VectorAC

A server-side anti-cheat for Minecraft Bedrock Edition on PowerNukkitX (PNX).

Completion mandate

Do not stop until the anti-cheat is functionally complete: suite green at zero disabled, plugin deployed and exercised on the fixture, docs current, every item IMPLEMENTED-VERIFIED / SPEC-COMPLETE / HUMAN-BLOCKED. Enforcement stays off by design — the deliverable is a shadow/observe-only candidate ready to test.

Status (read this first)

• Pipeline: working. Input path, evidence engine, shadow mode, capture and quarantine are in place.
• Enforcement: none. Every system runs in shadow. No path to kick, cancel, correct or ban is open.
• Detection: not measured against real players. Strong, corroborated, above-18-TPS cheats are detected. Slow blink, timer, combat, information leaks and under-load cheats are not covered.
• Physics constants: none validated against official-client data. 0 EXACT.
• False-positive rate: not measured. There is no real-player data yet.
• Combat validator: not built.

The authoritative status lives in docs/STATUS.md and docs/VERIFICATION.md. Trust those over this file.

Architecture (short)

Ingress → Gatekeeper → Input gate → Intent journal → Simulators (movement, combat, world, inventory) → Evidence engine → Response ladder (sinks) → Telemetry.

Key ideas:

• The server's own simulation is the reference. Client claims are checked against it.
• Detectors emit evidence. They never act.
• Policy (rate caps, dropped inputs) is enforced silently and is never evidence.
• Several independent sources are needed before anything escalates.
• Shadow mode is enforced by type: the shadow path holds a log-only sink.

Repository layout

• src/ plugin code (Java 25)
• oracle/ capture parser, differ, fit command
• src/test/resources/regression/ quarantined and regression fixtures. Do not edit.
• docs/STATUS.md current state
• docs/VERIFICATION.md gaps, tests, decisions
• docs/CHANGELOG.md decisions with reasons
• docs/SHADOW_EXIT_CRITERIA.md frozen criteria. Changes need a recorded reason.
• docs/MILESTONE-3-SPEC.md server-side rules (block break, reach, combat geometry, corrections)
• docs/CAPTURE-PROTOCOL.md how humans record official-client captures
• docs/MEGA-PROMPT.md the current job for agents

Test harness

• Cinnabar: a Rust Bedrock client, used as a headless driver for plumbing and load tests. Its physics and timing are unverified. Its traffic is non-vanilla.
• Xvfb is needed for Cinnabar on a Wayland desktop.
• Fixture: local PNX server on 127.0.0.1:19132. xboxAuth: false is required for Cinnabar.

Running

mvn -B test                 # plugin tests
cd oracle && mvn -B test    # oracle tests

Report the test counts with failures and skips. Disabled tests are not passing.

Who decides what

• Agents: implement specs, write tests, measure, document.
• Humans: approve decisions, fill reviewer fields, play official-client capture courses, review would-have-fired samples, and decide on any enforcement tier.

Not yet decided

• G7: permanent-trigger blind spot (leniency expiry)
• U10 fix status (see VERIFICATION.md)
• Reviewers for G1, G3, G4
• BDS binary availability (Milestone 3)
• Reach cap policy