Add Core Watcher Level 1 release candidate

[ael-dev3]

Outcome

Adds PR A of The Core Stirs stack: an original, review-ready Core Watcher — Level 1 asset candidate in Warpkeep-Assets, plus a hardened, review-only integration-readiness contract for later Warpkeep gameplay slices.

• one editable Blender source in the prepared local package
• four texture-free, self-contained static runtime GLBs
• close, LOD-lineup, transparent, and far-map previews
• a byte-exact tracked copy of the packaged runtime manifest
• a production-digest-pinned advisory integration profile
• exact manifests, bounds, semantic parts, pivot/orientation, materials, QA, checksums, privacy, provenance, and license boundaries
• fail-closed structural and integration verifiers with focused mutation and security tests

This PR contains lightweight review metadata, exact rendered previews, reports, provenance, contracts, and verifier code only. The prepared ZIP remains local.

Candidate artifact

• Intended tag: core-watcher-level1-2026-08-03 (not created)
• Package: Warpkeep_CoreWatcher_Level1_GameReady
• ZIP: warpkeep-core-watcher-level1-game-ready-2026-08-03-v1.zip
• ZIP bytes: 1,405,757
• ZIP SHA-256: 34c8a80186642659acea893c06199a8e7b615ac0f9685f2c58c4a27641f56a33
• Package QA: 58/58

LOD	Intended view	Triangles	Bytes	SHA-256
LOD0 High	Selected close inspection	2,354	129,520	64218fe3082466ae5864885e7c7bd623e2c233d8f1e5231ca5e75979b9a045db
LOD1 Balanced	Nearby strategy view	1,000	67,968	f6112167a67d91db46e1e3dcabbea2e537b3f8c8bcb36de5caca1ec63170a1f6
LOD2 Compact	Medium/reduced detail	282	27,636	6e9434d4e4f8ba03bec96a5bd47422caae88e04b230f7f3daf3219e833bf13e1
LOD3 Map	Overview/far-map signal	158	18,748	2f2e30bdd7593440cba8a5bd7a676d812c0b0a5910ece5174c8af434a72f146b

Exact review anchors

• Integration-profile digest: 0a34614dfb42f754fd2524b23ef213c2db502768ad9230bd6a27a9198a8251c0
• Runtime-manifest copy: 7,462 bytes, 0339dc9abe5c6a9340ef9be1d0ad908a5130eb9339a7ace4fafdb25a7548d1fd
• Source manifest: 2,416 bytes, 2c52e4744914b27fad6ba6b1e28ae1a02363612080079ac62933fd16ce580b04
• Source semantic fingerprint: a51eae5665ee3e7c59191b36dd1abfbbc1fa3ddd76405bee52c6c5fb3dad344c
• Release manifest: 7,520 bytes, 60eaa17e477d37f42d25b446ab9a907c6d57b919007b3632c3e5f327283113f0
• Release checksum sidecar: 124 bytes, 8196227e0cf7b4cc66d39ab14f2508c5f3d865b54222ab4293440bc818314f09
• Gallery manifest: 1,255 bytes, 90ec48066c69c6a4223dbc3911784c08c6dc86cad686d3581f4cfcfd15cab6bc

The profile digest is computed over the exact tracked UTF-8 bytes with only its own digest value zeroed. Both verifiers pin the expected production digest; a self-consistent rewrite cannot silently redefine the contract.

Modern integration guidance — not implementation

The advisory profile records the modern gameplay-facing expectations that belong around this asset later, without implementing or authorizing them here:

• Loading: content-addressed, same-origin, redirect-denied, abortable and timeout-bounded fetches; exact bytes and SHA-256 before parse; transactional clone/animation cleanup; context recovery; engine-generated fallback; no ordinary-build or runtime dependency on GitHub or an unpublished PR.
• Rendering: device quality (High | Balanced | Reduced) remains separate from camera band (overview | strategy | close); exact emitted bounds and semantic mesh/material roles are pinned; reduced quality may skip optional model fetches while a discoverable engine marker remains.
• LOD and instancing: one primitive per semantic mesh supports component-wise instancing. A deliberately non-authoritative 72-instance Map-LOD envelope is 11,376 visible triangles and 12 instanced draw groups, versus 864 naive clone draws. It does not declare a population, site, coordinate, or placement.
• Motion: presentation-only, bounded rigid transforms may use the Realm's shared scheduler; reduced motion is static and cannot alter visibility, selection, state, or actions.
• Mobile: iPhone Safari 390×844 QA covers page scrolling, cumulative cadence-independent pinch zoom, gesture lifecycle resets, visual-viewport resizing, safe-area insets, and 44–48 px controls. Passive presentation must remain pointer-inert so map gestures continue to work.
• Accessibility: a complete semantic Explore list remains available independently of WebGL; Inspect is camera-neutral; Locate is the only camera-moving action; history/back and focus restore correctly; presentation art is decorative; 200% page zoom, keyboard, and screen-reader coverage are required.
• Fallback and privacy: model failure preserves the public record and selection; retries are client-owned and bounded; opaque IDs, hidden coordinates, private state, and private atlas data are excluded from DOM, alt text, art, and telemetry.

