Delta

Delta is the extras ChupathingyCE adds on top of OpenCE's game protocol: the game list, stats, profile links, dedicated server admin tools, and a channel between ChupathingyCE machines for features OpenCE doesn't have.

Games with OpenCE players use OpenCE's protocol, so everyone plays together. Every part of Delta falls back to plain OpenCE behavior when the other side doesn't support it.

That channel, Delta Peer, is live as of ChupathingyCE 0.7.0b.

This site works with both clients, and always will. You don't need ChupathingyCE to see or join a game here.

Part	What it does	State
Delta Peer	A channel between ChupathingyCE machines in the same game, inside the same encrypted invite tunnel. Live since 0.7.0b: the handshake, platform keys and their player limits, opt-in profile sharing (not shown in the game yet), and passing the signed legacy table between machines. Coming: server messages, chat, votes and Halo PC map identity.	LiveGrowing
Delta List	Hosts and servers announce their games, and this site, the in-game browsers and the console list read them. It includes the live games and listing endpoints and the signed legacy table.	Live
Delta Stats	Carnage reports from hosts and players, checked against each other, are live. Since 0.7.1b, a host's full event log (kills with weapons and where they happened, accuracy, medals, objectives, vehicles and positions) goes to records, map heatmaps, server pages and match replays (the demo). It never includes IP addresses. What we collect.	LiveGrowing
Delta Link	Links a game install to a profile here with a short code (Link Profile). Since 0.7.1b, dedicated servers can be linked to a profile to a profile and managed from this site.	LiveGrowing
Delta Control	The ChupathingyCE Dedicated Server's admin tools: sv_ commands, a console, a control API and a web page. Since 0.7.1b: moderators and roles. Later: playlists and custom game types made on the page.	LiveGrowing

• An open, documented layer alongside OpenCE's game protocol. ChupathingyCE machines use it next to the game, never instead of it. The specification is docs/delta.md, and anyone can build a client, server or tool that speaks it.
• A set of parts under one name. Delta Peer runs between machines in a game. Delta List, Stats, Link and Control run between games, servers and this site (above).
• A signed legacy table. A small signed file that tells ChupathingyCE builds which OpenCE network versions they can play with, so keeping up with OpenCE doesn't always need a new download (below).

• Not a separate network. Every Delta game falls back to OpenCE's protocol for machines that don't speak Delta. OpenCE players still join ChupathingyCE games, and ChupathingyCE players still join theirs.
• Not a server in the middle of your games. Games stay peer to peer: one machine hosts and the others join it. This site lists games and keeps stats. It never carries gameplay, and you can play without it.
• Not required. network.protocol = "opence" turns Delta Peer off entirely.
• Not an account system. You don't need to sign up to play. Your profile is shared with other players only if you turn on network.share_profile.
• Not anti-cheat. What a machine says about itself over Delta is shown as a claim, not checked. The host still runs the game, as before.
• No data from OpenCE builds. OpenCE builds send this site nothing. Their public games are listed from OpenCE's own public listings.

ChupathingyCE machines in the same game recognize each other and agree on extras, while OpenCE machines in that game play exactly as before, so everyone stays in one player base.

• The handshake. A ChupathingyCE host marks its game in a spare bit of the advertisement, which OpenCE ignores. Once a ChupathingyCE client has joined (the usual OpenCE join, unchanged), it sends a hello on Delta Peer's own port (UDP 5160, next to the game's 5150), and the two agree on what both support. No answer within 4 seconds means plain OpenCE for the rest of that game. The game never waits for it.
• Mixed games. The handshake is per machine. A game can mix OpenCE and ChupathingyCE machines, and each pair uses only the features both support.
• Platform keys. Every ChupathingyCE machine says what it is (Windows, macOS, Linux, Android, Steam Deck or a dedicated server) and how many players it can handle. A host keeps its game within the weakest Delta machine's limit by taking fewer players, never by misstating the game's size, and players already in the game stay. Every platform ChupathingyCE ships today handles 128 players. The limits are for the console builds, once they support Delta Peer (the original Xbox handles 16 and has no network co-op).
• Opting out. network.platform_limits = "off" on a weaker machine opts it out of its own limit, so it can join games of any size.
• Turning it off. network.protocol is "auto" by default (Delta with machines that support it, plain OpenCE with the rest). "opence" turns Delta Peer off completely, with no port, no mark and no handshake. "delta" is the same as "auto" for now.
• Profiles are opt-in. Your player ID (your profile on this site) is shared with the other ChupathingyCE players of a game only if you turn on network.share_profile. It is off by default.

