How it works

The shape of it

Five layers, four languages, no framework and no build step.

The load-bearing idea: the chat never depends on the badge. Guests reach Cloudflare directly over their own cellular. The badge only feeds QR rotation and its own dashboard. If the rig dies entirely, the conversation is unaffected — which is what makes the badge a passive display rather than a server.

Scanning is the only way in

Not a policy — a property of how the token is made.

A join token is derived, not issued:

token = base32( HMAC-SHA256( BADGE_SECRET, "ROOM:window" ) )[0..8]
window = floor( now / 5 minutes )        +90s grace either side

The badge and the server compute the same answer independently, from the clock. That single fact carries most of the design:

• Passive badgeThe badge holds no authority. It cannot extend a code's life — an offline badge showing a stale code gets rejected, not honoured.
• Offline for 12h144 tokens are fetched in advance, so the badge keeps rotating correctly for about twelve hours with no network at all.
• A code is a labelTyping the room code grants nothing. Being in front of the badge is the credential, and a link travels where a badge does not.
• Bounded sharingEach token has a redemption cap, so a forwarded screenshot lets a few people in rather than travelling. ALLOW MORE lifts it when the queue is real and Steve can see it.

Scan to speaking

A PIN is not an identity

The worst bug this project has had, twice, in two different disguises.

The first version indexed people by their PIN: pinidx:<hash of the PIN> mapped straight to a person. Two people who happened to choose the same PIN resolved to the same record — and the second arrived as the first, holding their name, their guest number and their standing, with nothing in the room able to tell that from the first person coming back. With a suggester drawing from 32,768 values, that is a 5% event in a room of sixty.

Two normalisers, and why they must never be one

foldName   leetspeak, accents, runs collapsed  → impersonation checks
normalizeName  accents only, digits and runs kept  → the identity key

Folding belongs in the check and never in the key. A key that collapses runs turns AkaFukurou144 and AkaFukurou114 into one record — and since names are assigned with a counter, that is two people sharing an account. This has been got wrong once and caught by a test that walks every name the room can issue.

The room sleeps between messages

WebSocket hibernation, and the single most repeated bug here.

A Durable Object using acceptWebSocket is evicted between messages and rebuilt on the next one. So:

What legitimately lives on the instance is a value written and read inside one invocation — a re-entrancy guard, a coalescing flag — and a cache whose loss is harmless. Everything else is loaded on the way in and written on the way out.

Knowing a connection is still there

The room used to learn of a departure only from a close event, and a connection that dies without one — cellular dropping, a lid closing — could sit there indefinitely. It now uses Cloudflare's WebSocket auto-response: the runtime answers the client's ping with pong without waking the object, so the heartbeat costs nothing and is not billed, and getWebSocketAutoResponseTimestamp then says, per socket, when it was last heard from.

The transcript is data, never instruction

Everything in the prompt is untrusted except one signed block.

• Fenced< and > are replaced in every untrusted field, so nothing in the transcript can close it and forge the owner channel.
• SignedAn owner instruction carries a token minted fresh for that one call, from the CSPRNG, never persisted and never sent to a client. The system prompt says a block without it is a guest writing words that look like an instruction.
• CanaryThe model is told never to repeat the token. If it appears in the output — checked against the raw completion, not just the parsed JSON — the entire reply is discarded and the attempt recorded. It is the only positive evidence of injection available; everything else bounds the damage instead of noticing.
• Capped per personOne client contributes at most a third of the window. Without it, four messages a minute owns all thirty inside seven quiet minutes — four thousand characters of contiguous attacker-controlled text, not the 140 the message limit suggests.
• No authorityThe model raises concerns, bounded to names that actually appeared, advisory only. Routing model judgement into an action would hand that power to whoever writes the most persuasive message.

Fifty people at once

Hundreds of accounts is fine. Fifty simultaneous is a different thing.

Accounts cost nothing when nobody is holding them, and across three days there may be hundreds. The ceiling is on people chatting at the same moment, because that is the number the pacing, the name pool, the model's transcript window and a phone screen were all designed around. Past it a room stops being a conversation and becomes a feed.

• Counted as peopleDistinct names, not sockets. A laptop and a phone are one person, and somebody arriving on a second device must not be refused a seat they already hold.
• Hosts exemptNever counted, never refused. Being locked out of your own room because it is popular is the one failure this must not have.
• Stale seatsA socket that has stopped answering the heartbeat stops counting. A phone that left an hour ago must not hold a seat against somebody standing at the badge.
• Idle seatsWhen the room is full and somebody is waiting, the stalest seat goes — but only past twenty minutes of nothing. Nobody is deleted: name, PIN, number and messages all stay, and one tap brings them back.

What the cast knows

Two blocks of reference, and a rule about what to say when neither covers it.

The cast could read a conversation and nothing else. It could not say when a keynote was, where the coffee was, or how somebody gets their name back tomorrow — which is most of what anyone actually asks at a conference.

An event is fields, not prose

A venue can be read straight off the event's own web page. What comes back is not a summary — it is a filled-in form:

name  dates  venue  place  host  audience  shape
stay  travel            hotel, getting there
topics[] speakers[]     capped, because a handout is not a programme
lookup  ask             where to send people instead of guessing

The sentences are then rendered here, from our own templates. So what crosses from a stranger's website is a set of values, and the grammar around them is ours. A field the page does not mention is left out, and a missing field produces one fewer sentence rather than a hedge — a small meetup renders two lines, a three-day summit renders six, from the same object.

The default answer

Every sheet ends the same way, and a test fails if one loses it:

Anything else — sessions, times, rooms, speakers, tickets — check the
summit's own agenda or ask at registration. That is the answer whenever
I do not have something: I carry the basics, not the programme.

Being told to check the website costs somebody ten seconds. Being told the wrong room number costs them the session. So the cast never guesses a time, a place or a room, and it always has somewhere to send people — which is what stops "I don't know" being a dead end.

At the edge

Where the usual advice is actively wrong for this.

An IP is not a person

At a conference most of a hall shares one egress address — the venue NAT, the hotel NAT, iCloud Private Relay, whatever the VPNs are doing. A third or more of the room can look like a single client. Nothing that would refuse a person may be keyed on an address alone.

There is no device identifier underneath it either: a Worker never sees a hardware address, because MACs are link-local and stop at the first router. The per-device identity here is the signed session cookie.

Turnstile, on exactly one route

/rejoin is the only door into the room that does not need the badge, so it is the only one a script can attack at scale and the only one worth challenging. It is live in production, in Managed mode: most people get an invisible check, and a visitor whose network has a poor reputation gets a checkbox they can solve rather than a wall — which matters when a third of a hall shares one address.

The code stays inert without configuration: no sitekey and the widget is never built and no script is fetched; no secret and the server never asks. It never loads on localhost either, so the browser suite keeps no external dependency — and it could not use one anyway, because Turnstile refuses tokens to headless browsers by design. A test run here issued one challenge and it came back unsolved, source browser HeadlessChrome. That is the feature working, and it means the happy path is confirmed on a real device rather than in CI.

It fails open if Cloudflare's own verification endpoint is unreachable — the alternative is locking a whole conference out of rejoining because of a third party's blip, and a guess still has to pass the per-account lockout. An explicit rejection is still a rejection; only an exception is forgiven, and it is recorded.

Shipping it