{
  "schema": "phishdestroy.reading-edition.v2",
  "schema_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/article.schema.json",
  "object_type": "Dated article reading edition with PDF digest",
  "id": "output_steam_network/index",
  "language": "en",
  "title": "Steam automation: public code and platform controls — The Steam Dossier",
  "author": "PhishDestroy Team",
  "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html",
  "source_file": "steam_dossier/output_steam_network/index.html",
  "source_html_sha256": "72849dd247df36d5614e95d4e3b751c3d4f995f883f1e37cba23bc270b3b3596",
  "exported_at": "2026-10-18T11:58:30.589Z",
  "edition_date": "2026-10-18",
  "scope": {
    "text": "Authored discussion and analytical tables from the current source HTML. Interactive controls and navigation are omitted; interactive datasets remain linked.",
    "omissions": [],
    "evidence_status": "The signature authenticates this publication, not the truth or authenticity of third-party evidence."
  },
  "pdf": {
    "filename": "output_steam_network__index.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/output_steam_network__index.pdf",
    "sha256": "b281c152ae2afa8f1fda7056887d804a3c06f98e848ebf09116b5613d2791ecc",
    "bytes": 223250,
    "pages": 6
  },
  "integrity": {
    "signed_object": "output_steam_network__index.content.json",
    "signature_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/output_steam_network__index.content.json.asc",
    "checksum_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/output_steam_network__index.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "scope": "Exact UTF-8 JSON bytes, including content and the PDF SHA-256. No cryptographic PDF document signature is asserted."
  },
  "license": {
    "identifier": "CC0-1.0",
    "application": "Authored material only; third-party material retains its own rights.",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb"
  },
  "content": {
    "text": "Contents · Live article\n\nExhibit VII · Technical Architecture Analysis\nSteam Network Architecture — Protocol Fidelity & Ecosystem Analysis\n\nAutomation has public infrastructure.\n\nWHAT THIS SECTION PROVES\n\nThis module maps 252 public repositories, 3,320 GitHub profiles and 4,214 distinct profile–repository pairs in the collected Steam automation network. These records document public software and relationships between profiles and repositories. They provide a basis for examining automation capabilities and platform controls; they do not establish every operator's identity, Valve's knowledge of particular activity, or the absence of vulnerabilities in the software.\n\n18 October 2026 · scope clarification. Earlier wording overstated what this repository collection could establish about vulnerabilities, intent and revenue. The analysis below distinguishes documented interfaces and public software from conclusions that require operational or internal evidence.\n\n← Back to Executive briefing\n\nThe collected repositories make parts of the automation ecosystem inspectable: libraries implement client protocols, interact with Steam services and expose programmatic capabilities. Valve's Steamworks Web API overview confirms that Steam provides HTTP APIs, including public methods and protected methods requiring authentication. The existence of an interface establishes a technical capability; it does not establish that every use is authorized, safe or known to Valve.\n\nWhat the public software establishes\n\nThe collection includes projects such as SteamKit, node-steam-user, ValvePython/steam and ArchiSteamFarm. Their public code and documentation are sources for studying client-protocol implementations, message schemas and automated workflows. This network analysis is not a comprehensive vulnerability audit of those projects. Repository membership, a fork or a contribution also does not by itself identify a bot operator or establish involvement in a particular theft. The accountability question is which controls apply to the documented capabilities and what evidence exists of their enforcement.\n\nPillar 01 · Protocol Fidelity\nOfficial Protobuf Schemas\n\nAutomation libraries do not bypass security gates. They serialize official Protobuf messages (steammessages_clientserver.proto) over TCP/WebSockets directly to Valve's official CM clusters, exactly as the Steam Client does.\n\nPillar 02 · Algorithmic 2FA\nAuthentication and programmatic access\n\nClient libraries can expose authentication and trade-related workflows. Assessing a particular use requires evidence about the account, credentials, permissions and applicable controls. A library's capability alone does not prove that Valve authorized an operator or designed the feature for abuse.\n\nPillar 03 · Commercial Beneficiary\nFees need a defined calculation\n\nFee analysis needs a stated item price, currency, platform charge, publisher charge and rounding rule. A combined charge should not automatically be described as revenue retained by Valve. The repository graph does not measure transaction volumes, fees paid or account-purchase revenue. See the separate card economy analysis for its data and calculation assumptions.\n\nModule 01 · Repository & Protocol Evidence\nPublic Developer & Repository Infrastructure\n\nDetailed forensic catalog of 252 open-source repositories powering Steam automation. Traces how standard software engineering tools implement Valve's published API endpoints without exploits.