Execution Ladders - Iron Curtain — Design Documentation

Granular Foundational Execution Ladder (RA First Mission Loop -> Project Completion)

This section refines the early critical path into a build-order ladder for the first playable Red Alert mission loop. It does not replace M0–M11; it decomposes the early milestones into implementation steps and then reconnects them to the milestone sequence through completion.

A. First RA Mission Loop (Detailed Build Order, `M1–M3`)

Step ID	Build Step (What to Implement)	Primary Milestone	Priority	Hard Depends On	Exit Artifact / Proof
`G1`	`ic-cnc-content` can parse core RA asset formats (`.mix`, `.shp`, `.pal`) and enumerate assets from real data dirs	`M1`	`P-Core`	`M0`	Parser corpus test pass + asset listing on real RA data
`G2`	Bevy can load parsed map tiles/sprites and render a RA map scene correctly (camera + palette-correct sprite draw)	`M1`	`P-Core`	`G1`	Static map render slice (faithful map + sprite placement)
`G3`	Unit sprite animation playback baseline (idle/move/fire/death sequences)	`M1`	`P-Core`	`G2`	Animated units visible in rendered scene with correct sequence timing
`G4`	Input/cursor baseline in gameplay scene (cursor state changes, hover hit-test, click targeting primitives)	`M2` (early UI seam work)	`P-Core`	`G2`	Cursor + hover feedback working on entities/cells
`G5`	Unit selection baseline (single select, multi-select/box select minimum, selection markers)	`M2` (feeds `M3`)	`P-Core`	`G4`, `G3`	Selectable units with visible selection feedback
`G6`	Deterministic sim tick loop + order application skeleton (`move`, `stop`, state transitions)	`M2`	`P-Core`	`G2`	Repeatable sim ticks with stable state hashes
`G7`	Pathfinder + spatial query baseline (`Pathfinder`/`SpatialIndex`) integrated into unit movement order execution	`M2`	`P-Core`	`G6`	Units can receive move orders and path around blockers deterministically
`G8`	Movement presentation sync (render follows sim state: facing/animation/state transitions)	`M2`	`P-Core`	`G7`, `G3`	Units visibly move correctly under player orders
`G9`	Combat baseline: targeting + projectile/hit resolution (or direct-fire hit pipeline for first slice)	`M2`	`P-Core`	`G7`, `G6`	Units can attack and reduce enemy health deterministically
`G10`	Death/destruction baseline (unit death state, removal, death animation/cleanup)	`M2`	`P-Core`	`G9`, `G3`	Combat kills units cleanly with deterministic removal
`G11`	Mission-state baseline: victory/failure evaluators (`all enemies dead`, `all player units dead`)	`M3` (mission loop UX)	`P-Core`	`G10`, `G6`	Win/loss condition fires from sim state, not UI heuristics
`G12`	Mission-end UX shell (`Mission Accomplished` / `Mission Failed` screens + flow pause/transition)	`M3`	`P-Core`	`G11`, `M3.UX.GAME_CHROME_CORE`	Mission-end screen appears with correct result and blocks/resumes flow correctly
`G13`	EVA/VO mission-end audio integration (`Mission Accomplished` / `Mission Failed`)	`M3`	`P-Core`	`G12`, `M3.CORE.AUDIO_EVA_MUSIC`	Correct VO plays on mission result with no duplicate/late triggers
`G14`	Minimal mission restart/exit loop (replay same mission / return to menu)	`M3`	`P-Core`	`G12`	First complete single-mission play loop (start -> play -> end -> replay/exit)
`G15`	RA “feel” pass for first mission loop (cursor feedback, selection readability, audio timing, result pacing)	`M3`	`P-Core`	`G14`, `G13`	Internal playtest says “recognizably RA-like” for mission loop baseline
`G16`	Promote to `M3` skirmish path by widening from fixed mission slice to local skirmish loop + basic AI subset (`D043`)	`M3`	`P-Core`	`G15`, `M3.CORE.GAP_P1_GAMEPLAY_SYSTEMS`, `M3.CORE.GAP_P2_SKIRMISH_FAMILIARITY`	Local skirmish playable milestone exit (`M3.SP.SKIRMISH_LOCAL_LOOP`)