OpenCE builds carry a network version number, and an OpenCE client joins only hosts with exactly its number. OpenCE raises it often, usually for changes that don't touch multiplayer at all, and every raise splits players until everyone updates.

• ChupathingyCE follows each raise. A cross-play test runs against each new OpenCE build. Once it passes, the signed legacy table (below) tells existing ChupathingyCE builds which network versions to announce and join, without a new download. A raise that changes how multiplayer plays still needs a ChupathingyCE release, and the [D] servers move to it as they empty.
• ChupathingyCE joins a range. Its clients join OpenCE hosts of every number that plays multiplayer the same way, not just one.
• The signed legacy table. ChupathingyCE builds can follow a new OpenCE network version without a new download, once a signed table that allows it is published. Builds fetch it from this site (the API, with a copy on GitHub) at startup and every four hours. They keep the newest one they have accepted and pass it to each other over Delta Peer, so a machine that never reaches this site still gets it. It can also switch off a Delta Peer feature found unsafe, until a fixed build ships. Without it, a build plays with the numbers it shipped with.

When OpenCE raises its network version, a cross-play test plays each ChupathingyCE release still in use against the new OpenCE build: both ways, on Xbox maps, through joins, deaths, scores, the end of a game and players joining a game in progress. A release that passes is added to the signed legacy table, and follows the new OpenCE build without a download. One that fails needs a new release. Each row below shows what the current table says.

• Encrypted where the game is. Online, Delta Peer travels inside the same encrypted invite tunnel as the game. On a LAN it is plain, like the game itself.
• Hostile input by default. Every Delta Peer message has a fixed layout and a size limit and is parsed as if it came from an attacker. Unknown messages are ignored. A host only listens to the machines of its game, and a client only to its host. The parsers have unit tests and a fuzzer, and the tests run in CI.
• Rate limits per machine. Messages, handshakes and signature checks have a budget per machine, so a machine can only slow itself down.
• Claims aren't trusted. Platform, profile and build are for display only. Nothing in the game's state depends on them. Platform limits protect weaker machines, and the player of a weaker machine can opt out of its own.
• A signed legacy table. It is signed with Ed25519, and the signature is checked before anything in the file is read. Tables are capped at 16 KB, only a table newer than the one in use is accepted, and a table can only widen the versions a build already plays with, never narrow them. A table that fails any check is silently dropped. Testers and server admins can set a local override (network.legacy_table). It logs a warning and is never passed on to other players.
• Signing keys. The table's signing keys were generated inside GitHub Actions and went straight into protected secrets. No person has ever seen them. There are two, a primary key and a recovery key kept separately, so a lost or leaked key can be replaced without stranding anyone. Their public halves are in the game's source and docs/delta.md.

• No IP address is ever shown, logged in public or sent to this site from a server's event log. A game's region is worked out from the host's address, which is never shown. See what's tracked.
• Players are told apart by name and a hashed hardware ID, never the ID itself. See what we collect.
• Server owners can turn Delta Stats off. Linking a server to this site is opt-in, and the server can always unlink on its own.
• Since 0.7.1b, ChupathingyCE hides player addresses in its game and server logs by default. A log can still show a private address, such as a Docker or LAN one, which is not a player's public address.

Delta Stats are a host's record of its own game, sent to this site when the game ends, and every half hour during a long game. They come only from:

• our own dedicated servers;
• community dedicated servers, unless the operator turns it off (HALO_NET_REPORT_EVENTS=false);
• players hosting with ChupathingyCE, unless they turn it off (report_events = false under [network] in config.toml).

OpenCE builds never send Delta Stats. A game counts here only when its own host sends it. Co-op games are never recorded.

