The manual
Everything confcode does, in the order you will need it. Nothing here is longer than it has to be.
Getting in
Scanning the badge is the only way into the room. That is on purpose.
1 · Scan
Point your camera at the QR on Steve's lanyard. The code rotates every few minutes, so it only works while you are standing there.
2 · Pick a PIN
Six to fifteen letters and numbers, with at least one number. That is the whole sign-up — no email, no account, no app. The page tells you what is wrong as you type, or will suggest one.
3 · You are in
You get a name, a colour and an avatar, and you land in the same conversation as everybody else who scanned.
4 · Screenshot it
The room offers you a card with your name on it, drawn large and plain so a photo of it reads back cleanly. Save it to your photos. It is the fastest way back in tomorrow, and it takes two seconds now against a name half-remembered later.
Why no join link? Because a link travels and a badge does not. Being in front of the badge is the credential. Typing the room code gets you nothing — the code is a label, not a key.
And why a name as well as a PIN? Because a PIN on its own is not a person. If it were, two people who happened to choose the same one would be the same person, and the second would arrive holding the first's name. The name is assigned and unique; the PIN proves it is yours.
Your name, colour and avatar
All three are assigned. You can change how you look, not who you are.
- Your nameAssigned from a fixed list of 500 — mostly Japanese nature words paired with a creature — and your guest number is on the end of it:
AkaFukurou137. Nobody types their own, so nobody can impersonate anybody, and no two people can ever hold the same name in this room or the next one. It is also your username: when you come back, capitals do not matter. - How it is drawn••• → Your settings → Account offers
AkaFukurou137,akaFukurou137orakafukurou137. Appearance only — signing in lowercases anyway, so the three are already the same person. There is no ALL CAPS: it reads as shouting, and uppercase is the room’s own voice. - Guest numberNumbers start at 100 and go up. It is the handle every host command takes —
/warn 137— so the name tells you what to type without looking anything up, and hosts can refer to somebody without using their name in the room. - AvatarPicked for you at random from 124 icons. Change it in the ••• menu.
- ColourAlso assigned, also yours to change in the ••• menu. It is the background of your messages, in a shade picked so white text on it clears the WCAG AA contrast minimum — the bright version of every colour fails that badly.
- Your cardThe room offers you a picture of your username and PIN at the moments it knows them: when you first join, when you come back and type them, and when you change your PIN. Save it to your photos — that pair is what brings you back. Keep it to yourself, and add a second factor if you would rather a screenshot were not enough on its own.
- Your PINThe only thing you choose. Your name and your PIN together are what bring you back — the PIN on its own is not an identity, so two people who happen to pick the same one stay two people. Nobody can see it, including Steve.
A few of the avatars:
And stickers, which you can send instead of words:
Every command
Type these into the message box. On a phone, tap ••• then Console — every command is a button that fills the box for you.
Anyone/helpThe short version of this page, in the room./whoamiYour name, number, and how long you can come back for. Only you see it./usersWho is in the room right now, with their guest numbers./castThe four AI guests and what each one is for. Fixed text, so it costs nothing and cannot be talked into saying anything else./aboutWhere to read about this — said as a name, not a link, because the room filters links out and a domain is easier to repeat across a table anyway./timeThe room's clock./hosts <message>Reaches the hosts only. The one private message there is — and it goes upward, never guest to guest./2faSet up an authenticator, so a screenshot of your card is not enough to come back as you./clearClears your own view. Nobody else's./logoutSigns this device out. Your name and PIN bring you back./announce <message>Posts to the room so it gets noticed — full width, amber edge, never folded into a run of messages. It is filtered like any other message, links included: an announcement is the most persuasive thing anybody can post here./warn <n>Sends guest n a quiet, fixed note. Only they see it./alert <n>Tells every host that guest n needs attention./statusRoom code, headcount, message count, what the cast is doing./name <n> <name>Rename guest n./label <n> <label>Tag them: co-host, speaker, friend./promote <n>Make guest n a co-host./demote <n>Take it back./unlock <n>Clear a lockout after too many failed tries./release <n>Free a name, its PIN and its role entirely./ban <n>Blocks every device that guest is signed in on and closes their rejoin. It is deliberately not absolute: they can still scan the badge and start again as somebody new, because scanning is the only way in and it is the one thing a ban cannot reach. Use it to end a moment, not to build a wall./mute allSilence the whole cast. Also /mute kigo for one voice./unmuteLet them speak again./pace <level>quiet, normal or lively — how talkative the cast is. Multiplies the room-size rules rather than replacing them, so a lively crowd is still calmer than a lively room of three./wipeEmpties the transcript for everyone. Nobody is signed out, no names change hands, the room stays open — only what is on screen goes./tz <hours>Set the room clock, e.g. /tz -5.@1 … @4Address one of the cast: 1 Kireji, 2 Kigo, 3 Renga, 4 Ma. @ai lets whoever wants it answer. Only Steve can do this — a guest naming them is just conversation./pause / /resumeStop and restart the room without losing anything. Nobody new gets in, nobody can post; messages, names and PINs all survive./hoursOpening hours. /hours room 08:00 23:00, /hours cast 08:00 17:00 so the AI keeps different hours from the room, /hours ends <when> so a forgotten room pauses itself, /hours announce off, or /hours off. All of it pauses; none of it closes./conference <name>Name the conference. /conference about <text> sets the line shown under the status on the front page./closeClose the room. Every message goes with it.Deleting. Tap a message to open its reactions and there is a Delete beside them — on your own always, and on anybody's if you host the room. It happens quietly: the message stops being there and nothing marks the gap, because a "message deleted" notice draws a box around the thing that was removed.
