Improvement: Make the Xevious roadmap dependency-aware

[StarshipSuperjam]

A green mechanical check below shows this change conforms to the engine's rules — not that it is correct. What covers correctness is the behavioural steps in Review and your own read of the change; a green check is never a substitute for that. Your merge is the binding gate.

About those checks: only the one that runs when the change is proposed for merge can stop a risky one — anything that ran while I worked is early advice. Each check is itself proven against a deliberately broken example it must catch, so a passing check can't be one that quietly did nothing — but that proves the check works, not that the change is right. And a check that could not run leaves its area unverified.

Purpose

Make the complete Xevious build plan executable as dependency-aware GitHub work.

• Decompose broad capabilities into atomic leaves that can be composed into demonstrable delivery PRs.
• Prevent systems from claiming completion while their consumers, tests, specifications, or operator evidence are still missing.

Impact: GitHub now reflects what can actually be built and proved, not merely a high-level sequence.

Scope

Project the canonical plan into 13 capability parents and 66 independently closable leaves.

• Map every exact criterion to one leaf, delivery slice, leaf-only milestone, proof level, prerequisite slices, and direct blockers.
• Create native parent/sub-issue links, derived Project fields, and separate views for leaves, parents, and imported history.
• Add an idempotent, journaled migration and complete live reconciliation.
• Enforce closure evidence for provisional specs, dependencies, mechanics records, newly added success/failure tests, and exact-commit playtests.
• Preserve the five existing Project views, Engine-owned fields, and all protected state on active PR Feature: difficulty director and normal flying formations, live #34.

Change profile — the shape of this pull request at a glance:

• Size: 12 files changed, +3131 / −1 lines.
• Kinds of thing touched: 12 other files (not in the engine's map).
• Where: docs, .github, tools, tests.
• Shape: 8 commits on this branch — a standalone change unless a Part of #N line below says it is one slice of a larger effort.

This is a description, not a gate — it never blocks a merge. It is here so you can weigh the change by what it touches, not its line count.

Impact: The full roadmap is live, resumable, auditable, and arranged without making Project #4 a second source of truth.

Behaviors

Roadmap projection and closure are now mechanically checkable.

• Manifest validation rejects missing, duplicate, invented, cyclic, or provisional obligations — tests/test_roadmap.py.
• A PR cannot close a parent, a blocked/provisional leaf, or a leaf without matching mechanics, new criterion-specific success/failure evidence, and required operator approval — tests/test_roadmap.py.
• Manual closure is reopened unless a merged PR actually lists that leaf for closure — tests/test_roadmap.py and .github/workflows/roadmap-closure.yml.
• Live reconciliation fails on issue identity/content/state, hierarchy, milestone, Project field/item/view, preserved-view/field, or PR Feature: difficulty director and normal flying formations, live #34 drift — tools/roadmap.py reconcile.

Out of scope

No gameplay implementation or active slice-7 work changes here.

• PR Feature: difficulty director and normal flying formations, live #34's branch, commits, body, labels, milestone, Project metadata, and Claude worktree remain untouched.
• Draft product specifications remain draft; their leaves are visible but provisional and non-closable.
• This PR does not merge itself or apply the operator-owned guardrail-ack label.

Impact: The roadmap changes around ongoing delivery without disturbing it or pretending unsettled gameplay is executable.

Risk

The main risk is partial or incorrect external GitHub state.

• Stable keys, immutable snapshots, per-mutation journaling, batched Project calls, identity preflight, and roll-forward recovery bound partial failure.
• Reconciliation reads every desired item back and proves PR Feature: difficulty director and normal flying formations, live #34 unchanged.
• The workflow edit strengthens a merge gate and is intentionally left awaiting the operator's separate guardrail-ack consent.

Impact: Failures stop visibly and resume from recorded IDs instead of duplicating or silently deleting GitHub history.

Validation

Repository, live GitHub, workflow, and Engine validation are green locally.

• 176 repository tests pass.
• python3 tools/scratch_project.py verify preserves the original and verifies deterministic build SHA-256 4d7c2dfd15618a5f835bf79fe3592a0719e013f5625cf891f69ce77323ba7394.
• actionlint passes both changed workflows.
• python3 tools/roadmap.py reconcile proves 13 parents, 66 leaves, Project Maintenance: Bump mcp from 1.28.1 to 2.0.0 in /.engine #4, milestones, and PR Feature: difficulty director and normal flying formations, live #34 match the committed state.
• Engine CI passes with no hard findings; the full 4,908-test checker self-test passes.
• Knowledge graph and self-map were regenerated from the reconciled tree and were already current; no work was lost.

Impact: The approver can rely on deterministic local checks plus a complete live-state read-back; hosted checks must rerun on this final head.

Review

Standard review ran three independent implementation checks; every roadmap finding was fixed and targeted re-checks found no remaining product-roadmap blocker.

• Conformance, adversarial divergence, and technical-integrity checks completed.
• Fixed missing delivery dependencies, inaccurate AIR-08–11 mapping, and missing PR Feature: core game systems foundation — entity slots, collision groups, shared RNG #20 history.
• Fixed manual-closure bypasses, shallow history checkout, stale approval flow, unrelated mechanics/test evidence, snapshot drift, schema/project identity, cycle, pagination, idempotency, and reconciliation gaps.
• The adversarial final re-check returned no findings; the other targeted checks' final findings were fixed in commits e0d3bca, 686c1b9, and 3cbed53.
• A pre-existing Engine home-repository exemption concern was surfaced separately; this PR does not change Engine code or its guardrails, and installed Engine CI/self-tests remain green.
• The post-review fixes materially strengthen the reviewed build: between reviewed ce138ee and submitted 3cbed53, 394 lines were added and 58 deleted or modified across 10 files, a net +336 lines; all affected validation was rerun.
• Nothing here is something you can run yourself — the linked description isn't settled yet.

Impact: Review pressure was concentrated on the exact failure mode—work appearing complete before it can be exercised—and the submitted version is materially stronger than the first reviewed head.

Demonstration

Run the live reconciliation and then inspect the derived board.

• With authenticated gh, run python3 tools/roadmap.py reconcile. It prints that live state matches only when all issues, milestones, hierarchy links, Project values/views, preserved structures, and PR Feature: difficulty director and normal flying formations, live #34 match; altering any checked surface makes it fail with the drift.
• Open Xevious Project Board and compare Delivery leaves, Capability parents, and Imported history.

Impact: The operator can observe the real GitHub projection and a command that fails when it diverges.

Files of interest

Start with the desired state and enforcement boundary.

• docs/roadmap/manifest.json and docs/roadmap/criteria.json
• docs/roadmap/README.md and docs/roadmap/PR34_HANDOFF.md
• tools/roadmap.py and tools/check_roadmap_closures.py
• .github/workflows/roadmap-closure.yml and .github/workflows/xevious-project.yml
• tests/test_roadmap.py

Impact: These files determine scope, live projection, closure policy, and regression coverage.

AI involvement

Codex authored the decomposition, migration, enforcement, tests, live projection, and review fixes; the operator chose the objective, Standard depth, API use, and retained sole guardrail consent.

• AI judgment is load-bearing in criterion decomposition, dependency mapping, historical/provisional classification, and recovery design.
• Mechanical operations were validated against the committed manifest and paginated live read-back.

Impact: Human review should focus on the obligation/dependency model and closure policy; the operator's merge and guardrail-ack remain binding decisions.