blockyard 0.0.9 → 0.1.1

package/server/tls/selfsigned.js

@@ -0,0 +1,160 @@
+// A SELF-SIGNED CERTIFICATE, MADE HERE (operator, 2026-09-15: "Can we make the signing process
+// part of the installer to generate per-user certs for their nodes?" -- then "make https the
+// forced default"). Node can make a key pair and sign bytes but cannot write an X.509
+// certificate, and this repository has no dependencies by decision, so the certificate is
+// assembled by hand: a v3 TBSCertificate in DER, signed with ECDSA P-256 over SHA-256, wrapped
+// in PEM. Every install gets its own key and its own certificate, valid for a little over two
+// years, naming the addresses the monitor is reached on (subjectAltName), and the server makes
+// one on first start when no certificate of the operator's own is configured.
+//
+// The shape is the one `openssl req -x509` produces: issuer == subject (CN=blockyard),
+// basicConstraints CA:TRUE, keyUsage digitalSignature+keyCertSign, extKeyUsage serverAuth. A
+// browser warns once per address, as with any self-signed certificate, and then remembers it.
+// Node's own X509Certificate parses the result, which is what the tests hold it to.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+
+// ---------------------------------------------------------------- DER, the little that is needed
+const len = (n) => {
+  if (n < 0x80) return Buffer.from([n]);
+  const b = [];
+  for (let x = n; x > 0; x = Math.floor(x / 256)) b.unshift(x & 0xff);
+  return Buffer.from([0x80 | b.length, ...b]);
+};
+const tlv = (tag, body) => Buffer.concat([Buffer.from([tag]), len(body.length), body]);
+const seq = (...parts) => tlv(0x30, Buffer.concat(parts));
+const set = (...parts) => tlv(0x31, Buffer.concat(parts));
+const int = (v) => {
+  let b = Buffer.isBuffer(v) ? Buffer.from(v) : Buffer.from([v]);
+  while (b.length > 1 && b[0] === 0 && !(b[1] & 0x80)) b = b.subarray(1);
+  if (b[0] & 0x80) b = Buffer.concat([Buffer.from([0]), b]);
+  return tlv(0x02, b);
+};
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0]));
+// (arcs as an array, not dotted text: the address-hygiene test reads a four-arc OID as an IPv4 address)
+const oid = (arcs) => {
+  const p = Array.isArray(arcs) ? arcs : String(arcs).split('.').map(Number);
+  const out = [40 * p[0] + p[1]];
+  for (const v of p.slice(2)) {
+    const s = [];
+    let x = v;
+    do { s.unshift(x & 0x7f); x = Math.floor(x / 128); } while (x > 0);
+    for (let i = 0; i < s.length - 1; i++) s[i] |= 0x80;
+    out.push(...s);
+  }
+  return tlv(0x06, Buffer.from(out));
+};
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+const octet = (b) => tlv(0x04, b);
+const bits = (b, unused = 0) => tlv(0x03, Buffer.concat([Buffer.from([unused]), b]));
+const utc = (d) => {
+  const p = (n) => String(n).padStart(2, '0');
+  return tlv(0x17, Buffer.from(`${p(d.getUTCFullYear() % 100)}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`, 'ascii'));
+};
+const ctx = (n, body, constructed = true) => tlv((constructed ? 0xa0 : 0x80) | n, body);
+
+// an IP address as the bytes subjectAltName wants: four for v4, sixteen for v6
+export function ipBytes(addr) {
+  const kind = net.isIP(addr);
+  if (kind === 4) return Buffer.from(addr.split('.').map(Number));
+  if (kind !== 6) return null;
+  let a = addr;
+  // an embedded v4 tail (::ffff:192.0.2.1) becomes its two hextets
+  const m = a.match(/^(.*:)(\d+\.\d+\.\d+\.\d+)$/);
+  if (m) { const b = m[2].split('.').map(Number); a = `${m[1]}${((b[0] << 8) | b[1]).toString(16)}:${((b[2] << 8) | b[3]).toString(16)}`; }
+  const [head, tail = ''] = a.split('::');
+  const hs = head ? head.split(':') : [], ts = tail ? tail.split(':') : [];
+  const fill = a.includes('::') ? 8 - hs.length - ts.length : 0;
+  const hex = [...hs, ...Array(Math.max(0, fill)).fill('0'), ...ts];
+  if (hex.length !== 8) return null;
+  const out = Buffer.alloc(16);
+  hex.forEach((h, i) => out.writeUInt16BE(parseInt(h, 16), i * 2));
+  return out;
+}
+
+const pem = (label, der) => `-----BEGIN ${label}-----\n${der.toString('base64').replace(/(.{64})/g, '$1\n').replace(/\n$/, '')}\n-----END ${label}-----\n`;
+
+/**
+ * Make a self-signed certificate and its private key.