@mentions. Type @ and the first letters of a name and
the room offers you the rest — or just tap somebody's icon beside
what they said. A mention is a way to reply to someone in the open; it is
not a private message.
The console
For hosts. Tap ••• then Console. Everything below is a button, because admin at a conference happens on a phone, standing up, in a hall.
- RoomThe room code, who is in it, and the switches that change a live room: pause, the cast on or off, name the conference, set the clock, and clear the transcript.
- UsersEverybody here right now with their guest number, and per-person buttons — warn, flag to the hosts, rename, label, promote, ban. Anyone locked out after five wrong PINs appears here with Unlock and Release beside them.
- AccountsEverybody who has ever been in this room, which the Users tab cannot show — signed out, locked out, on how many devices, whether they have 2FA, when they were last seen. Sign out reaches a phone that is in a pocket; Close retires that PIN permanently and keeps the name taken so nobody else is given it. Booth screens are listed here too, with a Revoke beside each.
- AgentsThe cast, the number that addresses each one, and a Mute button each. The talkativeness dial — Quiet, Normal, Lively — applies the moment you tap it.
- ShareA join QR on a white ground, with a Copy link beside it. Screenshot it and send it on: it rotates in a few minutes and only lets a few people through, so it is the front door photographed, not a back one. It is a different code from the one on the badge — this one is derived here, from the server's clock; the badge shows the room's master code, which needs no clock at all. Both open the same room.
- CommandsEvery command as a chip. Tapping one drops it into the message box with the guest number already filled in; anything in CAPITALS is selected so your next keystroke replaces it.
- ActivityMessages, people and cast lines over the last hour, six hours or day, plus tokens and spend.
- LLMThe last fifty calls to the model, newest first: what triggered each one, which voices spoke, what it cost, how long it took — and, when nobody spoke, the reason it gave for staying quiet. The transcript that was sent is not here, only a count of lines: those are guests' words, they already live in the room, and a diagnostics panel is not where they belong. Underneath sits the watcher's panel, folded shut — the moderation pass raises concerns there, advisory and never an action.
- ErrorsWhat has gone wrong, with times, oldest at the bottom. Categories only — never a message, a name or a PIN. Cast lines filtered, people turned away, failed PINs, lockouts.
- VenuesThe conferences set up in advance. Each one shows both the fields it stores and the sentences the cast will actually be handed, so what you edit and what it says cannot drift apart. Read one straight off an event's website, correct it, then switch it on. The room's own self-knowledge is here too, to read.
- ConfigEvery number the room is running on, read from the constants themselves rather than retyped, so it cannot describe a room that does not exist. Almost all of it takes a deploy on purpose: a rate limit that can be loosened from a phone at a conference is a rate limit that gets loosened at a conference.
Clearing is not closing. /wipe empties what is on
screen and leaves everything else alone. /close ends the
room, signs everybody out and rotates the code. They sit one button
apart on the Room tab, so clearing asks first.
The AI in the room
Four guests running on Claude Haiku 4.5. They take part like anyone else, with an AI label on every message.