A.1 `G1.x` Substeps (Owned-Source Import/Extract Foundations, `M1` -> `M3` Handoff)

Substep	Build Step (What to Implement)	Primary Milestone	Priority	Hard Depends On	Exit Artifact / Proof
`G1.1`	Source-adapter probe contract + source-manifest snapshot schema (Steam/GOG/EA/manual/Remastered normalized probe output)	`M1`	`P-Core`	`G1`	Probe fixtures + source-manifest snapshot examples match D069 setup expectations
`G1.2`	`.mix` extraction primitives for importer staging (enumerate, validate entries, extract without source mutation)	`M1`	`P-Core`	`G1.1`	`.mix` extraction corpus tests + corrupt-entry handling assertions
`G1.3`	`.shp/.pal` importer-ready validation and parser-to-render handoff metadata	`M1`	`P-Core`	`G1.2`, `G2`	Validation fixtures + palette/sprite handoff smoke tests for render slice
`G1.4`	`.aud/.vqa` header/chunk integrity validation and importer result diagnostics (pre-playback checks)	`M1`	`P-Core`	`G1.2`	Import diagnostics distinguish valid/invalid media payloads with actionable reasons
`G1.5`	Importer artifact outputs (source manifest snapshots, per-item results, provenance, retry/re-scan metadata)	`M3`	`P-Core`	`G1.1`, `M1.CORE.DATA_DIR_AND_PORTABILITY_BASE`	Import artifact samples align with `05-FORMATS` owned-source import pipeline and D069 repair flows
`G1.6`	Remastered Collection source adapter probe + normalized importer handoff (out-of-the-box D069 import path)	`M3`	`P-Core`	`G1.5`, `M3.CORE.PROPRIETARY_ASSET_IMPORT_AND_EXTRACT`	D069 setup demo imports Remastered assets without manual conversion or source-install mutation

A.2 M2 Security Infrastructure (Parallelizable with `G4–G10`)

Step ID	Build Step (What to Implement)	Primary Milestone	Priority	Hard Depends On	Exit Artifact / Proof
`G10a.1`	`CredentialStore` API surface in `ic-paths`: Tier 1 (OS keyring via `keyring` crate) + Tier 2 (vault passphrase Argon2id KDF) + `vault_meta` SQLite table + DEK lifecycle	`M2`	`P-Core`	`M1.CORE.DATA_DIR_AND_PORTABILITY_BASE`	Tier detection auto-selects keyring or vault; encrypt/decrypt round-trip passes; `vault_meta` schema created
`G10a.2`	Identity key AEAD encryption at rest + `Zeroizing<T>` memory protection + vault passphrase prompt/change CLI	`M2`	`P-Core`	`G10a.1`, `M2.COM.TELEMETRY_DB_FOUNDATION`	`keys/identity.key` encrypted; `ic vault change-passphrase` works; decrypted key zeroized on drop

Parallelism note: G10a.* has no dependencies on the sim/render path (G4–G10). It depends only on M1.CORE.DATA_DIR_AND_PORTABILITY_BASE (data directory resolution) and the SQLite foundation. It can be implemented by a separate contributor in parallel with sim core work. Downstream consumer: G20.2 (signed credentials) hard-depends on M2.SEC.CREDENTIAL_STORE_CORE.