+ * @param {object} [o]
+ * @param {string} [o.cn='blockyard']       the common name (issuer and subject alike)
+ * @param {string[]} [o.sans=[]]            addresses and names the certificate is valid for
+ * @param {number} [o.days=825]             validity, from `now`
+ * @param {number} [o.now=Date.now()]
+ * @returns {{ cert: string, key: string, fingerprint: string, notAfter: number, sans: string[] }}
+ */
+export function makeSelfSigned({ cn = 'blockyard', sans = [], days = 825, now = Date.now() } = {}) {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const spki = publicKey.export({ type: 'spki', format: 'der' });
+  const ECDSA_SHA256 = oid([1, 2, 840, 10045, 4, 3, 2]);
+  const name = seq(set(seq(oid([2, 5, 4, 3]), utf8(cn))));
+  const notBefore = new Date(now - 5 * 60 * 1000);                 // five minutes of clock skew
+  const notAfter = new Date(now + days * 86_400_000);
+  const serial = crypto.randomBytes(16); serial[0] &= 0x7f;        // positive, 128 bits
+  // the names: unique, addresses as bytes, everything else as a DNS name
+  const uniq = [...new Set(sans.map((s) => String(s).trim()).filter(Boolean))];
+  // [2] dNSName and [7] iPAddress are IMPLICIT: the tag replaces the string's own, so the body is
+  // the bare bytes (an IA5String TLV inside read back as '"\u0016\u0009localhost"')
+  const names = uniq.map((s) => { const ip = ipBytes(s); return ip ? ctx(7, ip, false) : ctx(2, Buffer.from(s, 'ascii'), false); });
+  const ext = (id, critical, body) => seq(oid(id), ...(critical ? [bool(true)] : []), octet(body));
+  const extensions = [
+    ext([2, 5, 29, 19], true, seq(bool(true))),                                  // basicConstraints CA:TRUE
+    ext([2, 5, 29, 15], true, bits(Buffer.from([0x84]), 2)),                     // keyUsage: digitalSignature, keyCertSign
+    ext([2, 5, 29, 37], false, seq(oid([1, 3, 6, 1, 5, 5, 7, 3, 1]))),                   // extKeyUsage: serverAuth
+    ...(names.length ? [ext([2, 5, 29, 17], false, seq(...names))] : []),        // subjectAltName
+  ];
+  const tbs = seq(
+    ctx(0, int(2)),                       // version 3
+    int(serial),
+    seq(ECDSA_SHA256),
+    name,                                 // issuer
+    seq(utc(notBefore), utc(notAfter)),
+    name,                                 // subject: the same, which is what "self-signed" means
+    spki,
+    ctx(3, seq(...extensions)),
+  );
+  const signature = crypto.sign('sha256', tbs, { key: privateKey, dsaEncoding: 'der' });
+  const cert = pem('CERTIFICATE', seq(tbs, seq(ECDSA_SHA256), bits(signature)));
+  const key = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  const x = new crypto.X509Certificate(cert);
+  return { cert, key, fingerprint: x.fingerprint256, notAfter: Date.parse(x.validTo), sans: uniq };
+}
+
+/** A name as it compares: an IP by its bytes (Node prints v6 expanded and upper-case), a DNS name lower-case. */
+export const canonName = (s) => { const b = ipBytes(String(s).trim()); return b ? `ip:${b.toString('hex')}` : String(s).trim().toLowerCase(); };
+/** The names a certificate carries, canonical (canonName), IPs and DNS names alike. */
+export function certNames(certPem) {
+  const x = new crypto.X509Certificate(certPem);
+  return (x.subjectAltName ?? '').split(',').map((s) => s.trim().replace(/^(DNS|IP Address):/, '')).filter(Boolean).map(canonName);
+}
+
+/**
+ * The monitor's own certificate under `dir`: made on first use, kept after that, remade when it
+ * is within a fortnight of expiry or no longer names one of `mustName`. Returns the files and
+ * whether anything was written.
