| `forge/` | #322-next | git forge — hosting, GitHub-light UI + JSON API, forks/PRs with real merges, issues as pod resources, did:nostr + xlogin, Bitcoin-anchored history (Blocktrails); zero deps, zero build |

| `recordweb/` | — | [RecordWeb](https://github.com/recordweb) (RWP) node — institutional Records with `did:rwp`, content-addressed immutable snapshots in a version DAG (RFC 8785 + SHA-256 + Ed25519), one-way finalization, Merkle-rooted Cases; DID resolver + verify; **zero deps, zero seam gaps** — the four landed seams suffice for a from-scratch protocol |

| `ripple/` | [webcontracts#4](https://github.com/webcontracts/webcontracts.github.io/issues/4) | Ryan Fugger's ORIGINAL Ripple (2004) — bilateral trustlines, BFS payment routing through chains of pre-granted credit, creditor-only settle, hash-chained transition log (trustline.v1); signed single-balance bookkeeping, bigint micro-units, UI page; single-server atomicity honest, federation is the named next flavour |

| `globs/` | — | ranked realtime match server for [NEONGLOBS](https://melvincarvalho.github.io/neonglobs/) (a Globulos tribute) — matchmaking + bots + ELO + leaderboard over `ws.route`; server re-runs the game's deterministic sim as authority, vendored with a **bit-identical node↔Chromium parity contract** (the cross-engine float-determinism finding) |

Plus one directory that is a scenario, not a plugin:

[`federation-demo/`](./federation-demo/) — **two** JSS instances federating

plugins: [

{ module: at('relay/plugin.js'), prefix: '/relay' },

{ module: at('webrtc/plugin.js'), prefix: '/webrtc' },

{ module: at('globs/plugin.js'), prefix: '/globs', config: { aimTimeMs: 300 } },

{ module: at('terminal/plugin.js'), prefix: '/terminal', config: { token: 'compose-secret' } },

{ module: at('tunnel/plugin.js'), prefix: '/tunnel' },

{

Ranked online play for [NEONGLOBS](https://melvincarvalho.github.io/neonglobs/)

(a Globulos tribute): matchmaking, server-authoritative physics, three bot

levels, ELO ratings, and a leaderboard — as a #206 loader plugin.

plugins: [{ id: 'globs', module: 'globs/plugin.js', prefix: '/globs' }]

- `WS {prefix}/play` — the match protocol (documented at the top of

`plugin.js`): `hello` → `queue` → `matched` → per round

`phase`/`commit`/`reveal`/`result` → `matchEnd`.

- `GET {prefix}/leaderboard` — top 50 by rating, player count, bot anchors.

NEONGLOBS rounds are *simultaneous secret commitments* resolved by a

deterministic, fixed-timestep sim — a round is a pure function of its

commitments. So the server relays one small message per round, re-runs the

same sim as the single authority, and never streams a tick. `./sim.js` is

vendored from the game repo, where `tools/parity.sh` proves node and

headless Chromium produce **bit-identical** match results for the same

seeds (that took work — see findings).

`api.auth.getAgent` on the WS upgrade (node clients send `Authorization`),

or `hello{token}` for browsers — the token is lifted to an agent via

`getAgent` with a synthetic headers-only request, which the `auth.js`

contract documents as sufficient for bearer verification. Guests play

unrated. ELO: start 1200, K=32 vs humans, K=16 vs bots; bots are fixed

anchors (EASY 800 / MEDIUM 1100 / HARD 1400) that never move. Both deltas

are computed from pre-match ratings before either is applied. Disconnect

mid-match forfeits. State: `elo.json` (atomic tmp+rename) and

`matches.jsonl` in `pluginDir`.

- **`ws.route` + `getAgent` + `pluginDir` covered the whole service** — a

ranked realtime game server needed nothing beyond the documented surface.

Zero new seams.

- **Browser WS auth is the same gap every WS plugin has**: browsers cannot

set upgrade headers, so the plugin lifts a bearer sent in-band

(`hello{token}`) via `getAgent({ headers: { authorization } , ... })`.

Works because bearer verification only reads headers; a DPoP-bound token

would not survive this path (documented limitation, same as core's

`.webrtc`).

- **Cross-engine float determinism is real and it bites.** With stock

`Math.hypot`/`Math.sin`/`Math.cos`/`Math.atan2`/`Math.pow`, node 24 and

Chromium disagreed on 4 of 20 solver-mirror matches (implementation-

defined precision; knife-edge games amplify ulps). The game and this

vendored sim now use `sqrt(x²+y²)`, a pinned FRICTION literal, and

range-reduced Taylor-series trig — after which 40/40 matches are

bit-identical across engines. Any plugin that replays client physics

should expect this.

- **The server pushes `welcome` immediately after upgrade**, which beats a

message listener attached after the client's `open` event — the test

buffers from socket creation. Same race webrtc/ fixed on the server side

for the opposite direction.

Maps: the full ranked-match loop, bots, leaderboard, forfeits, keepalive

pings. Doesn't: spectators, reconnection grace (disconnect = forfeit),

multiple tables (soccer only, like the game), and rating decay — all

protocol-compatible extensions, none blocked by the api.