Sprint M0.2 — five avatars, one world

2026-07-28 · M0.2 · Closed — goal met in part

Closed 2026-07-28. Goal met in part — the infrastructure half is proven; the “a friend actually plays” half is carried forward honestly, because there was nothing to play yet.

• Five avatars replicate between clients over a real wss:// connection to the server deployed at outboxgame.thenerdybox.com.
• Every Join is credential-checked; there is no unauthenticated fallback anywhere in the path. An unauthorized join is refused and the connection closed — verified against the live deployed server, not only in tests.
• A production-only TLS bug was found and fixed: the client’s TLS backend resolves at run time rather than compile time, so a test suite that only ever spoke plaintext never exercised the code path that panics on a real wss:// handshake. See the devlog post for the full story.

Nothing to play yet — no gameplay exists until the next sprint builds it.