feat(queen): faces on the leaderboard, a way in on the roadmap, and rules that stopped being true

[gHashTag]

Three changes that answer one complaint: the board measured the game and never invited anyone into it.

The leaderboard shows people, not lane numbers

A lane signed @login in TRIOS_KEY_OWNERS now draws that person's GitHub avatar and links their profile. The connection is direct — the issues, the branches and the pull requests a bee opens all live on GitHub — so a leaderboard of faces is an invitation where a leaderboard of key #7 was a log.

The avatar is github.com/<login>.png, a public redirect: no API call, no token, no rate limit, and a 404 leaves the row readable. The login is validated twice — once on the server, once again on the page — because it ends up in an href and an <img src>, and a page that trusts a remote string to build a profile link can be pointed at somebody else's account. @alex/../torvalds, @alex.png, mail@example.com and a 40-character handle are each refused by name in a test.

This also fixes a real defect seen at 440 px on the live board: "Accepted" and "Bee hours" landed on top of each other. The three numbers now ride in one box.

The roadmap asks people in

The tab said how far the rewrite has to go and never said that anyone could push it. A measurement is not a reason for a stranger to stay.

The count of open port issues is now a button that opens the real GitHub search — the issues themselves, not a page about the project — and the text says the two things a newcomer does not know: that the work is cut into one file per issue, and that they need neither permission nor prior .t27 to take one. The number costs no extra request; it is the stage-progress search the bars already make, read as all - done.

The rules said there was no ranking

specs/catalog/onboarding.t27 is the rules of the game as a machine reads them: it compiles, its test blocks are evaluated, and only then is it published at t27.ai/llms.txt and t27.ai/agents.t27. One of its stated unknowns was:

"what a contribution is worth: there is no reward, no token and no ranking, and inventing one would break the honesty law above"

That stopped being true when LEADERBOARD shipped. Under a law that removes any claim which cannot be traced to a source, a claim contradicted by the thing we just built cannot be left standing.

The ranking is now stated where it can be checked — both addresses, both numbers, how it is derived — and in the same breath, that it buys nothing and converts to nothing. A seventh way in joins the six: a person who would rather lend than write can lend one provider key, which runs one bee. The pair that could quietly rot is tested together: a ranking arrived, and the rule against asking a reader for a credential did not move.

The tutorial

The LEADERBOARD tab invites people to lend a lane and nothing anywhere told them how. how-to-join-the-swarm is that missing page, in English and Russian: the game, the two ways in, the board tab by tab, the seven laws, and where a free provider key comes from.

The research behind its provider table is the part worth reading. The invitation runs into agreements that forbid it in explicit words — OpenAI bars transferring API keys, Anthropic names the API key directly, Google says credentials "may not be embedded in open source projects" — with no carve-out for non-commercial use. So the post leads with the design that asks nobody to breach anything: the key never moves and the bee runs on the contributor's own machine, the way AI Horde and BOINC work. That is named as missing here rather than implied as available.

Checks

• qa/queen-contrast-contract.mjs — 24 pairs over a lit and a dark field, worst 5.39:1.
• qa/tri-identity-contract.mjs — 669 checks. qa/queen-language-contract.mjs — 375 EN / 375 RU.
• scripts/onboarding-from-spec.mjs — 10 test blocks, 54 asserts, all hold; 7 join steps published.
• npm run typecheck:ratchet — no file gained errors (179 baseline).

Server side: gHashTag/BrowserOS#511.

{
  "version": 1,
  "head_sha": "f22bf5d35b58c14f4f226578707bf162259ca70c",
  "summary": "The leaderboard draws the GitHub people behind the lanes, the roadmap turns its open-issue count into a way in, and the machine-readable rules stop claiming there is no ranking now that XP exists.",
  "changes": [
    "Draw a lane holder's GitHub avatar and link their profile when the operator signed the lane as an at-login",
    "Validate the login again on the page rather than trusting the wire, because it becomes an href and an image source",
    "Put the three leaderboard numbers in one box so they cannot overlap when a row wraps on a phone",
    "Turn the roadmap's count of open port issues into a button that opens the real GitHub search",
    "Say on the roadmap that the work is one file per issue and needs neither permission nor prior t27",
    "Correct the onboarding spec, which stated there was no reward, no token and no ranking",
    "State the XP rule, both addresses and the fact that XP buys nothing, where the spec's own tests check it",
    "Add a seventh way in for a person who would rather lend a provider key than write code",
    "Publish a bilingual tutorial that explains the game, every tab of the board, the seven laws and both ways in",
    "State in that tutorial what each provider agreement actually says about handing a key to somebody else, quoting it"
  ],
  "tests": [
    {
      "command": "node scripts/onboarding-from-spec.mjs",
      "result": "the spec compiles and publishes; 10 test blocks, 54 asserts, all hold, 7 join steps",
      "status": "passed",
      "evidence": "The generator refuses to publish unless every test block in the spec evaluates true."
    },
    {
      "command": "node --experimental-strip-types qa/queen-contrast-contract.mjs",
      "result": "24 pairs measured over a lit and a dark field, worst 5.39 to 1, 28 stylesheets walked",
      "status": "passed",
      "evidence": "The new roadmap invitation panel is grounded on the veil and measured with the rest."
    },
    {
      "command": "node --experimental-strip-types qa/queen-language-contract.mjs",
      "result": "Queen language contract PASS with 375 English keys and 375 Russian keys",
      "status": "passed",
      "evidence": "Every new string on the roadmap is written in both languages and the counts stay balanced."
    },
    {
      "command": "npm run typecheck:ratchet",
      "result": "179 errors across 26 files against a baseline of 179; no file gained type errors",
      "status": "passed",
      "evidence": "Ratchet output on this branch."
    }
  ],
  "limitations": [
    "A face appears only where the operator wrote an at-login in TRIOS_KEY_OWNERS; until a person can submit their own key there is no self-service way onto the board",
    "The roadmap's open count comes from the first stage that carries a progress query, so it understates the work available across the other seven stages"
  ],
  "tags": [
    "queen",
    "leaderboard",
    "onboarding"
  ],
  "blog": {
    "title": "A board that measured the game but never invited anyone in",
    "summary": "The leaderboard now shows the GitHub people behind the lanes, the roadmap turns its own count into a way in, and the machine-readable rules were corrected where shipping XP had made them false.",
    "outline": [
      "A leaderboard of key numbers is a log; a leaderboard of faces is an invitation, and the connection to GitHub was there all along.",
      "The login is checked twice because it becomes a profile link, and a page that trusts a remote string can be pointed at a stranger's account.",
      "The roadmap counted how far the rewrite has to go and never said that a passing reader could push it along.",
      "The rules of the game are a spec whose tests run before publication, and one of its stated unknowns had been made false by our own work.",
      "Correcting it was not optional: the same law that forbids an unsourced number forbids a claim contradicted by the thing we shipped."
    ]
  }
}

🤖 Generated with Claude Code