security-game/TODO.md

# TODO

Work is grouped by theme. Each item should be small enough to complete and verify on its own;
see `AGENTS.md` for the workflow and `MEMORY.md` for the decisions behind these plans.

## Gap Analysis and v1.0.0 Roadmap

Baseline: **v0.7.2** (2026-11-01). Three playable venues, a complete escalation/access/radio
loop, shift review, Blender character/gear/prop library, 231 headless + 94 Python tests, a
13/13 clean screen-design judge and an optional Forward+ Desktop HQ build. This baseline is a
strong vertical slice, not yet a 1.0 product.

### Documentation audit (completed 2026-11-01)

- [x] Make `docs/architecture.md` the single architecture source: added the asset/content
      pipeline contracts, runtime venue-switch/fallback flows, deployment/version constraints,
      quality requirements, risk register and a documentation ownership map.
- [x] Keep command-heavy operational pages separate but subordinate: `docs/asset-tooling.md`,
      `docs/blender-assets.md`, `docs/getting-started.md`, `docs/RELEASING.md` and
      `docs/smoke-checklist.md` now link to architecture rather than acting as parallel sources.
- [x] Mark `docs/plan-graphics-v0.6.md` as completed/historical; current graphics work belongs in
      this roadmap.
- [x] Resolve stale claims: README release version/download row, development status
      "Forward+ not implemented", Blender props "not AO-baked", and historical plan status.
- [x] Record the documentation ownership rule in `docs/architecture.md` §12: design intent
      (`PLAN.md`), mechanics (`gameplay.md`), system architecture/contracts (`architecture.md`),
      decisions (ADRs), status (`development-status.md`), roadmap (`TODO.md`), operations
      (tooling/release docs).

### Gap register

| Area | Current baseline | Gap to 1.0 | Risk | Milestone |
| --- | --- | --- | --- | --- |
| First-hour experience | Venue menu and controls exist; no tutorial | No guided first shift, control coaching, objective recap or "what went wrong" debrief | New players bounce before the de-escalation loop lands | 0.8 |
| Campaign/progression | Venue selection and debug cycle | No career/venue order, unlocks, difficulty curve or persistent player progression | Shift loop feels like a tech demo rather than a game | 0.8 |
| Authored content | 3 venues, small event pools, one-line dialogue | Need a larger event matrix per venue, repeat/remix rules, failure/recovery events and more NPC dialogue | Repetition after a few shifts | 0.8 |
| NPC behavior | FSM intents, reactions, crowd/theater poses | Deeper negotiation, memory of earlier interactions, group dynamics, believable refusal/escalation edges | NPCs still feel deterministic/scripted | 0.8 |
| Access/evaluation | Recognition, wristbands/IDs/tickets/credentials, reputation/review | Fairness tuning, ambiguous cases, clearer evidence trail, richer grades and actionable feedback | Players cannot learn why a decision scored poorly | 0.8 |
| Shift lifecycle | Settings + completed-shift history persist | No mid-shift save/resume, pause-safe serialization, versioned save schema or replay | Interrupted sessions lose the run; future changes can break saves | 0.8 |
| Accessibility | Key remapping, gamepad, HUD font scale, shape escalation cue | Subtitles/captions, colour-independent cues, motion/audio sensitivity, text expansion, menu narration and full input alternatives need an audit | Public 1.0 cannot claim accessible play | 0.8–0.9 |
| Localization | English strings in `content/strings.en.json` | String extraction/coverage, pseudo-locale test, font fallback, text-length layout budgets and translator workflow | Text bugs and unsupported locales at release | 0.9 |
| Audio | Procedural crowd bed and radio crackle | Music/ambience direction, event SFX, voice/VO decision, caption hooks and mix budgets | Scene can feel silent/placeholder | 0.9 |
| Animation/presentation | Procedural poses, walk/idle theater, LOD impostor | More reaction/idle/negotiation poses, transitions, facial readability at portrait distance, camera-height decision | Cinematic close-ups expose the prototype layer | 0.9 |
| Performance/platform | 16-NPC budget measured headlessly; Compatibility default; optional Vulkan HQ | Target hardware matrix, 24-NPC profiling, draw-call/memory budgets, Web/HQ parity and frame-time regression gates | Crowded studio or Web drops frames | 0.9 |
| Content tooling | ScenarioFactory/.tres export, Blender manifest, asset audits | Schema validation, previews, event authoring workflow, reproducible asset rebuild notes and contributor onboarding | Content expansion becomes expensive/error-prone | 0.8–0.9 |
| QA/CI | Headless suite, smokes, screenshot compare, model-aware judge | End-to-end shift automation, full venue matrix, CI Godot-version strategy, manual judge budget and release checklist automation | Regressions escape or CI becomes non-reproducible | 0.9 |
| Release/legal | Tag-driven unsigned builds, Web zip, optional HQ | Signing/notarization, checksums, AI-asset provenance/licensing, credits, privacy/body-camera statement and storefront requirements | Public release blocked by trust/policy issues | 0.9.5 |
| Documentation | Layered docs consolidated; drift was found | Keep changelog/status/roadmap/ADR links synchronized per release; add contributor architecture tour | Docs become stale again | Continuous |

