines Are Proprietary: MIT Distribution Ceases, modules/ → core/, Third-Party Integration Confined to Studio Plugins

Status: Accepted · Date: 2026-08-08 · Supersedes 107 · interacts with 017, 100, 109

Context

Descent.Geometry, Descent.RngKit and Descent.Sandbox began as MIT repositories with their own upstreams, were vendored at the 2026-08-05 convergence, and have since diverged: ADR-100 rewrote the sandbox’s DoS-ceiling API and was declared a fork under ADR-107 pending an upstream offer. The business has now made the offer question moot: the three engines are proprietary, their MIT status is revoked going forward, and the upstream repositories cease to be a destination for anything.

What these three codebases contain, concretely, is why the mandate exists:

  • Descent.Sandbox carries the §3.1 DoS ceilings and the engine-pooling design around them. ADR-100’s whole argument was that published defaults for those ceilings were a security defect; published source for them is the same defect at a larger radius — an attacker reads the exact budget to walk under, per limit, with the enforcement seams named.
  • Descent.RngKit is the fairness core: audit-packet layout, allocation behaviour, the keep/drop mechanics every cartridge’s dice ride on. Its internals are what an aimbot-style cheat would be built against.
  • Descent.Geometry answers visibility. ADR-031’s anti-cheat posture depends on divergence digests whose discriminating power drops if an attacker can run the identical crate offline and precompute what the server will conclude.

Decision

  1. The three engines are closed source. MIT licensing ceases for all future versions. LICENSE, CONTRIBUTING.md and the public-repo translation READMEs are deleted from their trees; PackageLicenseExpression and the Cargo license fields are removed, so no artefact built from this tree claims an MIT grant it no longer makes.
  2. Revocation is prospective, and this is a property of the MIT licence rather than a choice. Copies already distributed under MIT remain MIT — the grant is irrevocable for what was conveyed. What this decision protects is everything not yet published: ADR-100’s ceiling API, the current parity oracle, and every change after the vendoring points recorded in the old vendoring table (5d7715e / d933079 / ae257db). Anyone claiming this ADR retroactively un-licenses an existing copy is wrong, and this clause exists so the claim cannot cite this document.
  3. The engines move from modules/ to a new root directory core/. modules/ was the vendored-open-source tier and keeps the first-party shared libraries (Descent.Vtt.Domain, .Protocol, .Sdk, .Geometry.Interop); core/ is the proprietary tier. The directory is the licensing statement, which is what makes the next clause checkable.
  4. Third-party integration is confined to Descent Studio plugins, over ADR-109’s module contract — a signed web bundle, a Native AOT child process on the versioned IPC seam, or rarely a C-ABI library. No third party links these engines, references their packages, or sees their source. First-party cartridges continue to reach RngKit through Descent.RngKit.Abstractions exactly as before; the abstractions seam is unchanged.
  5. Closed source is a business-risk control layered over the technical ones, never a replacement for them. §3.1’s fail-closed ceilings, server-side re-validation (ADR-098), and the parity corpus stand unchanged and remain the actual security boundary. If a control in this repository is ever justified by “the source is closed anyway”, that justification is a defect under this clause.

What survives ADR-107’s retirement

ADR-107 ruled that a change to a vendored module is offered upstream or declared a fork, enforced by a vendoring table in the root README.md. Its premise — an upstream relationship — no longer exists, so the rule, the table and the release-checklist item retire with it. Its diagnosis survives unchanged: an undeclared divergence is invisible debt. The successor obligation is simpler: the engines are owned outright, so every change is an ordinary reviewed change to this repository, and there is nothing left to declare against. ADR-100’s “declared fork, pending an upstream offer” status resolves to owned; no offer will be made.

Alternatives Considered and Why Rejected

  • Stay MIT and rely on the technical controls alone. The controls are real (clause 5), but the business judged the residual exposure — published ceilings, an offline parity oracle, and a commercial anti-cheat position — not worth carrying for the value open source was returning, which after the convergence was approximately none: ADR-107 records that the in-tree copies had already diverged and the upstream CI had gone inert.
  • Close the source but leave the trees in modules/. Rejected because modules/ would then mean two contradictory things, and the corpus’s own history (the W6 defect class) is that a name meaning two things outlives every comment explaining which is which. The move is what makes the licensing boundary structural rather than annotated.
  • Dual-license instead of revoking. Rejected as the worst of both: the sensitive material is sensitive precisely because it is readable, and a source-available licence publishes it identically while adding legal surface.
  • Keep ADR-107’s vendoring table as a historical marker. Rejected — the table is an enforcement point (a release-checklist item), and a retired obligation that still looks like one is exactly the decorative-control shape ADR-045 exists to prevent. The vendoring points move into this record (clause 2), where they are provenance rather than obligation.

Consequences (including negative)

  • The engines lose whatever external scrutiny MIT invited. Post-convergence that scrutiny was hypothetical — the upstreams received no contributions after vendoring — but the loss is real in kind and is accepted, not denied.
  • The public NuGet/crates identities of these packages end at their last published MIT versions. The in-tree release workflows continue to build signed artefacts; where those artefacts go is a distribution question this ADR leaves to the release process, with one constraint: not to a public feed under an MIT claim.
  • Archiving the upstream DescentVTT/Descent.* repositories is an obligation on the organisation, not on this repository, and nothing in this tree can enforce it. It is recorded here as a named release-checklist item precisely because it is otherwise invisible.
  • Studio plugin capability becomes a hard dependency for the modding story. Confinement to ADR-109’s surface is only a consequence, not a loss of function, if that surface actually ships; until it does, the honest reading is that third-party integration is closed, not moved.
  • Every path in the repository that said modules/Descent.{Geometry,RngKit,Sandbox} is wrong until updated — three solutions, eight project references, the Rust .targets bridge, the wasm build script, the E2E container image, seven workflows, and the rules corpus. The migration commits beside this record carry the sweep.

Rights-holders (ADR-079)

None. No new class of data is retained about any person.

Enforcement

  • Clause 1: the absence of LICENSE/CONTRIBUTING.md under core/ is checkable in-tree; the licence-metadata removals fail the pack/build if reintroduced half-way (an expression with no licence file, or a licence file with no expression, each trip their toolchain’s validation).
  • Clause 3: the build graph is the enforcement point — a stale modules/Descent.Geometry path fails cargo/MSBuild/CI loudly rather than resolving.
  • Clause 4: structural on the .NET side today (InternalsVisibleTo and project references name only first-party consumers; no package of these engines is published for a third party to reference), and behavioural at the Studio boundary per ADR-109’s signature and contract-range checks.
  • The upstream-archival item is a release-checklist entry (ADR-045’s third category), not a CI check, for the same reason ADR-107’s table was: it needs eyes on an external system.

Technology currency

Checked 2026-08-08, against this repository’s own state rather than an external source: the three engines’ in-tree revisions, the fork declaration in the root README.md’s vendoring table, and the inertness of the upstream relationship since the 2026-08-05 convergence (ADR-107’s own finding). No external version claim is made by this decision.