Detections and mitigations

The lifecycle of a flag

1. Observe. A packet arrives for a tracked player and is handed to the processors that care about it.
2. Simulate. Movement is replayed against a compensated view of the world: blocks the server changed but the client has not acknowledged yet still count as solid, and the client's own uncertainty is tracked separately.
3. Decide. If the observed result and the simulated result disagree beyond the current tolerance, the check records a violation.
4. Report. The violation raises a violation level, feeds the event stream, paints an alert and a verbose line, and is stored with the session when storage is enabled.
5. Act. checks.yml decides whether an alert turns into a log entry, a webhook, a broadcast, a ban or a cloud ban wave.

Violation level, decay and thresholds

• Violation level (VL) is the accumulated evidence for one check on one player. Alerts name it as x47 or similar.
• Decay removes a little of that VL over time so honest players do not drift into a punishment after hours of play.
• Setback VL is the level at which Venus stops accepting the player's position and corrects it.
• expire-after in a punishment group forgets a violation entirely after the configured number of seconds, independent of decay.

Categories

Checks are grouped by prefix, and that prefix is also the middle segment of their permission node. The categories you will see most often:

• prediction — the movement simulation itself, including phase and ground spoofing.
• combat — kill aura, aim patterns, auto-clicker, reach and hitbox checks.
• badpackets — impossible or contradictory client input: invalid pitch, duplicate slots, spoofed abilities, out-of-order interactions.
• packetorder — ordering between packets that must arrive in a fixed sequence.
• breaking, scaffolding, multiactions — world interaction and doing two things at once.
• timer, velocity, sprint, elytra, vehicle, inventory, chat, crash, exploit — exactly what the names suggest.

The full check set with each check's state and current violation level can be inspected through the check registry from a plugin.

Mitigations

A mitigation is an action short of a punishment. Venus applies three kinds: correcting a position (setback), vetoing a packet outright, and asking the client to resync. Staff who hold venus.mitigations can see them as they happen, which is often the clearest signal that something is wrong with a player.

Cloud detections

Cloud checks classify behaviour over a longer window than any single packet: patterns across a fight, an inventory, or a whole session. They arrive through the same alert pipeline and carry a confidence rather than a VL. Server owners can act on them or ignore them; they are configured through the cloud settings and the cloud service at the plugin level.

Experimental checks

Some checks ship disabled because they are still being tuned. They can be enabled in the configuration and are expected to produce false flags on unusual but legitimate clients. Run them on a test server before enabling them in production.