cat/tribes

feat: session-secret rotation script — one value everywhere or nobody logs in

2026-08-16T14:05:00-06:00

scripts/rotate-session-secret.sh mints a fresh SESSION_SECRET and pushes it to every prod worker (apex + all versioned hosts) plus the write-only TRIBES_SESSION_SECRET GH secret in one pass, never printing the value. Needed because all hosts share the .tribes.pub cookie domain: a cookie minted on the apex must verify on every versioned host, so the secret must rotate everywhere at once. Cost: one forced re-login.

feat: v0.4.0 map effects — the event log gets a visual twin

2026-08-16T13:51:33-06:00

The world map now animates the story it was already logging. A new effects layer (web/src/render/effects.ts) derives transient visuals from the frame event channels: battles pop crossed swords with an expanding winner-tinted ring and per-side loss floats; captured settlements burn under the captor's double shockwave; foundings bloom a banner; raids and caravan hits float their losses; buildings pop their own glyph when they come online and burn when they fall; starvation counts its dead; threats arrive with a pop (demon gates through a portal) and fade when cleared. Grammar: five shared primitives (ring, stepped glyph pop, fade, flame flicker, float text) composed per event kind. Effects age by wall clock so they read at any sim speed, coalesce per tile so max speed pulses instead of strobing, and evict texture before drama at the 24-effect cap. Pure presentation: POV-aware ingest reads the engine's fog-filtered channels, never engine state; idle cost stays zero via the existing dirty-flag paint loop. Protocol/engine: building_complete, building_destroyed, raid, and starvation events now carry x/y (all emission sites + dev-mock). Events stay out of stateHash; note viewFor now delivers these to any tribe with vision of the location — scripts can see raids they watch happen. Dev: window.__fx console hook (dev builds) drives synthetic effects for tuning; web tsconfig gains vite/client types for the DEV gate.

feat: v0.3.1 balance patch — the economy works, the formula audits, tribes meet

2026-08-16T10:39:59-06:00

Driven by two independent agent-fleet tournament reports (72 controlled sims, converging findings). Nine signals addressed: THE TOOL FAMINE (P0): all 8 tournament scripts across both fleets ended every sim at 0% tool coverage — the documented economic spine was unreachable from the docs. Root causes fixed: (1) spawn fairness now guarantees forest/hills/ore CLAIMABLE at tier-0 budget, not merely visible at radius 8; (2) ore rate scales with claimed veins (60 + 30/extra); (3) the smithy craft split uses fixed-point accumulators — a 400-permille weapons split actually yields weapons (largest-remainder gave every unit of tiny output to the heaviest target). A docs-only naive bot now builds the full chain and arms itself. LEGIBILITY (P0): build/found/muster/advance drops emit order_dropped events with the reason (capped 8/tick). Docs warn that sequential plans + silent drops are the classic freeze; primitives ships planBuilder which reads the events and skips blocked steps. Feeds render the reasons. SCORING (P1): buildings score STANDING structures with a usefulness audit (occupied houses only; per-type cap 8 full then half) instead of a lifetime completion counter; settlements score 10+10*tier instead of flat 40; defense scores (walls/towers in the military term, and fortification combat power x2.5 so investment repels); the age total-score multiplier is retired (flat 150/age + the real rate bonuses) killing the advance() spam lottery; coin scores min(coin, coinEarned)/20 + tradeVolume/40. MARKET & LADDER (P2): wantAmount:0 gifts/tribute actually deliver now (documented since v2, mechanically dead — matching skipped zero crosses); gifted coin is score-inert by construction, closing the flagged Elo collusion vector before it ever worked. Peddler pays 400/600 permille. The nightly ladder plays every lineup in BOTH slot orders, cancelling the spawn/slot variance that swamped strategy (1064 vs 48 same code+seed). Also: expansion decree was missing from the state hash (latent since it shipped); goldens repinned; isolation re-verified (1v1 0% never-meet, FFA 14% pair-never). Known residual: development under sustained raid pressure still suppresses harder than defense can answer — a dedicated anti-suppression pass (raid diminishing returns) is future work.

