feat(game-bridge): add deterministic StoryCore-to-Godot contract fixture

[zedarvates]

Summary

• add a strict public StoryCore-to-game interchange contract (v0.1)
• compile normalized specifications into deterministic SHA-256-addressed manifests and evidence records
• reject unknown fields, unresolved references, incomplete localization, authority mismatches, and private-component inclusion
• constrain CLI paths to allowlisted workspace-relative inputs/outputs and refuse traversal, absolute paths, unexpected characters, symlink escapes, and final output symlinks
• add the original bilingual Coinfall Chronicle Godot fixture using procedural shapes only
• add deterministic compiler tests plus a headless full-quest smoke

Public/private boundary

This change contains only an MIT public contract and local reference fixture. It does not contain or describe Ultimate Odycer's commercial server, internal agents/reasoners, private algorithms, credentials, or provider adapters. Production authority can connect later through the explicit external-contract boundary.

The Godot fixture is a non-authoritative consumer. Do not run public fork code on a self-hosted runner carrying personal, signing, deployment, or production credentials.

Evidence

• python -m unittest discover -s tests/game_bridge -v — 15/15 passed
• python -m compileall -q src/game_bridge tests/game_bridge — passed
• fresh compiler output compared byte-for-byte with both checked-in Godot JSON files — passed
• manifest content SHA-256: a75e7e506f27cee8e6bec9bcb65054ad264808c3c01508ee4de3e8645196c43a
• official Godot 4.7.2 Linux x86-64 asset SHA-256 verified: cadd3204e728a35d3f13adb7fd0d7902636b79f6b95c40c265eb73b6c35329e4
• headless editor import and GDScript parse — passed
• automated quest: 5 runes, score 250, reward state and French localization — passed
• marker: STORYCORE_GAME_SMOKE_PASS score=250 collected=5 locale=fr
• SonarQube on final head d0e2d03897342b5e912e056b36f7522fb5998bc8 — Quality Gate passed, 0 annotations, 0 security hotspots

Promotion gate

• strict contract and path-security regression suite
• final SonarQube Quality Gate
• Godot import and script parse
• automated full-quest smoke
• human review confirms the public/private boundary — owner approved 2026-08-30

The owner approved the public/private boundary on 2026-08-30. Keep this PR in draft: that approval does not authorize merge, release, or a public-runtime claim.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[zedarvates]

Automated public/private boundary audit — final head

Scope: the exact 13 files changed between base 5da07b1f2d64b7b1902ca7365f9121ed10789e99 and head d0e2d03897342b5e912e056b36f7522fb5998bc8.

• all 13 retained local files matched the remote head by Git blob SHA;
• credential/secret-pattern scan found no secret value (the only match was the word “secret” in the acceptance table);
• proprietary-name scan found three references, all exclusion-only: the fixture README and compiler module docstring say what is not included;
• no private module, internal architecture, model/provider implementation or credential path was found;
• no network client, subprocess, dynamic evaluation or shell execution was added;
• the only URL is the official Godot 4.7.2 release provenance recorded in smoke evidence;
• Python imports are standard-library only; Godot uses native APIs only;
• all changed files are text/JSON/GDScript/project metadata; no binary or third-party asset is present;
• all four JSON documents parse successfully;
• python -m unittest discover -s tests/game_bridge -v: 15/15 passed;
• python -m compileall -q src/game_bridge tests/game_bridge: passed;
• regenerated manifest and evidence matched checked-in files byte-for-byte;
• content SHA-256 remains a75e7e506f27cee8e6bec9bcb65054ad264808c3c01508ee4de3e8645196c43a;
• manifest file SHA-256 remains 21359cddd04a857dcee60c8ba9f320e3edc7d389a22dd61867318898201e1614.

License note: the fixture declares MIT and the repository LICENSE is MIT. The root package.json currently declares ISC; that mismatch predates this PR and should be reconciled before any distributable release, without broadening this PR.

This automated audit does not complete the remaining human public/private boundary checkbox. Keep the PR draft; no merge or release is authorized.

[zedarvates]

Owner gate recorded on 2026-08-30: « J’approuve la frontière public/privé de la PR #44, sans autoriser sa fusion. »

This satisfies the human boundary-review checkbox only. PR #44 remains open and in draft; merge, release, and publication are not authorized.