v3.4.5

Changelog v3.4.5

2026-09-25

cli-cyberia

• Replace complete security workflow to only secrets ci workflow run in e2e-build command (7a62232fe)

test

• Skip tree-completeness checks in sliced template trees (2530e48f1)
• Gate platform suites that load Cyberia modules on the product context (7d4af40bd)
• Run product test projects only in their product context (bea8961f7)
• Move the remaining tests under their domain and level directories (b700fdfe9)
• Pin every app shell to its docs submenu and domain overview (d89c18ca8)
• Select tests by domain and level with change-impact selection (27d174656)
• Share the binary lookup for suite requirements (11684b26c)

package

• Keep dev dependencies when installing the deploy catalog pins (421793b3b)
• Remove the socketsecurity prepare hook (7df7bc558)
• Lock ethers and canonicalize, drop fast-json-stable-stringify (cd1961037)

hardhat

• Pin undici through the @actions/http-client override (3ff1c2364)
• Key ObjectLayerToken by content hash instead of item id (13d7c0784)

docs

• Fix migrated rename underpost conf module, replace conf.dd to underpost.config.dd (59c278f48)
• Add object-layer, item-ledger, cryptokoyn, and underpost domain documentation (da7236cab)
• Move nexodev documentation under the domain tree (c49f1674e)
• Move Cyberia documentation under the domain tree (a1fbf3e93)
• Build documentation navigation from the authored docs tree (e17f7ba4e)

release

• Fix underpost config clean artifacts (5fa88b0b7)

github-actions

• Select CI tests through the domain and level projects (bf77aa647)
• Reference the renamed underpost.config.js in CI (485798e22)
• Update repository owner gitlab CI (086bcb4d9)
• Add already published guard before every npm publish (fad2fd108)
• Mirror scope trimmed to ghpkg-only (81fdefde6)

api

• Name the versioned API path in the boot data comments (40f60a523)
• Name the versioned API path in Cyberia comments and preview URLs (9d5964607)
• Build API paths from the versioned contract (1dc99703f)
• Cache instance, map, and client-hints reads through CacheService (c0fc8ac55)
• Enforce owner-or-admin on instance and map writes (f6bf1924f)
• Restore default write guards on audio and global map registry routes (e101112ce)
• Add the versioned API path contract (2c4155e9d)
• Move the stable slug with the title on edits (243e738b9)
• Resolve public profiles by username (71ecc0aa7)
• Assign every created document a public stable slug (73730892b)

deploy

• Regenerate the deployment manifests for the objectlayer host and the v1 API (964cab45a)
• Sync the cyberia product checkouts beside the engine (792e51da2)

server

• Bound valkey memory with LRU eviction (752d54d56)
• Derive host ports and development origins from one port map (cd3288f66)
• Import fs-extra consistently for filesystem access (2a45c3c8d)
• Add a Valkey-backed cache-aside service (505db2695)
• Add cross-domain read/write infrastructure and service-key auth (bd543fbe0)

deploy-cyberia

• Build, validate, promote, and prune content releases in the sync deploy (dcd150c58)
• Backfill stable slugs in the sync deploy (45da440c2)

cyberia-cli

• Wire the item catalog, ledger, content releases, and CID identity through the Cyberia CLI (b5f3ca981)

engine

• Wire the API contract, domain consumption, and docs publishing through the runtime and client build (0116ed294)
• Render entry metadata into the served shell (397bd5944)
• Serve the PWA shell for dynamic public routes (722aecab0)

cyberia

• Resolve instance-map item types through the item catalog (2ae233b6e)
• Serve boot content through the item catalog, ledger bindings, and content view (995586acb)
• Declare which domain owns each host and API of the deploy (e7b94c92b)
• Add versioned content releases with promote and rollback (805d6d123)
• Read the server key from the shared guard module (94e299e07)
• Guard quest progress writes with the server key (701717376)
• Stop offering a draining server from the registry (db1c72d6d)
• Guard the server registry with the shared server key (c10f7629c)
• Add a shared server-key guard for engine to game-server routes (ed00ed6a7)
• Rework atlas-sprite-sheet around CID-addressed renders (64f33601e)
• Bind Cyberia item labels to Object Layer definitions (7caee1a9e)

client

• Normalize the cryptokoyn and itemledger PWA icon sets and metadata (486dfeeac)
• Enable the top and bottom bar layout in the default and dogmadual shells (e9de7101f)
• Point the menu GitHub entry at the organization (1bc113d61)
• Add the admin-only user-management menu entry (24a0dff43)
• Paint the SSR splash in the loaded app theme (43db105a2)

client-objectlayer

• Scaffold the objectlayer PWA client app (907771c1e)

client-itemledger

• Add the item-ledger registry view and documentation submenu (9afc51b6c)

client-cryptokoyn

• Add the documentation submenu and wallet view styling (3989ce1c1)

client-cyberia

• Inject the Cyberia profile into the object-layer views and wire documentation icons (9c644e4ee)

client-nexodev

• Remove the retired wallet entry from the nexodev shell (cf3d8e587)

