Repository navigation
Beta gate: art pass, QA, performance, release checklist #45
Description
Take the stitched systems and make them presentable.
Scope
- Replace obvious placeholder visuals
- Add minimum viable asset pack for UI, icons, cards, units, and HUD
- Add smoke tests for auth, DEALT, SLIDE, map, and crew
- Add performance checks and error handling
- Add release checklist and staging validation
- Document known non-MVP deferrals
Acceptance Criteria
- Core gameplay loop is stable
- No blocker-level crashes in core modes
- Visuals are coherent enough for testers
- Release checklist exists and is checked off
- Deferred features are explicitly listed
Definition of Done
Build is fit for outside testers
Branch
feat/beta-crew-heat-npc-qa (same branch as Issues 7-9)
PR Title
feat(beta): crew stackapp heat npc gangs qa and art pass
Execution Order
- Issue 1 - MVP Foundation
- Issue 2 - OS Shell
- Issue 3 - DEALT Economy
- Issue 4 - SLIDE Combat
- Issue 5 - Territory Map
- Issue 6 - Ops Layer
- Issue 7 - Crew & Phone
- Issue 8 - Heat & World Tick
- Issue 9 - AI Gangs
- Issue 10 - Beta Gate
Activity
BrandDead commentedon Sep 12, 2026
Codex file reservation — connected block gameplay slice (2026-09-12)
Outcome: make each new claim persist one Block-DNA-authored canonical grid that the client placement UI and Flask encounter snapshot both consume, while preserving malformed/legacy grid fallback and encounter consequence reload idempotency.
Branch: fix/45-canonical-connected-grid
Reserved files:
Out of scope: Supabase data/migrations/RLS/functions/secrets/scheduler/deployment; renderer/art/Mapbox/economy balance/Ghost Crew/payments.
BrandDead commentedon Sep 13, 2026
Connected gameplay handoff saved
Draft PR: #138 — #138
Branch:
fix/45-canonical-connected-gridBase:
872bd67b5f1a38d1b47b5d02f8e96e3a6ef8ab4cHead:
90a82e95a4d15e6235fdd4527b60d29b9b4a12d0This is a maintainer handoff, not a merge request from Codex.
Contract summary:
grid_dataJSON.(x,y), tile type, deployability, cover, visibility/exposure, rounding, relocation order, and terrain.Final-state evidence:
CityBriefing.tsx/cityBriefing.tscase collision.git diff --check 872bd67..90a82e9: passed; worktree clean.All 21 changed files match the reservation above. No production data/database, migration, RLS, Edge Function, secret,
.env, scheduler, deployment, or merge was touched. Known limitations and the environment-specific iCloud path workarounds are fully recorded in the draft PR body. Maintainer should now inspect independently and decide any follow-up/merge order.BrandDead commentedon Sep 18, 2026
File reservation — 375px beta dock-clearance repair
Outcome: keep the Las Olas STRIP crew-lock action and the end of its scrollable content clear of the persistent command dock on a 375px phone, including the device safe-area inset.
Branch:
fix/45-beta-mobile-dock-clearanceReserved files:
frontend/src/components/layout/BlockLoopDesk.cssfrontend/src/components/layout/BlockLoopDesk.test.tsxdocs/PROJECT_LOG.mdOut of scope: the command dock’s shared layout and navigation behavior, desktop/tablet styling, MAP/diorama logic, gameplay state, Supabase, Vercel configuration, secrets, and the separate Babylon/Phaser performance pass.
Verification plan: establish a focused failing regression first, validate the 375px clearance contract plus the full frontend and backend suites, and perform a deterministic demo player-path check. No merge or deployment changes in this contribution.
BrandDead commentedon Sep 18, 2026
Reservation addendum — tutorial overlay source identified
The reproduced 375px overlap is caused by the global fixed
TutorialOverlayhint, not the command dock. To fix the root cause while keeping normal tutorial guidance elsewhere, this mobile repair also reserves:frontend/src/components/tutorial/TutorialOverlay.tsxfrontend/src/components/tutorial/TutorialOverlay.test.tsxThe existing reservation for
frontend/src/components/layout/BlockLoopDesk.css,frontend/src/components/layout/BlockLoopDesk.test.tsx, anddocs/PROJECT_LOG.mdremains unchanged. No other files are in scope.BrandDead commentedon Sep 18, 2026
Reservation addendum — application integration
The focused overlay test requires the existing app shell to tell
TutorialOverlaywhen theblock_looproute already owns the next action. This repair additionally reserves:frontend/src/App.tsxNo shared dock CSS, game-state, persistence, Supabase, Vercel, or performance files will be changed.
