summer-engine 1.3.2 → 1.5.0

package/hooks/pre-commit-doctor.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Summer Engine — Pre-commit doctor hook (OPT-IN)
+#
+# Event:    PreToolUse (matcher: Bash, if: "Bash(git commit*)")
+# Purpose:  Run `summer doctor` before any git commit Claude is about to make.
+#           Block the commit on FAIL. Allow with warnings on WARN.
+#
+# Status:   OPT-IN. Not registered in the Summer plugin manifest by default.
+#
+# To enable, add to ~/.claude/settings.json (or .claude/settings.json):
+#
+#   {
+#     "hooks": {
+#       "PreToolUse": [
+#         {
+#           "matcher": "Bash",
+#           "hooks": [
+#             {
+#               "type": "command",
+#               "command": "${CLAUDE_PLUGIN_ROOT}/hooks/pre-commit-doctor.sh",
+#               "if": "Bash(git commit*)",
+#               "timeout": 15
+#             }
+#           ]
+#         }
+#       ]
+#     }
+#   }
+#
+# Then: chmod +x ${CLAUDE_PLUGIN_ROOT}/hooks/pre-commit-doctor.sh
+#
+# Input:    JSON on stdin: { tool_name, tool_input: { command, ... }, ... }
+# Output:   On FAIL: stderr explanation, exit 2 (blocks commit).
+#           On WARN: stderr warnings, exit 0 (allows commit).
+#           On PASS or no `summer` CLI: silent, exit 0.
+#
+# Portability: bash 3.2+, POSIX-friendly. jq optional.
+
+set +e
+
+INPUT=$(cat)
+
+# ---------- Parse the command ----------
+COMMAND=""
+if command -v jq >/dev/null 2>&1; then
+    COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+fi
+if [ -z "$COMMAND" ]; then
+    COMMAND=$(printf '%s' "$INPUT" \
+        | grep -oE '"command"[[:space:]]*:[[:space:]]*"[^"]*"' \
+        | head -1 \
+        | sed 's/^"command"[[:space:]]*:[[:space:]]*"//;s/"$//')
+fi
+
+# ---------- Bail early if not a git commit ----------
+if ! printf '%s' "$COMMAND" | grep -qE '^[[:space:]]*git[[:space:]]+commit'; then
+    exit 0
+fi
+
+# ---------- Bail if `summer` CLI missing ----------
+if ! command -v summer >/dev/null 2>&1; then
+    # Don't block — user may have installed via plugin only.
+    exit 0
+fi
+
+# ---------- Run doctor ----------
+DOCTOR_OUT=$(summer doctor --json 2>/dev/null)
+if [ -z "$DOCTOR_OUT" ]; then
+    exit 0
+fi
+
+# ---------- Parse status ----------
+HAS_FAIL=0
+HAS_WARN=0
+FAIL_MSGS=""
+WARN_MSGS=""
+
+if command -v jq >/dev/null 2>&1; then
+    FAIL_MSGS=$(printf '%s' "$DOCTOR_OUT" \
+        | jq -r '.checks[]? | select(.status == "FAIL") | "  - " + (.name // "?") + ": " + (.message // "")' 2>/dev/null)
+    WARN_MSGS=$(printf '%s' "$DOCTOR_OUT" \
+        | jq -r '.checks[]? | select(.status == "WARN") | "  - " + (.name // "?") + ": " + (.message // "")' 2>/dev/null)
+    [ -n "$FAIL_MSGS" ] && HAS_FAIL=1
+    [ -n "$WARN_MSGS" ] && HAS_WARN=1
+else
+    # Fallback: substring sniffing
+    if printf '%s' "$DOCTOR_OUT" | grep -q '"status"[[:space:]]*:[[:space:]]*"FAIL"'; then
+        HAS_FAIL=1
+        FAIL_MSGS=$(printf '%s' "$DOCTOR_OUT" \
+            | grep -oE '"status"[[:space:]]*:[[:space:]]*"FAIL"[^}]*"message"[[:space:]]*:[[:space:]]*"[^"]*"' \
+            | sed -E 's/.*"message"[[:space:]]*:[[:space:]]*"([^"]*)"/  - \1/')
+    fi
+    if printf '%s' "$DOCTOR_OUT" | grep -q '"status"[[:space:]]*:[[:space:]]*"WARN"'; then
+        HAS_WARN=1
+        WARN_MSGS=$(printf '%s' "$DOCTOR_OUT" \
+            | grep -oE '"status"[[:space:]]*:[[:space:]]*"WARN"[^}]*"message"[[:space:]]*:[[:space:]]*"[^"]*"' \
+            | sed -E 's/.*"message"[[:space:]]*:[[:space:]]*"([^"]*)"/  - \1/')
+    fi
+fi
+
+# ---------- FAIL: block ----------
+if [ "$HAS_FAIL" -eq 1 ]; then
+    {
+        echo "=== Summer doctor: FAIL — commit blocked ==="
+        echo "$FAIL_MSGS"
+        echo ""
+        echo "Fix the failures above, or run: summer doctor"
+        echo "To bypass once: disable the pre-commit-doctor hook in settings.json."
+        echo "============================================"
+    } >&2
+    exit 2
+fi
+
+# ---------- WARN: allow with notice ----------
+if [ "$HAS_WARN" -eq 1 ]; then
+    {
+        echo "=== Summer doctor: WARN — commit allowed ==="
+        echo "$WARN_MSGS"
+        echo "============================================"
+    } >&2
+fi
+
+exit 0