client-underpost

• Reuse the shared markdown styles and drop the inline splash background toggle (2e71d6a01)

client-core

• Show the account role and add wallet and panel translations (a0d923595)
• Build the profile image URL with getApiBaseUrl (6f40710d4)
• Style panels through theme-scoped classes (bbfb18b72)
• Paint the SSR splash in the theme the app loads (214c009e3)
• Add an in-app documentation viewer and submenu plumbing (c8cc852f6)
• Resolve release and organization URLs from the repository identity (e07d69414)
• Surface service failures instead of empty results (14940fa11)
• Validate grid pages against the route that owns them (5e923dceb)
• Animate modal maximize and confirm transitions (307a6afd4)
• Sanitize user markup before it renders (d95880be3)
• Title public routes for the resource they present (89d269809)
• Refactor the dynamic column width rules (e88611d61)
• Navigate public routes by canonical path (82dce41e8)

mailer

• Link email templates through the versioned API path (d06d009fc)

object-layer

• Drop the direction table now owned by ObjectLayerProtocol (3d50d3e8a)
• Rework Object Layer to a CID-keyed canonical identity (26361dde8)

engine-cyberia

• Publish every host port and build without the cyberia-server clone (02e8ec978)

grpc

• Serve the CyberiaDataService schema from the engine (95011517a)

item-ledger

• Add the ItemLedger domain projecting ObjectLayerToken events (f68bc117e)

ipfs

• Move the Cyberia IPFS client into the generic ipfs domain (90facfbe9)

wallet

• Add SIWE wallet sign-in, replacing the WebCrypto identity (9c1d76a33)

db

• Add content-view partitions to serve versioned Cyberia content (9751cd1c6)

cli

• Fall back to local files when --tracked selects nothing to upload (83d2dfbc3)
• Consolidate inotify limit tuning into one sysctl file (2c3db4ead)
• Apply Kubernetes manifests server-side (fa6e5a5a6)
• Wrap shell-interpolated values in shellArgumentFactory (e53c064c9)
• Rename conf.js to underpost.config.js (3b9e845cd)
• Add the stable-slug migration to the db command (e74d71946)

New release v:3.4.0 (2026-09-15)

github-actions

• Remove Git LFS from GitLab mirror push pipeline (8be008098)
• Drop the template Pages auto-enablement and owner build override (c6e9dfd08)
• Publish the template Pages under the triggering owner (bbdbce2e4)
• Scope the template package publish to the underpostnet owner (7bea0bdee)
• Add new owner repository scope based on organization (7d9fdde93)
• Dispatch the org mirror per pushed repository (cdc80e951)
• Reject staged node_modules in the template package publish (2040f7717)
• Mirror releases to the organization with owner-scoped packages (34eaadaf8)

engine-cyberia

• Add the GitHub org name to the compose environment (4331754f1)

cyberia-docs

• Document the wasm-driver stream diagnostic flags (9f4e122ef)
• Reflow the economy and platform architecture docs (f7ce74cd2)

ssr-cyberia

• Keep the Cyberia 404 page on the requested URI (3449cf79d)

client

• Add a default NotFound status page for PWA clients (6d646ded8)
• Mirror the Underpost 50px top and bottom bars in the SSR splash (7cc74f207)

deploy

• Pin the per-deploy engine source repositories in the sync deploys (e0d01e2c1)
• Open the merged stream before the error stream in run_quiet (ce2b9eba9)

cli-release

• Run security audit and clean deploy ID artifacts in release pipeline (4163efe74)

package

• Move nodemon to base dependencies (7732e00ad)

deploy-cyberia

• Simplify sync-deploy script using build conf (65b5d8c05)

engine

• Keep non-literal dynamic imports out of the esbuild graph walk (9b5634567)
• Walk the runtime import graph with esbuild instead of regexes (067c86467)
• Generate the template .gitignore from the engine rules (4f12f11e0)
• Log the copied clipboard length instead of its content (6541792db)

client-core

• Shell the Underpost menu around the sliding top and bottom bars (a748e88b9)
• Add updateBarCustomVisibility to home button toggle to restore top scroll (451e5ce62)

cli

• Redact the Maas token secret from the baremetal log (4f8c55c76)
• Quote host command arguments in repository writes and pod exec (ce5b59260)
• Add the Socket.dev supply-chain audit command (8294fb557)

api

• Gate the full file listing behind the admin guard (32872740a)

cli-secrets

• Rotate GitHub Actions secrets under user and org targets (3676dcdf5)

New release v:3.3.77 (2026-09-13)

test

• Add cyberia instance data unit tests (2517a5d21)

client-core

• Rework the collapsed menu badge, tooltip, and hamburger chrome (0b4bca3f4)

engine

• Build the deploy sources with coverage from release and CI (b0fd53698)
• Withdraw the host traces with force inside the container (e09a23a9d)
• Read the fallback document body through the gateway pod (7d1151db5)

test-unit

• Skip the catalog tier suites a sliced tree does not ship (d8280cb4e)

deploy

• Keep the applied manifest echo off the sync output (ba3e915d8)
• Sweep the legacy per-host Gateway API objects (a3f1890f5)
• Apply the Lets Encrypt issuer through the Gateway API solver (fc42bec8e)
• Pin the pod bootstrap source repos in the prototype sync (1328bed08)
• Remove test variation in pod_bootstrap_cmd repository default (33513cd0a)

cli

• Mirror deploy id source paths back into their public repos (9debaad02)
• Compare the gateway status probe answer by status code (b7ce8de9c)

