Files
security-game/TODO.md
T
zwitschi f0cec192a7
Full build / Import + headless tests (push) Successful in 32s
Full build / Full desktop build + optional release (push) Successful in 3m29s
Restore pruned releases and verify CI publishing with v0.2.12
- Host root filesystem was expanded from 7.8G to 16G (~7.8G free), so the disk
  blocker is gone.
- Re-published v0.2.0 (4 artifacts) and v0.2.9 (5 artifacts) from the local build/
  outputs; both releases verify.
- Root SSH from the workstation is not available (publickey denied, password auth
  closes the banner); the host is administered via the zwitschi login.
- Version 0.2.12 exists to verify the tag pipeline end to end: the workflow should
  create the release via the checkout-credential fallback and upload all five
  artifacts.
2026-10-31 21:46:09 +01:00

3.4 KiB
Raw Blame History

TODO

Godot 4.3 prototype. Release v0.2.9 is tagged. Headless suite 139/139, plus the session, PLAN-verb, crowd, emergency, timeline, audio, and windowed focus/radial smokes.

Host REQUIRE_SIGNIN_VIEW stays deferred.

Scenario content still missing vs PLAN lists

  • Joke Shop: guest on the reservation list without ID; borrowed/mismatched ID; guest refuses wand screening; late arrival during a performance.
  • Studio: filming-boundary repeat (influencer ignores a posted line); celebrity-arrival crowd spike (more rubberneckers, not only one arrive spawn).
  • Building: "activate body camera" and "request reason" once those verbs exist, used in at least one authored event.

Distribution follow-up (host config, deferred)

Verified via API+host credentials (2026-10-31):

  • Repo is public (private:false) and account has admin rights.
  • Release v0.2.1 now carries all five artifacts (portable binaries + NSIS installer + AppImage).
  • Remaining host setting: instance-wide [service] REQUIRE_SIGNIN_VIEW=true makes anonymous browsing/downloads redirect to login. Host admin: REQUIRE_SIGNIN_VIEW = false under [service] in app.ini, restart Gitea. Alternative: mirror downloads.

Release pipeline follow-up

  • Fix tools/publish_release.sh: the ~/.git-credentials branch never set AUTH, so every tag build since v0.2.2 failed to publish.
  • Add a github.token fallback in .gitea/workflows/build.yml (the repo has no GITEA_TOKEN secret).
  • Fall back to the checkout's git extraheader when no token/credentials exist (the Gitea runner does not expose github.token).
  • Uploads now fail loudly and the release is verified to carry every artifact (a silent HTTP 4xx used to leave an empty release with a green job).
  • Host disk expanded to 16G (~7.8G free on /); v0.2.0 and v0.2.9 releases restored from the local artifacts and verified. No cleanup needed any more.
  • Verify the fallback on the next tag push produces a release automatically (the v0.2.11 tag build reached the publish step and created the release; only the upload failed on disk space).
  • Optionally backfill releases for v0.2.4–v0.2.8 (their CI artifacts were not retained; would need local rebuilds) or leave them superseded by the latest.

Open Polish

  • Keep % placeholders stable in Strings.fmt when adding keys (positional formatting).

Screen design references (QA tooling)

  • tools/screen_designs.py generate writes one reference design per screen (from the docs/ descriptions) to docs/screens/designs/, with an offline --draft wireframe mode and an OpenRouter --ai mockup mode.
  • tools/screen_designs.py compare checks docs/screenshots/*.png against the designs (aspect ratio, size, blank-frame, and layout/palette/detail drift).
  • Vision-model judge for semantic screenshot comparison. Pixel and perceptual metrics cannot decide whether a frame's composition is correct; a follow-up should send the capture + reference design to a vision model and ask whether they depict the same screen.

Tooling (when an editor workflow exists)

  • IDE/editor-based GUT integration. Until then the custom headless runner stays.
  • Optional later: author venues as .tres resources instead of ScenarioFactory functions.