feat: settlement smoke + spawn distance ceiling — tribes actually meet

2026-08-16T10:08:11-06:00

Measured on scattered spawns: peaceful 1v1s NEVER met (6/6 sampled) and FFA pairs only met when a warband marched — contact was 100% military. Two fixes: (1) settlement smoke — a settlement announces itself at 12/18/26/34 tiles by tier (visible from any of your settlements/warbands, regardless of terrain vision; fires sighted events and appears in enemySettlements). Units stay fogged. (2) spawn scoring gains a nearest-neighbor CEILING at ~45% of map size alongside the 18-tile floor, so arenas vary without stranding anyone past every horizon. Remeasured: 1v1 6/6 met (~t1500, when camps become towns); FFA 29/36 pairs met (19% never — inside the <=20% target), every tribe meeting at least one neighbor in every sim. Goldens repinned; trade scenario re-seeded (70). Dev only — ships to prod with the next release.

feat: spawns scatter per seed — no ring, biased apart, never overlapping

2026-08-16T09:52:06-06:00

The fixed spawn ring (3/8 radius, even angles, identical geometry every seed) becomes seeded best-candidate scatter: each spawn samples 24 random candidates past the ocean margin and keeps the farthest from everyone placed, with a hard-priority 18-Chebyshev separation floor (two fairness radii - terraforms can never pave each other) and heavy water penalties. Every seed is now a different arena; placement stays deterministic. Also tightens the water fairness quota: the guaranteeing water tile must itself sit inside the radius-8 window (rim adjacency to unseen water at r9 no longer counts; a pond is dug instead). Goldens repinned; battle and ages scenario tests re-seeded (41, 83); balance matrix verified healthy.

fix: pool items align icon with title in a two-line grid

2026-08-16T09:37:21-06:00

feat: identicons on the Simulate page — pools, roster slots, sims list

2026-08-16T09:32:20-06:00

chore: nightly dead-sim retry batch 32 -> 150 (dispatch is cheap fetches)

2026-08-16T09:31:24-06:00

feat: urizen identicons per script + million-name friendly-id space

2026-08-16T09:28:09-06:00

Identicons: hash(script id) -> one Urizen tile (blank/solid tiles skipped by deterministic ink-ratio probe, ruler columns excluded) x 20 tints x 12 border colors ≈ 1M stable combinations; initials remain as the pre-atlas fallback and hovers carry the true identity when the pigeonhole pinches. Shown in browse rows, the detail header, and proof chips. Friendly ids: adjective pool grows to 219 and every noun pool to ~130-150 (pools stay disjoint), and collisions now escalate to a second adjective (sly-ashen-wolf) before any numeric tag: ~30k short names per category, then 6-7M two-word names. Stored ids never re-derive, so existing names are untouched.

fix: proper syntax highlighting, proof chips, quiet date pickers

2026-08-16T09:20:15-06:00

One shared scanner-based highlighter (web/src/highlight.ts) replaces the two regex one-offs: real lexer states for strings/templates/comments, distinct token colors (strings green, numbers/literals violet, keywords amber, function names yellow, state/memory/api builtins blue). Proof rows become participant chips in place order — initials, crown glyph on the winner, full result in the hover — instead of a sentence per sim. Date filter inputs stay text-dim until they hold a value; picker glyph dimmed.

feat: display-name changes carry a 7-day cooldown

2026-08-16T09:02:37-06:00

Names are leaderboard identity; churn would make records unattributable. An effective change (including clears) stamps name_changed_at; further changes inside 7 days get a bad_input with the unlock time, same-value writes are no-ops, and the sharing toggle is unaffected. UserInfo exposes nameLockedUntil; the Account card shows the lock.

