open-wc/coordination/claims/M02-GMP-SANDBOX-CAPABILITIES-001.md

M02-GMP-SANDBOX-CAPABILITIES-001 — Debug movement capability gate

Ownership

• Target: M02
• Program: GMP/FND
• Owner/Agent ID: sindo-main-codex
• Branch: work/sindo-main-codex/m02-sandbox-capabilities
• Lease expires UTC: 2026-07-16
• Integrator: M02 milestone integrator

Outcome

Introduce an immutable local-player movement capability contract and require it at the movement boundary so debug sprint and free flight execute only in the explicit RenderSandbox profile and are rejected by Blizzlike335.

Non-goals

• Claim that current movement values or Blizzlike335 locomotion are 1:1.
• Build a global application/profile framework before the application shell exists.
• Remove debug Input Map actions or change their current sandbox bindings.
• Implement jump, fall, swim, collision, server authority or reconciliation.
• Mark M02 complete or edit its checklist/Evidence.

Paths

• Exclusive: src/gameplay/movement/player_movement_capabilities.gd, src/tools/verify_player_movement_capabilities.gd, this claim
• Shared/hotspots: src/gameplay/movement/local_player_movement_controller.gd, src/scenes/player/third_person_wow_controller.gd, movement/input verifiers, player regression scene, docs/modules/local-player-movement.md, docs/modules/player-input.md
• Generated/ignored: local .godot, native DLL, generated resources and renderer corpus

Contracts and data

• PlayerMovementCapabilities owns immutable profile ID plus explicit debug sprint/flight booleans and safe named factories.
• LocalPlayerMovementController requires the capability value; missing input falls back to Blizzlike335, never sandbox.
• Player scene maps its exported profile selection once at the composition boundary.
• Input actions and MoveIntent remain unchanged; rejected debug requests have no effect.

Dependencies

• Requires: merged character presentation package on master 8c71e46.
• Blocks: final M02 integration audit and milestone closeout.
• External state: none; verification is asset-free.

Verification

• Pure profile factory/default and immutability regression.
• Sprint accepted in RenderSandbox and ignored in Blizzlike335.
• Flight toggle/vertical basis accepted in RenderSandbox and rejected in Blizzlike335.
• Real regression scene verifies both profile compositions.
• Existing input/movement/terrain/camera/presentation and renderer gates remain required.
• Fidelity evidence: negative proof that debug capabilities cannot affect the compatibility profile; no positive movement parity claim.

Documentation deliverables

• Inline public API and profile semantics on the capability/controller boundary.
• Updated movement and input specs: API, inputs/outputs, data flow, lifecycle, failure/recovery, capability matrix and source map.

Simplicity and naming

• Important name: PlayerMovementCapabilities.
• Simplest approach: one immutable value injected into the existing controller.
• Rejected complexity: autoload singleton, generic feature-flag service and global profile registry.
• Unavoidable complexity: one profile-to-capability mapping at scene composition.
• Measured optimization evidence: not applicable.

Status

• State: ready-for-review
• Done: added immutable capability contract, gated sprint/free-flight, covered pure and real-scene profiles and updated movement/input specifications
• Next: milestone integrator reviews and merges 742c415
• Blocked by:

Handoff

• Branch/commit: work/sindo-main-codex/m02-sandbox-capabilities at 742c415.
• Outcome: debug sprint and free flight now require explicit PlayerMovementCapabilities.render_sandbox(); Blizzlike335, unknown and null capability inputs reject both effects.
• Public contract: immutable profile ID plus allows_debug_sprint and allows_debug_free_flight; named factories map configuration once at the composition boundary. The movement controller exposes its effective profile ID.
• Runtime composition: ThirdPersonWowController.movement_profile_id defaults to RenderSandbox, preserving renderer-scene behavior. Selecting Blizzlike335 keeps ordinary movement while ignoring Shift/Space/E/Q effects.
• Verification: capability profiles=3 sprint=2 flight=2 scenes=2 boundary=1, movement cases=12 state_transitions=2, input actions=12 intent_cases=6, terrain contract=4 interpolation=1 cache=1 failures=2, camera state_cases=12 policy_cases=3, presentation appearance_cases=9 animation_cases=10, coordinate boundaries files=101 consumers=5, and StreamingFocus runtime_scenes=2 capture_tools=3 passed.
• Renderer: dry-run passed project/material/dedupe/cache/manifest/calibration/ coordinate/server-spawn gates and planned all seven checkpoints; the combined run reported coordinate files=103. Missing proprietary GLB/DBC/ADT inputs produced the expected diagnostics only.
• Repository gates: documentation module_specs=8, coordination fallback_claims=30; five unrelated expired M00 claim warnings remain.
• Fidelity: this package provides negative evidence that sandbox-only debug movement cannot alter the Blizzlike335 profile. It does not prove ordinary movement, bindings, flight or timing match build 12340.
• Migration: direct LocalPlayerMovementController.new(...) callers that need debug behavior must now pass render_sandbox(); omitted/null capability is intentionally compatibility-safe. Existing repository scenes require no edit.
• Cache/persistence: no schema, cache, binding or stored-profile migration.
• Local ignored inputs: native extension DLL, UID cache and generated ADT resource scripts supported renderer verification and are not committed.
• Risks: runtime renderer scenes still default to RenderSandbox; the future application shell must explicitly choose its profile. Blizzlike335 currently guarantees only debug exclusion, not complete movement fidelity.
• Recommended merge order: merge after presentation (already on master), then perform the final M02 integration/evidence audit before any target closeout.
• Documentation: updated movement/input API, inputs/outputs, data flow, state, sequence, ownership, failure/recovery, capabilities, verification and source maps.