Publishing and versions

Drafts, snapshots, and versions

A draft is mutable and private to its owner. A snapshot is the exact editor document captured during publish. A version is an immutable, validated Rift bundle built from that snapshot.

Publish performs one atomic persistence operation after validation. A failure creates neither a snapshot nor a partial version.

Headless checks

The gate rejects:

• Invalid project schema or missing start player
• Missing transforms required by sprites/colliders
• Projects over 2 MiB, 20,000 entities, or 100,000 VM instructions
• Creator handlers that fail or exceed VM budgets
• Invalid capability arguments
• Projects that fail a 120-tick deterministic runtime simulation
• Bundle digest, runtime, project-schema, or physics incompatibility

Run the same validator for the checked-in reference bundle with corepack pnpm validate:fixture. CI also tests the Platformer Starter and malicious looping examples.

Sharing, rollback, and remix

Unlisted versions use /play/version_…. Possession of this link grants play access. Each link remains pinned even after another publish.

Rollback changes the project's active version pointer. Remix copies a published runtime project into a new owner-controlled draft and permanently records both the source project and source version. Remix never grants access to the source draft.

Public discovery foundation

Public discovery is separate from unlisted sharing. An eligible verified account may submit only its active immutable version with a bounded description, one to five allowlisted tags, a solid-color thumbnail, and the fixed content declaration. Five technical checks must pass before the submission enters deterministic New Releases ordering.

The player directory keeps that stable NEW_RELEASES_V1 newest-first feed and uses a separate CONTROLLED_EXPLORATION_V1 default surface. Explore considers a bounded recent candidate set, gives each eligible creator one freshness-aware slot before repeats, and rotates equal-day creators once per UTC day. Its response names the algorithm and policy. Likes, saves, follows, playtime, and client analytics do not change this order.

Workshop's Public release section shows the verified account's trust quota and platform kill-switch state. Publish an unlisted version first, enter a 10–500 character description, choose one to five tags, choose the card color, and declare fantasy violence or flashing lights before submitting. Guest drafts remain available, but only a short-lived verified account session can enable the submit button. The browser form never grants eligibility and the API validates every field again.

Opening an already submitted cloud project loads its current public metadata. Save public metadata changes only those bounded discovery fields; it does not alter the title, immutable version, bundle, checks, or original submission time. Every successful edit is written with a METADATA_UPDATED audit event. Disabled submissions cannot be edited until moderation restores them, and the platform kill switch also stops edits.

Automated checks are not moderation. Reporting, individually attributable moderator authentication, case resolution, appeals, and staffing remain launch dependencies. Public submission is disabled by default in deployed API configuration while those operations and the approved public identity provider are incomplete.

When public entries exist, New Releases links the creator byline to /creators/account_…. A creator page contains only currently public Rifts; a missing or fully disabled profile returns a not-found state. Disabling a submission removes it from both surfaces without mutating or deleting its immutable bundle.