package/hooks/run-hook.cmd

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Cross-platform hook dispatcher.
+# Usage: run-hook.cmd <hook-name>
+# Reads stdin, forwards to <plugin-root>/hooks/<hook-name>.sh
+# On Windows, Claude Code / Cursor / Codex invoke this via Git-Bash.
+
+HOOK_NAME="$1"
+shift || true
+
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK_SCRIPT="$HOOK_DIR/$HOOK_NAME.sh"
+
+if [ ! -f "$HOOK_SCRIPT" ]; then
+  # Missing hook = no-op (don't break the host).
+  exit 0
+fi
+
+if [ ! -x "$HOOK_SCRIPT" ]; then
+  # Not executable yet (likely fresh checkout). Fall back to bash invocation.
+  exec bash "$HOOK_SCRIPT" "$@"
+fi
+
+exec "$HOOK_SCRIPT" "$@"

package/hooks/session-start.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Summer Engine — SessionStart hook
+#
+# Event:    SessionStart (matcher: startup|clear|compact)
+# Purpose:  Orient Claude on every fresh Summer-enabled session.
+#           Detect Godot project + GameSoul + doctor health, surface a one-line
+#           Bob-style greeting as additional context.
+#
+# Input:    JSON on stdin with { session_id, source, model, cwd, ... }
+#           Common Claude Code env vars: $CLAUDE_PROJECT_DIR, $CLAUDE_PLUGIN_ROOT
+# Output:   JSON on stdout with hookSpecificOutput.additionalContext
+#           (also emits Cursor / Copilot CLI variants based on host env vars)
+# Exit:     Always 0 — never block session start.
+#
+# Portability: bash 3.2+ (macOS default), POSIX-friendly, works on Git Bash.
+#              Uses `grep -E` not `grep -P`. Falls back gracefully when jq
+#              and `summer` are missing.
+
+set +e  # Hooks must never kill the session.
+
+# ---------- Resolve project dir ----------
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+
+# ---------- Build the orientation lines (max 3) ----------
+LINES=()
+
+# Line 1: Summer ready + skill count
+SKILL_COUNT=""
+if command -v summer >/dev/null 2>&1; then
+    # `summer skills count` is best-effort; ignore failure
+    SKILL_COUNT=$(summer skills count 2>/dev/null | grep -oE '[0-9]+' | head -1)
+fi
+if [ -n "$SKILL_COUNT" ]; then
+    LINES+=("Summer ready. ${SKILL_COUNT} skills.")
+else
+    LINES+=("Summer ready.")
+fi
+
+# Line 2: Godot project + GameSoul one-liner (only if project.godot exists)
+if [ -f "${PROJECT_DIR}/project.godot" ]; then
+    PROJECT_NAME=$(grep -E '^config/name=' "${PROJECT_DIR}/project.godot" 2>/dev/null \
+        | head -1 | sed 's/^config\/name=//;s/^"//;s/"$//')
+    [ -z "$PROJECT_NAME" ] && PROJECT_NAME=$(basename "$PROJECT_DIR")
+
+    SOUL_FILE="${PROJECT_DIR}/.summer/GameSoul.md"
+    if [ -f "$SOUL_FILE" ]; then
+        # First non-empty, non-heading paragraph (one line)
+        SOUL_LINE=$(awk 'BEGIN{p=""} /^[^#[:space:]]/ && NF>0 {p=$0; exit} END{print p}' \
+            "$SOUL_FILE" 2>/dev/null | cut -c1-120)
+        if [ -n "$SOUL_LINE" ]; then
+            LINES+=("Godot project: ${PROJECT_NAME}. GameSoul: ${SOUL_LINE}")
+        else
+            LINES+=("Godot project: ${PROJECT_NAME}.")
+        fi
+    else
+        LINES+=("Godot project: ${PROJECT_NAME}.")
+    fi
+fi
+
+# Line 3: doctor FAIL one-liner (only on FAIL — silent on PASS/WARN)
+if command -v summer >/dev/null 2>&1; then
+    DOCTOR_OUT=$(summer doctor --json 2>/dev/null)
+    if [ -n "$DOCTOR_OUT" ]; then
+        FAIL_REASON=""
+        if command -v jq >/dev/null 2>&1; then
+            FAIL_REASON=$(printf '%s' "$DOCTOR_OUT" \
