Architecture

Runtime topology, trust boundaries, persistence, and deployment design.

Status
Source verified
Baseline
98b5313
Primary source
src/core, src/server, src/client

System overview

Thirdwurld is a persistent, real-time 3D environment in which human clients and autonomous residents use the same world protocol. The server owns world state, identity, authorization, persistence, and accepted mutations. Browser and headless clients render or act on the state they receive.

Browser clientThree.js rendering, React interface, input, local prediction
WebSocket protocolBinary snapshots, entity changes, chat, actions, and world events
Authoritative serverFastify, simulation, access control, validation, and persistence
Resident clientsHeadless participants using the shared engine, physics, and packet contract

Runtime topology

RuntimeResponsibilitiesPrimary implementation
BrowserRender the world, collect input, present 2D and in-world UI, interpolate remote motionsrc/client
ServerOwn canonical entities, permissions, events, assets, account state, and durable writessrc/server
Headless residentRun navigation, activities, memory context, conversation, and approved world actionssrc/server/residents.js
Shared engineEntity graph, systems, packets, physics integration, nodes, and scripting interfacessrc/core
Asset pipelineGenerate, bake, optimize, and validate GLB, VRM, texture, and collision assetsscripts, art/blender

JavaScript and ESM are shared across the browser, server, and headless resident runtimes. PhysX is compiled to WebAssembly so collision behavior does not depend on a separate physics implementation for each participant type.

Authoritative action flow

  1. IntentA human or resident selects an allowed action and submits typed context.
  2. TransportThe client sends a binary packet over the shared WebSocket protocol.
  3. ValidationThe server checks identity, scope, current state, target, and idempotency.
  4. MutationAn authorized service changes canonical state inside the server boundary.
  5. ReceiptThe result is recorded as state, an event, or a bounded failure result.
  6. ProjectionEach audience receives only the fields and visibility level it is allowed to read.

Design invariant

Client rendering or UI state never substitutes for server authorization or a durable receipt.

Authority and privacy model

ConcernControlFailure behavior
Actor identityAuthenticated account, resident, Host, or internal service identityReject before mutation
Owner-only dataServer-side selectors and audience-specific projectionsGeneric unauthorized response
World actionsAllowlisted verbs, destinations, objects, and policy checksNo inferred or partial action
RetriesIdempotency keys and short-window duplicate detectionReturn the accepted result or a conflict
In-world scriptsSES-hardened execution with bounded interfacesNo filesystem or arbitrary network access

Persistence

Knex provides one data-access layer across local SQLite and production Postgres. Boot-time migrations create additive schemas. World state, accounts, events, resident memory, relationship state, intent facts, and approved Host changes use distinct stores and visibility rules.

Data classStorageContinuity
World and account stateSQL through KnexPersists across server restart
World eventsTyped event recordsIdempotent, visibility-aware history
Resident memoryStructured SQL records with optional vector recallKeyword fallback remains available
AssetsLocal disk or object storageBackend selected through configuration
Transient simulationProcess memoryReconstructed from durable state after restart

Build and delivery

A single esbuild pipeline produces browser, server, and headless-client bundles. The Docker build uses separate builder and runtime stages. Railway health checks use /status, which reports build time and the best available commit provenance.

  1. CompileBundle the three JavaScript runtimes and copy versioned static assets.
  2. PackageCreate a reduced runtime image containing the build, dependencies, scripts, and source assets required at run time.
  3. Health checkRequire the HTTP status route before a deployment becomes active.
  4. Acceptance checkVerify exact product routes and browser behavior after deployment.

Current boundaries

  • A successful deploy and HTTP 200 establish availability, not complete gameplay correctness.
  • Resident behavior is constrained by allowlisted actions, finite routines, and server checks.
  • Model providers are optional; deterministic fallback behavior keeps core world state available.
  • Python is used for asset production and validation, not the request-time application runtime.
  • The public documentation describes implementation evidence, not user adoption or commercial scale.