New release v:3.3.76 (2026-09-12)

test-unit

• Skip cyberia product suites where the tree does not ship them (96d1de9e5)

client-core

• Add top-left hamburger menu button while the top bar is collapsed (b91f72210)

Cyberia

• Fix minified atlas sprite sheet workload and validations (b64cbf23a)
• Reuse authored cells when importing an object layer (117e0e620)
• Stage direction frames at one uniform size for webp (82b4acac6)
• Preview items and entity maps by the atlas idle still (c5fb8ae62)
• Cut an idle-preview still from each atlas render (0402a1243)
• Wire signed stats and entity levels through boot payloads (56000de95)
• Add entity levels and progression rules to the game defaults (208530c45)
• Sign stat modifiers in the shared contract (29df5fc49)
• Preview both atlas renders in the object-layer viewer (8e8441f6e)
• Read the audio File fields from the reference registry (0e3ca2903)
• Take the atlas renders when collapsing duplicate layers (8dcc9ed1a)
• Purge an atlas and its renders through the store (943e9e4c5)
• Add the File reference registry module (6b7610101)
• Navigate editors by instance code and item id (d87a56818)
• Store two atlas renders and refresh the minified one (73ffe183e)
• Bind item-pickup and craft audio events (3b0f1069d)
• Add dropChance to entity-type-default overrides (5014c7e33)
• Generate pixel-faithful sprite sheet atlases (dfba47760)
• Resolve object-layer item identity and map previews (2bd4f88d1)
• Reference entity-type defaults by id and derive skills from content (f669fa94f)
• Add audio assets and per-map audio configuration (3ec20cb33)
• Fix mentions of wasm-driver.py (d748d11dc)
• Cleared coments (602f984a0)

cyberia-client

• Surface featured worlds on the portal landing (90c528be5)

object-layer-engine

• Add axis rulers and cursor readout to the pixel canvas (cd4955c6b)
• Add cut, copy, paste, and scale tools with toolbar UI fixes (e215b3583)

cyberia-docs

• Document the idle-preview still (4344d73b9)
• Document the signed stat contract and progression (b7a4c3301)
• Reflow the audio option table and emphasis (8358fe5e8)
• Document the ol atlas renders and rebuild options (888c7bcbf)
• Reflow tables and emphasis across the architecture docs (64c7e3a2d)
• Document the Data Server URL as a required command-line flag (28c4a51e4)
• Document Data Server flags and manifest CLI (74a09d397)

cyberia-cli

• Carry the idle still through ol minify and backups (f41f66f52)
• Require an explicit source for the ol import commands (b7c759a2e)
• Implement restore OL backup workflow for a single itemId version instance and related document (293a62db2)
• Add copy manifests in cyberia-instance repository build workflow (0f40c2b82)
• Rework sync-src as a bidirectional dry-run mirror (6f05a7dc6)
• Integrated the cyberia public assets folders module into the cyberia repo's publish workflows (7e5c0e0a7)
• Integrated the cyberia-audio project module into the cyberia repo publish workflows (07993ee93)

engine

• Publish per-suite coverage reports as deploy artifacts (f37be7ba6)
• Resolve instances and maps by their codes (2daca38b8)
• Lower the default request timeouts to ten seconds (9fbb5c844)
• Publish products with the engine runtime dependency set (8bd9a12a3)
• Redact adjacent credentials in service error messages (e8ad83ae6)
• Fail downloads that stop short of their declared length (2cb52c254)
• Replace adm-zip with jszip and shared archive helpers (14e4857c4)
• Allow cross-origin reads on CRUD controllers (7100c5ee4)

test

• Fix cyberia stat-contract coverall (faf4f4378)
• Move sprite atlas and object-layer minify tests to the cyberia tier (931d98277)

cli-cyberia

• Add the stat balancing policies and contract generation to the CLI (d6f477f59)
• Route drops and imports through the atlas store purge (0a103f6e8)
• Rework the ol command on the stored atlas renders (73b5c2fa2)
• Sync the cyberia-instances checkout on publish with cmt --switch-repo (66ffde978)
• Keep CLI-name arguments through the underpost reroute (e898bf498)
• Add ol --minify reprocessing scoped to instances (9b19bfc1e)

docs

• Regenerate the CLI references for the storage and bundle options (4ce71e989)

cli

• Warn when a container resolves no OCI env overlay (20dcb3897)
• Rework push-bundle and pull-bundle as one client bundle transport (ead02902b)
• Rework fs selection around storage manifests (26471a64b)
• Resolve instance root path from conf in instance-build-manifest (fd08a771b)
• Deploy Mongo Express through the cluster command (4a9d03fbb)

cli-wireguard

• Install the landed source before any step runs it (96db68293)

deploy

• Consolidate deploy scripts on shared constants and bundle sync (dd9d1d368)
• Stream the deploy log verbatim in a new debug mode (1d41af6c0)
• Fix git track storage in dd-cyberia sync-deploy (3ed3c297d)

runtime-cyberia-server

• Upgrade go version v1.25 (2a14dd26a)
• Pass Data Server endpoints to cyberia-server as flags (c8b4a1b54)

runtime-cyberia-client

• Add CYBERIA_DATA_SERVER_URL on cyberia-client dockerfiles runtime (99738cc80)

package

• Update qs version >= 6.16.0 via overrides (b7697d52b)