+ */
+export function ensureSelfSigned(dir, { sans = [], mustName = [], days = 825, now = Date.now(), force = false } = {}) {
+  const certFile = path.join(dir, 'cert.pem'), keyFile = path.join(dir, 'key.pem');
+  let why = null;
+  if (force) why = 'asked to';
+  else if (!fs.existsSync(certFile) || !fs.existsSync(keyFile)) why = 'none yet';
+  else {
+    try {
+      const x = new crypto.X509Certificate(fs.readFileSync(certFile, 'utf8'));
+      const have = certNames(fs.readFileSync(certFile, 'utf8'));
+      const missing = mustName.filter((n) => !have.includes(canonName(n)));
+      if (Date.parse(x.validTo) - now < 14 * 86_400_000) why = `it expires ${x.validTo}`;
+      else if (missing.length) why = `it does not name ${missing.join(', ')}`;
+      else if (!x.checkPrivateKey(crypto.createPrivateKey(fs.readFileSync(keyFile, 'utf8')))) why = 'the key does not match it';
+    } catch (err) { why = `it cannot be read (${err.message})`; }
+  }
+  if (!why) return { certFile, keyFile, made: false, why: null };
+  const made = makeSelfSigned({ sans: [...new Set([...sans, ...mustName])], days, now });
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const write = (file, text) => { const tmp = `${file}.tmp`; fs.writeFileSync(tmp, text, { mode: 0o600 }); fs.renameSync(tmp, file); };
+  write(keyFile, made.key);
+  write(certFile, made.cert);
+  return { certFile, keyFile, made: true, why, fingerprint: made.fingerprint, notAfter: made.notAfter, sans: made.sans };
+}

package/systemd/blockyard.service

@@ -68,11 +68,13 @@ Environment=BLOCKYARD_NODE_URL=http://127.0.0.1:8331
 Environment=BLOCKYARD_DATADIR=/home/bitcoin/.bitcoin
 Environment=BLOCKYARD_LOGFILE=/home/bitcoin/.bitcoin/debug.log
 Environment=BLOCKYARD_LOG_LEVEL=info
-# ACCESS: accounts are OFF by default, so anyone who can reach the bound addresses
-# reads this monitor (role "viewer": charts, feeds, read-only RPC console). User
-# administration, the audit trail and node writes stay closed to them. Uncomment to
-# require sign-in (accounts, roles, sessions, CSRF, per-user audit):
-#Environment=BLOCKYARD_AUTH=1
+# ACCESS: hardened out of the box (2026-09-15) -- bound to 127.0.0.1 and sign-in ON;
+# the first start prints the admin password once (or set BLOCKYARD_ADMIN_PASSWORD).
+# To serve a LAN address put it in config/local.json (`server.hosts`) or uncomment
+# the first line; to open the monitor to readers with no account, the second --
+# then anyone who can reach the bound addresses reads it as role "viewer".