The cutting word. Reframes what was just said, or names the angle nobody has.
The season word. Welcomes newcomers and names the mood of the room.
Linked verse. Notices when two people are circling the same thing.
Negative space. Rarely speaks. Means it when it does.
- Can't be toldYou cannot address or instruct them. They read the room; they do not take orders from it.
- Signed instructionsThe one voice they do take is the host’s, and it arrives carrying a token minted fresh for that single call. A block without it is a guest writing words that look like an instruction. The model is told never to repeat the token; if it ever does, the whole reply is thrown away and the attempt is recorded.
- No DMsThey never send you anything but a fixed, pre-written note. There is no prompt that makes them write you a private message.
- No authorityThey cannot warn, mute, remove or name anyone. Moderation is a person, always.
- Quiet by defaultThey speak occasionally, not on every message. Steve can silence them entirely.
- LabelledEvery message they send is marked AI. They will never pretend to be a person.
- They know the basicsWhat this room is, and the basics of the conference — what it is, when, where. Ask them something the room does not carry and they will say so and point you at the event's own site, rather than guessing a room number. Being sent to the wrong floor is worse than being told to look it up.
Coming back
Your phone locks, the battery dies, you move to a laptop. Here is what happens.
Nothing to do
Reopening the page puts you straight back in as yourself, with your name and your messages. This is the normal case.
Scan again
Steve is standing right there. Scan, then tap I have been here before and give the name you were given with your PIN. A scan and a bare PIN makes somebody new.
confcode.com/rejoin
Your name and your PIN, for five days after your last visit. If you have set up an authenticator, its six-digit code too.
A second factor is worth having, and nobody is stopped for not having
one. Requiring it turned almost everybody away: hardly anyone enrols,
so the only people the rejoin page served were the few who had, and a
screenshot of a name and a PIN was worth nothing. Type /2fa
once and a picture of your card stops being enough on its own —
anyone who has enrolled must give the code, every time.
A warning or a ban ends the five-day window. Keeping a name between rooms is a courtesy, and that is the point at which it stops.
Privacy and house rules
Short, and all of it true.
- Everything publicEvery message you send is visible to everyone in the room. There are no private conversations between guests.
- Nothing keptMessages live only as long as the room. Closing it deletes them.
- No accountsNo email, no sign-up, no tracking, no analytics on you. A name you were given and a PIN you chose.
- No mic, no cameraThe badge has neither. It cannot hear or see anything.
- Nothing loggedThe event stream records counts and categories. Never message text, names or PINs.
- 140 charactersMessages are capped, links are filtered out, and abuse is blocked before anyone sees it.
- Off by defaultThe room only exists while Steve is at a conference and has opened it.
Be nice to each other. Moderation here is quiet by default and the AI is never the enforcer. Full terms.
The badge
A Pimoroni Badgeware Tufty 2350 on a lanyard, running MicroPython.
The badge needs the hotspot. The conversation does not. Guests' phones reach Cloudflare on their own cellular, so if the rig fails mid-conference the room carries on without it.
| Board | Pimoroni Badgeware Tufty 2350 (Mfr WARE002) |
| Processor | RP2350B @ 250 MHz · 520 KB SRAM · 8 MB PSRAM · 16 MB flash |
| Wireless | Raspberry Pi RM2 (CYW43439) — 2.4 GHz Wi-Fi, Bluetooth 5.2 |
| Display | 2.8" 320×240 IPS LCD, adjustable backlight |
| Controls | 5 front buttons (A / B / C, up, down), rear home and reset |
| Lighting | 4-zone rear mono LEDs |
| Power | 1000 mAh LiPo, USB-C charge and program, hardware RTC |
| Software | MicroPython on the BadgeOS launcher; the app is a folder on the badge's own USB drive |
| Uplink | A Solis Go hotspot in Steve's bag. Venue Wi-Fi is not trusted and not used. |
What the badge does
Six screens on A, a dedicated Control key on C, and a name badge on B.
| Invite | The default. A big QR and Steve's name — the screen the badge lives on, and the only one that never needs the network. |
| Transcript | The conversation, live, in block letters readable across a booth. One press from the default. |
| Dashboard | The room code, how many people are in it, the countdown to the next code, and how to come back. |
| Diagnostics | Wi-Fi state, battery, clock drift, how many codes are cached, when it last reached the server. |
| Log | What the badge has actually been doing. Errors in alert colour, newest last. |
| About | What this is, for somebody who picked the badge up. |
| Control (C) | Open or close the chat, allow more people, start a new room, sync, mute the cast, backlight, boot target. UP/DOWN to move, B to select; closing the room or rotating it needs B held. |
| Name badge (B) | Just his name and title, big — for when the QR is not the point. |
The chat never depends on the badge. Your phone talks to Cloudflare directly over your own cellular. The badge only rotates the QR and shows its own dashboard. If the badge dies mid-conference, the conversation carries on without it.
