Made here

Purple Lantern builds situations: a city whose infrastructure fails while the Patrician watches, a water plant seen from the wrong side of the desk, a routing fabric that accepts whatever it is told. A person walks in, does something, and finds out what follows. There is no score at the end, only a record of what happened and what made it possible. The games and labs are open source at Codeberg, and the tools live at CodeFloe with the blog.

Games

Choices have consequences and the situation unfolds through play.

  • Adventures, seat: attacker. Each world puts the player on the wrong side of the desk: a water plant, the plumbing under the internet, a cloud tenant that thinks they belong.

  • Ankh-Morpork: Lord Vetinari’s Dilemma, seat: governor. Run the city while its infrastructure fails and each choice costs something. No technical knowledge is needed, though a strong constitution and a tolerance for civic chaos help.

Simulations

A model of a system that people can enter, manipulate, observe and run again.

  • Smart grid simlab, seat: observer. Pick an attack from the dropdown and watch what it does to the grid, live: the well-known OT incidents on a dashboard instead of a slide.

  • ICS access and persistence simlab, seat: attacker. A utility’s estate in five zones, from the internet down to the control layer, with the routing and the firewalls real.

  • OT defence workbench, seat: defender. One asset, one probe, and a boundary to build between them. Each brief says what has to hold, and the workbench reports whether it held.

Roleplay

The system is partly made of people, with their relationships, competing interests and decisions.

Tools

Smaller things, built when a question had nowhere else to go. Huginn and Muninn sit on a public routing table and report what the control plane did, which beats inferring it from the data plane afterwards. Alongside them are a passive scanner, a watch-tower, a vulnerability forge, and drawers full of scripts for ciphers, networks, web applications, buffer overflows, endpoint detection and reverse engineering. Each repository says what it does and how far it got.

Notes

The five documentation sites hold the research behind the rest: what was read, what was tried, and what broke along the way. In 2026 the company’s own stack got the same treatment. Drawing its dependency graph turned up a US registry under the name, a US forge under the code and a US host under the pages, and a loop in which the mailbox recovered the registrar while the registrar’s zone routed the mailbox. The move that followed broke the loop, proved the committed font cache by pointing every outbound request at a dead proxy, and found a US payment processor under a SEPA mandate by paying it. The notes on blue include the parts that went wrong.

In development

All of them. A finished simulation would be a simulation of something that had stopped happening.

Nanny Ogg’s kitchen has a drawer for every kind of tool. She has never once opened the right one first, and the pie is on the table by six regardless.