COURIER LABNEXT: INPUT ORDER →

An owned game. A real network boundary.

The client asks.
The server decides.

Deliver a core, then test the rules that protect the delivery. This browser sends intentions to a separate local server process. Position, cargo and score belong to that server.

Teaching project • local development only • no production security claim

01 / PLAY THE SYSTEM

One core. One delivery.

Not connected
Delivered0
CargoEmpty
Server tick—
Authoritative courier arenaMove the blue courier from the depot to the yellow core, interact to collect it, and return to the depot. The coral wall blocks movement.DEPOTCORESERVER SNAPSHOT · NO LOCAL PREDICTION

Blue marker: you · dashed rings: 250 mm interaction range · coral: wall

Connect to your local server to begin.

Hold a direction button, arrow key or WASD to move.
Release to stop. Tap or press Space to interact.

Your browser and the server must both be running.

03 / BUILD THE DEFENSE

Restore a guard.
Prove it holds.

The complete reference is your comparison point. The first source lab removes one proximity check. You restore it, then prove remote pickup fails while a real delivery still succeeds.

  1. Establish the baselinenpm run ciStarts real server processes, sends legitimate and invalid traffic, and checks authoritative state.
  2. Open the source labnpm run lab:prepareCreates a private working copy with a missing guard. Follow lab/LEARNER.md, edit code and record your first attempt.
  3. Test catches and missesnpm run test:mutantsRemoves guards one at a time. Each negative control must fail at the intended state assertion.

Continue: build an admission policy and an HTTP test →

What this proves

These tests can establish behavior for this protocol, seed and schedule. They cannot certify production anti-cheat, detect every modified client, or show that a learner can transfer the skill. Later lessons add telemetry evaluation, recovery, performance and owned-process integrity.

Explore the complete software course →