New release v:3.3.73 (2026-09-01)

test

• Fix coverall template CI failures by handling stripped product surfaces (fb14840d4)
• Move rerouted plain reads to the cyberia app tier (944ea302e)
• Add unit suites for the propagation message resolution (78ac60a09)
• Fix coverall post-migration secret source resolution (dedb70980)
• Fix coverall config-scope and cron job previousEnv scope (d3d07e13b)
• Move rerouted plain reads to the integration tier (b59fd9734)
• Fake the system node candidates under a temp root (fcd3c8300)
• Fix cyberia coverall base repository case (d470fb1e4)
• Fix cyberia CLI assertion in build workflow (43df85d86)
• Cover the sync source guard (90b965ef4)
• Add unit suites for the execution profiles and offline build workflow (c86cdaab7)
• Extended the suites for the node URIs and deploy logging changes (354c9efba)
• Extended suites for the state, image build and fallback capture changes (355169317)
• Fix coveralls: hardhat module dependencie scope (2f7dbb8bd)
• Fix coveralls: event-targets alertmanager webhook receiver (b201c6dd7)
• Add infra and unit suites and raise the coverage gate (22d11215a)
• Fix coverage calculation excludes (87ce13fdd)
• Run the API test suite against an in-process server (8ed062470)
• Move suites into tiered unit, integration and e2e layouts (c17bf2e37)
• Replace Mocha and c8 with the Vitest tiered runner (cb648a10b)
• Update coverall execution order list (9a9ea3db7)
• Add mocha test runner configuration (ab4e84bb1)

github-actions

• Drop the engine repo from cyberia-scoped CI jobs (7e3dccd32)
• Resolve propagation payloads through cmt --propagate-msg (bfecdf73e)
• Point CI image flows at the package command (fffb75db1)
• Align CD workflow comments with the renamed deploy logging library (1cfe400e4)
• Carried the GitHub Actions runner marker through the deploy (b54fffa4f)
• Add export RUN_QUIET_CI for github runner (fd34bf4ec)
• Align CD workflow comments with current secrets (756bac9eb)
• Rename the template test workflow to unit and infra (e1cf38135)
• Run the tiered Vitest suites in the test pipelines (6ea5288e3)

cli-repository

• Add --propagate-msg resolution to the cmt command (f3491fec4)
• Add fastForwardEnginePair method (8db5d2d69)
• Keep GitHub credentials out of child Git commands (329d8a177)
• Derived the private conf repo from the engine sync pair (8d8a5b0bc)
• Derive the private repo name from the shared factory (34b5f17e4)
• Fix bare clone path removal in repository clone (b8df8ac25)
• Scope deployment builds to the requested instances (00aeafa9e)
• Skip backup commit when no changes are pending (022ef2f3d)

package

• Remove clean script (809f225d7)

cli-host

• Fix traceback env (d1fd667d5)

build

• FIx host environment entrypoint env scope (af8bfbee9)

docs

• Document configuration scopes and node capability boundaries (4cebdacbe)
• Document the package command and fleet sync flows (56622044c)
• Regenerate the CLI references for the execution profile and DB flag changes (604d65eba)
• Documented the node-based connection URIs across the CLI references (1c0eee0db)
• Documented the CLI domains, staged image builds and fallback capture (c46dbe4fd)
• Document the host, app, and state CLI domains (d9bc0bc2a)
• Update and normalize dynamic status badges across repositories (51be9cf00)
• Add Hybrid-Edge Cloud Distributed Infrastructure Scope document (80f9040ba)
• Add the repository contribution and testing conventions (9b861e27f)
• Document the tiered Vitest runner and the test command (aba90c472)
• Normalize markdown formatting in observability reference (8c586e9bb)
• Update nexodev reference docs for observability and cluster scoped users (2c0d6259b)

