[LIghtJUNction]

What changes

Replace /@root/web/'s introduction/local mini-game with a real-data constellation you can fly through. Each public user has a stable geometric star, their posts orbit it, and actual reply relationships form navigable arcs. An optional six-step expedition rewards discovering users, reading posts and following a reply without generating any writes. Drag, wheel/pinch, WASD, keyboard catalog and mobile layouts are supported; a perspective Canvas fallback retains navigation when WebGL is unavailable.

The renderer, deterministic scene/signing model and data/UI controller are separate local assets assembled into the packaged release page. No CDN, telemetry, synthetic users or production demo activity.

Data and private orbit

• GET/HEAD /_universe projects bounded cursor-based user/post pages through the existing anonymous executor and current ACL checks. Selected stars can page their older posts independently. Hidden reply targets are not disclosed.
• /_universe/me derives its account only from the current browser session and uses the existing read-only browser credential. Private conversations and message satellites live in a separate scene, never public counts, graph, search or caches. Hide/switch/account-change clears private state and the signing session.
• Public post, reply and private chat actions use explicit client-side Ed25519 signing compatible with the CLI protocol. The optional local identity.key seed is never uploaded; the imported signing key is non-extractable, memory-only, expires after ten minutes and is discarded when the page hides. Browser login does not silently acquire write authority. Uncertain retries retain their request ID.

Security boundary requiring review

Only the exact packaged release w_root_web/index.html, identified by its content digest, receives same-origin connectivity and a SHA-256-pinned script CSP. Modified root content, other sites and untrusted hosted bytes retain the opaque-origin sandbox. No unsafe-eval or external scripts are enabled. Resource text is rendered as text, not injected HTML. Existing hosting isolation tests remain, with the root release test updated to assert the precise exception.

Verified on 2026-10-01

Head: daa5583f609cd474eaf6ddc8eb7d70dd53b97769.

Dedicated PR verification passed: https://github.com/TokenNotIncluded/msg/actions/runs/36874526990

• PostgreSQL/Python 3.15: 31 tests passed, zero failures/errors/skips, including all five new universe tests, release upgrade/idempotency, browser workspace and untrusted hosting isolation. The new tests cover private-data filtering, session-derived private conversations, pagination/cursor binding, exact-release CSP and real Unicode WebCrypto-to-executor Ed25519 interoperability with idempotent replay.
• Real Chromium/WebGL under the production CSP: passed. Exercised drag navigation, user selection, reading a post, following a reply, anonymous private-view denial, authenticated private/public separation, explicit signed submission, mobile overflow and keyboard access. No browser page errors.
• Dedicated Ruff check/format and the repository's Python quality workflow: passed.
• Screenshots and JUnit: artifact post-universe-evidence from the run above. Desktop, close-up star, private orbit and mobile images use isolated test fixtures, not live users or a deployed preview.

The hosting, credential, storage-session, recovery, subject-view, client and service-alias boundary workflows have also passed. Broader integration/rewrite/deployment-rehearsal workflows were still running at the last check; this is not a claim that the complete repository suite has finished.

No merge or deployment has been performed. Design details and verification commands: docs/post-universe.md. The temporary source-transfer workflow has been removed; the retained verification workflow has read-only permissions.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.