Live availability for the server and for the tanks, every incident since the project started, the append-only receipt chain behind the controls that caused them, the state copies and restore drills, and the delivery record. Trust overview →
Live figures refresh every 15 seconds in place. Last updated .
Every legend entry links to the record that produced it. Chart markers are pointer shortcuts to the same records; by keyboard, reach them through the legend above or the incident list on Incidents.
0 human players and 96 computer-controlled agents across the four tanks. Agents are rule-based: fixed steering and target selection, no model and no inference call.
| Tank | Active players | Agents | Top score | Leader |
|---|---|---|---|---|
| Pacific | 0 | 24 | 0 | — |
| Atlantic | 0 | 24 | 0 | — |
| Indian | 0 | 24 | 0 | — |
| Arctic | 0 | 24 | 0 | — |
Everything the tank holds — the control receipt chain, the 90-day action log, player profiles and spend history — is copied to object storage on a daily schedule. A restore drill reads the most recent copy back out of object storage, restores that copy into a scratch instance, and compares the scratch instance’s export digest against the copy’s; equal digests mean the stored copy reconstitutes the state it was taken from rather than merely something like it. If no copy can be read, the drill fails and says so rather than testing the live object instead. Passed.
| Measure | Value |
|---|---|
| Last copy taken | 2026-08-28 03:17:13 UTC |
| What it covered | 43 keys (28 player profiles), 23 control receipts, 732 action-log rows |
| Copy digest (SHA-256) | f1f455ca42312df5fdcfe3af33c4c65fa809136065d0c29d35ba3e6f33c922e0 |
| Copies retained | 8 dated, plus the most recent |
| Last restore drill | Passed · 2026-08-23 21:00:39 UTC |
| Drill result | copy of 2026-08-23 21:00Z read back from backups/state/latest.json; digest 268f0d9798529281…; 35 keys, 17 receipts, 727 log rows; live state has moved on since the copy |
Scheduled tank downtime is tracked separately from unscheduled outages and from server availability, because only one of the three is a fault. 9 recorded over 10d 8h. Raw incident JSON →
3.2h of it scheduled and excluded from availability.
Bars show how long impact lasted; diamonds are instantaneous events. Every mark is a link to its incident and control receipt, reachable by keyboard as well as pointer.
Closed by WG-018 hotfix: operations auth now accepts only the minted environment token, refuses plaintext HTTP, denies when no token is configured, and every response carries HSTS. Fix verified in production. Investigation closed; the separate maintenance gate was not changed.
2026-08-19T03:19:25.421Z → 2026-08-19T03:30:26.405Z
Scheduled maintenance
2026-08-19T00:51:56.822Z → 2026-08-19T03:33:16.937Z
Authenticated operations message-response test; no downtime occurred.
2026-08-19T00:51:53.982Z → 2026-08-19T00:51:53.982Z
Scheduled maintenance
2026-08-19T00:24:50.937Z → 2026-08-19T00:48:04.651Z
Authenticated operations message-response test; no downtime occurred.
2026-08-19T00:24:48.299Z → 2026-08-19T00:24:48.299Z
Authenticated operations message-response test; no downtime occurred.
2026-08-19T00:24:06.488Z → 2026-08-19T00:24:06.488Z
Owner confirmed this report was a controlled closeout dry run with no compromise identified. Investigation closed; the separate maintenance gate was not changed.
2026-08-19T00:23:10.437Z → 2026-08-19T01:39:27.228Z
Authenticated operations message-response test; no downtime occurred.
2026-08-19T00:17:05.123Z → 2026-08-19T00:17:05.123Z
The tank was briefly taken offline while root-wide downtime routing and Durable Object reductions were verified.
2026-08-18T21:45:00.000Z → 2026-08-18T21:49:30.000Z
2ee686237e6995045283f4d22dfb240741c753fa91bc57beb15c9052d28d636aService state copied to object storage: 43 keys, 23 receipts, 114837 bytes.
Service state copied to object storage: 43 keys, 22 receipts, 113066 bytes.
Service state copied to object storage: 40 keys, 21 receipts, 109499 bytes.
Service state copied to object storage: 40 keys, 20 receipts, 107805 bytes.
