# V2 Game Data Integrity

V2 game data files use SHA-256 hash verification on load to detect tampered
assets before they can affect boot, streaming, simulation, cosmetics, economy,
or online play. The integrity plan covers shipped `.pak` archives, IoStore
containers, cooked asset registry files, shader code libraries, localization
bundles, and dedicated-server cooked data.

## Verification Contract

`V2/ue/Build/DRM/v2-game-data-integrity.json` defines every protected data
surface and writes release evidence under the DRM archive. Each surface requires
a signed manifest, per-chunk hashes, startup baseline verification, and
streaming chunk verification. The runtime contract is hash verification on load:
the client or server verifies the data surface before trusting a loaded asset or
streamed chunk.

Required surfaces:

- Pak archives
- IoStore containers
- Cooked asset registry
- Shader code libraries
- Localization bundles
- Server cooked data

## Mismatch Response

Missing files, unexpected files, hash mismatches, signed manifest failures, and
chunk hash failures all detect tampered assets. A mismatch enters safe-boot
repair behavior without crashing, disables online play and ranked access, and
blocks progression grants until a verified repair or reinstall restores the
signed data set.

The plan depends on the offline license cache contract so offline grace mode
cannot bypass corrupted game data checks.

## CI Gates

`V2/ue/Tools/plan-v2-game-data-integrity.py` emits the deterministic game data
integrity plan. `V2/ue/Tools/check-v2-game-data-integrity.py` validates the
manifest, planner output, offline license cache dependency, BuildGraph package
surfaces, Horde wiring, CI workflow wiring, and this runbook.

Required release gates:

- `drm-game-data-integrity-plan-generated`
- `drm-game-data-integrity-surface-coverage`
- `drm-game-data-integrity-on-load-hash-verification`
- `drm-game-data-integrity-tamper-detection`
- `drm-game-data-integrity-safe-mismatch-response`

The on-load gate requires SHA-256 verification for every protected data surface,
and the safe-mismatch gate requires non-crashing repair behavior for every
surface.