Add situation report for 2026-03-01

Comprehensive project sitrep covering architecture, component status,
health assessment (3 CRITICAL, 17 HIGH findings), technical debt,
recent sprint activity, and prioritized next actions.

https://claude.ai/code/session_01ER2KALC2hH6NdsNKNKYgYB

Author: claude

SITREP-2026-03-01.md

@@ -0,0 +1,163 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# IDApTIK — Situation Report
+**Date**: 2026-03-01
+**Branch**: `master` @ `f66606e`
+**Scanned by**: Claude Opus 4.6
+
+---
+
+## 1. Project Identity
+
+**IDApTIK** is an asymmetric co-op stealth puzzle-platformer and adaptive game engine ecosystem. Players hack simulated networks through a reversible virtual machine — undo is the defence, forward execution is the attack, and the ordering of reversals creates emergent tactical depth.
+
+- **Created by**: Joshua B. Jewell
+- **Developed under**: hyperpolymath (Jonathan D.A. Jewell)
+- **License**: PMPL-1.0-or-later
+- **Repo age**: 8 days active (2026-02-22 → 2026-03-01), 44 commits, single primary author
+- **Velocity**: ~5.5 commits/day — extremely high throughput sprint
+
+---
+
+## 2. Codebase Metrics
+
+| Metric | Value |
+|--------|-------|
+| Total files | 985 |
+| Total LOC scanned | 116,148 |
+| Primary language | ReScript (285 files, ~11,100 LOC) |
+| Secondary languages | Idris2 (22 files, ~3,700 LOC), Elixir (~3,000 LOC), Shell (~2,800 LOC), Zig (13 files, ~2,100 LOC), Scheme (32 files, ~850 LOC) |
+| Other | Rust (escape-hatch), JSON (60), YAML/TOML configs |
+| Git tags | None |
+| Open PRs/Issues | None visible |
+
+---
+
+## 3. Architecture Overview
+
+```
+ PLAYER (Browser / Desktop / TUI)
+    │
+    ├── main-game/       PixiJS 8 + ReScript 12 + Vite + Deno    [98%]
+    ├── idaptik-ums/     Tauri 2 + ReScript + Idris2 + Zig       [30%]
+    └── escape-hatch/    ratatui TUI (Rust)                       [20%]
+         │
+         ├── shared/          Cross-component types & kernels     [100%]
+         ├── vm/              Reversible VM engine (24 instrs)    [ 95%]
+         ├── dlc/             29 puzzles + CLI + bundler           [ 90%]
+         └── sync-server/     Elixir/Phoenix co-op multiplayer    [ 60%]
+              │
+              └── containers/  Podman + Wolfi (3 images)          [ 40%]
+```
+
+**Key architectural insight**: The reversible VM (`vm/`) is the central engine. Five tiers of instructions (register arithmetic → conditionals → stack/memory → subroutines → I/O → multi-VM networking) provide the full execution model. Reversibility is the core gameplay mechanic, not an implementation detail.
+
+---
+
+## 4. Component Status
+
+### Mature / Near-Complete
+| Component | Status | Notes |
+|-----------|--------|-------|
+| **main-game/** | 98% | Full game engine — HUD, inventory, resource kernel, combat, 3 training screens, hardware wiring |
+| **shared/** | 100% | Kernel scheduler, 10 domain kernels, all resource types |
+| **vm/** | 95% | 24 instructions incl. CPCALL, pure library, extensive tests |
+| **dlc/idaptik-reversible/** | 90% | 29 puzzles, REPL, validator, 42/42 CLI tests pass |
+| **Justfile orchestrator** | 95% | Full-stack build verification |
+
+### In Active Development
+| Component | Status | Notes |
+|-----------|--------|-------|
+| **Multiplayer (sync-server)** | 60% | Phoenix Endpoint, GameChannel, sessions, PubSub, PhoenixSocket client, 6/6 connectivity tests |
+| **Bebop Connections** | 60% | 7 types, registry, terminal commands |
+| **Hardware Wiring** | 60% | UI implemented, physical ports interactable |
+| **VMMessageBus** | 50% | Co-op event queue, port routing |
+
+### Early / Scaffolded
+| Component | Status | Notes |
+|-----------|--------|-------|
+| **idaptik-ums/** | 30% | Tauri 2.0 migrated, Idris2 ABI (14 modules), Zig FFI solvers, procedural generators |
+| **escape-hatch/** | 20% | Rust scaffold, classified mainframe theme |
+| **Containers** | 40% | 3 Containerfiles built, but not production-hardened |
+| **Mod Minter & Editor** | 0% | Not started |
+
+---
+