B. Continuation Chain After the First Mission Loop (Milestone-Level, Through Completion)

Step ID	Next Logical Step	Primary Milestone	Priority	Hard Depends On	Why This Is Next
`G17`	Minimal online skirmish slice (relay/direct connect, no tracker/ranked)	`M4`	`P-Core`	`G16`, `M2.CORE.SNAPSHOT_HASH_REPLAY_BASE`	Proves finalized netcode architecture in the smallest real deployment slice
`G18`	Campaign runtime vertical slice (briefing -> mission -> debrief -> next mission)	`M5`	`P-Differentiator`	`G16`, `M5.SP.LUA_MISSION_RUNTIME`	Proves campaign graph/runtime flow before scaling campaign content
`G19`	Full campaign correctness/completeness (Allied/Soviet + media fallback-safe flow)	`M6`	`P-Differentiator`	`G18`	Delivers the campaign-first product promise and stabilizes SP maturity
`G20`	Multiplayer productization (browser, ranked, trust labels, reports/review, spectator)	`M7`	`P-Differentiator` / `P-Scale`	`G17`, `G19`	Expands “it works online” into a trustworthy multiplayer product
`G21`	Creator foundation lane (CLI + minimal Workshop + profiles/namespace)	`M8`	`P-Creator`	`M2` (can run in parallel before `G20`)	Reduces creator-loop friction without waiting for full SDK
`G22`	Scenario editor core + full Workshop + OpenRA export core	`M9`	`P-Creator`	`G20`, `G21`	Delivers the first full creator-platform promise
`G23`	Campaign editor + advanced game modes + RA1 export + editor extensibility	`M10`	`P-Creator` / `P-Differentiator`	`G22`	Enables advanced authored experiences and D070-family mode tooling
`G24`	Ecosystem polish + LLM stack (built-in + BYOLLM) + visual/render-mode expansion + platform breadth	`M11`	`P-Optional` / `P-Scale`	`G20`, `G23`	Keeps optional/polish systems after core gameplay/multiplayer/editor foundations are stable

C. Dependency Notes for the First Mission Loop (Non-Obvious Blockers)

~~PG.P002.FIXED_POINT_SCALE~~ Resolved: Scale 1024 (matches OpenRA). See research/fixed-point-math-design.md. No longer a gate.
~~PG.P003.AUDIO_LIBRARY~~ Resolved: Kira via bevy_kira_audio. See research/audio-library-music-integration-design.md. No longer a gate.
M3 AI scope must be frozen before G16.
- Use the documented “dummy/basic AI baseline” subset from D043; do not pull full M6 AI sophistication into the M3 exit.
G11 mission-end evaluators should be implemented as sim-derived logic, then surfaced through UI (G12).
- Prevents UI-side win/loss heuristics from diverging from the authoritative state model.
G17 online slice must keep strict M4 boundaries.
- No tracker browser, no ranked queue, no broad community infra assumptions in the M4 exit.
G21.5–G21.7 (p2p-distribute) can start independently of the game engine but IC integration (G21.7) requires G21.2 (minimal Workshop).
- The standalone P2P crate has no IC dependencies and lives in a separate MIT/Apache-2.0 repo. However, wiring it into Workshop delivery requires the publish/install baseline from G21.2 to exist first.

