chore: multiplayer cookbook

[NathanFlurry]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[railway-app]

🚅 Deployed to the rivet-pr-4200 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
frontend-inspector	😴 Sleeping (View Logs)	Web	Feb 24, 2026 at 3:36 am
frontend-cloud	😴 Sleeping (View Logs)	Web	Feb 24, 2026 at 3:35 am
website	❌ Build Failed (View Logs)	Web	Feb 24, 2026 at 3:27 am
mcp-hub	✅ Success (View Logs)	Web	Feb 24, 2026 at 3:26 am
ladle	❌ Build Failed (View Logs)	Web	Feb 24, 2026 at 3:25 am

[NathanFlurry]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• chore: multiplayer cookbook #4200 : 2 dependent PRs (#4201 , #4253 ) 👈 (View in Graphite)
• feat(dashboard): bring new tabs back #4249
• fix(rivetkit): fix sqlite teardown logic #4259
• main

---

How to use the Graphite Merge Queue

Add the label merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: chore: multiplayer cookbook

This PR adds two categories of content: (1) game example specs and agent notes under .agent/, and (2) OpenSpec workflow commands/skills under .claude/. No production code is changed.

Overall the specs are well-structured and demonstrate good RivetKit actor patterns. A few issues worth addressing:

---

Security

idle-base-builder-leaderboard-2-5d.md — identity model contradiction

The spec uses a localStorage-generated UUID as the actor key (idleWorld keyed by [playerId]), but the security checklist states:

No spoofing: World actor is keyed by server-known identity (c.conn.id).

These two statements directly contradict each other. The playerId from localStorage is a client-controlled value — any client can claim any playerId and connect to any other player's world actor. If an actor implements player-specific actions without verifying the caller matches the actor's playerId, this becomes a privilege escalation vector.

Either:

• The security checklist needs to be rewritten to accurately describe the localStorage identity model and its limitations (a player who clears localStorage loses their world; there's no authentication), or
• The actor should validate that c.conn.id-based authentication is the true source of identity, with playerId only used as a namespace key for persistence.

npc-town-vercel-ai-sdk-2-5d.md — prompt injection not addressed

The AI design section lists input constraints (bounded message length, rate limits) but doesn't mention prompt injection. Players can craft messages designed to override the system prompt or make NPCs behave unexpectedly. The spec should include at least a note about sanitizing or constraining the player message before passing it to the model, and treating all player input as untrusted.

---

Inconsistencies

Missing openspec-verify-change skill

10 commands are added under .claude/commands/opsx/ (including verify.md), but only 9 corresponding skills are added under .claude/skills/. The verify.md command has no matching openspec-verify-change/SKILL.md. This may be intentional if the skill pre-exists, but it's worth confirming.

c.conn.id reconnect ambiguity not resolved in specs

.agent/friction/rivetkit.md explicitly flags c.conn.id identity ambiguity across reconnects as a known friction point. All 7 game specs use c.conn.id as the sole player identity (in some cases also as the actor state key), but none of them document the UX or behavior when a player reconnects with a new conn.id — they would appear as a new player and any in-progress state would be orphaned. This should either be acknowledged as a non-goal in each spec, or a reconnect/resume pattern should be described for examples where it matters (e.g., FPS mid-match, party game mid-round).

MMO chunked world — vague block type enum

The worldChunk block type is defined as "wood"|"stone"|"grass"|.... The trailing ... is too vague for a spec. Either define the full enum, or explicitly call out that the implementation should define the complete set.

---

Minor Issues

FPS spec — formatting bug

In realtime-multiplayer-fps-3d.md, the Testing section has a broken list:

- Actor-level tests for `fpsMatchmaker` indexing/heartbeat/cleanup with SQLite-backed `matches` table.
Actor-level tests for `fpsMatch`:

The line Actor-level tests for fpsMatch: is missing its leading -, breaking the markdown list.

Command/skill content duplication

The .claude/commands/opsx/ and .claude/skills/openspec-*/ directories contain substantively the same content. The skill files include a version metadata header and in at least one case an additional guardrail (the ff skill explicitly notes that <context> and <rules> blocks should not be copied into artifact output). If these diverge over time they will become inconsistent. Consider whether a single source of truth (with skills pointing to commands, or vice versa) would be more maintainable.

---

Positive Notes

• The actor design patterns are consistent and well-reasoned across specs: coordinator/data actor split, SQLite via rivetkit/db for persistent state, c.conn.id as identity, c.schedule for offline progression.
• The multiplayer cookbook (.agent/notes/multiplayer-cookbook.md) is a solid reference covering tick rates, netcode tradeoffs, physics library recommendations, and a security baseline checklist.
• Server-authoritative combat (FPS) and economy (idle builder) are correctly designed with server-owned math and validation.
• The game-examples-issues log is a useful record of practical friction encountered during implementation.
• The spatial sharding approach in the MMO chunked world spec cleanly demonstrates the actor-per-chunk pattern without overcomplicating the client handoff story.

[pkg-pr-new]

More templates

• actor-actions
• actor-actions-vercel
• ai-agent
• ai-agent-vercel
• example-ai-and-user-generated-actors-freestyle
• chat-room
• chat-room-vercel
• example-cloudflare-workers
• example-cloudflare-workers-hono
• collaborative-document
• collaborative-document-vercel
• cross-actor-actions
• cross-actor-actions-vercel
• example-cursors
• example-cursors-raw-websocket
• example-cursors-raw-websocket-vercel
• example-cursors-vercel
• custom-serverless
• custom-serverless-vercel
• example-elysia
• example-elysia-vercel
• example-experimental-durable-streams-ai-agent
• example-experimental-durable-streams-ai-agent-vercel
• geo-distributed-database
• geo-distributed-database-vercel
• hello-world
• hello-world-vercel
• example-hono
• hono-react
• hono-react-vercel
• example-hono-vercel
• example-kitchen-sink
• example-kitchen-sink-vercel
• multi-region-vercel
• multiplayer-game
• example-multiplayer-game-patterns
• multiplayer-game-vercel
• native-websockets
• native-websockets-vercel
• next-js
• per-tenant-database
• per-tenant-database-vercel
• example-raw-fetch-handler
• example-raw-fetch-handler-vercel
• example-raw-websocket-handler
• example-raw-websocket-handler-proxy
• example-raw-websocket-handler-proxy-vercel
• example-raw-websocket-handler-vercel
• example-react
• example-react-vercel
• sandbox
• sandbox-coding-agent
• sandbox-coding-agent-vercel
• sandbox-vercel
• scheduling
• scheduling-vercel
• example-sqlite-drizzle
• example-sqlite-raw
• example-sqlite-raw-vercel
• state
• state-vercel
• example-stream
• example-stream-vercel
• example-trpc
• example-trpc-vercel

@rivetkit/virtual-websocket

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/virtual-websocket@4200

@rivetkit/cloudflare-workers

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/cloudflare-workers@4200

@rivetkit/framework-base

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/framework-base@4200

@rivetkit/next-js

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/next-js@4200

@rivetkit/react

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/react@4200

rivetkit

pnpm add https://pkg.pr.new/rivet-dev/rivet/rivetkit@4200

@rivetkit/sql-loader

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/sql-loader@4200

@rivetkit/sqlite-vfs

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/sqlite-vfs@4200

@rivetkit/traces

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/traces@4200

@rivetkit/workflow-engine

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/workflow-engine@4200

@rivetkit/engine-runner

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/engine-runner@4200

@rivetkit/engine-runner-protocol

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/engine-runner-protocol@4200

commit: d50f2d3