engine

• Deliver cron environments from scoped projections and injected keys (b9262c9e8)
• Gate cluster operations on a node role capability table (a6c71588e)
• Split the host configuration into scoped durable sources (46bba77b5)
• Keep the selected NODE_ENV through the OCI env overlay (99c738905)
• Collapse the start bootstrap into one source pull (4ee41e393)
• Harden command logging around credentials (3899bcba2)
• Bundle the test coverage report into deployed artifacts (6b7ebaaed)
• Serve CronJobs from a labeled engine mirror (687322acb)
• Pin database PVs down to one claim under /data (97a53cbd6)
• Prepare container storage for host-mounted volumes (3b5470a3d)
• Add deploy package manifest generation and the package CLI (3ec0b5265)
• Add execution profiles and the offline command gate (4e9b80d67)
• Dropped the stale baked-CLI comments from the runtime Dockerfiles (26a328fbb)
• Guarded the optional cron conf mirror in the private repo sync (b7e987f18)
• Awaited the deployment build steps so the status endpoint stays live (6190fda26)
• Captured the in-memory fallback world as a persisted instance (971ff629a)
• Baked the runtime CLI into the images from a staged archive (ca46e5f5f)
• Add OCI runtime env overlay context (8c625e42d)
• Move container runtime status into a dedicated state store (b331c4ea7)
• Drop stale API documentation comment headers (77b82ee74)
• Ignore the .underpost directory in Docker builds (148d07a59)
• Rebuild the template before each deploy id assembly (39b09cd0f)
• Guard the template checkout and prune stale sources on build (1034ca412)
• Move Valkey adapter to database layer (cce8cdb20)
• Organize server modules by domain (4178f40b4)
• Build product manifests declaratively (27c228299)
• Ignore the local environment and test report directories (231eb84f1)
• Harden server framing and CSP security headers (cb5f7a005)
• Resolve repository identity in shared server and client modules (1bd92d6d8)
• Extract systemd probe helpers and redact shell credentials (211ae10cc)
• Extract deploy route registry into dedicated router module (4bd7bd3a7)
• Verify nftables egress block chains and policies (4168f699d)
• Harden database backup pipeline with exec-readiness gates and bounded retries (0ed2917b8)

cli

• Report the underpost reroute at info level (b9c798b4b)
• Add a build-only mode to the sync-cluster command (8d3ce9879)
• Mirror generated deployment manifests into the project tree (225da8bc9)
• Keep the node sync off the machine it runs from (4fbb9376a)
• Pin re-entrant commands to executing package location (151ce5a10)
• Centralize underpost resolution and drop the stale DB pod-ensure flag (3c1b61866)
• Streamed the state domain as a live pod table with runtime telemetry (a6a25a24d)
• Added a net-tables diagnostic run workflow (191febeef)
• Applied the per-deployment OCI env overlay before manifest builds (b39768b99)
• Resolved connection URIs by node name through the edge targets (9bb6285ff)
• Carried the sub-configuration through the client build (951eb9740)
• Reworked the state command into a runtime status domain (0a6c55a99)
• Folded the env and config commands into the host configuration store (1acb5babf)
• Report caught CLI errors to stderr instead of stdout (205fe6fea)
• Add host, app, and state domains migrating the config commands (1ef280b3f)
• Remove test CLI module and prune client assets (36750f961)

scripts

• Restrict node setup to RHEL hosts with a system Node (e8f4a13b2)
• Targeted instance flags in the test deploy monitor (5dcbeb0d8)
• Remove the stale local underpost CLI link script (c3c1d2b46)
• Add graceful node shutdown and auto-restore script (3a5958c00)
• Update event monitor script with wireguard and envoy logs (14c83ec68)

cli-secrets

• Rotate the GitHub token and seed cron env secrets (441b81a3f)
• Rework the secret CLI around the shared domain actions (afa84003d)
• Publish underpost-config only through the secret layer (588af5f06)
• Add SOPS setup and status onboarding commands (ceb717e2b)

event

• Report why a dispatcher Node binary is rejected (b615b9a80)
• Report unreadable cluster as unknown in deployed event state (e184e6c2e)

cli-wireguard

• Reconcile per-node-role services on fleet sync (bc03d54c8)
• Add restart dispatcher on wireguard sync and update ingress recovery wait in ENGINE_SYNC_STEPS scripts steps (74936a404)
• Refactor edge state into deployment topology (0b457088d)
• Report peer public keys and unregistered identities in status (10ef0d140)

deploy

• Add per-deploy package scripts and shared host preparation (076388a72)
• FIx deploy npm install order (665c37f16)
• FIx treat missing target-colour deployment as normal blue/green state (aa3097210)
• Add the optional per-deployment env secret overlay to the dev manifests (a830b0213)
• Streamed the runtime state and stamped the bootstrap container status (89a45ad30)
• Renamed the deploy logging library to the GitHub Actions variant (10bce1a4a)
• All in invocations now use one flag per -continued line (cb3adbec0)
• Converted the deploy scripts to the shared deploy-step log contract (de350d199)
• Add CD Node Source Pull pipeline logic (7f20ea0d5)
• Fix cyberia deployment entry point script with cli surface scope (ed16da715)
• Consolidate host prep and update pod start commands (104ac9c38)
• Add a dd-core remote sync and deploy helper script (736fe2ec9)
• Resolve the deployment environment from --env and --dev flags (1e04b3e00)
• Rename run secret command to secret --from-cron-env in deploy scripts (101c77526)

cyberia-cli

• Add related instance deploy paths in cyberia catalog (dec9e1175)

client-core

• Fix Resolve Swagger UI 404 and incorrect API target in specs (aa6ba8606)