D. Campaign Execution Ladder (Campaign Runtime Slice -> Full Campaign Completeness, `M5–M6`)

Step ID	Build Step (What to Implement)	Primary Milestone	Priority	Hard Depends On	Exit Artifact / Proof
`G18.1`	Lua mission runtime baseline (`D004`) with deterministic sandbox boundaries and mission script lifecycle	`M5`	`P-Differentiator`	`G16`, `M2.CORE.SIM_FIXED_POINT_AND_ORDERS`	Mission scripts run in real runtime with deterministic-safe APIs
`G18.2`	Campaign graph runtime + persistent campaign state save/load (`D021`)	`M5`	`P-Differentiator`	`G18.1`, `D010`	Campaign state survives mission transitions and reloads
`G18.3`	Briefing -> mission -> debrief -> next flow (`D065` UX layer over `D021`)	`M5`	`P-Differentiator`	`G18.2`, `M3.UX.FIRST_RUN_SETUP_AND_MAIN_MENU`	One authored campaign chain is playable end-to-end
`G18.4`	Failure/continue behavior, retry path, and campaign save/load correctness for the vertical slice	`M5`	`P-Differentiator`	`G18.3`	`M5` campaign runtime slice exit proven with save/load and failure branches
`G19.1`	Scale campaign runtime to full mission set (mission scripts, objectives, transitions, outcomes)	`M6`	`P-Differentiator`	`G18.4`	All shipped campaign missions load/run in campaign flow
`G19.2`	Branching persistence, roster carryover, named-character/hero-state carryover correctness	`M6`	`P-Differentiator`	`G19.1`, `D021` state model	Branching outcomes and carryover state validate across multi-mission chains
`G19.3`	FMV/cutscene/media variant playback + fallback-safe campaign behavior (`D068`)	`M6`	`P-Differentiator`	`G19.1`, `M3.CORE.AUDIO_EVA_MUSIC`	Campaigns remain playable with/without optional media packs
`G19.4`	Skirmish AI baseline maturity + campaign/tutorial script support (`D043/D042` baseline)	`M6`	`P-Differentiator`	`G16`, `M6.SP.SKIRMISH_AI_BASELINE`	AI is good enough for shipped SP content and onboarding use
`G19.5`	D065 onboarding baseline for SP (Commander School, progressive hints, controls walkthrough integration)	`M6`	`P-Differentiator`	`G19.4`, `M3.UX.FIRST_RUN_SETUP_AND_MAIN_MENU`	New-player SP onboarding baseline is live and coherent
`G19.6`	End-to-end validation of full RA campaigns (Allied + Soviet) with save/load, media fallback, and progression correctness	`M6`	`P-Differentiator`	`G19.2`, `G19.3`, `G19.5`	`M6` exit: full campaign-complete SP milestone validated

E. Multiplayer Execution Ladder (Minimal Online Slice -> Productized MP, `M4–M7`)

Step ID	Build Step (What to Implement)	Primary Milestone	Priority	Hard Depends On	Exit Artifact / Proof
`G17.1`	Minimal host/join path (`direct connect` or `join code`) wired to final `NetworkModel` architecture	`M4`	`P-Core`	`G16`, `D006`, `D007`	Two local/remote clients can establish a match using the planned netcode seam
`G17.2`	Relay time authority + sub-tick timestamp normalization/clamping + sim order validation path	`M4`	`P-Core`	`G17.1`, `D008`, `D012`	Online orders resolve consistently with bounded timing fairness and deterministic rejections
`G17.3`	Minimal online skirmish end-to-end play (complete match, result, disconnect cleanly)	`M4`	`P-Core`	`G17.2`, `G16`	`M4.NET.MINIMAL_LOCKSTEP_ONLINE` exit proven in real play sessions
`G17.4`	Reconnect baseline decision and implementation or explicit defer contract (with user-facing wording)	`M4`	`P-Core`	`G17.3`, `D010`	Reconnect works in the documented baseline or defer contract is locked and reflected in UX/docs
`G20.1`	Tracking/browser discovery + trust labels + lobby listings	`M7`	`P-Differentiator`	`G17.3`, `G19`, `D052` baseline infrastructure	Browser-based discoverability works with correct trust label semantics
`G20.2`	Signed credentials/results and certified community-server trust path (`D052`)	`M7`	`P-Differentiator`	`G20.1`, `M2.SEC.CREDENTIAL_STORE_CORE`, `M2.COM.TELEMETRY_DB_FOUNDATION`, `PG.P004.LOBBY_WIRE_DETAILS`	Signed identity/results path works and is reflected in lobby/trust UX
`G20.3`	Ranked queue + tiers/seasons + queue health/degradation rules (`D055`)	`M7`	`P-Differentiator`	`G20.2`, `PG.P004.LOBBY_WIRE_DETAILS`	Ranked 1v1 queue works and is explainable to players
`G20.4`	Report / block / avoid UX + moderation evidence attachment + optional review pipeline baseline	`M7`	`P-Scale`	`G20.1`, `G20.2`, `D059`, `D052`	Player moderation/reporting loop works without capability coupling confusion
`G20.5`	Spectator + tournament basics + signed replay/exported evidence workflow	`M7`	`P-Differentiator` / `P-Scale`	`G20.2`, `G20.3`, `D010` replay chain	Multiplayer productization milestone (`M7`) exit: browser, ranked, trust, moderation, spectator all coherent