+## 5. Health Assessment
+
+### Strengths
+- **Core engine is solid**: vm/ at 95%, shared/ at 100%, main-game/ at 98%
+- **Good architectural documentation**: 15 ADRs, white paper, TOPOLOGY.md, DESIGN-DECISIONS.adoc
+- **Testing exists across the stack**: 53 test files across 5 languages
+- **Security-conscious**: panic-attacker audit pipeline, Trustfile, SECURITY.md, threat model
+- **Polyglot but purposeful**: each language serves a clear role (ReScript=UI, Idris2=formal ABI, Zig=performance solvers, Elixir=real-time sync, Rust=TUI)
+
+### Risks & Blockers
+
+#### CRITICAL (3 findings)
+1. **Rust edition typo**: `edition = "2024"` in two Cargo.toml files — Rust 2024 edition doesn't exist. Blocks `escape-hatch/` and `main-game/src-tauri/` from compiling.
+2. **Documentation drift**: `idaptik-level-architect/` referenced in 8+ files but directory was renamed to `idaptik-ums/`. Stale paths in Trustfile, CONTRIBUTING, DESIGN-DECISIONS, AI-MANIFEST.
+
+#### HIGH (17 findings)
+- **CI runs no tests**: `quality.yml` does linting only — no `just test-all`
+- **`test-all` is incomplete**: only runs vm/ and game/, skips shared/, dlc/, ums/, escape-hatch/
+- **Test failures silently swallowed**: `|| true` in test-game recipe
+- **4 unwrapped `parseExn` calls** in UMS generators and vm/ (crash on malformed input)
+- **WebSocket CSRF disabled** (`check_origin: false` in sync-server config)
+- **Unencrypted DB connections** (ArangoDB + VerisimDB over HTTP)
+- **Dependency version drift**: `@rescript/core` is `^1.5.0` in UMS vs pinned `1.6.1` elsewhere
+- **Broken external repo references** in UMS Justfile (4 non-existent paths)
+
+#### MEDIUM (33 findings)
+- 1,723 deprecated `Js.*` API calls need migration to `@rescript/core`
+- 24 `getExn`/`parseExn` calls need safer alternatives
+- Container base images use `:latest` (non-reproducible)
+- Shell scripts have unquoted variables in `kill` commands
+- 6 ADRs declared in META.scm but files don't exist
+
+---
+
+## 6. Technical Debt Summary
+
+| Category | Count | Effort |
+|----------|-------|--------|
+| Deprecated API migration (`Js.*` → `@rescript/core`) | ~1,723 calls | Large (multi-session) |
+| Unsafe unwrap calls (`parseExn`, `getExn`, `getUnsafe`) | ~24 sites | Small-medium |
+| Doc/path rename drift (`level-architect` → `ums`) | ~12 files | Small |
+| Missing CI test integration | 1 workflow | Small |
+| Container hardening (image pinning, healthchecks) | 3 Containerfiles | Small |
+
+---
+
+## 7. Recent Sprint Activity (Feb 22–Mar 1)
+
+The last 8 days represent an intense development sprint:
+
+1. **Feb 22-26**: Foundation — co-op multiplayer (Phoenix + WebSocket), container orchestration, E2E tests (Playwright), PWA icons, DLC tests (42/42 pass), combat overhaul
+2. **Feb 27**: Major expansion — level architect → UMS rename, Idris2 ABI (14 modules), Zig solvers, procedural generators (network topology, power systems, campaigns), database federation (ArangoDB + VerisimDB), A2ML metadata wiring
+3. **Mar 1**: Stabilization — rename cleanup PR (#27), critical fixes
+
+---
+
+## 8. Recommended Next Actions
+
+### Immediate (unblocks correctness)
+1. Fix `edition = "2024"` → `"2021"` in both Cargo.toml files
+2. Complete `idaptik-level-architect` → `idaptik-ums` rename across all docs/configs
+3. Fix `test-all` to cover all components; remove `|| true` from test recipes
+4. Update Trustfile paths to match actual directory structure
+
+### Short-term (unblocks quality)
+5. Add test execution to CI (`just test-all` in quality.yml)
+6. Wrap unwrapped `parseExn` calls in UMS generators
+7. Pin `@rescript/core` version consistently across all components
+8. Add production config for WebSocket origin checking and DB TLS
+
+### Medium-term (reduces debt)
+9. Begin `Js.*` → `@rescript/core` migration (1,723 calls)
+10. Pin container base images to specific digests
+11. Create missing ADR files (016-021) or remove from META.scm
+12. Implement or defer the `#/editor` route stub in UMS
+
+---
+
+*Generated 2026-03-01 by Claude Opus 4.6.*