KLYRNGAMES
Open panel ↗

THE BUILD LOG / OCTOBER 2026

A better panel.
One proven step at a time.

English first. A new design direction. Real server workflows, with evidence behind every milestone.

34/69acceptance criteria met
01 / NOW

Design & first playable server

11 items in development or review

02 / NEXT

Recovery before expansion

Console, files, backups, and a tested restore.

03 / THEN

Hosting as a business

Reseller pools, migration, and certified games.

G00 Repository discovery and isolation7/7

Know what the estate already has and keep GAMES apart from it.

G00-discoveryVerifiedP0 Estate discovery record The existing Klyrn products were surveyed; reuse and gaps are written down. 4 of 4 criteria

Anyone can see what GAMES reuses from Klyrn and what it builds new.

Acceptance criteria

  • Met: Repositories, modules and owners of each product recorded
  • Met: Reusable assets listed with their source files
  • Met: Missing shared pieces (identity, translations, PostgreSQL) recorded
  • Met: Current Pterodactyl versions checked against GitHub, not memory
G00-isolationVerifiedP0 Separate boundary, host and secrets GAMES has its own code boundary and its own servers. 3 of 3 criteria

Work on GAMES cannot break Klyrn VM or Klyrn WEB.

Needs G00-discovery

Acceptance criteria

  • Met: Own module directory, no imports from other products
  • Met: Own host, not shared with any existing product
  • Met: Architectural decisions recorded as ADRs

G01 Tracking foundation Current milestone8/10

This roadmap and the changelog, live and honest from day one.

G01-manifestsVerifiedP0 Roadmap and release manifests with validation The roadmap is a checked file, so a status cannot be set without proof. 3 of 3 criteria

Progress is recorded in one place and cannot claim what was not shown.

Acceptance criteria

  • Met: Schema for roadmap items and releases
  • Met: Validator rejects unknown dependencies, unevidenced verified items and releases without a healthy deployment
  • Met: Validator has tests that prove each rejection
G01-public-pagesReleasedP0 Public roadmap and changelog pages The redesigned English-only roadmap and changelog are live, with responsive verification and release records. 5 of 5 criteria

The owner and providers can follow progress at gamecp.klyrn.com.

Needs G01-manifests

Acceptance criteria

  • Met: /roadmap with milestone, status and module filters, list and board views
  • Met: /changelog, /changelog/<version> and a JSON feed
  • Met: Each page shows the manifest revision and build time
  • Met: New English design verified in light and dark, 390 to 1440 pixels wide
  • Met: Redesigned English-only pages deployed over HTTPS and checked externally
G01-owner-trackingPlannedP1 Owner tracking view with evidence and blockers A signed-in view for the owner with the evidence behind each status. 0 of 2 criteria

The owner sees evidence links and blockers without opening the repository.

Needs G01-public-pages, G03-accounts

Acceptance criteria

  • Not yet: /app/project-tracking behind sign-in, owner role only
  • Not yet: Shows internal notes, evidence and blockers per item

G02 GAMES control room design6/8

A new English-only design: public site, server workspace, create flow, and honest tracking.

G02-tokensIn progressP0 Control room tokens and core components New typography, copper accents, porcelain surfaces, and a dedicated dark console. 2 of 3 criteria

Every GAMES screen shares one look that is recognisably Klyrn.

Acceptance criteria

  • Met: Klyrn identity adapted into original control room composition, with light and dark themes
  • Not yet: Buttons, fields, tables, badges, dialogs, toasts with focus rings and 44px targets
  • Met: Reduced motion honoured
G02-screensIn progressP0 Homepage, server list, create flow and server workspace New homepage and interactive panel; sample mode is explicit and live workflows need end-to-end verification. 4 of 5 criteria

The main screens exist in the approved direction before features fill them.

Needs G02-tokens, G03-i18n

Acceptance criteria

  • Met: Public homepage with clearly labelled preview features
  • Not yet: Server list in grid and dense modes with every status state
  • Met: Create flow Game, Configure, Review
  • Met: Server workspace with only applicable sections
  • Met: English screenshots in light and dark at 1440, 1024, 768 and 390 pixels

G03 Identity, tenancy and English experience5/10

Real accounts, organizations, permissions, and a complete English experience.

G03-accountsIn progressP0 Accounts, sessions and two-factor Password and authenticator sign-in, encrypted enrollment, one-use recovery codes, persistent account attempt limits and session revocation are implemented and integration tested. Scoped API tokens are limited to one workspace and current permissions. Password reset and assisted recovery remain open. 2 of 3 criteria

People sign in safely and can recover access.

Acceptance criteria

  • Met: Password and TOTP sign-in with rate limits
  • Met: Session revocation and scoped API tokens
  • Not yet: Documented account recovery
G03-federationBlockedP2 Klyrn Account federation Single sign-on with other Klyrn products, once Klyrn Account offers it. 0 of 1 criteria

One Klyrn login across products.