client

• Fix typo SSRComponent (e92751afe)
• Served the fullcalendar global build bundle (164cb0706)
• Rename FullScreen.js to ViewModeController.js (35e250bd3)
• Drop dead code from the wallet, file explorer and nexodev shell (9b4ec76dc)
• Refresh the service worker and its cache policy (e0a270b35)
• Rework the calendar, docs and translation surfaces (511afcc5e)

cli-cyberia

• Resolve underpost invocations through the shared CLI resolver (04989793e)

lampp

• Implement shared provisioning contract repositories (1730cced3)

monitoring

• Refactor binary availability metrics to state timeline and stat panels (ae1f39223)
• Document node exporter provisioning and role relabeling in observability docs (de8a72b56)
• Provision node exporter on hubs and relabel node roles in dashboards (7454ec408)
• Add Node Metrics dashboard, Node Exporter, and 5 cluster threshold alerts (40c3d6e71)

conf

• Restore dev API config generation and CORS origin mapping (afaebcf16)

server-start

• Hand off the build through a linked underpost CLI (42ae75c08)

cli-client

• Extract the client build into a dedicated CLI module (86c38d8a2)

cli-cron

• Fix vultr cronjob mounts collector host path (c674e1114)

release

• Add bump version pattern target (52c30bf82)

engine-cyberia

• Align the cyberia module with the tiered test runner (4ad1a9ea5)
• Update sharp dependencie to sharp v0.35.3 (44b5df725)

server-conf

• Default missing conf files and gate dev subconfigs to development (612d52577)

cli-run

• Show probe count in get-traffic index column (efd2adc25)
• Add index column # as the first column of the get-traffic host table in run.js (3540071e4)

cli-new

• Add clusterDeployFactory method to generate base cluster deploy folder engine-private/deploy (8f2a070bf)

pwa-microservices-template

• Add default template assets including favicons, splash screens, and PWA manifest (f7ab699f2)

cluster

• Converge observability stack and provision secrets from cron env (944fb9882)

cli-dns

• Add ingress port block and unblock workflows (28ee09f93)

cli-ssh

• Make SSH users cluster scoped with shared registry (ba35a2c4d)

monitor

• Add cluster observability stack and operational event dispatcher (4fd2097d0)

cron

• Fix resolved deployId list related job defualt in cron main callback method (4d88f472a)

New release v:3.3.0 (2026-08-18)

github-actions

• Add workflow_dispatch trigger event handling in .github/workflows/ghpkg.ci.yml (e21320cf7)
• Reorder coverall test list (eb20336b2)
• Replace default npm coverall test with scripts/coverall-test.sh (3471f3009)
• Refactor move CD workflow commands into deployment scripts with run_quiet wrapper (222a18d71)
• Update .github/workflows/engine-test.cd.yml (94e42e58e)
• Add import-default-items steps to cyberia CD (350444f9f)
• Update.github/workflows/engine-cyberia.cd.yml (53e9da171)
• Update base node in engine-core CD pipeline (fa039f257)

cli-cyberia

• Include deploy strategies in generated projects (66bc733eb)
• Refactor make data.item.id is now a unique index for every case (1391efce3)
• Add WebSocket load test runner command (eebec67ed)

engine

• Expand server module JSDoc annotations (213a55191)
• Move writeEnv helper into environment module (9c57e3629)
• Fix SELinux host paths mounts logic and definition (6cf8dda11)
• Extract environment and cron deploy helpers into dedicated modules (6ba3fa4c3)
• Enforce SELinux across cluster, SSH, and provisioning (9d57a359d)

cli-wireguard

• Add SSH forwarding via VPS edge (54de1e6e5)
• Extract forward proxy and systemd helpers into server modules (97be08d10)
• Implement HTTP/CONNECT forward proxy for WireGuard (a95163df2)
• Implement idempotent in Restart, reconnect, and reset pipeline (65710c3bd)
• Implement Edge Hub WireGuard and HAProxy CLI module (2e293b875)

catalog-cyberia

• Add coverall cyberia trigger script (c8e59eed0)

scripts

• Mark scripts as executable (8f04cbc70)

release

• Fix missing file bump version scopes (4aa983a5d)

deploy

• Mark deploy scripts as executable (b18151bfa)

hardhat

• Update hardhat npm module version to sync current project scope v3.2.90 (8fc717b99)
• Update undici override dependency to v6.28.0 (fb2d2aa3b)

dependabot

• Disable typescript autoupdate (8bd761833)

cli-client

• Add only ssr build workload flag option and logic (92026a66e)

cli-cron

• Fix cron CLI setup flag and single job execution (84eab73d9)

cli-repository

• Add getDefaultBranch resolve in switchRemote method (04bc8743b)

cli-ssh

• Add initializeDefaultSshConfig method (84f5f8698)

cli-vultr

• Add Vultr Bandwidth Monitor cron job CLI Module (22fb9249a)

cli-dns

• Add blokc/unblock ingress/egress workflow handling (980fab35a)

underpost-ingress

• Enable response compression in ingress and gateway (7763f9da2)

test

• Fix missing pngjs import in object-layer test pipeline (20c1f24d8)
• Add WebSocket load test for cyberia-server (e3ff27772)

engine-cyberia

• Remove eiri from entity default inventory (e8f8d03c7)
• Add fallback world default items staging and hot reload (e646c430d)
• Add playerBaseSpeed field to instance config defaults (7cdbd23d2)
• Add WebSocket connection limit env to cyberia-server (c6f834c7d)

client-cyberia

• Add Fallback World Engine editor view (cf61dfe8e)
• Implement IPFS cid filters in ObjectLayerEngineViewer component (93eb69928)

docs

• Document moveAck reconciliation and move coalescing in Cyberia replication (24b14ca4e)

