# Production-Readiness Acceptance Matrix

> **Evidence record — not current product guidance.** Use the [documentation index](../../../README.md) for current behavior and architecture.

**Matrix version:** 0.8

**Last audit:** 2026-07-14

**Release-candidate commit:** Not nominated

**Overall result:** **Not ready**

This is the current authority for Gitea
[`#50`](https://git.spacetrainclubhouse.com/Falling-Metal-Interactive/Blacksite/issues/50).
The older H1-H6 files are historical implementation snapshots and do not satisfy this gate.

## Evidence Rules

| State | Meaning |
|-------|---------|
| Pass | Candidate-specific evidence proves the full row. |
| Partial | Some implementation/evidence exists, but the full row is not proven. |
| Deferred | The project owner has explicitly postponed this check; it is not a pass. |
| Missing | Required implementation or candidate evidence does not exist. |
| Fail | Current authoritative evidence contradicts the gate. |
| External | Requires a person other than the implementer. |

Acceptance evidence must name the exact candidate commit and commands or protocol used. Results from
another commit, a dirty worktree, or an older package do not transfer to the candidate.

## Exit Gate

| ID | Requirement | State | Current evidence and gap |
|----|-------------|-------|--------------------------|
| G1 | Project create/open/resume, scene authoring, autosave/recovery, hierarchy, prefab, and asset integrity pass | Partial | Project/recovery/session/multi-scene/prefab implementations are documented in [project launcher](../../project-launcher.md), [session recovery](../../session-recovery.md), [multi-scene composition](../../multi-scene-composition.md), and [prefab authoring](../../prefab-authoring.md). Collaborative file safety `#49`, non-blocking native dialogs `#52`, guarded shutdown/savepoints `#55`, scoped UI action safety `#57`, deterministic asset fingerprints `#56`, and [external FBX dependencies](../fbx-external-texture-dependencies/) `#58` have feature-level source/native acceptance. #56 additionally passed a fresh LFS checkout, both validators, mtime-only drift, and artifact hash stability at `cbd380a`; #58 passed both override and blocking dependency states at `3e30c61`. Candidate-specific end-to-end reruns remain. |
| G2 | Brush, material, terrain, physics placement, animation, audio, navigation, PIE, and build/package samples pass | Partial | The [five-area sample pack](../sample-regression-pack/) passed source and native acceptance on exact implementation commit `d52cc2e`, including Brush, Material, Terrain, Physics Placement, and Rendering. No release candidate is nominated, brush acceptance `#37` remains open, and combined animation/audio/navigation/PIE/build evidence is incomplete. Packaged testing is owner-deferred. |
| G3 | Undo/redo/cancel invariants and helper cleanup cover every production mutation path | Partial | Source implementation and focused evidence are complete in [operator regression testing](../../operator-regression-testing.md) and the [operator-invariants evaluation](../operator-invariants/); Gitea `#33` closed at `c55f347`. A clean, exact-candidate rerun is still required for `Pass`. |
| G4 | Representative project completes an eight-hour soak without unbounded memory/target growth or unrecoverable failure | Missing | No candidate soak log, resource timeline, failure ledger, or target-growth measurement exists. |
| G5 | Cold start, scene open/save, asset refresh, common manipulation, and package-build budgets are documented and measured | Missing | Gitea `#34` is open; no ratified budgets or candidate measurement record exists. |
| G6 | Headless content validation and CI are green from a clean checkout | Missing | [CI configuration](../../../../.github/workflows/ci.yml) hydrates LFS, runs both project/sample content gates, and asserts a pristine checkout. The [#56 feature run](../deterministic-asset-fingerprints/) passed native startup and both validators from a fresh LFS-hydrated worktree at `cbd380a`; [#58](../fbx-external-texture-dependencies/) passed both validators and clean native startup at `3e30c61`. The local M2 content-workspace run passed `process-assets --check`, both validators, full all-feature tests, and strict all-feature lint over 48 assets, but its dirty worktree is not candidate evidence. No release candidate is nominated and no candidate CI run is linked. The current Gitea server does not expose an Actions run endpoint for this repository. |
| G7 | First-hour UX and recovery QA are signed off by someone other than the implementer | External | No independent sign-off exists. Gitea `#36` remains open; historical H1-H6 implementation-pass notes do not count. |
| G8 | Known limitations have severity/workaround and no P0 blocker remains | Partial | Sample-pack gap `#32`, guarded shutdown/savepoints `#55`, scoped UI action safety `#57`, deterministic imported-asset fingerprints `#56`, external FBX dependency handling `#58`, and property-block application/promotion `#53` have complete feature-level implementations; no known P0 implementation blocker remains. A consolidated candidate limitations ledger and exact-candidate rerun are still missing. Dynamic deformed Solari geometry `#54` is a documented P2 limitation with Forward/raster fallback. |

## Deliverables

| ID | Deliverable | State | Evidence or next action |
|----|-------------|-------|-------------------------|
| D1 | Versioned acceptance matrix under `docs/editor/evaluations/` | Pass | This file, version 0.8. |
| D2 | Release-candidate representative project and reproducible validation commands | Partial | The committed [sample regression pack](../sample-regression-pack/), commands, exact-implementation native evidence, and [fresh-checkout fingerprint protocol](../deterministic-asset-fingerprints/) exist. Nominate a release candidate and rerun the complete set from a clean LFS-hydrated checkout. |
| D3 | Signed milestone comment linking evidence, limitations, and exact commit | Missing | Post only after G1-G8 pass; no candidate exists yet. |

