Integrate native runtime, redesigned world, and canonical humanoids

.github/workflows/ci.yml

@@ -48,7 +48,7 @@ jobs:
       - name: hydrate LFS assets exercised by tests
         run: >
           git lfs pull
-          --include="client-3d/public/assets/pawn-pack/equipment/Under/boots_canvas_ankle.glb,client-3d/public/assets/pawn-pack/equipment/Under/under_bodysuit.glb,client-3d/public/assets/pawn-pack/equipment/Under/gloves_knuckled_half.glb,client-3d/public/assets/pawn-pack/weapons/custom/scrapline_machete.glb,client-3d/public/assets/pawn-pack/weapons/custom/field_saber.glb,client-3d/public/assets/pawn-pack/weapons/custom/quarry_chopper.glb,client-3d/public/assets/pawn-pack/weapons/custom/wpn_smg_sten_mk2.glb,client-3d/public/assets/pawn-pack/weapons/custom/wpn_carbine_kiln.glb,client-3d/public/assets/pawn-pack/weapons/custom/lightning_carbine.glb,client-3d/public/assets/pawn-pack/vibrosword.glb,client-3d/public/assets/pawn-pack/pawn_male.glb,client-3d/public/assets/pawn-pack/special/droid_grok_humanoid.glb,client-3d/public/assets/world-items/travel_terminal_grok_wedge.glb,client-3d/public/assets/world-items/travel_terminal_grok_wedge_screen.png"
+          --include="client-3d/public/assets/pawn-pack/equipment/Under/boots_canvas_ankle.glb,client-3d/public/assets/pawn-pack/equipment/Female/Under/boots_canvas_ankle.glb,client-3d/public/assets/pawn-pack/equipment/Under/under_bodysuit.glb,client-3d/public/assets/pawn-pack/equipment/Under/gloves_knuckled_half.glb,client-3d/public/assets/pawn-pack/weapons/custom/scrapline_machete.glb,client-3d/public/assets/pawn-pack/weapons/custom/field_saber.glb,client-3d/public/assets/pawn-pack/weapons/custom/quarry_chopper.glb,client-3d/public/assets/pawn-pack/weapons/custom/wpn_smg_sten_mk2.glb,client-3d/public/assets/pawn-pack/weapons/custom/wpn_carbine_kiln.glb,client-3d/public/assets/pawn-pack/weapons/custom/lightning_carbine.glb,client-3d/public/assets/pawn-pack/vibrosword.glb,client-3d/public/assets/pawn-pack/pawn_male.glb,client-3d/public/assets/pawn-pack/pawn_female.glb,client-3d/public/assets/pawn-pack/special/droid_grok_humanoid.glb,client-3d/public/assets/world-items/travel_terminal_grok_wedge.glb,client-3d/public/assets/world-items/travel_terminal_grok_wedge_screen.png"
           --exclude=""
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
@@ -84,6 +84,11 @@ jobs:
     needs: denylist
     steps:
       - uses: actions/checkout@v4
+      - name: hydrate audited LFS sources
+        run: >
+          git lfs pull
+          --include="content-pipeline/labs/humanoid-runtime-refit/source/male/rb_v4_anim.glb,content-pipeline/labs/humanoid-runtime-refit/source/male/pawn_male_refined.glb,content-pipeline/labs/humanoid-runtime-refit/source/female/rbf_v2_anim.glb,content-pipeline/labs/humanoid-runtime-refit/source/female/rbf_v3_anim.glb,content-pipeline/labs/humanoid-runtime-refit/source/female/pawn_female_refined.glb"
+          --exclude=""
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"

.gitignore

@@ -2,6 +2,8 @@
 /target/
 **/target/
 **/*.rs.bk
+# Rust client build products (target/ already covered above)
+client-rust/out/
 Cargo.lock.bak
 
 # Node
@@ -83,6 +85,7 @@ logs/
 
 # Local runtime persistence
 server/.local-state/
+server/.local-state-archive-*/
 server/data/
 
 .game-lab/

AGENTS.md

@@ -1,22 +1,25 @@
 # Successor Agent Notes
 
-Treat `~/dev/games/successor` on Bunker as the sole canonical checkout. Its
-branch is `main`. Inspect current code, processes, fixture identity, and Git
-status before broad changes. Preserve unrelated local work.
+Work from the repository checkout provided by the current environment. Inspect
+the current source tree, processes, fixture identity, and Git status before
+broad changes. Preserve unrelated local work.
 