What a game's batch holds:

• each player's name, their client and platform, and a keyed hash of their machine's hardware ID, hashed again by this site with its own secret key (never the ID itself, and never shown to anyone);
• kills: who, whom, with what (headshot, melee, stuck, splatter), and where both players stood;
• shots fired and shots that hit, by weapon, for accuracy; damage dealt and taken; grenades thrown;
• medals, multikills and sprees; flag, ball, hill and race events; vehicle rides; weapon and power-up pickups; spawns;
• each living player's position, sampled every 2 seconds, for heatmaps and match replays;
• when each player joined and left, and their ping every 10 seconds (the match page shows only the game's average);
• on a dedicated server, a record each minute of players, frame time, CPU and memory.

IP addresses are never included: not in a batch, not in the Delta Stats tables, and not on any page. Any address in free text a server sends, such as a moderation reason, is removed before it is kept.

A player shows as their confirmed profile only when their own copy of the game claimed their line of that game with its player key, as with carnage reports. A host's claim about who a player is doesn't count. Anyone else is shown by name only, and anyone can use a name.

Each match and its players' totals are kept. Kills with their positions are kept for 180 days, match timelines for 180 days, replays (positions) for 30 days, heatmap squares for 365 days, and server health for 90 days. If the site runs short of space, the oldest replays are deleted first.

When signed in, you can use your profile to hide your stats (your Delta Stats page, the records and the leaderboards leave you out) and your heatmaps (your personal heatmap, and your positions in replays and match heatmaps). Your name and score stay on match scoreboards, as on the carnage reports.

OpenCE games show up on this site too. Carnage reports, Delta Stats, records and the other extras come only from ChupathingyCE hosts, servers and players.

For every listed game, OpenCE games included, the site keeps:

• the listing, while the game is listed: name, map, game type, player counts, whether it is open or under way, network version and region. Games a ChupathingyCE host announces also list who is playing, and the host's platform;
• once a minute, each listed game's name, map, game type and player count, for the activity charts, kept 90 days;
• for two days after a game is last seen, its map and player count (and, for games a ChupathingyCE host announces, who was playing), to check players' carnage reports against.

From ChupathingyCE hosts, servers and players:

• carnage reports, sent by the host when a game ends;
• players' carnage reports of the games they join, whoever hosted them: when an online game ends, the player's game sends the scoreboard as it saw it, and the site merges reports of the same game. On by default; report_joined_games = false under [network] in config.toml turns it off;
• Delta Stats, from our dedicated servers, community servers and player hosts. On by default; report_events = false under [network] in config.toml turns it off (what a game's batch holds);
• service records, game history, medals, records and leaderboards, worked out from those;
• scoreboard pages, in three tiers: confirmed (Delta Stats from the host), verified (the same game's scoreboard came from two or more players' games and they agree) and unverified (one report covers the game). Names aren't checked, so anyone can use any name. Only a ChupathingyCE player gets a scoreboard page or a search hit, from their own line in the reports their game sent (it carries their player ID). Everyone else in those scoreboards, OpenCE players included, is a name on that game's scoreboard and nothing more;
• profiles and badges, for players who make a profile;
• for a copy linked to a profile: which game it is in, kept in memory only and forgotten about 3 minutes after the last word, so the profile can show "Playing now". Profiles can turn it off (share_presence = false under [network] stops the copy sending it);
• crash reports, sent only when the player agrees. Public IP addresses are removed from them before they are kept.

OpenCE builds send this site nothing.

IP addresses: listing a game and letting players join it needs the host's address. The site holds it in memory while the game is listed, to check that later announcements and reports come from the same host, and works out the game's region from it. Addresses are also held in memory for rate limits. No page or API shows an address. The web server's access log keeps request addresses for 14 days.

• Signed updates. The keys exist. The self-updater starts requiring signatures in the next release, once signed nightly builds have proven the pipeline.
• More of Delta Peer. Server messages first, then the rest listed above.

The full design, with details for developers, is in docs/delta.md. The endpoints are on the API page. Delta Stats heatmaps have a preview with sample data. The game's code is at ChupathingyCE on GitHub.