+                | jq -r 'first(.checks[]? | select(.status == "FAIL") | .message) // empty' 2>/dev/null)
+        else
+            # Crude fallback: first "message" near a "FAIL"
+            FAIL_REASON=$(printf '%s' "$DOCTOR_OUT" \
+                | grep -oE '"status"[[:space:]]*:[[:space:]]*"FAIL"[^}]*"message"[[:space:]]*:[[:space:]]*"[^"]*"' \
+                | head -1 \
+                | grep -oE '"message"[[:space:]]*:[[:space:]]*"[^"]*"' \
+                | sed 's/.*"message"[[:space:]]*:[[:space:]]*"//;s/"$//')
+        fi
+        if [ -n "$FAIL_REASON" ]; then
+            LINES+=("Summer setup needs attention: ${FAIL_REASON}. Run: summer doctor")
+        fi
+    fi
+fi
+
+# ---------- Compose context ----------
+CONTEXT=""
+for line in "${LINES[@]}"; do
+    if [ -z "$CONTEXT" ]; then CONTEXT="$line"
+    else CONTEXT="${CONTEXT}"$'\n'"$line"
+    fi
+done
+
+# Bail with empty JSON if we somehow have no lines
+if [ -z "$CONTEXT" ]; then
+    printf '{}\n'
+    exit 0
+fi
+
+# ---------- JSON-escape for embedding ----------
+escape_for_json() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    s="${s//\"/\\\"}"
+    s="${s//$'\n'/\\n}"
+    s="${s//$'\r'/\\r}"
+    s="${s//$'\t'/\\t}"
+    printf '%s' "$s"
+}
+CONTEXT_ESC=$(escape_for_json "$CONTEXT")
+
+# ---------- Emit per-host shape ----------
+# Cursor: top-level additional_context (snake_case)
+# Claude Code: nested hookSpecificOutput.additionalContext
+# Copilot CLI / SDK standard: top-level additionalContext (camelCase)
+if [ -n "${CURSOR_PLUGIN_ROOT:-}" ]; then
+    printf '{"additional_context":"%s"}\n' "$CONTEXT_ESC"
+elif [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -z "${COPILOT_CLI:-}" ]; then
+    printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"%s"}}\n' "$CONTEXT_ESC"
+else
+    printf '{"additionalContext":"%s"}\n' "$CONTEXT_ESC"
+fi
+
+exit 0

package/marketplace.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
+  "name": "summer",
+  "description": "Summer Engine plugins for Claude Code",
+  "owner": { "name": "Summer Engine", "email": "founders@summerengine.com" },
+  "plugins": [
+    {
+      "name": "summer",
+      "source": "./",
+      "version": "1.4.0",
+      "description": "AI game-dev studio: 19 skills under summer: namespace, MCP bridge, session-start + pre-commit hooks.",
+      "author": { "name": "Summer Engine", "email": "founders@summerengine.com" },
+      "category": "game-development",
+      "tags": ["game-dev", "godot", "ai-game-engine"],
+      "keywords": ["game-dev", "godot", "ai-game-engine", "skills"],
+      "brandColor": "#FF8F17",
+      "capabilities": ["Interactive", "Read", "Write"],
+      "defaultPrompt": [
+        "I want to make a game.",
+        "/summer:brainstorm-game"
+      ]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summer-engine",
-  "version": "1.3.2",
+  "version": "1.5.0",
   "description": "CLI and MCP tools for Summer Engine — the AI-native game engine",
   "keywords": [
     "game-engine",
@@ -25,6 +25,14 @@
   "files": [
     "dist/",
     "skills/",
+    "hooks/",
+    ".claude-plugin/",
+    ".cursor-plugin/",
+    ".codex-plugin/",
+    ".opencode/",
+    "gemini-extension.json",
+    "marketplace.json",
+    ".mcp.json",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"

package/skills/_tests/specs/design-npc.md

@@ -6,7 +6,7 @@
 - Summer MCP tools available.
 - Host file tools available (Read, Edit, Write).
 