BrandDead commentedon Sep 18, 2026
Mobile STRIP action-clearance repair ready for review
Opened draft PR #147: #147
A real 375×812 browser reproduction showed the global fixed tutorial hint covering the Lock Dre and Rome action on the Las Olas STRIP desk. The route does not render the command dock; the tutorial hint was the actual overlap source.
The PR hides that redundant hint only while
block_loopis active, where the desk already owns the next action. The hint still renders on other routes. It adds a focused two-state regression and records the diagnosis inPROJECT_LOG.md.Validation on the declared Node 24 runtime: 883 frontend tests, TypeScript, ESLint, asset audit, asset package validation, and production build passed. Backend: 95 pytest tests passed. Manual beta path at 375×812 confirms the hint is absent and the 44px crew-lock action is fully visible. No gameplay/persistence/Supabase/Vercel/secret/asset changes.
BrandDead commentedon Sep 18, 2026
File reservation — demo-only Block Loop ledger guard
Outcome: prevent the browser-local Las Olas demo ledger from being read or written during a signed-in player session. The ledger remains available only to the seeded
demo-playerevaluation path; authenticated save state stays on the existing server/hydration path until the separate authoritative player-state milestone is complete.Branch:
fix/45-demo-ledger-auth-guardAllowed files:
frontend/src/stores/blockLoopStore.tsfrontend/src/stores/__tests__/blockLoopStore.test.tsdocs/PROJECT_LOG.mdOut of scope / explicitly untouched:
App.tsx, authentication providers, Supabase migrations/RLS/functions/secrets, Vercel environment configuration, database rows, payments, game balance, encounter calculations, and existing PR #147 files.Acceptance: a seeded demo still restores its own local consequence ledger, while an authenticated/non-demo player never reads or writes that local ledger. Focused tests plus full frontend/backend validation will be run before a review-only PR.
This is a narrow beta-safety preparation slice under #45, not production persistence.
BrandDead commentedon Sep 18, 2026
Demo-ledger account isolation ready for review
Draft PR #149 is ready for review: #149
It prevents the Las Olas browser-only demo ledger from restoring or projecting fixture cash, product, wounds, and encounter receipts into a signed-in player's shared stores. The seeded
demo-playercontinues to reload its own evaluation state. This is deliberately not the production saved-game implementation: no Supabase, Vercel, server, schema, secrets, or balance changes.Validation completed before review: focused 9 frontend tests; full Node 24 frontend suite/typecheck/lint/assets/build; backend pytest 95 passed; clean diff.
Remote CI and Vercel preview are the remaining review gates.
BrandDead commentedon Sep 18, 2026
File reservation — staging saved-game security hardening
Outcome: make the source-controlled Supabase schema safe to use for the upcoming authenticated saved-game slice by closing the staging audit’s public-schema RLS/grant gaps and making intended role access explicit. This is an additive migration and offline contract-test contribution only; it does not apply SQL remotely.
Branch:
fix/45-staging-rls-grant-hardeningReserved files:
backend/supabase/migrations/007_staging_saved_game_security_hardening.sql(new, additive)backend/supabase/world-proof-manifest.jsonbackend/supabase/scripts/test_security_hardening_contract.py(new)docs/STAGING_SECURITY_HARDENING_PLAN.md(new)docs/PROJECT_LOG.mdScope:
Out of scope / untouched:
000–006.Acceptance: staged source identifies
billing_productsandentitlementsas canonical, the migration closes the audit’s critical RLS exposure without creating client write access, policy tests cover intended grants/roles, and the Supabase AI can apply it later only todealt-world-proof-stagingafter review.Validation: test-first offline contract tests, world-proof manifest validation, backend pytest, and repository diff/secret checks. A separate staging apply/two-user RLS proof will occur only after this PR is reviewed.
BrandDead commentedon Sep 18, 2026
Staging saved-game security hardening ready for review
Opened review-only PR #150: #150
The source migration is not applied remotely. It prepares the isolated, non-production
dealt-world-proof-stagingproject for the upcoming authenticated saved-game work by making game-owned map support and operational ledger tables service-only, replacing broad public policies with explicit authenticated reads, keeping durable direct browser writes ungranted, and fixing known safe function search paths/grants.Validation completed: PostgreSQL grammar parse (105 statements); new migration contract tests (7 passed); world-proof manifest validation; bootstrap tests (4 passed); backend pytest (95 passed); Node 24 frontend validation (882 tests, typecheck, lint 0 errors, assets, production build); clean diff.