+#Environment=BLOCKYARD_BIND=0.0.0.0
+#Environment=BLOCKYARD_AUTH=0
 #
 # Node writes stay off, and while accounts are off they stay off even if actions are
 # enabled -- a write with no identity behind it is not attributable. Enabling needs
@@ -82,15 +84,46 @@ Environment=BLOCKYARD_LOG_LEVEL=info
 #Environment=BLOCKYARD_ENABLE_ACTIONS=1
 #Environment=BLOCKYARD_ACTIONS=testmempoolaccept,savemempool
 
-# Modest hardening. NoNewPrivileges plus a read-only /home is enough here: the
-# service must read the node's RPC cookie and log, so a full PrivateTmp/
-# ProtectSystem=strict would fight the thing it is monitoring.
+# SANDBOX (audit 2026-09-16, M8). This block used to be "modest hardening", and its comment said
+# NoNewPrivileges plus a read-only /home was enough -- but no read-only /home was ever set, and it
+# claimed ProtectSystem=strict would stop the service reading the node's cookie. It would not:
+# strict makes paths READ-ONLY, and reading is all the monitor does with the node. Everything below
+# was started and checked against this app (tests/unit-sandbox note in docs/INSTALL.md section 6).
+#
+# The whole filesystem is read-only to the service except what it writes: its data directory
+# (sessions, history, audit trail, TLS certificate), its config directory (the node form and the
+# Display settings save there), and the address index if you configured one. EDIT ME: these paths
+# follow WorkingDirectory above; add the index directory (`addressIndex` in config/local.json) as a
+# third ReadWritePaths line. The leading "-" skips a path that does not exist yet.
+ReadWritePaths=-/storage/blockyard/data
+ReadWritePaths=-/storage/blockyard/config
+#ReadWritePaths=/var/lib/blockyard-index
+ProtectSystem=strict
+# The node's cookie and log are usually under a home directory: readable, never writable.
+ProtectHome=read-only
+PrivateTmp=true
+PrivateDevices=true
+UMask=0077
 NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
 ProtectKernelTunables=true
 ProtectKernelModules=true
+ProtectKernelLogs=true
 ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+ProtectProc=invisible
+RestrictNamespaces=true
+RestrictRealtime=true
 RestrictSUIDSGID=true
 LockPersonality=true
+# AF_NETLINK: the boot check that a configured address exists reads the interfaces through it.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+# NOT MemoryDenyWriteExecute: V8's JIT needs writable-executable memory, and node aborts under it.
 
 StandardOutput=journal
 StandardError=journal

package/docs/PRIVATE-LEADERBOARD.md

@@ -1,230 +0,0 @@
-# Blockchain leaderboards for the Diversions — scoping report
-
-**Private local document.** Gitignored via `docs/PRIVATE-*.md`. Not a decision, not a commitment —
-a scoping of what this would actually take, written 2026-09-13.
-
-> Note on the privacy guard: `test/privacy.test.js` scans `git ls-files`, so an ignored file is
-> outside it. That is how a real LAN address reached a commit earlier today. Nothing sensitive
-> should go in here on the assumption a test will catch it.
-
----
-
-## The short answers
-
-| question | answer |
-|---|---|
-| Do we need a Bitcoin address? | **Only if you want on-chain writes or signed identity.** A working leaderboard needs neither. |
-| How do people submit scores? | **A replay, not a score.** The server re-plays the game and computes the score itself. |
-| Can we do it for free? | **Yes, entirely** — if "use the blockchain" means *seed from a block hash and anchor by timestamp*. **No** if it means *one transaction per score*. |
-| What is the hard part? | **Not the blockchain.** It is proving a score was earned rather than typed into a POST body. |
-
----
-
-## 1. The insight this whole design rests on
-
-The three games were built with a pure-rules / screen split, and the rules are **deterministic by
-construction**. This was done for testability, but it is exactly what a trustworthy leaderboard
-needs.