-## Case 1: Happy Path — basic patrol-and-chase enemy
+## Case 1: Happy Path — basic patrol-and-chase enemy with personality + intent
 
 **Input:** "Add a basic enemy that chases the player when it sees them."
 
@@ -16,7 +16,7 @@
 2. User confirms "basic enemy".
 3. `summer_get_scene_tree`
 4. `summer_inspect_node "./World/Player"` — confirms it's in `player` group
-5. (Skill proposes the bundle: scene tree + script + states + telegraph + loot hook + "May I create?")
+5. (Skill proposes the bundle: scene tree + script + personality knobs + intent enum + action SM + telegraph + loot hook + "May I create?")
 6. After user OK:
    - `summer_add_node(parent="./World/Enemies", type="CharacterBody3D", name="Enemy")`
    - `summer_add_node(parent="./World/Enemies/Enemy", type="CollisionShape3D", name="Body")`
@@ -36,9 +36,14 @@
 - [ ] Skill asks the archetype question before any tool call.
 - [ ] Scene has BOTH a Vision Area3D AND a Sight RayCast3D (the two-step perception pattern).
 - [ ] Vision shape is saved as a standalone `.tres`, NOT inline sub_resource (silent-fail trap).
-- [ ] Script defines an `enum State` with at least 4 states (idle / alert / attack / dead).
-- [ ] Script has an attack `telegraph` parameter in 0.3–0.7 sec range.
-- [ ] Script emits a `died` signal.
+- [ ] Script declares four `@export_range(0.0, 1.0)` personality knobs: `aggression`, `patience`, `caution`, `punishment`.
+- [ ] Script jitters personality in `_ready` via `randf_range` clamped to `[0.0, 1.0]`.
+- [ ] Script defines an `enum Intent` with at least 5 values from {IDLE, PATROL, INVESTIGATE, HUNT, KILL, RETREAT, RESCUE_ALLY}.
+- [ ] Script defines an `enum State` with the 4 action states (CALM / ALERT / AGGRESSIVE / DEFEATED).
+- [ ] Intent layer (`_update_intent` / `_decide_intent`) computes `current_intent` from perception + personality.
+- [ ] Action SM (`_update_action`) reads `current_intent`; it does NOT write it.
+- [ ] Script has an `attack_telegraph` parameter in 0.3–0.7 sec range, scaled by aggression at attack time.
+- [ ] Script emits a `died` signal AND an `ally_defeated` signal.
 - [ ] Script uses `distance_squared_to` (NOT `distance_to`) for range comparisons.
 - [ ] Script uses typed GDScript per `_shared/gd-style.md`.
 - [ ] Skill asks "May I create / write …" before each user-visible mutation.
@@ -53,7 +58,7 @@
 **Expected behavior:**
 
 - Skill recognizes the scale conflict.
-- Says: "100 enemies with full FSM + LOS perception will eat your frame budget. For wave mobs at this scale, the right archetype is the wave-mob (2 states, no LOS, direct line to player). Want me to build that instead?"
+- Says: "100 enemies with full intent SM + LOS perception will eat your frame budget. For wave mobs at this scale, the right archetype is the wave-mob (single KILL intent, 2 action states, no LOS). Want me to build that instead?"
 - Does NOT silently build 100 expensive enemies.
 - Offers the trade-off explicitly.
 