Service state copied to object storage: 36 keys, 19 receipts, 103253 bytes.
The most recent copy in object storage was read back, restored into a scratch instance, and its export digest matched the copy's.
Service state copied to object storage: 35 keys, 17 receipts, 101063 bytes.
Service state copied to object storage: 35 keys, 16 receipts, 99666 bytes.
A copy of service state was restored into a scratch instance and its export digest matched the original.
Service state copied to object storage: 34 keys, 14 receipts, 97906 bytes.
Authenticated operations control restored the game and resolved operational downtime.
Closed by WG-018 hotfix: operations auth now accepts only the minted environment token, refuses plaintext HTTP, denies when no token is configured, and every response carries HSTS. Fix verified in production. Investigation closed; the separate maintenance gate was not changed.
Report white-hat-ce395a2b-6d48-49bd-b8e3-f58e6b58b162 triggered immediate game downtime pending operator review.
Owner confirmed this report was a controlled closeout dry run with no compromise identified. Investigation closed; the separate maintenance gate was not changed.
Scheduled maintenance. This is separate from 1 security report.
Authenticated message-response control completed without downtime.
Authenticated operations control restored game traffic. 1 security report remains open until separately resolved.
Corrected prior restoration semantics: service impact ended, but the security report remains open.
Scheduled maintenance
Authenticated message-response control completed without downtime.
Authenticated operations control restored the game and resolved active downtime incidents.
Authenticated message-response control completed without downtime.
Report white-hat-752ff51a-0a26-4b07-a317-c2a2f3533b06 triggered immediate game downtime pending operator review.
Authenticated message-response control completed without downtime.
Every feature update, the deployment batch that carried it, and how those batches line up against the availability above and the metered spend. The same record is available as data.
Ship a complete playable and operational proof of concept inside one working day.
Stop gameplay immediately without hiding status, incidents, or control history.
Support keyboard, mouse, touch, responsive layouts, and readable evidence.
Keep high-impact controls authenticated, attributable, and receipt-backed.
| Feature update | Deployment | |||
|---|---|---|---|---|
WG-001 | feature | Serve the game and its operations pages from one WorkerHost the game and public operations as one controlled deployment. | 00:00 | D01 |
WG-002 | feature | Run the game simulation on the serverRun movement, growth, collisions, bots, and state on the server. | 00:25 | D01 |
WG-003 | enhancement | Add size-based combat, a dash and rocketsLarge sharks eat smaller sharks; rockets beat every shark. | 00:55 | D01 |
WG-004 | fix | Fix frame tearing and input lagTighten rendering and steering for mouse, keyboard, and touch. | 01:20 | D02 |
WG-005 | enhancement | Adapt the game UI to any screen and inputSupport desktop, keyboard-only, mouse-only, and mobile play. | 01:50 | D02 |
WG-006 | feature | Publish service and tank logs with downloadsPublish service and tank evidence without internal player identifiers. | 02:15 | D03 |
WG-007 | enhancement | Match the debug drawer to the public log formatAlign the selected debug language with public tank logs. | 02:40 | D03 |
WG-008 | feature | Map every product action to the usage it billsMap product actions to Workers, Durable Objects, D1, and R2 usage. | 03:05 | D03 |
WG-009 | enhancement | Stop gameplay when spend reaches the limitReset current-spend tracking and stop gameplay at the measured limit. | 03:30 | D04 |
WG-010 | feature | Put maintenance, billing and alerts behind one panelKeep maintenance, billing, alerts, and security controls together. | 04:00 | D04 |
WG-011 | fix | Restore gameplay without closing the investigationRestoring gameplay ends impact without closing the investigation. | 04:25 | D04 |
WG-012 | enhancement | Chain every control decision into a signed receiptLink control decisions in an append-only SHA-256 receipt chain. | 04:50 | D05 |
WG-013 | fix | Stop tables clipping timestamps and identifiersContain timestamps, subjects, schemas, and identifiers at every viewport. | 05:15 | D05 |
WG-014 | enhancement | Keep the site up while the tank is closedKeep the portal online while billing or operators close the Shark Tank. | 05:35 | D05 |
WG-015 | enhancement | Organise the evidence for ISO 27001 and 42001Organize evidence toward ISO/IEC 27001 and ISO/IEC 42001. | 06:30 | D06 |
WG-016 | fix | Unify the wording across every pageUnify Shark Tank language, reason-coded evidence, and the final sales narrative. | 08:00 | D07 |