-
-Verified headless under Node on 2026-09-13:
-
-```
-tetris.js   newGame(seed) with a seeded rng(seed); newGame(12345) twice → identical queue
-arkanoid.js hash01(key) everywhere, NO Math.random — capsules, minion lanes, drift phases
-breakout.js launch angle is an argument, not a roll
-all three   "no DOM, no canvas, no clock"; they import and run fine in plain Node
-```
-
-Entry points for a replay: `step(g, dtMs)` (breakout, arkanoid), `tick(g)` / `move` / `rotate` /
-`hardDrop` (tetris). `tetrust.js` already drives the rules from a **fixed-step accumulator**
-(`while (G.acc >= ms)`), so a game is already a discrete sequence of steps, not a wall-clock
-animation.
-
-**Therefore the server can replay a submitted game and recompute the score.** That is real
-anti-cheat, and it does not involve Bitcoin at all.
-
-## 2. What "use the blockchain" can usefully mean here
-
-Four options, ranked by what they actually buy:
-
-### (a) Block hash as the game seed — free, and the best fit
-
-The tip hash at game start becomes the seed. This gives three properties for nothing:
-
-- **Unpredictable** — nobody can pre-compute a favourable piece order, because nobody knows block
-  N+1's hash. (Miners have a marginal grinding advantage; irrelevant at this stake.)
-- **A lower time bound** — a game seeded from block N provably was not played before block N. That
-  is a real timestamp, from our own node, at zero cost.
-- **A fair shared round** — everyone playing "the block 966,781 round" gets the same piece order, so
-  scores are comparable in a way they never are with per-player seeds. This is the genuinely novel
-  bit: a *per-block tournament*.
-
-We already have the data: `/api/blocks` returns hashes, and the monitor is watching a node anyway.
-
-### (b) OpenTimestamps anchoring — free, proves *when*
-
-Hash the leaderboard state periodically and submit the digest to public OTS calendar servers, which
-aggregate thousands of digests into one transaction. Produces a Bitcoin-anchored proof that the
-leaderboard said X at time T, and costs nothing because the calendar operator pays the fee.
-
-Cost: one outbound HTTPS call to a third party, which conflicts with this project's "outbound
-connections are limited and on demand" stance — it would need to be opt-in and documented in
-`docs/SECURITY.md` alongside the exchange APIs.
-
-### (c) OP_RETURN per score — cheap, not free, and probably wrong
-
-Real numbers from the node right now: fee estimates ≈ **5.65e-06 BTC/kvB ≈ 0.57 sat/vB**, relay
-floor 1 sat/vB. A minimal OP_RETURN transaction is ~200 vB → **~200 sats ≈ 15¢** at $77k.
-
-But: needs a funded wallet, key custody, a UTXO set to manage, change handling, fee bumping when the
-mempool moves, and it puts arcade scores in every archival node on Earth, for ever. It also requires
-passing the node-writes gate, which currently needs four independent yeses and is off by default.
-
-**Recommendation: no.** Use (a) for fairness and (b) for timestamping.
-
-### (d) Signed scores for pseudonymous identity — free via RPC, but legacy addresses only
-
-A player signs their submission with a Bitcoin key; the address is their leaderboard identity. No
-funds, no on-chain footprint.
-
-**Partly wrong as first written, corrected 2026-09-13 after the operator asked "why do we need
-crypto primitives — can't we just use the bitcoind rpc?".** They were right.
-
-*Verifying* a user's signature needs no crypto code at all: **`verifymessage` is already permitted
-by our own allowlist** and the node does the pubkey recovery. Confirmed it genuinely evaluates
-rather than stubbing — a malformed signature errors `-3 Malformed base64 encoding`, and a bech32
-address errors `Address does not refer to key`.
-
-What survives is an **asymmetry**: the node can verify, but it cannot sign *for us*. The Umbrel has
-no wallet loaded (`listwallets` → `[]`), `signmessage` is in our own deny list as a wallet mutator,
-and asking a user's node to hold the monitor's identity is the wrong layer anyway. So:
-
-- **users proving they control an address** → pure RPC, no crypto, no dependency;
-- **the monitor holding its own identity and signing attestations** → local keys, which is a
-  custody decision rather than a coding one.