fix: owners are never 'anon' — display names + friendly-id fallback

2026-08-16T08:53:16-06:00

Browse showed 'anon' for every owner because shoo pairwise identities carry no name. Owners now fall back to their friendly user id, and the Account card gains a display-name editor (PATCH /api/me {name}, sanitized, 40 chars; also settable via the set_sharing MCP tool). Cron/ladder sim computes now dispatch as self-invocations via SELF_ORIGIN so each replay gets its own CPU budget instead of sharing the scheduled() budget, and the nightly retry batch grows to 32.

fix: dead sim computes self-heal; login screen speaks agent

2026-08-15T23:46:09-06:00

The create-time replay is the only thing that rated a public sim — if it died (CPU limit, crash) the sim was orphaned forever: no metrics, no rating, and public sims reject client backfill. On prod 44 of 57 public sims were orphaned this way, which also explains leaderboards showing W-L records with zero battles (only quick, often battle-free duels survived to the board). Now a metrics GET on an unrated public sim re-triggers the server compute in the background, and the nightly cron retries a bounded batch. Both paths are idempotent (metrics first-write, rating_events PK). Also: the sign-in card now carries the agent pointer block (auth.md, llms.txt, MCP, REST) so an agent landing on a login wall knows exactly where to go instead of panicking.

fix: account merge preserves public sharing

2026-08-15T23:08:19-06:00

public_sharing lives on the user row; merging a sharing-enabled device account into a never-shared site account silently delisted the whole portfolio. The merge now ORs the flag. Regression test added.

chore: release script copies prod r2_buckets and limits into versioned configs

2026-08-15T23:05:21-06:00

fix: badges never truncate and get their own table column

2026-08-15T22:58:49-06:00

.model-chip loses its 16ch ellipsis cap; listed/model/linked badges move out of the name cell into a dedicated nowrap column.

fix: Create page uses the viewport; state column stops word-wrapping

2026-08-15T22:55:23-06:00

Wide layout (1560px) with the scripts table taking the 3fr column; STATUS and EXPIRY collapse into one compact cell that only says something noteworthy — 'rejected' in red, or the expiry date for unpinned scripts. Starred rows say nothing: the star IS pinned. Table cells never break mid-word.

fix: Connect is two semantic columns, not a card bag

2026-08-15T22:51:41-06:00

Left: your account (account, identities, danger zone). Right: your agent (connection card with docs folded in, examples). The paste-a-pubkey 'add device key' flow is gone entirely — UI and endpoint — the pairing code IS how devices join. Identities show human labels ('shoo account', 'device 1a2b3c4d') with the raw identifier in a tooltip, and the link-code output tells you exactly what to say to your agent. Sign-in copy no longer mentions token minting.

feat: device-pairing link codes — no more console-paste account linking

2026-08-15T22:47:51-06:00

Connect > Identities gains 'Generate link code': a short single-use code (10-min expiry, sha-256 stored) that the device redeems — POST /api/keys/link {code} or the new MCP link_account tool — merging the device's account into the code-minting account. The gh-auth-login pattern: the browser session authorizes the target, holding the key's bearer token authorizes the source; nobody pastes signatures into a console. The signed programmatic path remains as fallback.