F. Creator Platform & Long-Tail Execution Ladder (`M8–M11`)

Step ID	Build Step (What to Implement)	Primary Milestone	Priority	Hard Depends On	Exit Artifact / Proof
`G21.1`	`ic` CLI foundation (init/check/test/run loops) + local content overlay/dev-profile run path	`M8`	`P-Creator`	`M2`, `D020`	Creators can iterate through real game runtime without packaging/publishing
`G21.2`	Minimal Workshop delivery + package install/publish baseline (`D030/D049`)	`M8`	`P-Creator`	`G21.1`, `M2.COM.TELEMETRY_DB_FOUNDATION`	Minimal Workshop path works for creator iteration and sharing
`G21.3`	Mod profiles + virtual namespace + selective install hooks (`D062/D068`)	`M8`	`P-Creator`	`G21.2`, `D061` data-dir foundation	Profile activation/fingerprint/install-footprint behavior is stable
`G21.4`	Authoring reference foundation (generated YAML/Lua/CLI docs; one-source docs pipeline)	`M8`	`P-Creator`	`G21.1`, `D037` knowledge-base path	Canonical creator docs pipeline exists before full SDK embedding
`G21.1a`	CLI import-plan inspection for owned-source imports (probe output, source selection, mode preview)	`M8`	`P-Creator`	`G21.1`, `M3.CORE.PROPRIETARY_ASSET_IMPORT_AND_EXTRACT`	`ic` CLI can preview owned-source import plans before execution
`G21.2a`	Owned-source import verify/retry diagnostics (distinct from Workshop package verify path)	`M8`	`P-Creator`	`G21.2`, `G21.1a`	Diagnostics output separates source probe/import/extract/index failures with recovery steps
`G21.3a`	Repair/re-scan/re-extract tooling for owned-source imports (maintenance parity with D069)	`M8`	`P-Creator`	`G21.3`, `G21.2a`	CLI maintenance flows recover moved installs/stale indexes without mutating source installs
`G21.4a`	Generated docs for import modes + format-by-format importer behavior (one-source pipeline from `05-FORMATS`)	`M8`	`P-Creator`	`G21.4`, `G21.3a`	Creator docs pipeline publishes importer/extractor reference used by SDK help later
`G21.5`	`p2p-distribute` core engine + tracker client + download→seed lifecycle (standalone crate, design milestones 1–2)	`M8`	`P-Creator`	`M0.OPS.STANDALONE_CRATE_REPOS`	Two instances transfer a torrent; HTTP tracker works; interop with ≥1 standard BT client
`G21.6`	`p2p-distribute` config system + profiles + peer discovery + NAT (design milestones 3–5, 7)	`M8`	`P-Creator`	`G21.5`	All config groups validated; DHT works; NAT traversal reachable; uTP functional
`G21.7`	`p2p-distribute` embedded tracker + IC integration baseline (Workshop `publish/install` via P2P, `ic-server` seeding)	`M8`	`P-Creator`	`G21.6`, `G21.2`	Workshop delivery uses P2P; auto-download on lobby join uses `embedded_minimal` profile
`G22.1`	Scenario Editor core (`D038`) + validate/test/publish loop + resource manager basics	`M9`	`P-Creator`	`G20.5`, `G21.3`	Scenario authoring works end-to-end using real runtime/test flows
`G22.2`	Asset Studio baseline (`D040`) + import/conversion + provenance plumbing + publish-readiness integration	`M9`	`P-Creator`	`G22.1`, `G21.2`	Asset creation/import supports scenario authoring and publish checks
