Keldrin Game Adapter SDK 0.9.140 - Developer Preview

This package contains the framework-dependent SDK/Core CLI, scoped MIT-covered
source, current authoring examples and bounded offline check runners. It is not
a Keldrin application installation. Read this file and KNOWN_LIMITATIONS.txt
before dated sections of copied reference documents. App/game publication and
native operation receipts remain separate from SDK authoring checks.

Prerequisites: Microsoft .NET 10 runtime with a compatible 10.0 patch, plus
PowerShell 7 for the check runners. Optional source reproduction needs the SDK
version selected by source/global.json (10.0.302/latestPatch). No .NET runtime,
game runtime or installer is bundled. Windows reproduction does not certify
another operating system merely because the CLI targets net10.0.

Extract to a fresh directory, then run:
  pwsh -NoProfile -File ./Test-BundleManifest.ps1
  pwsh -NoProfile -File ./Run-Quickstart.ps1 -OutputDirectory ../sdk140-reports

Choose a fresh report directory OUTSIDE this extraction. The quickstart uses the
exact prebuilt DLL for six commands across 21 invocations: describe-contract,
author-schema, author-lint, canonical-payload, verify-package and test-contract.
It replays 76 SOURCE-bound synthetic Setup cases: Minecraft 123 seventeen,
Terraria 115 twelve, Abiotic 121 fourteen plus 17 boundary, Enshrouded 120-public
fourteen, and Icarus 121 two. It lints the Enshrouded 127 stop-policy source and
its canonical form (no fixtures or evidence ship with that example). It verifies
the separate signed JSON-only Core Keeper 1.0.4 reference with the SDK's embedded
official public verification trust. These are intended check counts; only a
completed quickstart receipt establishes that they passed for this extraction.

The runners do not download/install/activate/sign/publish a package, start a game,
mutate an installed profile, accept an agreement or contact a game endpoint.
Source and signed archive fixture digests differ. Native release tests and the
full SDK unit suite are separate evidence, not these standalone quickstart cases.

What changed since the 0.9.123 Developer Preview:
- Trusted publisher keys. Keldrin 0.9.130 moved to an ordered list of official
  keys. The SDK embeds both public keys (source/tools/GamePackages): the host
  key, which signs every package published from 0.9.130 on, first, and the
  original key, kept as the offline spare, second. verify-package accepts a
  package signed by either; the 0.9.123 SDK could verify only the original key.
- Stop policies. Core gained save-aware stop kinds (Valheim and Core Keeper
  save-and-exit, Enshrouded console break) declared by the package. The
  Enshrouded 127 example (examples/enshrouded/127) is the 1.1.4 source with
  StopKind EnshroudedBreakSaveExit and minimum host 0.9.127, beside the signed
  1.1.3 payload it was built from.
- Core source closure also carries the host's Steam update check types, backup
  archive compression and Web access password helpers; they are build inputs,
  not SDK features.
- The generic contract feature floors are unchanged: the newest generic features
  still declare minimum host 0.9.123 in docs/contract-0.9.140.json and
  docs/author-schema-0.9.140.json. A package that needs a stop policy or the
  rotated key names its own minimum host (0.9.127 or later).

Preferred versioned examples are Minecraft 123, Abiotic 121, Enshrouded 120-public
(fixtures) and 127 (stop policy), Terraria 115 and Icarus 121. Their
manifest/evidence/fixture/README files retain exact source bytes. Some evidence
rows are scoped author attestations, not SDK certification. Omitted artwork
metadata remains so the declarations and Setup fixtures can be replayed. No asset
availability or redistribution right is inferred. Authors must provide
distributable assets, update their metadata and rebind fixtures/evidence before
submitting a changed package.

Minecraft's example pins official Mojang server 26.3 and a portable Azul Zulu
Java 25 runtime. Neither download nor any vendor runtime/legal files are bundled.
The included notice-deduplication JSON is an audit of declared notice selection,
not a copy of vendor notices or a redistribution grant. No unreviewed automatic
latest-Java/latest-Minecraft discovery is implemented by this pinned declaration.

To reproduce the CLI source, COPY source/ to a separate directory, then run:
  dotnet build tools/GameAdapterSdk/GameAdapterSdk.csproj -c Release
Do not build inside the pristine extraction: generated files are deliberately
rejected by the integrity runner. Keep the relative Core ProjectReference,
Directory.Build.props/global.json and both embedded PUBLIC verification keys
intact. This source-build closure deliberately excludes partial unit-test
sources that require the full application repository; use the standalone
quickstart here. A rebuilt CLI is a separate binary identity and grants no
signing authority.

No vendor artwork, game executable/JAR/JRE, world, profile, raw log, private key,
credential, Service/Desktop binary, apphost, PDB, signing tool or .NET runtime is
included. LICENSE and LICENSING.md cover SDK/Core/documentation/JSON only, not
the whole Keldrin application or vendor assets. Game names imply no endorsement.

The bundle manifest provides unsigned integrity, not publisher authentication.
Use the exact versioned ZIP/manifest hashes independently published by Keldrin.
Signed package verification is separate. Earlier public SDK objects remain
immutable historical references. This Developer Preview makes no blanket V2FC
or native gameplay certification claim.
