Feature: import credited Xevious sprite sheets

[StarshipSuperjam]

A green mechanical check below shows this change conforms to the engine's rules — not that it is correct. What covers correctness is the behavioural steps in Review and your own read of the change; a green check is never a substitute for that. Your merge is the binding gate.

About those checks: only the one that runs when the change is proposed for merge can stop a risky merge — a check that ran while the change was still being written is early advice. Each check is itself proven against a deliberately broken example it must catch, so a passing check can't be one that quietly did nothing — but that proves the check works, not that this change is right. And a check that could not run leaves its area unverified.

Purpose

Import the five supplied Xevious sprite sheets while preserving their third-party attribution.

• Credit The Spriters Resource and the named sheet contributors.
• Record that the repository operator did not create the supplied artwork.
• Avoid claiming a reusable license that the source does not state.

Impact: The Scratch project carries the supplied reference sheets without making a false ownership, permission, or license claim.

Scope

Add an inactive Scratch costume library backed by provenance-enforced overlay assets.

• Preserve the five supplied PNG files unchanged.
• Reference them from the canonical Scratch project structure.
• Add per-file source, attribution, checksums, and license-status records.
• Update the mechanics evidence gate so declared external media is distinguished from forbidden code, ROM data, and lookup-table transfers.
• Build and validate the generated Scratch archive.

Change profile — the shape of this pull request at a glance:

• Size: 14 files changed, +291 / −20 lines.
• Kinds of thing touched: 14 other files (not in the engine's map).
• Where: src, docs, README.md, tests, tools.
• Shape: 2 commits on this branch — a standalone change unless a Part of #N line below says it is one slice of a larger effort.

This is a description, not a gate — it never blocks a merge. It is here so you can weigh the change by what it touches, not by its line count.

Impact: All five sheets become available in the generated project and remain reviewable in source control.

Behaviors

The generated Scratch project contains all five credited sprite sheets without changing current gameplay.

• A hidden, scriptless sprite_sheets target contains five named costumes — test_sprite_sheet_library_is_hidden_and_credited.
• Each imported file is byte-identical to the supplied PNG — SHA-256 assertions in test_sprite_sheet_library_is_hidden_and_credited.
• Historical Scratch targets retain their values and ordering — test_canonical_source_preserves_original_json_values_and_order.
• Build/import round trips retain existing per-file provenance — test_current_source_survives_build_import_roundtrip.
• A mechanics record cannot approve transferred media without its provenance attestation — test_media_transfer_record_requires_provenance_attestation.

Out of scope

This change does not slice the sheets into gameplay-ready frames or add enemy behavior.

• No image pixels are edited.
• No new gameplay scripts are introduced.
• No ownership, permission, or reusable-license claim is made.
• Dependabot PR Maintenance: Bump mcp from 1.28.1 to 2.0.0 in /.engine #4 and all Engine dependency maintenance remain outside this product change.

Impact: The import remains reversible and does not overstate what attribution permits.

Risk

The main risk is redistributing third-party game artwork without a stated reusable license.

• Attribution does not itself grant permission.
• The project records the absent license instead of representing the artwork as freely reusable.
• A Scratch-structure edit could unintentionally affect script scheduling or runtime behavior.

Impact: Provenance is explicit, files remain unchanged, historical-target and round-trip tests bound structural risk, and the operator remains the merge gate.

Validation

All local project and Engine validation passed on reviewed commit 6360983.

• 47 project tests passed.
• Scratch repository verification preserved the original hash 3a870e44…274e and produced deterministic build hash 78f214f7…db76c.
• The mechanics-record check accepted docs/mechanics/001-sprite-sheet-library.md.
• All five repository PNG hashes match the supplied files.
• Python bytecode compilation passed with an isolated cache.
• Engine CI validation passed with no hard findings.
• All 4,358 Engine self-tests passed in one serial run.
• The self-test wrapper intentionally deletes a successful run's detailed log; its clean pass summary was retained.

Impact: An approver can rely on deterministic packaging, exact file identity, provenance coverage, and the full automatic test gates; these checks do not establish legal permission.

Review

Quick review completed with no extra cold review passes; automatic checks found and helped fix migration assumptions, with no unresolved product finding.

• The operator selected quick review.
• The plan gate, implementation, scoped project checks, full Engine validation, and submission checks completed.
• No extra reviewer ran the operator's code in a throwaway copy; automatic tests ran only in the isolated feature worktree.
• The old mechanics attestation would have falsely denied this intentional graphics transfer; it was replaced with separate logic-transfer and media-provenance attestations while preserving the historical legacy record.
• Five tests that assumed canonical source had no post-baseline target or overlays were updated to retain their real historical-preservation and round-trip guarantees.
• Both Engine index files were regenerated after reconciling with main; both were already current, so zero index files changed and no work was lost.
• Local hard-check carve-outs were re-derived: two apply only in the Engine's own home repository, and the live issue-resolution witness requires GitHub credentials locally but remains enforced in CI.
• Close-linkage preflight found no issue this pull request will close and no closing keyword to neutralize.
• Reviewed and submitted code are the same commit: between reviewed 6360983 and submitted 6360983, 0 lines were added and 0 deleted or modified.
• No settled product description is linked to this direct operator request, so no generated acceptance steps are available; the behaviors above are checked by the named project tests.

If the merge button is greyed but every check passed, it may be an unresolved review conversation — here's what that means and what you can do.

GitHub won't let a pull request merge while a review comment on it is still marked unresolved — even when all the automated checks are green. The merge button just greys out. This isn't a failure; it's a comment someone left that hasn't been settled yet.

You can settle it yourself. Read the comment, decide you're genuinely satisfied it's been handled, and then mark it resolved — resolving it is you accepting the point it raised, so it's worth doing only once you've read it, never as a formality to get past the button. The engine never resolves one of these for you: a comment flagged a concern, and clearing it unread would defeat the reason it's there.

To find it: open the pull request's Conversation tab (or Files changed) and look for the comment with a Resolve conversation button. If a rebase or a force-push moved the lines the comment was attached to, GitHub marks it outdated and hides it — on the Conversation tab, expand the collapsed outdated comments to reach it, read it there, and only then resolve it.

Impact: This is the engine's own quick-review account; the approver's merge is the binding gate.

Files of interest

Start with the credit record, then inspect the Scratch target and enforcement changes.

• docs/ASSET_CREDITS.md
• src/xevious/assets/provenance.json
• src/xevious/project.json
• tools/check_mechanics_record.py
• tests/test_scratch_project.py

Impact: These files most directly determine which images ship, how their origin is represented, and how future imports remain honest.

AI involvement

Codex planned, implemented, tested, and documented the import; the operator selected the source, required attribution, and chose quick review.

• Codex selected the existing provenance-enforced overlay mechanism and the hidden costume-library representation.
• Codex identified and repaired the obsolete no-external-media test assumption.
• The operator remains responsible for judging the third-party media risk and approving the merge.

Impact: AI judgment is load-bearing in Scratch integration and provenance wording; source selection, risk acceptance, and final approval remain human decisions.