feat: the social fishbowl — sharing, Elo boards, R2 storage, keypair identity

2026-08-15T22:40:54-06:00

PUBLIC SHARING: a one-time toggle + starring lists a script in Browse with owner-editable metadata (title, description, model attribution from a daily-synced models.dev catalog, opt-in source sharing). Uploads are normalized (comment/whitespace-stripped) and hashed; a copy of another user's listed script soft-links to the canonical. Hearts bookmark others' scripts into a liked pool usable in create_sim (+ ex_ example ids). Trash: soft delete with 14-day restore; account deletion (REST-only) anonymizes canonicals others depend on. RATED SIMS: all-slots-listed sims are public and rated by the SERVER replay only — pairwise Elo (K=24), idempotent per sim, sim_results as watchable proof. Windowed boards rank rating gained (24h/7d/30d/6m); updated/battled sorts; a bounded nightly ladder auto-matches rating-adjacent scripts. R2 STORAGE: script sources (src/.js) and sim metrics move to an R2 bucket; D1 keeps thin index rows with dual-read legacy fallback + nightly backfill. Metrics are content-addressed by REPLAY IDENTITY (sha256(seed+config+slot hashes), derived server-side — uploads cannot land anywhere else) so identical roster+seed sims share one object. KEYPAIR IDENTITY: the default credential is a device ed25519 keypair (~/.config/tribes/identity.json, see /auth.md). POST /api/keys/auth signs tribes-key-auth:: and mints the key's single wire token (replaced each mint). Authorized-keys model: GET/add/revoke identities in Connect; shoo login becomes an optional link (account merge). The Tokens page and /api/tokens are gone. user_identities lets one account hold many credentials. robots.txt welcomes agents. WEB: dashboard split into Connect / Create / Browse / Simulate tabs; Browse is public (leaderboard, model filters, detail with proof sims, head-to-head, versions, shared source). MCP: 10 new tools; llms.txt documents the whole meta. Worker suite: 107 tests over a real-SQL node:sqlite D1 fake + Map-backed R2.

feat: territory as strategy — expansion decree, living borders, reachable ages

2026-08-15T21:36:20-06:00

Territory is a choice, not physics. New decree('expansion', 0-1000, default 500): the base camp footprint is automatic, but all reach beyond it — tier, age, and population (+1 claim budget per 25 of isqrt(pop), capped) — is scaled by the decree. Isolationists stay deliberately small; manifest destiny claims every acre and borders keep creeping as the civilization grows, so the territory chart no longer flatlines at tier 3. Ages were unreachable in practice: age 1 needs 100 hides, hides come from herd slaughter, and the founding herds were culled at the first slow tick for lack of pasture. The hall now shelters a small founding flock (6 herd + 2 herder slots), and the reference bots manage herds with hysteresis (slaughter fat flocks, spare thin ones), build pastures with pop, and express territorial identity through the expansion dial. Docs updated (decree table, territory-as-choice section, pasture note); goldens repinned; test harness opts into full expansion explicitly.

test: rework engine suite for the humble start (34 passing)

2026-08-15T21:20:30-06:00

growBot harness bootstraps a ten-soul camp through the real build/tech chains; goldens repinned; new invariant tests for the humble start, threat grace, muster gating, sieges, ages, and sub-floor starvation. Root typecheck now runs per-package tsc (tsc -b had no root project); web vitest passes with no test files.

feat: openlayers-style map camera — cursor wheel zoom, drag pan, minimap

2026-08-15T21:20:30-06:00

Presentation-only camera over the native-resolution canvas: zoom-to-fit default (reset via fit button, replacing zoom 1:1), wheel/pinch zoom anchored at the cursor (fit x0.8 to 8x), pointer drag pan with edge clamping, and a 140px minimap with viewport rectangle that recenters on click and hides when the whole map fits. Tooltips account for the transform; no page scroll in any mode.

feat: make the war meta fire — stone bootstrap, raid no-ops, phased bots, bigger maps

2026-08-15T21:20:30-06:00

- mine costs timber only (stone came only from miners, so a misspent starting 20 stone permanently locked a tribe out of the metal economy) - raids on a target with no garrison, near-floor pop, and bare stores no longer resolve: no more farming a beaten camp for infinite battle wins - warlord founds mining outposts properly: packs only affordable supplies, respects settle distance, retries instead of one-shotting; routes stone home alongside ore - bulwark and magnate get phased labor policies (farm-first to ~150 pop, then their identity diet), affordability-aware build chains, reachable muster gates, and a landlocked check before betting on docks - map ladder up one tier: 2-3 tribes 48, 4-5 64, 6-8 80 - most games now end with real wilderness between borders (~13% claimed in a 4-way) - docs updated (map sizes, raid rule, mine bootstrap note) Balance matrix (3 seeds x 8k ticks): every archetype wins somewhere (homesteader 6, bulwark 5, warlord 5, magnate 2 of 18); bulwark counters warlord 2/3; battles 87-1208 per warlord game, 0 in peaceful matchups.