-
-Node 22 does have enough for the second if wanted: secp256k1 DER sign/verify, `ripemd160`, and
-therefore hash160 — a P2WPKH address derives zero-dependency (verified: produced a valid bech32
-address with a ~40-line encoder). It is *recovery* from a compact signature that Node lacks, and
-only the monitor-side signing path would need it.
-
-**THE REAL CONSTRAINT IS ADDRESS TYPE, NOT CRYPTO.** Measured against the node on 2026-09-13:
-
-| address | `verifymessage` |
-|---|---|
-| P2PKH `1...` | **works** — returned `false` for a wrong signature, i.e. it evaluated |
-| P2SH `3...` | error: `Address does not refer to key` |
-| P2WPKH `bc1q...` | error: `Address does not refer to key` |
-| P2TR `bc1p...` | error: `Address does not refer to key` |
-
-Core's `verifymessage` implements the old "Bitcoin Signed Message" scheme, which is defined only
-for P2PKH. **Most modern wallets — including the one on an Umbrel — hand out `bc1q` or `bc1p`
-addresses, and those users cannot sign this way at all.** That is the main obstacle to the
-user-identity design, and no amount of our own code fixes it, because the limitation is in the
-signing standard rather than in us.
-
-Options, in order of how much they cost:
-
-1. **Accept legacy-only**, and say so in the UI: "paste a `1...` address". Many wallets can still
-   produce one; Sparrow, Electrum and Core itself can sign with a legacy key. Free, honest, and
-   excludes some users.
-2. **BIP-322** — the modern generalised signing scheme covering segwit and taproot, and what `bc1`
-   wallets actually implement. **Checked, and the answer is no:** Core 31.1.0 (`/Satoshi:31.1.0/`)
-   exposes `verifymessage`, `signmessage`, `signmessagewithprivkey`, `signrawtransactionwithkey`,
-   `signrawtransactionwithwallet` and `enumeratesigners` — and **no BIP-322 method of any name**.
-   So the node cannot verify a segwit or taproot signature for us. Supporting `bc1` identities means
-   implementing BIP-322 verification ourselves, which needs precisely the secp256k1 primitives the
-   RPC route was chosen to avoid. That is a substantial piece of work and a dependency-rule
-   conversation, not an afternoon.
-3. **Do not use Bitcoin signing for identity at all** — a chosen display name plus the replay proof.
-   The replay is what makes a score trustworthy; the address only says *who*. If the leaderboard is
-   local or shared-by-export, a name is sufficient and costs nothing.
-
-## 3. Recommended design
-
-**Decision taken 2026-09-13: identity means _users prove who they are_** — the monitor holds no
-key, signs nothing, and custodies nothing. Everything below assumes that.
-
-**Per-block tournaments, verified by replay, identified by address, anchored by timestamp.**
-
-1. A round opens when a block lands. Its hash seeds every game in that round.
-2. The player plays locally, exactly as now.
-3. On game over, the client submits a **replay**: `{ game, seedBlock, seedHash, steps[], claimedScore }`
-   where `steps[]` is the discrete input sequence the fixed-step loop already produces.
-4. The server imports the same pure rules module, replays the steps, and computes the score itself.
-   The claimed score is ignored except as a cross-check — a mismatch is a rejected submission.
-5. Accepted entries join the round's board. When the round closes (next block), the board is hashed
-   and optionally OTS-anchored.
-
-**Identity, if a player wants one** (optional — an anonymous entry is still replay-verified):
-
-- The server issues a challenge string tied to the round (`blockyard:<round>:<nonce>`).
-- The player signs it in their own wallet and pastes address + signature.
-- We call `verifymessage` — already permitted by the allowlist, no crypto code, no key on our box.
-- `validateaddress` first, so a `bc1` address is refused with *"legacy `1...` addresses only, see
-  BIP-322 note"* rather than a confusing `Address does not refer to key`.
-
-Two allowlist additions are needed, one line each: `validateaddress` and `deriveaddresses`. Both
-are read-only and currently denied only because nothing had asked for them.