Needs G03-accounts

Blocked by my.klyrn.com has no OIDC issuer yet (ADR 0005)

Acceptance criteria

  • Not yet: Sign in through my.klyrn.com as an OIDC provider
G03-tenancyIn progressP0 Organizations, memberships and permissions Customer workspace creation and workspace-filtered server browsing are live. Full delegation, cross-tenant stream coverage, and invitations remain open. 0 of 3 criteria

Providers, resellers and customers each see only what is theirs.

Needs G03-accounts

Acceptance criteria

  • Not yet: Vendor, provider, reseller, customer hierarchy with server-verified workspace context
  • Not yet: Granular permissions; delegation cannot exceed the delegator
  • Not yet: Negative tests across sibling customers and resellers for list, search, export and signed URLs
G03-i18nReleasedP0 English-only product experience English only for this phase. Additional languages are outside the current launch scope. 3 of 3 criteria

The current product offers English consistently, without a Hebrew version or language switch.

Acceptance criteria

  • Met: English is the only published locale, without a language switch or Hebrew alternate links
  • Met: Previously published Hebrew routes no longer serve the Hebrew product
  • Met: Panel, validation, empty states, and tracking are usable in English

G04 Node enrollment and protocol0/3

Game nodes join securely, report health and can be revoked.

G04-enrollmentIn progressP0 Node enrollment, certificates and heartbeat Enrollment and agent heartbeat code exists. The earlier lab reconnection report still needs current evidence. 0 of 3 criteria

A provider adds a game node in minutes, and a lost node can be cut off.

Needs G03-tenancy

Acceptance criteria

  • Not yet: One-use expiring enrollment token, per-node certificate
  • Not yet: Outbound connection, heartbeat, reconnection, version negotiation
  • Not yet: Revocation shown to work against a live agent

G05 First real game, end to end3/8

A Minecraft server you can deploy, join, control, back up and restore.

G05-minecraftIn progressP0 Minecraft vertical slice Live console, configuration edits, backups, and a restored world-data change verified. Client join and browser creation remain open. 2 of 5 criteria

A customer gets a playable Minecraft server and can protect its world.

Needs G04-enrollment, G06-operations

Acceptance criteria

  • Not yet: Deploy Paper from the create flow
  • Not yet: A real client joins
  • Not yet: Console, start, graceful stop, force stop
  • Met: File manager edits server.properties safely
  • Met: Backup, then restore a world and see the change undone
G05-api-reliabilityIn progressP0 Resolve intermittent API responses before expanding the lab Current external, authenticated, and host-origin samples returned complete responses. The original intermittent failure is still unconfirmed. 1 of 3 criteria

The panel receives reliable API responses and gives clear recovery guidance on a timeout.

Needs G04-enrollment

Acceptance criteria

  • Met: Compare repeated external, nginx-local, and direct controller requests with elapsed times and response sizes
  • Not yet: Diagnose the reported intermittent empty responses and record a reproducible fix or bounded current finding
  • Not yet: Browser handles request failure without presenting stale or sample data as live

G06 Durable operations and quotas1/3

Retries and double clicks are safe; capacity can never be overspent.

G06-operationsIn progressP0 Durable operations and capacity reservations Pool contention, persisted retry delays, attempt limits, and lease ownership are tested. Backup and restore receipts prevent blind replay. Activity can confirm completed node receipts without rerunning work; incomplete outcomes still need operator recovery. 1 of 3 criteria

Double clicks, retries and parallel requests never create duplicates or overspend.

Needs G03-tenancy

Acceptance criteria

  • Not yet: Operations with idempotency keys, checkpoints, deadlines and per-server leases
  • Met: Concurrent reseller creates cannot exceed the pool (tested under contention)
  • Not yet: Abandoned reservations released only when confirmed unused

G07 Pterodactyl egg import and compatibility4/6

Import eggs with a clear report of what works, what is adapted and what is blocked.

G07-eggsIn progressP0 Egg import with a compatibility report The Egg Center stores workspace-scoped PTDL_v2 review versions, original files and compatibility findings. A source-bound imported application egg has been published to its workspace and provisioned through the live panel, with offline installation, readiness, HTTP and console verified. File, public HTTPS URL and pinned catalog imports retain source bytes. URL imports refuse private destinations; catalog imports verify source checksums. Bounded installation-time properties and JSON scalar patches pass source-to-runtime tests. Visible read-only variables are enforced; fixed hidden values require explicit non-secret review. Networked installation, secret storage, broader parser semantics, per-start rewrites and upstream game certification remain in progress. 4 of 6 criteria

Providers bring their Pterodactyl eggs and see exactly what will work.

Needs G05-minecraft

Acceptance criteria

  • Met: Import by file, authorised URL (SSRF-safe) or catalog; source bytes kept
  • Met: Findings classed supported, adapted, blocked or unverified
  • Met: Install scripts run in a constrained installer with no host access
  • Met: Fixture set including a privileged egg that is refused
  • Not yet: Supported configuration parsers and variable visibility/secret rules preserve source semantics
  • Not yet: Upstream reference eggs pass install, readiness, stop and persistence through reviewed publication

G08 Core management breadth0/2

SFTP, schedules, databases, allocations, updates, team access and notifications.