---

CYBERIA

Network Object Layers

Stackable Rendering Layers as a Unified Tokenized Reality

Cyberia is an MMORPG extension built on the Underpost Platform. The platform owns the
toolchain, deployment surface, PWA delivery, and base infrastructure. Cyberia adds a three-service MMO
runtime: engine-cyberia, cyberia-server, and cyberia-client.

engine-cyberia is the sidecar-backed data layer: a Node.js sidecar that owns content,
validation, persistence, the gRPC/REST data services, and asset metadata. It backs the authoritative
Go server and the WASM client with data — it does not run the simulation or the presentation.

---

Ecosystem at a glance

                         ┌───────────────────────────────────────────────┐
                         │              UNDERPOST PLATFORM               │
                         │  toolchain · deploy · PWA build · static      │
                         │  delivery · cluster/image/db · monitoring     │
                         │                                               │
                         │   underpost CLI  ──▶  builds & deploys all    │
                         └───────────────────────────────────────────────┘
                                            │  hosts / delivers
                                            ▼
   ╔═══════════════════════════════ CYBERIA MMO ═══════════════════════════════════╗
   ║                                                                               ║
   ║   ┌──────────────────┐   gRPC    ┌──────────────────┐   WebSocket             ║
   ║   │  engine-cyberia  │ ────────▶ │  cyberia-server  │ ───────────┐            ║
   ║   │     (Node.js)    │           │       (Go)       │            │            ║
   ║   │                  │           │                  │            ▼            ║
   ║   │ content          │           │ authoritative    │    ┌──────────────────┐ ║
   ║   │ validation       │           │ simulation       │    │  cyberia-client  │ ║
   ║   │ persistence      │           │ world tick       │    │    (C / WASM)    │ ║
   ║   │ gRPC/REST data   │           │ AOI replication  │    │                  │ ║
   ║   │ asset metadata   │           │                  │    │ rendering        │ ║
   ║   └──────────────────┘           └──────────────────┘    │ input            │ ║
   ║            │                                             │ prediction       │ ║
   ║            └──────────────── REST (content/assets) ─────▶│ presentation     │ ║
   ║                                                          └──────────────────┘ ║
   ╚═══════════════════════════════════════════════════════════════════════════════╝

   One source of truth per concern:
     content & world config ── engine-cyberia
     real-time world state  ── cyberia-server
     presentation & input   ── cyberia-client

---

1. Toolchain and base infrastructure

Underpost Platform is the operational backbone and the source of truth for deploy IDs, runtime
selection, host/path layout, generated client assets, and environment resolution.

Area	What it owns
Toolchain	underpost CLI, build, deploy, release, metadata, secrets, environment selection
Infrastructure	bare metal, LXD, Kubernetes, K3s, kubeadm, images, SSH, runners
Data operations	MongoDB, MariaDB where needed, backups, cron, monitoring
Delivery	static build, SSR views, PWA packaging, service worker generation, host/path routing

underpost is the shared control surface for everything infrastructural. Cyberia-specific work belongs
in the cyberia CLI, never in parallel platform commands. When a concern already exists in underpost,
reuse it instead of forking a Cyberia variant.

---

2. PWA workflow

Every deployed client ships as a static application shell with PWA support. The pipeline has exactly two
inputs:

• the deploy ssr configuration in underpost.config.dd-*.js (or conf.ssr.json)
• the service worker source in src/client/sw/core.sw.js

Everything else — index.html pages, sw.js, the precache list — is generated during the client
build. Treat them as outputs only; never hand-edit them.

Runtime service-worker behavior:

Request	Strategy
static assets	stale-while-revalidate
API GET	network-first + short cache
API mutations	network-only + background replay
navigation	network-first + fallback shells

Fallback selection: offline network → offline fallback view; origin/server failure → maintenance
fallback view. Only fallback-marked views are guaranteed precached.

---

3. Cyberia MMO extension

Responsibility split

Service	Owns	Must not own
engine-cyberia	content, validation, persistence, gRPC/REST data services, asset metadata	authoritative simulation, render policy
cyberia-server	authoritative simulation, world tick, gameplay mutation, AOI replication	content authority, presentation metadata
cyberia-client	rendering, input, prediction, interpolation, presentation	authoritative world state, gameplay authority

Two boundaries are non-negotiable:

• Do not move authoritative logic into the client.
• Do not move content-authority logic into the Go runtime.