WG-017 | bonus | Rewrite the outage jokesSpent the bonus hour rewriting the outage jokes. Shipped zero business value, on time and under budget. | 09:00 | D08 |
WG-018 | hotfix | Require TLS and a token on the operations gateClosed in 7 minutes. Operations auth had an unauthenticated fallback when no token was set. It now accepts only the minted token, over TLS, and denies when there is none.Security report and control receipts → | 09:07 | D09 |
WG-019 | hotfix | Draw the arena boundary that kills on contactClosed in 10 minutes. The arena radius killed on contact but was never drawn. It now renders, with a warning band inside it.Reproduced on production before the fix → | 09:17 | D10 |
WG-020 | hotfix | Add a thumbstick and ability pads for touchClosed in 38 minutes. Tapping to steer spent the dash on every tap. Touch play now steers from a thumbstick, with the abilities on their own pads.Controls and layout verified on a phone viewport → | 09:55 | D11 |
WG-021 | hotfix | Measure availability from project start, not 24 hoursClosed in 21 minutes. A rolling 24-hour availability window forgot every incident older than a day. Availability now runs from project start, and the logs page carries the full record.Availability bar and legend → | 10:16 | D12 |
WG-022 | hotfix | Merge three billing tables into one meterClosed in 13 minutes. Three billing tables in three column shapes compared against nothing. One meter now reads every service on a shared axis, and spend is sampled hourly and charted.Usage against the free tier → | 10:29 | D13 |
WG-023 | hotfix | Chart incidents by cause, start and durationClosed in 13 minutes. The incident page redrew the status page's availability bar and said nothing about the incidents themselves. It now charts each incident by cause, start and duration.Incident chart → | 10:42 | D14 |
WG-024 | hotfix | Put taking the game offline behind authenticationClosed in 12 minutes. The route that disabled the game was gated by two forgeable headers, one of them published in the public API document. Reporting and taking the game down are now separate operations, and only the takedown is authenticated.Control receipts → | 10:54 | D15 |
WG-025 | hotfix | Stop the status page reloading itselfClosed in 6 minutes. A three-second full-page reload wiped screen-reader position and keyboard focus, with no way to stop it. Figures now update in place, and the refresh can be paused.Availability status → | 11:00 | D15 |
WG-026 | hotfix | Stop dialogs stealing keyboard focusClosed in 4 minutes. The in-game dialogs re-armed their focus trap on every re-render, throwing keyboard users back to the Close button twice a minute. The trap now arms once per dialog.Play the game → | 11:04 | D15 |
WG-027 | hotfix | Fix unreadable overlay text in light modeClosed in 5 minutes. The light theme turned overlay text near-black but left the panels behind it dark, hiding the score at 1.05:1. On-canvas overlays now keep one palette in both themes.Play the game → | 11:09 | D15 |
WG-028 | hotfix | Key log throttling to the connection, not a cookieClosed in 14 minutes. Public log writes were throttled against the visitor's own cookie, so dropping it bought a fresh allowance every request. Throttling is now keyed to the connection, under a ceiling shared by every visitor at once.Public service log → | 11:23 | D16 |
WG-029 | hotfix | Check tank capacity when a seat is takenClosed in 4 minutes. Seats were counted when a connection opened rather than when it sat down, so one client could open enough connections to claim every seat. Capacity is now checked at the moment a seat is taken.Tank occupancy → | 11:27 | D16 |
WG-030 | hotfix | Bound the incident record so it cannot block recoveryClosed in 9 minutes. Incidents were stored as one ever-growing record, written by the same operation that restores service, so a long enough history would have blocked recovery. The record is now bounded, and only resolved incidents are archived.Incident record → | 11:36 | D16 |
WG-031 | hotfix | Announce search and paging results onceClosed in 11 minutes. Searching or paging the evidence tables rewrote the record count in silence, and a paging button that switched itself off dropped the keyboard to the top of the page. The count now speaks the whole result once per settled search, and the buttons keep their place.Public evidence → | 11:47 | D17 |
WG-032 | hotfix | Stop chart marks swallowing the keyboardClosed in 3 minutes. Each mark on the incident and availability charts was a keyboard stop that announced nothing and showed no focus ring. The marks are pointer shortcuts again, and the same records are ordinary links beside each chart.Incidents → | 11:50 | D17 |
WG-033 | hotfix | Give every API endpoint its own headingClosed in 8 minutes. The API reference had one heading and thirty-one identically named sections beneath it, so assistive software could not reach a particular endpoint. Every operation is now its own heading, with an index of all thirty-one at the top.API reference → | 11:58 | D17 |