@@ -73,8 +78,9 @@
 **Expected behavior:**
 
 - Skill picks the **boss** archetype (different complexity budget).
-- Calls out: "Boss complexity (6–10 states, scripted phases) is at the threshold where a behavior tree might pay off, but I recommend a hand-coded FSM with phase enum first since you're a single dev."
-- Walks the four pillars but at boss scale: more tells per state, telegraph 0.5–0.7 sec, distinct mechanics per phase (cap at 4–6 total mechanics).
+- Calls out: "Boss complexity (6–10 action states, 5–7 intents incl. RESCUE_ALLY, scripted phases) is at the threshold where a behavior tree might pay off, but I recommend a hand-coded FSM with phase enum first since you're a single dev."
+- Recommends boss personality bias: aggression 0.7–0.9, patience 0.7–0.9, punishment 0.8–1.0 (from the tunable matrix).
+- Walks all six pillars at boss scale: more tells per state, telegraph 0.5–0.7 sec, distinct mechanics per phase (cap at 4–6 total mechanics).
 - Defers to `ai-and-npcs/boss-patterns/SKILL.md` for the deeper phase-transition patterns.
 - Does NOT just scale up the basic-enemy stub.
 
@@ -83,6 +89,7 @@
 - [ ] Skill recognizes "boss" requires a different design.
 - [ ] Skill caps at 4–6 distinct mechanics across phases.
 - [ ] Skill mentions phase enum as the FSM extension.
+- [ ] Skill cites boss-archetype personality ranges from the tunable matrix.
 - [ ] Skill defers to boss-patterns for deeper detail rather than trying to one-shot it.
 
 ## Case 4: No Summer MCP — fallback path
@@ -94,19 +101,43 @@
 **Expected behavior:**
 
 - Skill detects MCP unavailable.
-- Asks user to paste the existing scene tree (or the relevant `.tscn` snippet) so node paths are right.
+- Asks user to paste the existing scene tree (or relevant `.tscn` snippet) so node paths are right.
 - Generates a `.tscn` snippet (Enemy + Vision + Sight + Mesh + CollisionShape) with valid Godot 4 scene syntax.
-- Writes `scripts/enemy_ai.gd` directly.
-- Provides manual editor instructions for connecting the `body_entered` signal (or a connection block in the `.tscn`).
+- Writes `scripts/enemy_ai.gd` directly with the personality + intent + action layers intact.
+- Provides manual editor instructions for connecting the `body_entered` signal.
 - Still asks "May I write …" before each file write.
 
 **Assertions:**
 
 - [ ] Skill does not blindly call `summer_*` tools and fail.
 - [ ] Generated `.tscn` is valid Godot 4 syntax (parseable).
-- [ ] Generated GDScript has the same FSM structure (states / telegraph / died signal).
+- [ ] Generated GDScript has personality knobs, intent enum, action SM (same structure as MCP path).
 - [ ] Skill still asks "May I" on writes.
 
+## Case 5: Group emergence — squad of 4 with varied aggression
+
+**Fixture:** Same as Case 1. User wants a small squad, not a wave.
+
+**Input:** "Spawn a patrol squad of 4 basic_grunt enemies near the gate."
+
+**Expected behavior:**
+
+- Skill picks the **basic enemy** archetype with squad framing.
+- Confirms the squad uses the **same `enemy_ai.gd` script and same archetype `.tscn`** — variation comes from per-instance personality jitter, NOT 4 different scripts.
+- Shows / verifies that `personality_jitter` (default 0.15) is set on each instance, with base aggression in the basic_grunt range (0.5–0.7).
+- Predicts the emergent roles: with jitter, post-spawn aggression values land roughly across `0.35 / 0.5 / 0.65 / 0.85` and produce a sniper / anchor / flanker / berserker mix.
+- Does NOT author per-instance roles by hand.
+- Does NOT duplicate the script per role.
+
+**Assertions:**
+
+- [ ] All 4 spawned NPCs use the same script file and same archetype scene.
+- [ ] Each instance's `_ready` jitters all 4 personality knobs via `randf_range` clamped to `[0.0, 1.0]`.
+- [ ] Skill explicitly cites group emergence (varied aggression -> varied roles) instead of authoring roles centrally.
+- [ ] Skill does NOT recommend creating `sniper_ai.gd`, `flanker_ai.gd`, etc. as separate scripts.
+- [ ] Skill calls out that two NPCs with the same base archetype will still feel different post-jitter.
+- [ ] If the user pushes back ("I want one to definitely be a sniper"), skill suggests narrowing that *instance's* base values (e.g., aggression 0.2, caution 0.8) rather than forking the script.
+
 ---
 
 This spec runs via `/skill-test design-npc spec` (see `_meta/skill-test/SKILL.md`).