Important limits are documented in the PR: no remote SQL/Auth/Vercel/secrets/scheduler/payment/production change;
spatial_ref_sysremains for a dedicated PostGIS compatibility decision;handle_new_user()grant tightening waits for a real staging signup proof; and the later saved-game command slice must replace legacy direct browser-write fallbacks.After PR review/merge, the next database action is an authorized staging-only migration apply followed by a disposable two-user/anonymous RLS smoke test and advisor rerun. Do not apply this to production.
BrandDead commentedon Sep 23, 2026
Repository triage update: this beta-gate umbrella remains open but is blocked by the current P1 integration/evidence work, especially #163 and the residual visual acceptance in #77/#78.
Do not close #45 from CI alone. Unblock it only after the canonical Ghost Crew attack slice is integrated and the remaining browser/action-path, required viewport, real-device touch/accessibility, performance/memory, release-checklist, and rollback evidence is attached.
BrandDead commentedon Sep 30, 2026
File reservation — reusable independent SLIDE beta critic (2026-09-30). Outcome: add a review-only Agent Skill so Cursor/Grok and future agents grade real gameplay captures independently, score gameplay and visual quality 0–10, and run at most three evidence-based repair rounds. Branch: docs/45-slide-game-critic. Reserved: .agents/skills/slide-game-critic/SKILL.md (new) and a short dated entry at the top of docs/PROJECT_LOG.md. No gameplay, assets, tests, stores, Supabase, secrets, preview/deploy or #157 edits. Validate skill frontmatter + repo checks; open a focused draft PR for integration review.
BrandDead commentedon Sep 30, 2026
Independent beta critic Agent Skill merged in PR #191 at cf05276. The branch passed skill validation, 1016 frontend tests/4 skipped, frontend build, 95 backend tests and all required PR checks. The skill is guidance only; no user play/critic score or #175 authenticated saved-game proof is inferred from this merge. Protected-main CI has now passed; Grok still needs real current-build play captures before an independent critic can score.
BrandDead commentedon Sep 30, 2026
2026-09-30 active beta checkpoint (private Cursor Grok run; no founder likeness attached here): independent critic reviewed local demo captures at playable SHA 444a987 and scored Gameplay 5/10, Visuals 4/10, composite 4/10, medium confidence—below the ≥8 candidate threshold. Findings: GG-001 real-world faction labels (founder decision); GG-002 empty-role attack launch; GG-004 375×812 banner/toast overlap; GG-003 duplicate demo contact IDs; GG-005 retreat copy/ledger mismatch. #193 owns narrow GG-002/004/003 regression fixes; #192 and draft PR #194 track the separate player-facing legacy ATTACK route pending founder A/B choice. Private Weezy demo created one roster entry but photo generation yielded labeled stock art (NOT PASS); no likeness in GitHub. #175 authenticated two-user saved-game proof remains open. Do not close this beta gate from CI or issue creation alone; require refreshed phone/desktop play, independent re-score, protected-main CI, and release checklist.
BrandDead commentedon Sep 30, 2026
2026-09-30 integration checkpoint: PR #196 merged at 638d11e after independent 375×812/1440×900 Chromium play, 1025 frontend passes / 4 skips, 95 backend passes, 0 lint errors, and green exact-main CI 36776931664. #193 is closed; GG-002/003/004 and the mobile tap interception are fixed in scope. Critic scores from older SHA 444a987 (Gameplay 5, Visuals 4, composite 4) must NOT be upgraded without a fresh independent capture/re-score on current main. Residual P2 phone presentation debt: the noninteractive hint can still visually cover a target card while scrolling (though touch now passes through), and dismissing Nightfall drops the page inset during its brief exit animation (~0–200 ms), causing transient header overlap; stable frame is clear. Triage these in the next bounded art/UX pass, not as a claim that #196 failed. #192 canonical ATTACK route choice, GG-001 labels, GG-005 retreat copy/economy, #195 true photo likeness, and #175 authenticated staging save evidence remain open. Outside-beta gate remains blocked.
BrandDead commentedon Oct 1, 2026
Launch QA status 2026-09-30: #200 car screen UI/art/seat gate merged at 04ee0e3 with green exact-main CI run 36810868090. Local demo 375×812, 390×844, 1440×900 DRIVE → dealer driver + shooter passenger → mission passes; 1,033 frontend tests / 4 skips, 95 backend tests, asset audit 0 warnings, package 7.70 MB / 20 MB. This does not clear #175 two-user Auth proof, #192 ATTACK route/dismount, #201 named passenger firing, #195 private personalized likeness or #190 live Nightfall art proof. Earlier critic 5/10 gameplay and 4/10 visuals is not rescored. Keep outside beta blocked.