[curtadams]

For turn-level AI, the only thing the Dom3 team need do is publish the client file descriptions. That is very little work. We can do the rest.

Security requires that the only thing coming from the clients back to the servers is orders and that the only thing coming from the servers to the clients is nation-specific info. This has to be done even if the client flie descriptions aren't published. Obfuscated files or not, Norfleet just demonstrates what every security professional will say, which is that concealment doesn't give usable security. Once that's done, you can't hack Dom3 from the client files, period.

Making the server recognize only orders from the client is trivial if it's not already done that way. You can sync order creation and check by having both run off a "doableBy(Commander commander)" method in the Order interface/abstract class. Item transfers and the gem/money spinners would need to be implemented as orders rather than as operations on the world model but that's easy if not already done.

Having the client (player's) view of the world operate from a representation of their knowledge of the world rather than the actual world model is not trivial but worth the effort even if not already done. Actually, even thinking about doing it the other way makes my head hurt - that would be WAY harder.