WG-034 | hotfix | Stop the tank list reading itself aloudClosed in 9 minutes. The tank list read every tank's counts aloud every three seconds, because a moving top score rewrote the whole sentence. It now speaks only what changed, and the same pass fixed the light theme's status colours.Play the game → | 12:07 | D17 |
WG-035 | hotfix | Replace the content policy that allowed any scriptClosed in 24 minutes. The pages carried a content security policy that allowed any inline script, which is the one thing such a policy exists to refuse. Each response now mints a single-use token and runs only the scripts carrying it.Public evidence → | 12:31 | D18 |
WG-036 | hotfix | Strip internal detail from errors and exportsClosed in 12 minutes. Internal failure messages, build identifiers and exported player names all reached public output, the last of them as text a spreadsheet would run as a formula. All three now say only what a reader needs.Cost and capacity meters → | 12:43 | D18 |
WG-037 | hotfix | Verify the receipt chain on every readClosed in 21 minutes. This page called the control history tamper-evident, but nothing re-checked it and its head was only ever compared against itself. Every receipt is now re-derived on read, and the verdict is stated on the page.Control receipts → | 13:04 | D18 |
WG-038 | hotfix | Strip invisible characters from display namesClosed in 14 minutes. A display name could carry invisible characters that reversed the leaderboard around it or impersonated another player, and saved players had no ceiling. Those characters are stripped, and new saved entries are bounded without evicting a real player.Play the game → | 13:18 | D18 |
WG-039 | hotfix | Report today's spend on a readable scaleClosed in 18 minutes. Every included allowance resets daily, but the cost page reported lifetime totals on a linear bar where 0.008% of an allowance and 8% were the same invisible sliver. It now measures the day and plots every meter on a logarithmic axis.Usage against the free tier → | 13:36 | D19 |
WG-040 | hotfix | Every page can be navigated without a mouse or a screenClosed in 26 minutes. None of these pages let you jump past the navigation, so reaching the content meant tabbing through the same links every visit. Sorted columns showed which way they were sorted with an arrow and nothing else. Tables carried no name, and nothing tied a column heading to the figures beneath it. Following a link to a particular receipt scrolled to it but left the keyboard behind.Public evidence → | 14:02 | D20 |
WG-041 | hotfix | The outage page says there is an outageClosed in 11 minutes. When the game was taken down, the page announced itself with a randomised joke in the browser tab and in its only heading — funny, but it never said the game was down. The availability chart had the same fault in another form: the picture carried the downtime, the text beside it did not. Two faint colours were also too close to their background to read comfortably.Status → | 14:13 | D20 |
WG-042 | hotfix | The game stops going quiet at the moments that matterClosed in 19 minutes. Anything said twice in a row was only said once: a second death at the same score, or a second disconnect, passed in silence. Losing the connection was drawn on screen but never spoken. Turning off the on-screen radar also removed the spoken description of where you are, so a visual setting silenced a non-visual aid. The help shortcut fired from one keypress with no way to switch it off, including while typing.Play the game → | 14:32 | D20 |
WG-043 | hotfix | Players can use their own nameClosed in 9 minutes. A name written entirely in Chinese, Cyrillic, Greek, Hebrew, Korean or emoji was refused and the player was renamed to Player, while a name mixing one of those with Latin letters was fine. The name check compared against Latin letters only, so a name containing none of them looked empty rather than unscreenable. Names are now accepted on what they actually contain.Play the game → | 14:41 | D21 |
WG-044 | feature | Publish the policies the standards ask forBuilt in 34 minutes. The conformance register recorded what this service does against two standards, but the written record behind it did not exist — and the largest block of missing rows was not engineering, it was four documents nobody had written. They are now published at /policies/ as pages rather than filed as documents nobody can check: what the service is and where its boundary sits, what it protects and refuses to do, who is accountable for what, and what the computer-controlled sharks actually are. Twenty-seven gaps closed; readiness moved from 45 to 61 per cent.Policies → | 15:15 | D22 |