### Milestone 0.8.0 — First hour and content depth

- [ ] Add a skippable first-shift tutorial: movement/look, focus, action wheel, access check,
      warning, body camera, radio and shift review; teach by doing, not a wall of text.
- [ ] Add a persistent campaign shell: venue order/unlocks, selected difficulty, shift summaries
      and a clear "next shift" path. Keep debug venue cycling separate.
- [ ] Add an objective/recap layer: current venue policy, shift phase and a post-incident recap of
      what evidence was checked and why the outcome was judged fair/unfair.
- [ ] Define a content matrix for each venue (routine, scripted, edge, recovery and rare-threat
      events) and fill the largest holes; target meaningful variety across all four phases.
- [ ] Expand NPC dialogue beyond one-line intent replies: refusal reasons, de-escalation responses,
      recognition callbacks and group reactions, all localized and deterministic under seed.
- [ ] Add mid-shift save/resume with a versioned schema and migration test; keep completed-shift
      history and settings compatible.
- [ ] Add difficulty/pacing options (spawn rate, tolerance, report strictness) without changing the
      de-escalation-first rules; expose them in Settings with defaults matching the current build.
- [ ] Add a new-player help overlay and a searchable controls reference distinct from the HUD legend.
- [ ] Exit: a new player can complete a first shift without the README; each venue has enough
      content for repeated shifts; save/resume survives restart; 0.8 test matrix is green.

### Milestone 0.9.0 — Production quality and platform readiness

- [ ] Animation/presentation pass: negotiation/reaction poses and transitions, readable faces in
      portrait, resolved camera height, and no coat/skirt leg clipping in normal movement.
- [ ] Audio pass: music/ambience direction, event SFX, radio/crowd mix, caption hooks and a VO
      decision with production scope.
- [ ] Localization pass: all player-facing strings externalized, pseudo-locale layout test, font
      fallback and a contributor translation workflow.
- [ ] Accessibility pass: subtitles/captions, colour-independent access/escalation cues, motion
      and flash options, full keyboard/gamepad parity and documented assist options.
- [ ] Performance pass: profile 24 live NPCs, all venues, Web and Desktop HQ; record frame-time,
      draw-call and memory budgets; add regression checks where automation is possible.
- [ ] QA pass: automated end-to-end shift for each venue, full smoke matrix, screenshot/judge
      baselines, and a documented manual judge budget/model pin.
- [ ] Resolve the Godot baseline: choose one supported version (or an explicit 4.3-CI/4.7-local
      matrix), align export templates and visual smoke results, and document the policy.
- [ ] Exit: production content is feature-complete, accessibility/localization acceptance criteria
      pass, target hardware matrix is measured, and no P0/P1 defect remains open.

