Nexus SecOps -- Team Leaderboards POC (Y.js + WebRTC)

Read this before joining a team

This is an educational POC for visualizing collaborative learning progress. It is not a production leaderboard. There is no anti-cheat, no server-side score validation, no persistence beyond the current peer session, no moderation, and no authentication. Anyone in the room can claim any score. Treat scores here as study-group banter, not a competitive ranking.

External CDN exception: Nexus SecOps is normally a zero-external-dependency static site. This tool is the documented exception (matching the Purple Team Arena and Peer Review POCs). It loads yjs@13.6.18 and y-webrtc@10.3.0 from cdn.jsdelivr.net. The dynamic imports use Subresource Integrity (SRI) hashes for tamper detection.

SRI hashes are PLACEHOLDERS in this POC The integrity="sha384-ghlZMZ/j8iYg2QKKfDUo2/h7LTtqgqEDJZLR58Aha3XZ9l4K/MTy+y2mTTbKNPa9" attributes referenced below are placeholders, identical to the sibling POCs. Before deploying this page publicly, regenerate real SHA-384 SRI hashes for the exact pinned version URLs at srihash.org (or via openssl dgst -sha384 -binary file.mjs | openssl base64 -A) and replace the placeholder strings. With placeholders, modern browsers refuse to execute the modules and the tool fails closed — that is intentional.

Public WebRTC signaling: The y-webrtc default signaling endpoints are wss://signaling.yjs.dev, wss://y-webrtc-signaling-eu.herokuapp.com, and wss://y-webrtc-signaling-us.herokuapp.com. Your room name is sent to those servers in plaintext. Anyone who knows your room name can join and self-report a score under any name. Do not transmit anything sensitive. The default room name is clearly synthetic.

Anti-cheat: there is none. This tool reads your local stats from sibling tools and broadcasts them to peers. Peers cannot verify those stats are real — anyone in the room can publish any number. For competitive use, integrate the Skill Portfolio Verifiable Presentation export so peers can cryptographically verify each claim. Even then, server-side validation is the only real defense.

What real leaderboard infrastructure needs (and this POC does not provide): server-side score validation, persistent backend (Postgres / SQLite / Durable Objects), authentication tied to identity, moderation tooling (kick / mute / ban), VC-based score proofs with cryptographic verification, rate limiting, historical leaderboards, team grouping, achievements engine, and abuse reporting. This POC ships none of that — it demonstrates the Y.js + WebRTC sync pattern only.

How this tool reads your stats

This tool reads localStorage from sibling tools (Skill Mastery Map, Daily Practice, Skill Portfolio). Open those tools first to populate your stats. The leaderboard syncs your stats to peers but does not write back to those tools' localStorage — your local state is the source of truth, this tool is a read-only mirror that publishes to the room.

Concepts Mastered — reads nexus_mastery_v1 (Skill Mastery Map). If empty, opens with 0 and a hint to open the source tool.
FSRS Streak — reads nexus_fsrs_history_v1 (Daily Practice). Streak = consecutive days with at least one logged review.
Badges Earned — reads nexus_portfolio_v1 (Skill Portfolio). Counts issued credentials and groups by tier.
Activity Feed — emits an event to the room when your local stats change between snapshots (debounced, rate-limited per type).

Want verifiable scores instead of self-reported ones? Export a Verifiable Presentation from the Skill Portfolio and share it alongside your leaderboard claim. Peers can then check the JWS signature against your did:web document.

Connection

Team room name (synthetic)

Display name

Avatar

Not in a team

Your local stats (this is what gets published)

Concepts Mastered — ranked

Source: nexus_mastery_v1 (Skill Mastery Map). Sorted by count, ties broken by earliest join.

No team members yet. Join a team above.

FSRS Review Streak — ranked

Source: nexus_fsrs_history_v1 (Daily Practice). Streak = consecutive days with at least one review (today or yesterday counts as active).

No team members yet. Join a team above.

Badges Earned — ranked

Source: nexus_portfolio_v1 (Skill Portfolio). Sorted by gold, then silver, then bronze count.

No team members yet. Join a team above.

Live Activity Feed

Last 50 events in this room. Auto-emitted when your local stats change (debounced to max 1 event per type per minute). Newest first.

All Concepts Reviews Badges Joined Left

Activity events will appear once you join a team.

What this POC does NOT do

No anti-cheat / no score validationAnyone in the room can publish any score under any name. There is no server-side check, no challenge protocol, no proof-of-work. The "leaderboard" is purely self-reported.
No persistenceState lives in the Y.Doc in browser memory. When the last peer leaves, the room is gone. Refreshing the page wipes your local view; reconnect re-syncs from any remaining peer.
No authenticationAnyone who knows the room name joins. Display name and avatar are self-asserted and can be spoofed. There is no identity verification.
Public signalingRoom names are sent in plaintext to public y-webrtc bridge servers (signaling.yjs.dev and Heroku endpoints). Treat the room name as guessable.
No moderationNo rate limit, no kick / mute / ban, no content filter. A malicious peer can spam the activity feed or publish absurd scores until the document grows unbounded.
No historical leaderboardsOnly the current room session. No "top scores this week", no daily reset, no all-time records. When the room dies, the rankings die with it.
No achievements beyond raw countsThis tool ranks on the existing badge / mastery / streak counts pulled from sibling tools. It does not introduce new achievements or its own scoring system.
No team groupingEveryone in the room is one flat leaderboard. There is no concept of teams-within-the-room, no captain, no team total. For team-vs-team play, run two rooms.
No NAT traversal beyond STUNy-webrtc uses public STUN servers but no TURN. Peers behind symmetric NATs or strict corporate firewalls will fail to connect.
For real productionAdd server-side score validation, persistent storage (y-leveldb / y-indexeddb / Postgres), VC-based score proofs (Skill Portfolio integration), OAuth-tied authentication, moderation tooling, audit logging, rate limiting, and historical leaderboards. None of that ships here.

How it works (Y.js architecture)

Y.Doc — single shared CRDT document for the room.
Y.Map "members" — keyed by clientID; each entry is {name, avatar, joined, mastery, streak, totalReviews, mature, lapseRate, lastReview, badges:{gold,silver,bronze,total,last}}.
Y.Array "activity" — rolling list of {user, name, avatar, time, type, payload} events. Capped client-side at 50 in the rendered view; capped at 200 in the underlying array.
WebrtcProvider — peer discovery via signaling, then direct P2P data channels. No server holds state.
Local stats publisher — reads nexus_mastery_v1, nexus_fsrs_history_v1, nexus_portfolio_v1 on connect, on a 30-second poll, and on the storage event (cross-tab updates). Writes to your Y.Map entry and emits debounced activity events.
Reset my contribution — deletes your key from Y.Map and emits a left event. Other peers stop showing you.

Browser requirements

WebRTC (RTCPeerConnection, RTCDataChannel) for peer-to-peer transport
WebSocket for signaling server connection
ES Modules (<script type="module">) for Y.js + y-webrtc dynamic imports
Subresource Integrity (SRI) — modules will not execute without verified hashes once placeholders are replaced
localStorage — for reading sibling-tool state