feat: organic territory claims + Ages prestige ladder

2026-08-15T20:41:00-06:00

- territory: multi-source bucket-Dijkstra claims with terrain costs (plains 1, forest 2, swamp 3, mountain 5; water/river/volcano unclaimable) budgeted by tier — natural borders, chokepoints, no overlap; census/capacity derive from claims; TribeView.claims + SettlementView.territoryTiles; map renders true claim edges instead of squares - ages: advance verb burns an escalating hoard to climb wandering->settled->crafting->high; each age +10% extraction/refinement, +3 warband power per soldier, flat score term and +25%-per-age score multiplier (prestige accelerator); age_advanced events; bots attempt advancement periodically; violet 'age' series in the score breakdown

feat: tribe-scaled worlds, anti-rush drilling, resilient collapse, territory borders, identity cards

2026-08-15T20:24:12-06:00

- mapSizeForTribes: 2-3 tribes -> 32, 4-5 -> 48, 6-8 -> 64; mapgen floor 32 - anti-rush: starter armory cut to 24 weapons/8 armor; fresh warbands drill 250 ticks (60% power, raid/besiege refused) — WarbandView.drilling - collapse resilience: settlement pop floor (40), threat arson capped above 6 buildings, hall grants kitchen-garden farmer + salvage woodcutter slots; wars now end in devastated remnants and recovery, never extinction spirals - map: dashed tribe-tinted territory borders per settlement (tier radius) - chronicle rail: identity cards (portrait, name, @description parsed from script source, version ref); live vitals/feeds move to world mode - bots: adaptive muster size, warlord feeds his war machine, @description tags; balance matrix now warlord>homesteader, bulwark>warlord, magnate>warlord

feat: 64x64 world, fullscreen no-scroll HUD, distant-view glimpse band

2026-08-15T20:04:55-06:00

- MAP_SIZE back to 64; mapgen climate bands, biome blobs, lakes and veins now scale by area (old 128 sims still replay at their locked config) - app locks to 100dvh with internal-only scrolling; endgame is a dismissible overlay with a HUD victor chip; home page in scroll columns - distant view: persistent glimpse band (vision +5) reveals terrain CATEGORY only ('.', 'f', '^', 'w' - veins hidden), hashed state, rendered at 35% alpha; TribeView.distant for scripts; overlay no longer intercepts the replay invite in world mode

feat: instant chronicle, game-feel HUD, Qud-style terrain variation

2026-08-15T19:38:24-06:00

- server precomputes full sim metrics at create_sim (waitUntil, 120s CPU limit); share links render the finished chronicle + endgame instantly; first-viewer client fallback POSTs the cache (first-write-only, gzipped, shape-checked); workerd encodeBody:'manual' + D1 blob normalization - UI redesigned as a 1-bit terminal wargame console: VT323, punched-frame HUD panels, CHRONICLE/WORLD mode toggle, segmented game clock, faction panels with Urizen portraits, victory banner, telemetry-styled charts - map: per-cell deterministic terrain variants + decor + tone jitter + shoreline treatment (23 new hand-picked tiles) - world replay is opt-in: WATCH THE REPLAY boots the deterministic runner

chore: replace middle-dot separators with plain hyphens repo-wide; untrack output/ screenshots

2026-08-15T19:06:59-06:00

chore: footer credit removed — art credit lives in README only (CC0)

2026-08-15T19:05:27-06:00