### Milestone 0.9.5 — Release candidate

- [ ] Content lock and external playtest round (at least five first-time players); triage findings
      by severity and fix all P0/P1 issues.
- [ ] Balance and fairness pass across all venues: scoring, difficulty, event weights, NPC
      compliance and emergency false-positive/negative rates.
- [ ] Save migration test from 0.8/0.9 saves; verify settings, shift history and resume paths.
- [ ] Release engineering: signed/notarized macOS where possible, checksums, Windows/Linux install
      smoke tests, AppImage update, Web hosting verification and Desktop HQ Vulkan fallback.
- [ ] Legal/credits review: AI-assisted asset provenance, music/SFX licenses, privacy/body-camera
      language, age/content rating and storefront requirements.
- [ ] Documentation sign-off: architecture/ADR/status/TODO/changelog/README/smoke checklist all
      match the release candidate; capture final gallery and run compare + judge.
- [ ] Exit: release candidate passes the manual smoke checklist on every target; no release-blocking
      legal or platform issue remains.

### Milestone 1.0.0 — Launch

- [ ] Freeze content and version, run full final QA on Windows/Linux/macOS/Web/Desktop HQ, and
      verify fresh installs plus upgrade paths.
- [ ] Publish store/release notes, credits, known limitations, accessibility statement and
      controls; verify every download link and artifact checksum.
- [ ] Tag `v1.0.0`, publish through CI, verify the release page and post-launch patch policy.
- [ ] Definition of 1.0: three complete venues with campaign/tutorial, stable save/resume,
      accessibility/localization acceptance, measured performance on the target matrix, signed
      release artifacts where platform rules require it, and documentation synchronized with the
      build.

### Explicit post-1.0 / non-blocking candidates

- [ ] Live 3D body-camera replay.
- [ ] Additional venues or seasonal events.
- [ ] Real voice/dialogue audio.
- [ ] Image-to-mesh prop pipeline.
- [ ] Rare easter eggs/cameos (e.g. Bob Dobbs) only after core content and QA are stable.

### Roadmap dependencies and risks

- Content volume is the largest schedule risk; tutorial and campaign work must not outrun the
      event/dialogue matrix.
- The vision judge is a dev-time aid with an external key/budget; CI must never make it a hard gate.
- Godot version changes can alter lighting/imports; do not combine an engine baseline move with a
      content/feature milestone.
- Signed macOS builds and legal/AI provenance are release blockers, not polish.
- Keep the de-escalation-first rules and rare-emergency design unchanged while adding progression,
      difficulty and feedback.

## Realism follow-ups (deferred)

- [x] Re-run the screen-design judge for `12-joke-shop`, `13-studio-arrival` and the
      Forward+ A/B with the valid key: **13/13 match, 0 diff**; the HQ A/B is in the report.
- [ ] Capture a hooded/winter NPC close-up once a scenario spawns types 5-7 (the explicit
      `--portrait-type` override is already in `capture_realism.gd`).
- [ ] Human-authored tree/hedge silhouettes: the whole scene now reads well except the foliage,
      which is still flat-shaded clumps (`_shrub()`/`_tree()` in `tools/blender_assets.py`).
      Only worth doing if a higher-poly organic builder is added to the library.
- [ ] Camera height: the concept frames are shot at ~1.55 m with a slightly wider lens; the game
      camera sits at 1.7 m. Decide whether the first-person height should match the art direction
      or stay at the current gameplay value.

## Future ideas (optional, not scheduled)

- [ ] Live 3D body-camera replay (the timeline is text-only today).
- [ ] Additional venues or seasonal events authored from the new `.tres` files.
- [ ] Real voice/dialogue audio (the crowd bed and radio crackle are procedural).
- [ ] Swap the primitive prop builder for an image-to-mesh model API behind the same
      `assets/models/generated/<prop>.glb` contract.