That works because the badge is a passive display. Tokens are derived by HMAC from the room code and a five-minute window, so the badge and the server compute the same answer independently from the clock. The badge cannot extend a code's life — an offline badge showing a stale code gets rejected, not honoured — and it can keep rotating correctly for about twelve hours with no network at all, from 144 tokens issued in advance.
Nothing is stored and nothing is exchanged: the badge and the server are not kept in sync, they simply agree, because they are doing the same arithmetic on the same clock. That is what lets the badge be a screen with no authority — and why a photograph of the QR stops working a few minutes after it is taken.
A screen instead of a badge
A tablet or a laptop at confcode.com/kiosk shows the same rotating code on a full screen — the front of the badge, without the name on it — so a booth or a table can let people in while the badge is on a lanyard somewhere else.
- It only shows codesThere is no chat on it, no console, no way to post. It renders the QR and nothing else, because a screen left unattended on a table is exactly the thing that should not be able to do anything.
- It has to sign inAn id and a PIN, and a six-digit code from an authenticator when one is configured — checked only after the id and PIN match, so it never answers the question of whether a PIN was right.
- One at a timeSigning a new screen in ends the last one. There is never a second booth token loose in the world without somebody deciding there should be.
- RevocableConsole → Accounts → Booth screens → Revoke. The tablet's cookie stays perfectly valid and simply stops meaning anything, which is how every session here works: a signature proves which device it is, and the room decides what that is worth.
The route does not exist until its credentials are set. A door that has not been built cannot be left open.
How it is built
Five layers, four languages, no framework anywhere.
| Server | A Cloudflare Worker with two Durable Objects — one per room, plus a registry that guarantees only one room is ever open. |
| Chat page | Hand-written HTML, CSS and JavaScript. No framework, no build step, no dependencies. |
| Badge app | MicroPython on the Tufty, with its own 5×7 block-matrix text renderer so the screen is readable across a room. |
| Control app | A Go terminal dashboard, plus a phone-friendly console inside the chat itself. |
| The cast | Claude Haiku 4.5, called with a fenced transcript it can read but never be instructed by. |
| Tests | 336 Worker tests, 79 badge tests, and a browser suite across five device profiles — iPhone, iPhone SE, Pixel, Chrome and Safari. |
The security model is short enough to state in full. Scanning is the only way in. The transcript is data and never instruction, so a message cannot talk the model into anything. The model cannot name anyone for action — it can raise a concern, and a person decides. Badge credentials and admin credentials are separate, and each rejects the other, so a lost badge never reaches the admin surface.
The long version. How the token is derived, why the badge holds no authority, what the room does when it goes to sleep between messages, what reaches the model and what cannot, and which pieces of standard edge advice are actively wrong here — confcode.com/tech.
When something goes wrong
- Code expiredThe QR rotates every few minutes. Wait for the badge to change and scan again.
- One momentLots of people joining at once. Wait for the next code.
- Too many triesFive failed attempts locks a PIN. Ask Steve —
/unlockclears it. - Didn't matchWrong PIN or code, or more than five days since your last visit. Scan the badge.
- Chat is closedThe room is only open while Steve is at a conference.
- Lost your PINScan the badge again. You will be given a new name — a scan with a bare PIN always makes somebody new.
- Forgot your nameIt is beside every message you sent, and
/whoamitells you. Without it you cannot come back to that identity, only start a new one. - Lost your phoneFind Steve. He can release your name so you can start fresh.
- Nothing loads at allAlmost always cookies. confcode keeps one signed cookie saying which device you are — no name, no PIN, nothing about you as a person — and without it the room cannot tell your messages from a stranger's. confcode.com/cookies says which setting to change on which phone.
- Room is fullFifty people are chatting. Somebody who has been quiet for twenty minutes gives their seat up as soon as anybody is waiting, so it usually clears on its own — scan again in a few minutes.