Data flow

engine-cyberia ──gRPC──▶ cyberia-server ──WebSocket──▶ cyberia-client
engine-cyberia ──REST──────────────────────────────▶ cyberia-client

engine-cyberia as the sidecar-backed data layer

engine-cyberia is the only Cyberia service that owns content-backed data and asset metadata.

• Boot-time world configuration flows from engine-cyberia to cyberia-server over gRPC GetFullInstance.
• Client-facing assets, object layers, dialogues, and presentation hints flow from engine-cyberia to cyberia-client over REST.
• Simulation never migrates into the sidecar, and presentation policy never migrates out of the client.

Runtime / health model

Three supervised processes run in parallel, each with its own monitor and reconnect loop. Gameplay is live only when all three are healthy at once.

        ┌──────────────────────────────────────────────────────────────┐
        │                    SUPERVISION (parallel)                    │
        │                                                              │
        │   engine-cyberia        cyberia-server        cyberia-client │
        │   ┌────────────┐        ┌────────────┐        ┌────────────┐ │
        │   │  monitor   │        │  monitor   │        │  monitor   │ │
        │   │ +reconnect │        │ +reconnect │        │ +reconnect │ │
        │   └─────┬──────┘        └─────┬──────┘        └─────┬──────┘ │
        │         │                     │                     │        │
        │         └──────────┬──────────┴──────────┬──────────┘        │
        │                    ▼                     ▼                   │
        │            all three up & connected?                         │
        └────────────────────────────┬─────────────────────────────────┘
                                      │
                ┌─────────────────────┼─────────────────────┐
                ▼                     ▼                     ▼
          ┌───────────┐        ┌───────────┐         ┌───────────┐
          │  HEALTHY  │        │ DEGRADED  │         │  STANDBY  │
          │ all 3 up  │        │ ≥1 service│         │ gameplay  │
          │ gameplay  │        │ reconnect-│         │ paused    │
          │ live      │        │ ing / down│         │ until all │
          │           │        │           │         │ 3 healthy │
          └───────────┘        └───────────┘         └───────────┘

State	Meaning
healthy	all three Cyberia services are up and connected
degraded	at least one service is reconnecting or unavailable
standby	gameplay is paused because the full three-service set is not healthy

---

User commands

Use underpost for platform, infrastructure, build, and deploy. Use cyberia for MMO content and
extension workflows. Both share the same helpers — never duplicate config, env, or path logic.

Platform (underpost)

# Bootstrap a new app (local app serves on http://localhost:4001)
underpost new app-name

# Build the client bundle / static + PWA output
underpost client
npm run build            # node bin client

# Deploy and operate
underpost deploy <deploy-id>
underpost monitor

Cyberia (cyberia) — bin/cyberia.js

Group	Command	Purpose
ol	cyberia ol [item-id]	ObjectLayer import, procedural generation, atlas/sprite
instance	cyberia instance [instance-code]	export / import / drop a Cyberia instance and its data
client-hints	cyberia client-hints [instance-code]	per-instance presentation hints (palette, camera, icons)
chain	cyberia chain <sub>	Hyperledger Besu + ERC-1155 ObjectLayerToken lifecycle
run-workflow	cyberia run-workflow <name>	named maintenance/build scripts from scripts/

Common examples:

# Object layer content
cyberia ol hatchet,sword --import                 # import specific items
cyberia ol --import-types skin,floors             # batch import by type (or: all)
cyberia ol floor-desert --generate --seed fx-42   # procedural generation
cyberia ol hatchet --to-atlas-sprite-sheet        # build atlas sprite sheet
cyberia ol --drop --client-public                 # drop data + static asset folders

# Instance data
cyberia instance FOREST --export ./backup
cyberia instance FOREST --import ./backup
cyberia instance FOREST --drop

# Presentation hints
cyberia client-hints cyberia-main --seed-defaults

# Chain / token lifecycle
cyberia chain deploy --chain-id 777771
cyberia chain status
cyberia chain register / mint / transfer / burn / pause / unpause

# Named workflows
cyberia run-workflow import-default-items
cyberia run-workflow seed-skills
cyberia run-workflow seed-dialogues
cyberia run-workflow build-manifest
cyberia run-workflow build-server-dashboard

Run the MMO services

# engine-cyberia (Node.js data/content services)
npm start                                          # node src/server

# cyberia-server (Go authoritative simulation)
cd cyberia-server && go run main.go                # dev
cd cyberia-server && go build -o cyberia-server . && ./cyberia-server

# cyberia-client (C / WASM presentation)
cd cyberia-client && make -f Web.mk clean && make -f Web.mk web
cd cyberia-client && make -f Web.mk serve-development     # serves on :8082

---

Operational guardrails

• Prefer one source of truth for config, deploy IDs, runtime selection, startup behavior, and generated assets.
• Reuse existing helpers and conventions instead of creating parallel implementations.
• Do not duplicate parsing, env resolution, or path normalization logic across modules.
• Treat generated artifacts (sw.js, static pages, atlases, README, manifests) as outputs only.
• Host-level changes must be idempotent, reversible, and explicit; validate before mutating; keep
  orchestration scripts safe to rerun.
• engine-private/ is a private external dependency. Reference it only as private input; never assume
  its contents exist locally.