## Workflow Coverage

| Workflow | Implementation status | Candidate acceptance |
|----------|-----------------------|----------------------|
| Project create/open/resume | Implemented | Not rerun |
| Scene save, autosave, recovery | Implemented | Not rerun |
| Hierarchy parenting and prefab structure | Implemented | Not rerun |
| Multi-scene composition | Implemented | Not rerun |
| Five-area editor sample pack | Implemented with manifest, native menu, typed scene gate, and headless validation | Exact-implementation source/native acceptance passed at `d52cc2e`; not rerun as one release candidate |
| Brush blockout/edit/CSG | Implemented foundation; `#37` open | Not signed off |
| Material catalog and assignment | Renderer/material foundation `#51`, Material Library, exact targeted drops, and MaterialPropertyBlock application/promotion `#53` are implemented | Not rerun as one candidate |
| Rendering volumes and look development | Deterministic visible rendering fixture is in the sample pack | Not rerun as one candidate |
| Terrain authoring | `#22`-`#24` source/live acceptance complete; M3 closed | Feature-level live acceptance exists; not rerun as one candidate. Packaged-runtime acceptance owner-deferred. |
| Physics placement | `#25` source/live acceptance complete | Feature-level live acceptance exists; not rerun as one candidate. Packaged-runtime acceptance owner-deferred. |
| Collider authoring and diagnostics | `#26` source/live acceptance complete | Feature-level live acceptance exists; not rerun as one candidate. Packaged-runtime acceptance owner-deferred. |
| Animation | Implemented | Not rerun |
| Audio | Implemented | Not rerun |
| Navigation | Implemented | Not rerun |
| PIE | Implemented | Not rerun |
| Build/package/runtime | Implemented foundation | Deferred by owner |
| Collaborative file safety | Implemented; `#49` closed with live external-change acceptance | Not rerun as one candidate |
| Native file/folder dialogs | Implemented; `#52` closed with live 12-second compositor-responsiveness hold | Not rerun as one candidate |
| Guarded shutdown and clean savepoints | Implemented; `#55` source validation and all seven native workflows passed at source implementation `4b33f32` | Feature-level acceptance complete; not rerun as one candidate |
| Scoped UI action safety | Implemented; `#57` source validation, six focused regressions, selection precedence, and native toolbar/Inspector/diagnostics workflows passed at `9e23ae7` | Feature-level acceptance complete; not rerun as one candidate |
| Imported asset identity and generated artifacts | Implemented; `#56` uses shared BLAKE3 fingerprints, byte-preserving semantic publication, and normalized registry order | Fresh LFS checkout, native startup, mtime-only drift, validators, and artifact hashes passed at `cbd380a`; not rerun as one candidate |
| FBX external texture dependencies | Implemented; `#58` uses one sandboxed resolver, transactional bundle import, labeled loader images, authoritative manifests, and explicit Source Materials/Authoring Override semantics | Sibling/`.fbm`/missing/traversal/symlink tests, both validators, exact-implementation native chair QA, and a controlled broken fixture passed at `3e30c61`; not rerun as one candidate |
| Content workspace and import authoring | Registry v3, shared content pipeline, managed-path hiding, reviewed destination-first Import Here/Import To, file-manager multi-selection/context actions, transactional extract-and-map model defaults, stable-ID move/copy semantics, derived-aware Trash/restore, DefaultGrid, and reviewed exact-slot property-block promotion are implemented locally | [M2 native evaluation](../content-workspace-m2/) records the Poly Haven import/extraction, reimport orphan Locate/Clear, reference-safe folder move, fresh-ID Duplicate, guarded duplicate undo including generated manifests, Forward/Solari fallback, deterministic 48-asset headless processing, and a packaged DefaultGrid launch through 2026-07-14. Focused tests cover Import To/final-path review and transactional property-block promotion. Full all-feature tests/lint and validators pass with zero blockers. Exact committed-candidate rerun, clean-worktree assertion, Gitea attachments, and independent signoff remain pending. |

## Candidate Validation Commands

Run these from a fresh clone of the nominated commit with Git LFS content present. Record wall time,
machine profile, exit code, and artifact hashes. Packaged commands stay disabled until the project
owner re-enables them.

```bash
cargo fmt --all -- --check
cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo clippy -p editor -p game --bins --features dev,hot-reload -- -D warnings
cargo test --workspace
cargo validate-levels --project .
cargo validate-samples --project .
cargo process-assets --project . --check --json
cargo bake-navigation --project . --check
```

When packaged acceptance is re-enabled, append the exact `package-project` profile/target commands,
package hash verification, and packaged-runtime smoke protocol used for the candidate.

## Soak Protocol

The final candidate must run for eight continuous hours against the representative project. The
record must sample process RSS, GPU memory, target-directory size, recovery generations, background
job counts, and error/warning totals at least every five minutes. Exercise scene switching, save and
recovery, asset refresh, all five sample-pack scenes, material editing, brush/terrain/physics tools,
animation/audio/navigation, PIE transitions, and build UI cancellation without replacing the
candidate during the run.

A pass requires no unrecoverable editor failure, no lost authored work, no unbounded upward trend in
steady-state resource use, bounded recovery/cache behavior, and a triaged explanation for every
error. Numeric thresholds remain blocked on the performance-budget work in `#34`.

## Independent Sign-Off

The evaluator must not be the implementation agent. They record the candidate commit, machine,
elapsed first-hour workflow, recovery scenario, defects, severity, and go/no-go decision. Waivers
must include a workaround and owner ticket; an open P0 cannot be waived.