package/skills/_tests/specs/fps-controller.md

@@ -16,29 +16,41 @@
 1. `summer_get_scene_tree` — verify empty World exists.
 2. `summer_add_node(parent="./World", type="CharacterBody3D", name="Player")`
 3. `summer_add_node(parent="./World/Player", type="CollisionShape3D", name="Collision")`
-4. `summer_add_node(parent="./World/Player", type="Camera3D", name="Camera")`
-5. `summer_set_prop("./World/Player/Collision", "shape", "CapsuleShape3D")` (creates standalone, NOT inline sub-resource)
-6. `summer_set_resource_property("./World/Player/Collision", "shape.height", "1.8")` (only after the shape is standalone)
-7. `summer_set_prop("./World/Player/Camera", "position", "Vector3(0, 1.6, 0)")`
-8. `summer_input_map_bind(name="move_forward", events=[{type:"key", key:"W"}])`
-9. `summer_input_map_bind(name="move_back", events=[{type:"key", key:"S"}])`
-10. `summer_input_map_bind(name="move_left", events=[{type:"key", key:"A"}])`
-11. `summer_input_map_bind(name="move_right", events=[{type:"key", key:"D"}])`
-12. `summer_input_map_bind(name="jump", events=[{type:"key", key:"Space"}])`
-13. (User-side write) `Write` script file `scripts/player_controller.gd` after the agent asks "May I attach the controller script to ./World/Player?"
-14. `summer_save_scene`
-15. `summer_get_script_errors`
+4. `summer_set_prop("./World/Player/Collision", "shape", "CapsuleShape3D")` (creates standalone, NOT inline sub-resource)
+5. `summer_set_resource_property("./World/Player/Collision", "shape", "radius", "0.4")`
+6. `summer_set_resource_property("./World/Player/Collision", "shape", "height", "1.8")`
+7. `summer_add_node(parent="./World/Player", type="Node3D", name="Head")`
+8. `summer_set_prop("./World/Player/Head", "position", "Vector3(0, 1.6, 0)")`
+9. `summer_add_node(parent="./World/Player/Head", type="Camera3D", name="Camera")`
+10. `summer_input_map_bind(name="move_forward", events=[{type:"key", key:"W"}])`
+11. `summer_input_map_bind(name="move_back",    events=[{type:"key", key:"S"}])`
+12. `summer_input_map_bind(name="move_left",    events=[{type:"key", key:"A"}])`
+13. `summer_input_map_bind(name="move_right",   events=[{type:"key", key:"D"}])`
+14. `summer_input_map_bind(name="jump",         events=[{type:"key", key:"Space"}])`
+15. `summer_input_map_bind(name="sprint",       events=[{type:"key", key:"Shift"}])`
+16. (User-side write) `Write` script file `scripts/player_controller.gd` after the agent asks "May I create the controller script and attach it to ./World/Player?"
+17. `summer_save_scene`
+18. `summer_get_script_errors`
 
 **Assertions:**
 
 - [ ] CharacterBody3D node exists at `./World/Player`.
 - [ ] CollisionShape3D is a child of Player with a CapsuleShape3D (NOT BoxShape, NOT SphereShape).
-- [ ] Camera3D positioned at `y ≈ 1.6` (head height).
-- [ ] All 5 input actions bound: `move_forward`, `move_back`, `move_left`, `move_right`, `jump`.
+- [ ] A `Head` Node3D pivots at `y ≈ 1.6` and contains the Camera3D as a child (yaw on body, pitch on head — never both on the body).
+- [ ] All 6 input actions bound: `move_forward`, `move_back`, `move_left`, `move_right`, `jump`, `sprint`.
 - [ ] Skill asks "May I create / attach …" before the script write.
 - [ ] Skill never calls `summer_set_resource_property` on an inline `sub_resource` (the silent-fail trap from `_shared/mcp-tools-reference.md`).
 - [ ] Final step is `summer_save_scene` followed by `summer_get_script_errors`.
 - [ ] Script uses typed GDScript per `_shared/gd-style.md` (`@export`, `:=`, `class_name`).
+- [ ] Script defines `coyote_time` and `jump_buffer_time` as `@export` floats with sensible defaults (0.05–0.2).
+- [ ] Script defines separate `ground_accel`, `ground_friction`, `air_accel`, `air_friction` exports — NOT a single `move_speed` snap-to-target.
+- [ ] Script implements `air_accel < ground_accel` (reduced air control, not zero, not full).
+- [ ] Script defines an `external_velocity: Vector3` accumulator AND a public `add_external_velocity(impulse: Vector3)` method.
+- [ ] Script subtracts the previous frame's external contribution at the top of `_physics_process` BEFORE applying gravity (prevents knockback compounding).
+- [ ] Script uses `move_toward` for horizontal acceleration/deceleration — not `velocity.x = direction.x * speed` snap.
+- [ ] Script applies asymmetric gravity (`fall_gravity_multiplier` when `velocity.y < 0`).
+- [ ] Mouse look pitches `Head`, not `Player`. Pitch is clamped to `[pitch_min, pitch_max]`.
+- [ ] `Input.mouse_mode = Input.MOUSE_MODE_CAPTURED` set in `_ready`.
 