\n\n252Repositories\n4,554Role Links\nInspect repository evidence → Module 02 · Ecosystem Demographics\nGlobal Engineering Ecosystem Metrics\n\nGeographic and institutional breakdown of 3,320 software engineers contributing to the Steam automation ecosystem, including corporate affiliations across major technology employers.\n\n3,320Engineers\n98,902Connection Pairs\nInspect ecosystem metrics → Module 03 · Interactive Visual Graph\nInteractive Protocol & Developer Network Graph\n\nComprehensive Vis.js interactive network graph mapping repositories, protocol libraries (SteamKit, Steamworks, ASF), and cross-project contributor overlaps. Visually demonstrates the legitimate, interconnected open-source software architecture powering Steam's automation ecosystem.\n\nInteractiveVis.js Engine\nCluster IsolationLive Search\nZero ExploitsStandard APIs\nLaunch interactive network graph →\nRegulatory & Legal Context (GDPR Article 25 & Consumer Protection):\nUnder the principle of Data Protection by Design and by Default, a platform architecture that permits silent API-key generation, unnotified trade cancellation, and machine-automated asset liquidation is an architectural choice of the platform operator. When Valve systematically rejects consumer reimbursement claims by asserting that losses were caused by \"external cyberattacks,\" it conceals that the attack vector is Valve's own intentionally designed Web API architecture.\n\nINTERACTIVE VIEW\n\nFull interactive visualisation of the 252-repository, 3,320-developer network graph is available at network.html. Aggregate metrics are on the BI Metrics page.\n\nThe Steam Dossier · Technical Architecture Archive · Public Source Records · All rights surrendered to humanity.",
    "headings": [
      {
        "level": 1,
        "text": "Steam Network Architecture — Protocol Fidelity & Ecosystem Analysis",
        "anchor": "pd-output_steam_network__index--heading-1",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "level": 3,
        "text": "Official Protobuf Schemas",
        "anchor": "pd-output_steam_network__index--heading-2",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "level": 3,
        "text": "Authentication and programmatic access",
        "anchor": "pd-output_steam_network__index--heading-3",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "level": 3,
        "text": "Fees need a defined calculation",
        "anchor": "pd-output_steam_network__index--heading-4",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "level": 2,
        "text": "Public Developer & Repository Infrastructure",
        "anchor": "pd-output_steam_network__index--heading-5",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "level": 2,
        "text": "Global Engineering Ecosystem Metrics",
        "anchor": "pd-output_steam_network__index--heading-6",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "level": 2,
        "text": "Interactive Protocol & Developer Network Graph",
        "anchor": "pd-output_steam_network__index--heading-7",
        "source_url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      }
    ],
    "links": [
      {
        "label": "Live article",
        "url": "https://phishdestroy.io/steam_dossier/output_steam_network/index.html"
      },
      {
        "label": "← Back to Executive briefing",
        "url": "https://phishdestroy.io/steam_dossier/index.html#briefing-heading"
      },
      {
        "label": "Steamworks Web API overview",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "card economy analysis",
        "url": "https://phishdestroy.io/steam_dossier/card_economy"
      },
      {
        "label": "Module 01 · Repository & Protocol Evidence Public Developer & Repository Infrastructure Detailed forensic catalog of 252 open-source repositories powering Steam automation. Traces how standard software engineering tools implement Valve's published API endpoints without exploits. 252Repositories 4,554Role Links Inspect repository evidence →",
        "url": "https://phishdestroy.io/steam_dossier/output_steam_network/valve_ru_farming_isolated.html"
      },
      {
        "label": "Module 02 · Ecosystem Demographics Global Engineering Ecosystem Metrics Geographic and institutional breakdown of 3,320 software engineers contributing to the Steam automation ecosystem, including corporate affiliations across major technology employers. 3,320Engineers 98,902Connection Pairs Inspect ecosystem metrics →",
        "url": "https://phishdestroy.io/steam_dossier/output_steam_network/steam_ecosystem_dashboard.html"
      },
      {
        "label": "Module 03 · Interactive Visual Graph Interactive Protocol & Developer Network Graph Comprehensive Vis.js interactive network graph mapping repositories, protocol libraries (SteamKit, Steamworks, ASF), and cross-project contributor overlaps. Visually demonstrates the legitimate, interconnected open-source software architecture powering Steam's automation ecosystem. InteractiveVis.js Engine Cluster IsolationLive Search Zero ExploitsStandard APIs Launch interactive network graph →",
        "url": "https://phishdestroy.io/steam_dossier/output_steam_network/network.html"
      },
      {
        "label": "network.html",
        "url": "https://phishdestroy.io/steam_dossier/output_steam_network/network.html"
      },
      {
        "label": "BI Metrics",
        "url": "https://phishdestroy.io/steam_dossier/output_steam_network/steam_ecosystem_dashboard.html"
      }
    ],
    "tables": [],
    "cited_source_ids": []
  },
  "resources": []
}