-
-**Testing this path needs no wallet.** `signmessagewithprivkey` takes a WIF and a message and
-returns a signature, so a test can generate a genuine legacy-address signature as a fixture and
-assert that our verification accepts it and rejects a tampered message — without depending on a
-wallet existing on whatever node the suite runs against. That matters: the Umbrel has none
-(`listwallets` → `[]`), and the fake node in `scripts/fake-node.js` would otherwise have to grow a
-signing implementation.
-
-Why this is worth doing: the leaderboard is **verifiable by anyone**. Given the replay, any third
-party can recompute the score using the same public rules file. That is a much stronger claim than
-most leaderboards can make, and it comes from the determinism that already exists.
-
-## 4. What it actually costs to build
-
-| piece | size | notes |
-|---|---|---|
-| Record inputs in the three screen modules | **M** | The fixed-step loop already exists; capture `(stepIndex, action)` pairs. Arkanoid is the fiddliest — mouse position per step needs quantising or it is unreplayable. |
-| Headless replay harness | **S** | The rules already import under Node. Mostly a loop and a score readout. |
-| Replay determinism tests | **M** | The real work: proving client and server agree on every float. **See §5.** |
-| Submission API + storage | **S** | One POST, one GET, a JSON file per round. |
-| Round lifecycle from block events | **S** | The monitor already emits new-tip events. |
-| Leaderboard UI | **M** | A page, a per-round board, a "verify this replay yourself" button. |
-| OTS anchoring | **S** | Optional, opt-in, one HTTPS call. |
-| **Total** | **~2-4 days** | Assuming local/self-hosted scope. |
-
-## 5. The risks, honestly
-
-- **Floating-point determinism is the sharp edge.** `breakout.js` and `arkanoid.js` advance ball
-  physics with floats. Same JS engine, same order of operations, same result — but client and server
-  are *different Node/browser builds*, and any divergence makes an honest player's replay fail
-  verification. **This must be proven before building anything else**: record N real games in a
-  browser, replay them server-side, and assert bit-identical scores. If it does not hold, the fix is
-  integer or fixed-point physics, which is a rules rewrite. Tetris is much safer here — it is
-  integer grid logic.
-- **Replay size.** A ten-minute Arkanoid game at 60 steps/second is ~36,000 steps. Compressible
-  (most steps are "no input"), but it is not a 20-byte score.
-- **A leaderboard is inherently shared, and this app is not.** Blockyard is a single-user LAN
-  monitor that ships open-access with a `viewer` ceiling. A *global* leaderboard means **you run a
-  hosted service** — with moderation, abuse handling, data retention, and an endpoint strangers
-  POST to. That is a different product with different obligations, not a feature of this one.
-  Three honest scopes:
-  - **Local only** — verified replays, your own high scores, no server. Nearly free to build.
-  - **Shared export** — a signed/anchored replay file you can hand to someone else to verify.
-  - **Hosted leaderboard** — the real product, and the one with ongoing cost and duty of care.
-- **Replay does not stop a bot.** It proves the score was *achievable under the rules*, not that a
-  human earned it. A perfect Tetris bot submits perfectly valid replays. Per-block rounds limit the
-  damage (everyone gets one shot at that seed) but do not eliminate it.
-- **Scope creep into custody.** The moment there is a funded address, this stops being a monitor and
-  becomes something holding other people's money-adjacent state. Option (c) is where that starts,
-  which is the strongest argument against it.
-
-## 6. Recommendation
-
-1. **Spike the determinism question first** (half a day). Everything else is wasted if browser and
-   server disagree on ball physics.
-2. Build **local-only** verified replays with block-hash seeds. Free, no address, no third party, no
-   hosted service, and it delivers the interesting half: provably fair rounds and self-verifying
-   scores.
-3. Add **OTS anchoring** only if "provably at this time" matters to you. Opt-in, documented as an
-   outbound connection.
-4. **Do not** put scores on-chain per-game, and **do not** introduce a funded wallet.
-5. Treat a hosted global leaderboard as a separate product decision, not a Diversions feature.