Select a Part or Model in Studio, answer "what is this object?", fill a form —
it becomes a gatherable node, a mob or a quest giver. Closes the gap between
authoring a def and setting up a world object, which until now meant knowing to
tag a part and hand-typing PascalCase attributes in the property panel.
Engine — components can declare an attribute SCHEMA:
- src/components/Schema.luau (new): AttributeSpec/Display/ComponentSchema types,
normalize/defaults/get/list, and the schemas for Gatherable, Mob, QuestGiver.
Dependency-free ON PURPOSE: the plugin requires it live at edit time, and the
component modules themselves can't be required there (Harvesting asserts
IsServer; Remotes creates instances in ReplicatedStorage).
- Components.define now accepts EITHER the legacy `attr = default` map or a
schema array, normalizing both to one ordered spec list; bind() reads the
derived default map, so binding is byte-identical. Legacy maps are sorted, as
`pairs` order is arbitrary and would make a UI jitter. New getSchema/
listSchemas. The three shipped components pull name/tag/display/attributes
from the schema; their onSetup bodies are untouched (defaults verified
identical, all 23 attributes).
Plugin — the Build page:
- Field.luau (new): coerce/format/equalsDefault, lifted from ConfigAdmin (which
now delegates), shared by every schema-driven editor.
- FieldRow.luau (new): the shared [○/●] label … control + help row, including a
⌄ picker that cycles authored ids for fields declaring `ref`.
- BuildAdmin.luau (new): live schema read with three distinct empty states,
selection/eligibility/identify, deltas-only attribute writes, applyType
(tag + clear any other component) and clear.
- BuildAdminUi.luau (new): chooser cards, grouped form, multi-select apply,
stale-bind-marker warning, SelectionChanged-driven refresh.
- init.server.luau: record()-wrapped buildActions + the page.
Docs: docs/admin-plugin.md Build section + a 60-second walkthrough,
docs/extending.md schema guide, a CONTRIBUTING rule that new creator components
declare one, CHANGELOG.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bring SurvivorCore's coordinated-disclosure setup in line with the sibling
public repo: a public engine consumed by other games has the same
"public issue = public exploit" risk.
- SECURITY.md: private "Report a vulnerability" channel (GitHub Security
Advisories), coordinated disclosure (ack → fix privately → release →
publish advisory + CVE + credit), supported-versions = latest release,
scope = engine code in this repo (games' own code/content out of scope),
and the Roblox-specific "never trust the client / validate RemoteEvents"
guidance. Notes selene + luau-lsp as the code-scanning equivalent since
Luau isn't CodeQL-supported.
- CONTRIBUTING: point would-be reporters to the private channel, and
document the multi-issue-close convention (separate `Closes #N` each).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner relaxed the asset side of the content-free rule — assets in this repo are
free to use — so the engine now ships its generated HUD icons as defaults instead
of leaving blank slots. Two wins: the HUD is iconed out of the box, and the icons
render in Studio's EDIT view (no Play needed), so you can author/tune the HUD and
see the real thing — or edit it straight from the Explorer.
- StatDefs.luau: each of the 7 stats carries an `icon` default. Putting it here
(not as a per-bar HUD attribute) keeps the admin-panel/config override working —
a per-bar attribute would shadow it. resolveIcon: per-bar attr > config/def.icon
(now the shipped id) > Assets > "".
- assets/hud/SurvivalHud.model.json: bake each bar's child `Icon` ImageLabel
(Image + Visible=true) so it shows in edit mode; the Credits counter (no StatDefs
entry) also gets a per-bar `Icon` attribute to drive its runtime resolution.
- Retire demo/client/HudIcons.client.luau (+ its demo.project.json mount): the
runtime icon-assigning script is now redundant.
- Relax the docs/PR-template "content-free" wording to "design-free": free default
ART may ship (overridable per stat); game-specific DESIGN (items/recipes/lore)
still never ships. Updated design-language, survival-stats, CONTRIBUTING.
- CHANGELOG: record default icons + add the missing admin-plugin entry; note CI
now builds all three Rojo targets.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A Studio dock widget that lets the experience owner tune the survival stats
through a validated form instead of hand-editing Attributes on the
SurvivalStatsConfig instance — the first slice of the Builder/Admin plugin (#11).
The point is compatibility: edits are LOCKED against engine updates. StatAdmin
(the pure, headlessly-testable logic layer) writes deltas only — it sets an
attribute solely when the owner changes a field from the live engine default,
and removes it on reset / edit-back-to-default. So unset fields keep following
the (improvable) engine defaults across a SurvivorCore release, while explicit
overrides live on the owner's instance, which the engine only ever seeds and
never overwrites. Nothing tuned is lost; nothing left alone is frozen.
Hard guardrail: the plugin can read/write only the seven owner-tunable fields
(STUDIO_ATTR_MAP). A write() assert makes it impossible to ever set the
engine-owned semantics Invert / DangerHigh — re-freezing the affliction
fill-direction bug is structurally unreachable. Runtime-verified in Studio:
every write path exercised (including rejected Invert/DangerHigh attempts) left
zero banned attributes on the instance.
- plugin/StatAdmin.luau — logic: roster, effective values, deltas-only writes
- plugin/StatAdminUi.luau — the dock-widget form (per-field reset, override dots)
- plugin/init.server.luau — toolbar/widget wiring + ChangeHistory undo steps
- plugin.project.json — separate Rojo tree; build with --plugin to install
- CI: stylua + a plugin-sourcemap luau-lsp pass + a plugin build
- docs/admin-plugin.md + cross-links; fix stale Invert row in the no-code table
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add docs/survival-stats.md (the stat model, no-code SurvivalStatsConfig tuning, the
SurvivorStatBar/Stat contract, the Rojo one-way-sync caveat) and cross-link it.
CHANGELOG Unreleased entry. CI + CONTRIBUTING now run stylua/luau-lsp over assets/
so the HUD loader is checked.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CONTRIBUTING mirrors FediHome's structure for the Roblox stack: prerequisites
(Studio + Rojo plugin 7.6.1, rokit, wally), local dev, code style (no hardcoded
asset IDs, content via register()/components, content-free core), the dev/main
branching model, PR flow, changelog rule, and label conventions. Seed
CHANGELOG.md (Keep a Changelog) with Unreleased + a 0.1.0 foundation entry. Add
getting-started (Rojo+Wally and drop-in .rbxm) and extending (register() API,
components, Hooks) guides; cross-link from architecture.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