 Read these files in order before making architecture or runtime claims:
 
 1. `docs/CANONICAL_CONTEXT.md`
 2. `docs/CURRENT_PROJECT_STATE.md`
 3. `docs/CURRENT_DEPLOYMENT.md`
 4. `docs/VERIFICATION.md`
+5. `docs/TOOLS_AVAILABLE.md`
 
 The canonical context owns architecture and scope. The state document is a
 dated implementation snapshot. The deployment document owns volatile public
 release identity. The verification document owns commands and runtime proof.
-Narrow design docs may add detail but cannot override those four files.
-Files under `docs/future/` are retained proposals, not current behavior. Verify
-their assumptions against `main` before implementing them.
+The tools guide documents repository-owned developer tooling agents should use
+for inspection and automation. Narrow design docs may add detail but cannot
+override those four authoritative project documents. Files under
+`docs/future/` are retained proposals, not current behavior. Verify their
+assumptions against the current source tree before implementing them.
 
 ## Credential authority
 
@@ -50,19 +53,19 @@ release may use the backed-up reset path instead of compatibility work. Record
 the backup identity, reset scope, new generation, exact release identities, and
 post-reset player journey in `docs/CURRENT_DEPLOYMENT.md`.
 
-## Host, source, and service ownership
+## Source, service, and tooling ownership
 
-| Use | Host and path | Agent rule |
+| Use | Location | Agent rule |
 | --- | --- | --- |
-| Canonical integrated source | Bunker: `~/dev/games/successor`, branch `main` | Inspect HEAD, dirt, and `docs/CURRENT_DEPLOYMENT.md` before using it. Canonical checkout HEAD is development truth, not automatically production truth. |
-| Temporary isolated work | Bunker disposable worktree | Start from `main` or the exact requested source commit. Merge or archive intentional work, then remove the worktree and its task branch before handoff. |
-| PawnForge authoring | Bunker: `~/dev/games/pawn-forge/pawnforgev2` | Use for humanoid, rig, socket, and GLB source work. |
-| Interactive cockpit | Michael's Mac | Use for interactive review and macOS-specific package proof. Do not assume a Mac checkout matches Bunker. |
-| Public alpha | AWS | Site/client/downloads are S3/CloudFront; the single-writer authority is private EC2 behind the ALB. Bunker is not the public game host. |
+| Integrated source | Current repository checkout | Inspect source identity, local changes, and `docs/CURRENT_DEPLOYMENT.md` before using it. The checked-out source is development truth, not automatically production truth. |
+| Temporary isolated work | Disposable local checkout or worktree | Start from the requested source revision. Preserve or integrate intentional work, then remove temporary state before handoff. |
+| PawnForge authoring | Neighboring `pawn-forge/pawnforgev2` checkout | Use for humanoid, rig, socket, and GLB source work; resolve its location from the environment rather than a fixed host path. |
+| Interactive review | Any supported workstation with the required display and platform tools | Bind proof to the exact source and built artifact rather than the workstation name. |
+| Public alpha | AWS | Site/client/downloads are S3/CloudFront; the single-writer authority is private EC2 behind the ALB. Local development hosts are not public game hosts. |
 
 The public surfaces are `https://www.successorgame.com` and
-`https://world.successorgame.com`. The AWS instance has no public SSH ingress;
-use the documented SSM/operator route. Local listeners and disposable
+`https://world.successorgame.com`. The AWS instance has no public remote-shell
+ingress; use the documented provider operator route. Local listeners and disposable
 verification shards remain loopback-only. A Vite page, screenshot, listener,
 temporary pod, or Rust process does not become the public alpha merely because
 it is reachable from a test client.
@@ -73,21 +76,16 @@ Never infer production identity from the current branch name or newest commit.
 
 ## Repository discipline
 
-`main` is the only long-lived branch in both the canonical checkout and the
-local Bunker hub. A temporary task worktree is allowed when isolation is
-useful, but it is not another source of truth. Before handoff:
+Do not infer source authority from a branch name, checkout path, workstation,
+or local worktree layout. Preserve unrelated local changes and bind every
+verification result to the exact source revision and working tree that produced
+it. Temporary isolation is allowed when useful, but it is not another source of
+truth. Before handoff, integrate or preserve intentional work and remove any
+temporary checkout state created for the task.
 
-1. merge verified work into `main`, or preserve unfinished work in a named
-   recovery bundle or patch;
-2. remove the temporary worktree;
-3. delete its task branch; and
-4. confirm `git worktree list` normally shows only
-   `~/dev/games/successor`.
-
-Do not accumulate verification-farm, cache-root, or detached worktrees. Do not
-launch a new task from another task worktree. Production release identities
-remain independent of `main` and must still come from
-`docs/CURRENT_DEPLOYMENT.md`.
+Do not accumulate verification-farm, cache-root, or detached worktrees.
+Production release identities remain independent of local source-control layout
+and must come from `docs/CURRENT_DEPLOYMENT.md`.
 