Gameplay and authority boundary

This remains a visual asset PR. The integration profile explicitly sets asset authority to false for catalogue, population, site identity, coordinates, placement, visibility/fog, activation, encounter/combat/AI state, health, damage, loot/rewards, cooldowns, respawn, pathing, collision, picking, selection, actions, routing, networking, persistence, ownership, and SpacetimeDB. Only visualOnly is true.

Later owner-gated work remains split and unimplemented here:

1. B — public catalogue and server placement: public Core site IDs, eligible cells, topology/hydrology constraints, and public visibility projection.
2. C — Realm client: approved content-addressed loading, markers, LOD allocation, instancing, picking, mobile gestures, fallback, and accessibility.
3. D — authoritative gameplay: SpacetimeDB encounter state, combat, health, damage, actions, rewards, cooldowns, and persistence.
4. E — QA and operations: desktop/mobile budgets, migrations, observability, recovery, and rollout evidence.
5. F — activation: separate fail-closed owner approval and staged rollout.

Outstanding Warpkeep work was inspected read-only for architectural context. This PR consumes no unmerged APIs, branches, seeds, coordinates, hidden sites, private atlas payloads, review art, or gameplay code and creates no dependency on another open PR.

Originality boundary

The Watcher is an original narrow bifurcated obsidian monolith with a suspended restrained ultraviolet core, cage rings, asymmetric floating shards, and a cold ground sigil.

• no Hegemony geometry, palette swap, banner, crest, unit, Worker, castle, or wagon reuse
• no input from the separate Core faction crest release
• no third-party model, texture, icon, code, name, or protected reference artwork
• broad comparative research informed map-scale discoverability and visible level language only
• combatEnabled=false

Verification

Passed on head b13d6ac0dd0a50fa8c5b7615637acabf2f6d25e1, based directly on Warpkeep-Assets main@10c84fbcc339f143ee6f25dfe7a0682660e0e458:

• repository suite: 95/95 tests
• integration-profile verifier: exact pinned digest and all no-authority gates pass
• focused package verifier: ZIP and extracted root both pass; exact 15-file inventory and 58 named QA checks
• exact semantic roots and 23/20/15/12 LOD parts; one primitive per mesh; node, mesh, material, hierarchy, and role contracts pass
• transformed glTF bounds, footprint, ground contact, normalized normals/quaternions, embedded-only buffers, and exact material values are recomputed
• official Khronos glTF validator: zero issues across 4/4 GLBs
• clean Blender 5.2 factory imports: 4/4; no cameras, lights, armatures, or actions
• generic trusted-manifest verifier and nested checksums: passed
• all preview copies are byte-exact, fully decodable encodes without descriptive/private metadata; standard JFIF structure is explicitly recorded
• two clean builds produced byte-identical runtime GLBs and previews plus the same semantic Blender fingerprint
• hostile --root helper injection, digest redefinition, source-record drift, symlink escape, FIFO/special files, oversized or deeply nested JSON, malformed DEFLATE, image bombs/metadata, GLB resource expansion, private paths, credentials, and material/semantic drift all fail closed
• descriptor-relative no-follow/nonblocking reads, bounded JSON/ZIP/GLB/image parsing, exact QA schema/timestamp checks, and checksum-sidecar binding have focused mutation regressions
• all three PR-only commits use the GitHub noreply identity for both author and committer metadata
• compileall and git diff --check: passed

The structural verifier proves package shape and safety. The separately tracked release manifest and checksums remain the authenticity anchor for the exact unpublished candidate bytes.

Deliberately not included

• no ZIP, GLB, Blender source, transparent master, or generated build directory in Git
• no 72-site catalogue, coordinates, seeds, hidden sites, SpacetimeDB schema, client loader, UI, combat, deployment, or activation
• no GitHub Release, tag, attachment upload, runtime install, or production mutation
• no merge and no action on another PR

Owner gates

This is PR A only and remains a draft.

1. Review and approve the art, package, and advisory handoff.
2. Separately authorize release/tag publication if desired.
3. Start later Warpkeep PR slices only after their own scope and authority are approved.

Production remains untouched.