WG-045 | feature | Write down how risk is decided, and what the sharks actually areBuilt in 58 minutes. The register said what this service does but not how it decides what to do about anything. There is now a stated method for scoring a risk, an assessment that names the twelve this service actually carries — the spend ceiling, one durable object holding the receipt chain with no backup, display-name abuse, a provider outage, unscanned dependencies — and objectives measured from live routes rather than asserted. Five more documents cover how the computer-controlled sharks are built and checked, how code is written and released, who may reach what, and which laws and licences apply. Writing them turned up four things the service was describing inaccurately, and those were corrected rather than left flattering. Sixteen gaps closed; readiness moved from 61 to 77 per cent.Policies → | 16:13 | D23 |
WG-046 | feature | Do the things the register said were only written downBuilt in 71 minutes. Forty-two rows were marked partial, and sorting them showed most were not missing writing at all — they were activities defined and never performed, or one piece of engineering nobody had built. The engineering came first: everything the tank holds — the receipt chain, the ninety-day log, player profiles, spend history — is now copied daily to object storage under a digest, and the copy is proven by restoring it into a scratch instance and checking the two digests match. The first drill failed for a real reason and that failure is on the public chain in front of the passes. Then four activities were run for the first time and recorded — an access review, a supplier check, a compliance review and the AI policy review — and seven documents written for what remained. Ten rows are still open and named: no dependency scanning, no erasure route, no audit independence, and supplier certificates nobody has obtained. Readiness moved from 77 to 93 per cent.Policies → | 17:24 | D24 |
WG-047 | feature | Split the site in two, because it was serving two audiences from one menuBuilt in 96 minutes. The site is a game and a public conformance record, for two sets of people who want nothing from each other, and every page carried the same ten-item menu listing both. Thirteen of the site's sixty thousand words were for players. The game keeps one link out; the record gets its own front door at /trust/ with six figures on it, each one a link to the page that owns it and none of them stored twice. The roadmap and incident pages folded into operations, so the receipt chain renders once instead of on two pages and the uptime and spend numbers appear only where they are measured. Cost moved to /spend/, because "inquiry" was being used for the billing page and for the whole record at the same time. The policy set became one route per document with an anchor on every section — it was 201 KB with no identifier on any of its 144 headings, so nothing in it could be cited. Old addresses redirect and the published JSON did not move. Also fixed on the way through: money could be spent on routes the spend limit exempted, saving a profile had nothing bounding it, a body-size check a chunked request walked straight past, a header set on one branch of the router, chart links no keyboard could reach, thirteen tables with no header row, a button that told a screen reader the opposite of what was happening, and a register that needed three screens of sideways scrolling on a phone.Trust and operations → | 19:00 | D25 |
WG-048 | feature | Deploy the split, then close the four things it left behindBuilt in 88 minutes. The previous version was written and never deployed, so for its whole life the register pointed at routes the live service did not serve; that went out first. Then four things that were written down but not true. The restore drill said it restored the most recent copy and did not: it exported the live object and restored that, which proves the object can copy itself and proves nothing about object storage. It now reads the copy back out of the bucket, and with no bucket or no copy it fails and says so instead of quietly testing something else. Three policy records stated the evidence walk's result as a present-tense measurement and all three had the previous version's numbers; they are read off the register when the page is built, so they cannot go stale again. The link checker accepted any 200 as proof a route exists, but every unrouted path here answers 200 with the game — it now requires each response to carry something only the real page emits. And the split had left the spend and API pages reachable from two of the seven trust pages, so every page carries the whole estate in its footer. Two other things: the stylesheet was 38.6 KB re-sent on every page view and is now fetched once and cached, and every link on the delivery chart is a 24-pixel target instead of nine.Operations → | 20:28 | D26 |