 ## Supported product surfaces
 
@@ -105,6 +103,55 @@ remain independent of `main` and must still come from
 Do not add another gameplay client, world fixture, combat authority, or asset
 manifest without an explicit product decision and a canonical-context update.
 
+## Rust client (client-rust/)
+
+`client-rust/` is the in-development native Rust client intended to eventually
+replace `client-3d/`, `desktop/`, and `client-tui/`. Until parity is proven and
+a product promotion happens, the existing clients remain the supported player
+surfaces; `client-rust/` must not be published, linked from the site, or added
+to the download ledger.
+
+It is a standalone Cargo workspace, deliberately outside the root Rust
+workspace and the pnpm workspace. Root repo gates do not cover it; its own
+gates are mandatory for any change under `client-rust/`:
+
+- `make -C client-rust verify` — unit tests, performance regression against the
+  matching checked-in environment baseline, size regression, and absolute ceilings.
+- `make -C client-rust check-allocs` — steady-state frame loop must report
+  `frame-allocs 0`; any per-frame heap allocation is a gate failure.
+- `make -C client-rust runtime-check` — frame-time p50/p99, peak RSS, and
+  allocation stats for the standard demo scene vs baseline and ceilings.
+- `make -C client-rust nostd` — the engine crates must keep building for
+  `thumbv7em-none-eabihf` (no_std purity proof).
+
+Hard budgets (`client-rust/budgets.json` is authoritative):
+
+- stripped wasm <= 4.0 MiB; stripped native binary <= 6.0 MiB;
+- zero steady-state heap allocations per frame;
+- peak RSS in the standard scene <= 512 MiB;
+- runtime and terrain GPU p99 <= 8.33 ms, and generic render GPU p99 <=
+  16.67 ms on a supported baseline environment;
+- regressions: size +max(512 KiB, 25%), perf +100%, RSS +5% versus the matching
+  checked-in baseline. The larger size/perf headroom is intentional:
+  presentation fidelity takes priority inside the absolute caps.
+
+Environment baselines live in `client-rust/bench/baselines/` and change ONLY
+via `make -C client-rust bench-baseline`, reviewed like code. An intentional
+regression ships the matching baseline update with a written justification.
+
+Engine rules: `successor-engine-core` and `successor-engine-render` are
+`#![no_std]` + `alloc`; no `core::fmt` in shipped paths; platform access only
+through `successor-platform`; rendering backends only through the `Gpu` trait.
+The wasm FFI import list in `client-rust/source/platform/src/web/` and the JS
+shim `client-rust/web/successor.js` must change in lockstep. New dependencies
+are weighed against the size gate — wgpu, winit, bevy, tokio, and wasm-bindgen
+are explicitly rejected. The wire protocol reuses `crates/successor-net` types;
+gameplay authority stays in Rust `successor-sim` — the client renders streamed
+state and submits commands, exactly like the existing clients. The ECS carries
+a repo-tailored prefab/JSON/asset layer (versioned `schema`/`format`
+discriminators, manifest-by-stable-id, `resolveRuntimePublicPath` fail-closed
+rules) mirroring how `client-3d`/`client` consume assets.
+
 ## Authority boundary
 
 Rust `successor-sim` owns deterministic gameplay: movement, pathing, structure
@@ -126,7 +173,7 @@ The active presentation library is rooted at:
 - `client-3d/public/assets/`
 - `client/public/successor-audio/`
 - `client/public/successor-slice/`
-- `~/dev/games/pawn-forge/pawnforgev2/` on Bunker (source checkout)
+- neighboring `pawn-forge/pawnforgev2/` source checkout
 
 Keep GLB source provenance, manifests, sockets, material rules, and runtime
 loaders aligned. Preserve authored shaders, effects, weather, crop/flora work,

Cargo.toml

@@ -3,6 +3,7 @@ resolver = "2"
 members = [
     "crates/successor-core",
     "crates/successor-inventory",
+    "crates/successor-movement",
     "crates/successor-sim",
     "crates/successor-net",
     "crates/successor-wasm",

README.md

@@ -31,6 +31,7 @@ client-3d/       Three.js client, HUD, shaders, effects, weather, and GLB loader
 client-tui/      terminal client and terminal journeys
 client/          renderer-neutral protocol, state projection, commands, and headless host
 desktop/         Electron distribution of client-3d
+client-rust/     in-development native Rust client (no_std engine, GL renderer, Colyseus protocol)
 site/            marketing, account, connect, browser-launch, and download shell
 server/          network edge, rooms, persistence projection, chat, and Rust bridge
 crates/          deterministic Rust simulation, net types, inventory, and WASM bindings