docs(adr): slice 3 design - security role model + moderation commands (ADR-0005)

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    open-pull-requests-limit: 25
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      dotnet-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "*"
+      dotnet-major:
+        update-types:
+          - "major"
+        patterns:
+          - "*"

.github/release-drafter.yml

@@ -0,0 +1,95 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+commitish: main
+
+version-resolver:
+  major:
+    labels:
+      - 'breaking-change'
+  minor:
+    labels:
+      - 'type: feat'
+  patch:
+    labels:
+      - 'type: fix'
+      - 'type: docs'
+      - 'type: refactor'
+      - 'type: test'
+      - 'type: chore'
+      - 'type: ci'
+      - 'type: revert'
+  default: patch
+
+autolabeler:
+  - label: 'type: feat'
+    title:
+      - '/^feat(\(.+\))?(!)?:/i'
+  - label: 'type: fix'
+    title:
+      - '/^fix(\(.+\))?(!)?:/i'
+  - label: 'type: docs'
+    title:
+      - '/^docs(\(.+\))?(!)?:/i'
+  - label: 'type: refactor'
+    title:
+      - '/^refactor(\(.+\))?(!)?:/i'
+  - label: 'type: test'
+    title:
+      - '/^test(\(.+\))?(!)?:/i'
+  - label: 'type: chore'
+    title:
+      - '/^chore(\(.+\))?(!)?:/i'
+  - label: 'type: ci'
+    title:
+      - '/^ci(\(.+\))?(!)?:/i'
+  - label: 'type: revert'
+    title:
+      - '/^revert(\(.+\))?(!)?:/i'
+  - label: 'breaking-change'
+    title:
+      - '/^(feat|fix|docs|refactor|test|chore|ci|revert)(\([^)]*\))?!:/i'
+
+categories:
+  - title: '⚠️ Breaking Changes'
+    labels:
+      - 'breaking-change'
+  - title: '🚀 Features'
+    labels:
+      - 'type: feat'
+  - title: '🐛 Bug Fixes'
+    labels:
+      - 'type: fix'
+  - title: '📚 Documentation'
+    labels:
+      - 'type: docs'
+  - title: '🔄 Refactoring'
+    labels:
+      - 'type: refactor'
+  - title: '✅ Tests'
+    labels:
+      - 'type: test'
+  - title: '🔧 Maintenance'
+    labels:
+      - 'type: chore'
+      - 'type: ci'
+      - 'type: revert'
+
+include-labels:
+  - 'type: feat'
+  - 'type: fix'
+  - 'type: docs'
+  - 'type: refactor'
+  - 'type: test'
+  - 'type: chore'
+  - 'type: ci'
+  - 'type: revert'
+  - 'breaking-change'
+
+exclude-labels:
+  - 'skip-changelog'
+  - 'internal'
+
+template: |
+  ## Changes
+
+  $CHANGES

.github/workflows/pr-title-check.yaml

@@ -0,0 +1,13 @@
+name: PR Title Check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+  statuses: write
+
+jobs:
+  validate:
+    uses: LayeredCraft/devops-templates/.github/workflows/pr-title-check.yml@v10.1

.github/workflows/release-drafter.yaml

@@ -0,0 +1,20 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  draft:
+    uses: LayeredCraft/devops-templates/.github/workflows/release-drafter.yml@v10.1
+    with:
+      event_name: ${{ github.event_name }}
+      pr_draft: ${{ github.event.pull_request.draft == true }}

SPEC.md

@@ -179,9 +179,13 @@ configuration and open items.
 
 Explicitly out of scope for v1, to revisit later:
 
-- **Moderation/admin tooling**: permission levels (player/builder/admin),
-  mute/kick/ban, admin commands, audit logging. Known future need, not
-  designed yet.
+- **Moderation/admin tooling**: permission levels, mute/kick/ban, admin
+  commands — designed, see
+  [ADR-0005](docs/adr/0005-security-role-model-and-moderation-commands.md)
+  and
+  [PLAN-0005](docs/plans/0005-security-role-model-and-moderation-commands.md);
+  not yet implemented. Audit logging remains undesigned, tracked as an
+  open item in PLAN-0005.
 - **Soft-code/scripting engine**: revisit once data/config-driven NPC and room
   behavior proves insufficient.
 - **Procedural frontier generation algorithm**: choice of generation approach

docs/accounts-auth.md

@@ -147,8 +147,15 @@ silently skipped).
   "non-empty" is enforced.
 - Password reset flow — with no email/OAuth identity backing the account,
   there's no "forgot password" recovery path; not designed. Likely
-  admin-assisted reset only (ties into deferred moderation tooling, see
-  `SPEC.md`).
+  admin-assisted reset only (ties into the moderation tooling designed in
+  [ADR-0005](adr/0005-security-role-model-and-moderation-commands.md), not
+  yet implemented).
+- Ban enforcement — designed in
+  [ADR-0005](adr/0005-security-role-model-and-moderation-commands.md)/
+  [PLAN-0005](plans/0005-security-role-model-and-moderation-commands.md)
+  (a banned `PlayerBehavior.IsBanned` rejects login at password
+  verification), not yet implemented — today, login has no concept of a
+  banned user at all.
 - The password itself travels in cleartext over Telnet (only the on-screen
   *display* is suppressed) — no transport encryption exists yet; SSH (see
   [networking.md](networking.md)) would be the natural place this gets