Version 0.3.0

Why Windows warns about it

The executable is not signed with a code-signing certificate, so SmartScreen shows unknown publisher. Choose More info, then Run anyway. That warning is accurate — it says nobody has paid to attach an identity to this file — and it will keep appearing until there is a certificate. It is also the reason the game contains no auto-updater: an unsigned executable that downloads and replaces executables behaves exactly like malware, and antivirus vendors classify on behaviour.

What is in this version

0.3.0 is the version string the source carries today. The prototype has been through thirty-odd tasks; these are the parts a player meets.

Also in this version, behind the scenes: the candidate gate now decides on counted work rather than measured time, so its verdict is identical on a slow machine, and an offline batch generator can put a hundred proposals through import and gating unattended. Neither is part of the game you run; both are why the candidates can be trusted not to melt your frame rate.

Known issues, stated before you find them

• No drawn art. Characters and world are primitives with deliberately wrong proportions. The renderer that will read hand-drawn sheets exists and is tested; the sheets do not.
• The weapon barrel sticks out in front of the player. That is the model, not an aiming bug.
• Extreme projectile density drops frames. The worst-case profile — 256 homing projectiles against 500 enemies — measured about 62 ms per physics frame on the developer's machine, well outside the 16.7 ms budget for 60 Hz. An ordinary 500-enemy crowd measured about 12.5 ms on the same machine. These are development measurements on one Windows PC, not a guarantee for yours.
• Balance is not settled. Weapons, ammunition scarcity and wave pacing are all first passes. Whether switching weapons is worth doing is an open question.
• The season phase trusts your system clock. Moving it forward opens a trial early. This is a single-player game with nothing to win, and a server to prevent that would cost more than the problem.
• A malformed schedule is skipped, not fatal. The shipped catalog is playable on its own, so a typo in a date must not empty the perk offers.

Controls

What it writes, and what it sends

The game writes one settings file and nothing else:

%APPDATA%\Godot\app_userdata\Chaos Lab\settings.cfg

It holds your language, your movement scheme and whether the update check is allowed. There is no telemetry, no crash reporter, no identifier and no account. To refuse the update check permanently, add this to that file:

[updates]
check_enabled=false

The check is a single GET of a static JSON file at startup. It carries no query string and nothing about you; a server would learn that an address fetched a file, which a download link would tell it anyway. It never blocks the title screen, and failure is silent because having no network is a normal state of a machine rather than an error.

Update manifest — /updates/latest.json

The endpoint the game reads. It is a static file describing the newest build; the game reacts only when the version in it is higher than its own, and then only by revealing a button that opens a link in your browser.

{
  "version": "0.3.0",
  "season_name": "Season 1 — Health and Safety Review",
  "notes": "Three gated Season 1 candidates ship in this build.",
  "download_url": "https://chaoslabgame.ru/downloads/ChaosLab-0.3.0-windows-x64.zip"
}

What the game refuses, and why the parsing is suspicious: this is the only text in the game that comes from outside it, and it lands both on a label and in the hands of the operating system's URL handler — which is not a browser, but "do whatever this machine does with this string".

• version must be digits and dots.
• download_url must begin with https://, be printable ASCII and stay inside a bounded length. Anything else is refused rather than opened.
• The displayed strings are stripped to one bounded line, because a newline in a release note is a free line of title screen positioned by whoever wrote the manifest.
• A response larger than a small JSON document is rejected before it is parsed, and the request gives up after a few seconds.

The 0.3.0 build points at https://chaoslab.invalid/updates/latest.json — a deliberately unresolvable address — so an unconfigured feature is inert rather than merely unsuccessful. Publishing a season is uploading this file; rolling one back is uploading the previous one.

Building it yourself

The project is a Godot 4.7.1 project. With matching export templates installed, the Windows build is one command from the repository root, and the preset embeds the project data into a single portable executable:

godot --headless --path . --export-release "Windows Desktop" builds/windows/ChaosLab.exe

The automated suite runs headless from the same checkout, and the candidate gate is a script you can point at any candidate resource before it is allowed near a trial.