V1 acceptance criteria

V1 is accepted only when every mandatory criterion below has an automated test or a documented end-to-end verification result.

Installation and bootstrap

compose.yaml starts one public main application and one non-public restricted agent.
The main application has no Docker socket mount.
First run requires creation of an administrator and refuses normal use until bootstrap is complete.
A master encryption key and agent authentication secret are read from files, not literal environment values.
All post-bootstrap product settings listed in the specifications are editable in the UI.

Invalid templates and manifests are rejected with field-specific errors.
The Palworld examples validate against the checked-in schemas.
Creation presents image, digest or tag, ports, mounts, resources, data origin and backup policy before confirmation.
Port conflicts, insufficient disk space and paths outside approved roots block creation.
An administrator can create an empty instance or create one from a validated imported save.
The created container is registered in SQLite and carries DoGaMa labels and a non-forgeable registration binding checked by the agent.
Unrelated Docker containers never appear in the API or UI and cannot be targeted through identifier substitution.

Global administrators can manage system configuration and all instances.
Non-admin access is absent unless an instance membership exists.
User and manager baselines match docs/domain/authorization.md.
Fine-grained overrides can remove a manager permission or add the separately controlled backup.restore permission.
Every privileged API endpoint has denial tests; UI hiding alone is not accepted.

State distinguishes Docker running from game ready and exposes installing, starting, online, stopping, backup, restore, update, degraded, error and unknown conditions.
Start, stop, restart, update and delete operations are serialized per instance and are idempotent where applicable.
Repeated crash restarts trip a configurable circuit breaker.
Resource limits, port mappings and approved storage mounts survive container recreation.
Update displays old and new image references, makes a safety backup when configured, verifies health and rolls back or stops safely on failure.
Deletion preserves player data and backups unless the administrator separately confirms their removal by typing the instance name.

Manual and five-field cron schedules work with a retention count per instance.
Automatic retention deletes only eligible automatic backups; manual and imported backups are not silently removed.
If online_save exists, idle shutdown requests and confirms a game save before stopping; otherwise DoGaMa stops first and archives afterward.
Backup archives include a manifest and SHA-256 checksum and are written atomically.
Restore verifies integrity, creates a pre-restore backup by default, stops the server and has a defined rollback or safe-stop result.
Imports are staged and reject absolute paths, traversal, escaping links, device files, excessive file counts and extraction bombs.
Import at instance creation does not create the server until validation succeeds.
A normal instance export contains no secrets; a backup export is integrity-verifiable.

Only WebAssembly modules are accepted.
The runtime enforces memory, fuel/instruction, time, response-size and concurrency limits.
A module receives no filesystem, clock, random, environment, process or raw socket access unless exposed by a documented host function.
Network calls can reach only the bound instance endpoint, declared protocol and declared integration port.
Capability and function disagreement fails module activation.
Template and module versions are independently upgradeable and a compatibility check precedes activation.

Secrets are encrypted at rest and never returned after write.
Authentication is rate-limited; sessions use secure cookie settings and CSRF protection.
Audit records important human/security actions but not page views, metrics polling or normal health probes.
Audit retention defaults to 30 days and is configurable by an administrator, including a bounded manual purge.
Email, generic webhook and Discord can be configured and tested in the UI.
Notification delivery is queued, redacts secrets, retries with bounds and never blocks the originating operation.
SSRF protections cover artwork downloads, webhook destinations and any administrator-provided URL.

Go tests, static analysis, frontend tests and schema/example validation pass.
Database migrations work from an empty database and from the prior released schema.
Backup/restore, update rollback, authorization and agent-scope integration tests pass against a disposable Docker environment.
Documentation links resolve and examples use the same field names as the schemas.