G08-breadthIn progressP1 SFTP, schedules, databases, allocations and team access Calendar planning for daily and weekday schedules is tested across timezone transitions. Inactive drafts and paginated run history have scoped panel controls. Terminal operation outcomes reconcile into history, with admitted failures kept uncertain. Saved outcomes can be checked from the panel without repeating server actions. Durable disable barriers and automatic acknowledgment retries are tested in isolated databases. Activation reservations and persisted next-due cursors are tested behind the disabled-only database gate. An opt-in dispatch loop is tested. The scoped activation API is tested. Active panel controls are verified in the sample workspace. The controller foundation is deployed with dispatch off. Live scheduling drills and gate opening remain unfinished, alongside SFTP, databases, extra allocations, team access and notifications. 0 of 2 criteria

Daily server management without leaving the panel.

Needs G05-minecraft

Acceptance criteria

  • Not yet: Scoped SFTP, schedules with time zones, managed databases, extra allocations
  • Not yet: Team permissions and notifications

G09 Provider and reseller business0/1

Capacity pools, customers, packages and branding for providers and resellers.

G09-businessPlannedP1 Pools, packages, customers and branding Built-in reseller operations. 0 of 1 criteria

A reseller sells within a pool and explains every refusal.

Needs G06-operations

Acceptance criteria

  • Not yet: Pool allocation, packages, customer creation, branding, role isolation end to end

G10 Pterodactyl migration0/2

Move a Pterodactyl estate with a dry run, validation and a rollback path.

G10-migrationPlannedP1 Guided Pterodactyl 1.x and 2.x migration Move from Pterodactyl safely; the lab source is a real Pterodactyl 2.0 beta. 0 of 2 criteria

A provider moves from Pterodactyl with a dry run and a way back.

Needs G07-eggs, G11-games

Acceptance criteria

  • Not yet: Version-detecting read-only source adapters
  • Not yet: Dry run, user mapping, staged transfer, fenced cutover, tested rollback in the lab

G11 Certified game packs0/1

Each advertised game passes install, update, query and backup tests.

G11-gamesPlannedP1 Certified game packs Only games that pass tests are listed as certified. 0 of 1 criteria

Each advertised game is proven, not assumed.

Needs G05-minecraft

Acceptance criteria

  • Not yet: Paper, a modded Minecraft, a SteamCMD title, Valheim and an app fixture pass the lifecycle matrix

G12 Rentals and integrations0/2

Licensing, grace periods, custom domains and WHMCS.

G12-commercialIn progressP2 Licensing, custom domains and WHMCS Signed entitlement verification and isolated cache tests pass. Controller scheduling policy and operator import are tested. Trusted-key deployment, renewal, custom domains and billing remain unfinished. Prices are not published yet. 0 of 2 criteria

Providers rent GAMES and plug it into their billing.

Needs G09-business

Acceptance criteria

  • Not yet: Signed entitlements with grace policy; running games never stop for billing
  • Not yet: Custom domains with ownership checks and certificates; WHMCS lifecycle tested

G13 Recovery and diagnostics0/1

Incident timeline, staging copies, restore drills and safe updates.

G13-recoveryPlannedP2 Incident timeline, staging and restore drills Recovery tools with evidence. 0 of 1 criteria

When a server breaks, one timeline shows why.

Needs G08-breadth

Acceptance criteria

  • Not yet: Incident timeline, staging clones, restore drills, safe update workflow

G14 Hardening and load0/2

Security review, failure drills and measured load.

G14-hardeningPlannedP1 Security review, failure drills and load Hardening before any paid use. 0 of 2 criteria

Failures were rehearsed before customers meet them.

Needs G10-migration, G12-commercial

Acceptance criteria

  • Not yet: Threat model, security review and the failure scenarios of section 19
  • Not yet: Load results on a published reference environment

G15 Private provider pilot0/1

Real workloads with a first provider, limits written down.

G15-pilotPlannedP1 Private provider pilot A first provider, with limits stated. 0 of 1 criteria

A real provider runs real workloads with written limits.

Needs G14-hardening

Acceptance criteria

  • Not yet: Pilot with monitored incidents and documented limitations

G16 General availability0/1

No blocking defects; documentation, support and rollback ready.

G16-gaPlannedP1 General availability General availability. 0 of 1 criteria

Every public claim matches evidence.

Needs G15-pilot

Acceptance criteria

  • Not yet: No release-blocking defects; docs, support, update and rollback ready

G17 Expansion0/1

Windows and MU Online, more games, SDK and marketplace, each gated on its own.

G17-windowsDeferredP3 Windows runtime and MU Online Windows games later, on their own tested runtime. 0 of 1 criteria

Windows-only games such as MU Online, on a tested VM boundary.

Needs G11-games

Deferred because Needs a separate Windows runtime on a VM boundary; after G11.

Acceptance criteria

  • Not yet: Windows runtime with its own isolation, tested with MU Online server files