 ## Case 2: Failure Path — existing PlayerOld in scene
 
@@ -83,16 +95,17 @@
 
 **Expected behavior:**
 
-- Skill detects no MCP and falls back to direct file edits on `level.tscn`.
-- Writes a `.tscn` snippet with CharacterBody3D + CollisionShape3D + Camera3D following the format in the skill's "Fallback (no MCP)" sections.
-- Writes `scripts/player_controller.gd` directly via host file-write tools.
-- Edits `project.godot` to add the InputMap actions.
+- Skill detects no MCP and falls back to direct file edits on `level.tscn` (or whatever main scene exists).
+- Writes a `.tscn` snippet with CharacterBody3D + CollisionShape3D + Head Node3D + Camera3D following the format in the skill's "Fallback (no MCP)" section.
+- Writes `scripts/player_controller.gd` directly via host file-write tools — same skeleton as the MCP path (coyote + buffer + air-accel + external-velocity + move_toward).
+- Edits `project.godot` to add the InputMap actions (all 6: WASD + jump + sprint).
 
 **Assertions:**
 
 - [ ] Skill identifies that MCP is unavailable (does not blindly call `summer_*` tools and fail).
-- [ ] Generated `.tscn` is syntactically valid Godot 4 scene format (parseable by Godot).
-- [ ] Generated `project.godot` patch follows Godot's input action format (`input/move_forward = { ... }`).
+- [ ] Generated `.tscn` is syntactically valid Godot 4 scene format (parseable by Godot, includes `[gd_scene ... format=3]` header and a CapsuleShape3D sub-resource with `radius` and `height`).
+- [ ] Generated `project.godot` patch follows Godot's input action format (`input/move_forward = { "deadzone": ..., "events": [...] }`).
+- [ ] Generated script still includes coyote_time, jump_buffer_time, external_velocity, move_toward acceleration model (the fallback path is NOT a downgraded skeleton).
 - [ ] Skill still asks "May I write …" before each file write.
 