`G22.3`	Full Workshop/CAS + moderation tooling + OpenRA export core (`D049/D066`)	`M9`	`P-Creator` / `P-Scale`	`G22.1`, `G22.2`, `G20.2`	`M9` exit: full creator platform baseline works (scenario editor + Workshop + OpenRA export core)
`G22.3a`	`p2p-distribute` hardening — fuzzing (1M+ iterations), chaos tests, v2/hybrid support, storage perf, control surfaces, `crates.io` publish (design milestones 6, 8–10)	`M9`	`P-Creator`	`G21.7`	Fuzz-clean; interop verified; fast resume < 1s; web API + CLI operational; published to crates.io
`G22.4`	SDK embedded authoring manual + context help (`F1`, `?`) from the generated doc source	`M9`	`P-Creator`	`G21.4`, `G22.1`	In-SDK docs are version-correct and searchable without creating a parallel manual
`G23.1`	Campaign Editor + intermissions/dialogue/named characters + campaign test tools	`M10`	`P-Creator`	`G22.3`, `G19`	Branching campaign authoring works in the SDK
`G23.2`	Game mode templates + D070 family toolkit (Commander & SpecOps, Commander Avatar variants, experimental survival)	`M10`	`P-Differentiator`	`G23.1`, `G22.1`, `D070`	Advanced mode templates are authorable/testable with role-aware UX and validation
`G23.3`	RA1 export + editor extensibility/plugin hardening + localization/subtitle workbench	`M10`	`P-Creator`	`G22.3`, `G23.1`, `G22.2`	`M10` exit: advanced authoring platform maturity (campaign editor + modes + RA1 export + extensions)
`G24.1`	Ecosystem governance polish + creator feedback recognition maturity + optional contributor cosmetic rewards	`M11`	`P-Scale` / `P-Optional`	`G20.4`, `G23.3`	Community governance/reputation features are mature and abuse-hardened
`G24.2`	LLM stack (`D016/D047/D057`): built-in CPU models (Tier 1) + BYOLLM providers (Tiers 2–4), prompt strategies, editor assistant surfaces	`M11`	`P-Optional`	`G23.3`, `G22.4`	Tier 1 works offline after initial model-pack download, no account needed; Tiers 2–4 optional; all LLM tooling schema-grounded and does not block core workflows
`G24.3`	Visual/render-mode infrastructure expansion (`D048`) + platform breadth polish (browser/mobile/Deck)	`M11`	`P-Optional` / `P-Scale`	`G20.5`, `G23.3`, `D017` baseline	`M11` exit: optional visual/platform breadth work lands without breaking low-end baseline

G. Cross-Lane Sequencing Rules (Completion Planning Guardrails)

Do not start G22.* (full visual SDK/editor platform) before G20.5 + G21.3.
- This prevents editor semantics and content schemas from outrunning runtime/network/product foundations.
G21.* is intentionally parallelizable after M2, but G22.* is not.
- Early creator CLI/workshop foundations reduce rework; full visual SDK needs stabilized runtime semantics.
G21.5–G21.7 (p2p-distribute crate) is parallelizable after M0 standalone crate repos are bootstrapped.
- The P2P crate is a standalone MIT/Apache-2.0 repo with no IC dependencies. Core engine work (G21.5) can begin as soon as the repo exists. IC integration (G21.7) depends on the minimal Workshop baseline (G21.2).
G24.* remains optional/polish unless explicitly promoted by a new decision and overlay remap.
- M11 should not displace unfinished M7–M10 exit criteria.

Keyboard shortcuts

Iron Curtain — Design Documentation