Ship the browser smash toy publicly and document it.
Deploy: web/ is live at https://digalot.fyi/destroy/ — served on the dealgod VPS like
thriftgod (an nginx:alpine static container on dealgod_default + a /destroy/ location in
the shared reverse proxy). README.md now carries the exact deploy/update steps + a full
rollback runbook. No app code changed.
3GOD hardening (LANE5 deliverable B) was found ALREADY DONE on the live instance and
verified — not re-changed:
- GOD3_OPEN is off: unauthenticated write via Cloudflare → 403; GET /api/list → authed:false.
- SSRF plugged: POST /api/fetch with file:///etc/hostname and http://169.254.169.254/ →
rejected ("only public http(s) URLs allowed"), nothing written.
- Reads stay public (CF GET 200 + CORS *); trusted tailnet peers still push passwordless
via the TS_ALLOW IP allowlist (this session's meshgod pushes used that path).
Verified public: /destroy/ 200 over CF, JS as application/javascript, props (intact +
fractured) load from /3god/a/* with CORS *, printer boss shatters into 16 GLB chunks,
no console errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A shareable one-click web toy (not a port of the Godot game): walk a record store
first-person, pull a record, and wreck the place in the browser. Built on
thriftgod's pointer-lock FP-interior patterns, zero build step (three r0.175 +
@dimforge/rapier3d-compat over an importmap).
- physics.js: Rapier WASM world, one body per prop, support-graph cascade
(smash a rack → its crates pancake), pre-fractured swap (chunk_* bodies) with
generative-shard fallback until Lane 2 ships fractured GLBs, capped debris pool.
- props.js: GLTFLoader/DRACOLoader; loads props live from the 3GOD depot
(/a/<file>, CORS-open) with a local web/assets/ mirror fallback so it never
hard-fails offline. Read-only against the depot.
- juice.js: camera-trauma screenshake, hitstop, per-material particle bursts and
procedural Web-Audio smash voices (wood/cardboard/vinyl/glass/steel), combo HUD.
- main.js: FP controller, record-store room, grab/smash raycasting, record ritual
(pull → held → throw → shatter), "share your mess" canvas screenshot.
Assets mirrored offline: record/crate/rack (from the Godot lane) + cashbot/
council-bin (from 3GOD). Verified in-browser: props load, smashing spawns shards +
particles + combo, rack cascade pancakes its crates, record ritual and share work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