 ---

package/skills/_tests/specs/host-authoritative-state.md

@@ -0,0 +1,104 @@
+# Skill Spec: /host-authoritative-state
+
+## Fixture
+
+- A Godot 4.5 / Summer Engine project with `/peer-to-peer-multiplayer` Layer 1 already done — `NetworkManager` autoload exists, exposes `peer_joined` / `peer_left` signals.
+- Project may have a partial player scene; no Managers yet.
+- Summer MCP tools available; engine on localhost:6550.
+
+## Case 1: Happy Path — design HealthManager from scratch with full ownership audit
+
+**Input:** "I want to add health, damage, and a kill counter to my multiplayer game. Help me set it up correctly."
+
+**Expected behavior:**
+
+1. Skill confirms `NetworkManager` already exists; if not, defers to `/peer-to-peer-multiplayer`.
+2. Skill walks the user through the fundamental question on each new field: `health`, `max_health`, `score`, `kills`. All four → host-owned.
+3. Skill proposes one Manager per domain — `HealthManager` for health/max_health, `ScoreManager` for score/kills. Asks before creating each.
+4. For `HealthManager`, skill walks the canonical shape:
+   - Data dict keyed by `peer_id`.
+   - `_host_apply_damage()` mutator with `if not NetworkManager.is_host: return` first line.
+   - `_client_request_damage()` RPC with `@rpc("any_peer", "call_remote", "reliable")` and validation (range, line-of-sight, cooldown, magnitude).
+   - `_broadcast_health()` and `_broadcast_death()` with `@rpc("authority", "call_remote", "reliable")`.
+   - `peer_joined` registers, `peer_left` cleans up.
+5. After file write, `summer_get_script_errors` to verify clean compile.
+
+**Expected MCP tool sequence (partial):**
+
+1. `summer_get_scene_tree` — confirm NetworkManager autoload presence.
+2. `Read autoloads/network_manager.gd` — confirm signals match expected shape.
+3. (User approves HealthManager) `Write autoloads/HealthManager.gd`.
+4. `summer_get_script_errors` to verify.
+5. (User approves ScoreManager) repeat.
+
+**Assertions:**
+
+- [ ] Skill applies the fundamental question explicitly to each field — does not silently dump generic state.
+- [ ] Skill proposes one Manager per domain, not one mega-Manager for all state.
+- [ ] Every `_host_apply_*` function's first line is `if not NetworkManager.is_host: return`.
+- [ ] Every `_client_request_*` is `@rpc("any_peer", "call_remote", "reliable")` and has at least three validators.
+- [ ] Every `_broadcast_*` is `@rpc("authority", "call_remote", "reliable")`.
+- [ ] `peer_joined` and `peer_left` lifecycle is wired in `_ready()`.
+- [ ] Skill does NOT use `MultiplayerSynchronizer` for any health/score field.
+- [ ] Skill asks "May I…" before each new file creation.
+
+## Case 2: Late-join state sync
+
+**Input:** "I have HealthManager working but new players who join mid-match see 100 HP for everyone, even players who are at 30 HP. Fix it."
+
+**Expected behavior:**
+
+- Skill identifies the bug: no late-join state replay.
+- Skill explains the pattern: `_send_full_state(peer_id)` method on each Manager, called from `peer_joined`, uses `rpc_id` (flavor 4) to target only the joining peer.
+- Skill audits all existing Managers for missing `_send_full_state` and adds it.
+- Skill verifies idempotency — receiving a broadcast twice for the same peer must be a no-op.
+
+**Assertions:**
+
+- [ ] Skill diagnoses the missing late-join replay before writing code.
+- [ ] Skill uses `rpc_id(target_peer, ...)` (flavor 4), NOT a broadcast to all peers.
+- [ ] Skill audits ALL existing Managers, not just HealthManager — score, inventory, cooldowns all need the same fix.
+- [ ] Skill checks that broadcast handlers are idempotent before shipping.
+- [ ] `summer_get_script_errors` runs after each file edit.
+
+## Case 3: Edge — client wants to lie about position (client-predicted)
+
+**Input:** "A peer reports another player is teleporting around the map. I added validation to `_client_request_position()` and it blocks legitimate movement. What do I do?"
+
+**Expected behavior:**
+
+- Skill identifies the user has put `position` into the wrong column. Position is **host-authoritative with client prediction**, not pure host-owned.
+- Skill explains: clients send their input/intent (movement direction + jump), not their final position. Host runs the same physics function authoritatively. If host's computed position diverges from client's reported position by more than a tolerance, host snaps the client (reconciliation).
+- Skill removes the `_client_request_position` validator and points to `/peer-to-peer-multiplayer` Layer 4 for the prediction/reconciliation pattern.
+- Skill notes that "blocking" position requests defeats the point of prediction — it would make movement feel terrible. The right response to a divergent client is reconciliation, not rejection.
+
+**Assertions:**
+
+- [ ] Skill recognizes position is the "Sometimes" category from the fundamental question, not pure host-owned.
+- [ ] Skill defers reconciliation logic to `/peer-to-peer-multiplayer` Layer 4 instead of inventing a new pattern.
+- [ ] Skill does NOT propose validating each position update with range/distance checks — that's the wrong tool.
+- [ ] Skill explains why teleport-cheating is caught by reconciliation, not rejection.
+
+## Case 4: No Summer MCP — fallback path
+
+**Fixture:** Same as Case 1, but Summer MCP unavailable.
+
+**Input:** "Add a HealthManager autoload to my multiplayer game."
+
+**Expected behavior:**
+
+- Skill detects MCP unavailable.
+- Walks the same Manager shape (data, mutators, requests, broadcasts, lifecycle).
+- Instead of `summer_get_script_errors`, asks the user to save and check errors via the Godot editor.
+- Provides exact `[autoload]` lines for `project.godot` to paste.
+- File write still goes through `Write` host tool with "May I…" approval.
+
+**Assertions:**
+
+- [ ] Skill detects MCP unavailable; doesn't blindly call `summer_*` tools and fail.
+- [ ] `project.godot` autoload lines are provided as exact paste-able text.
+- [ ] Manager shape (5-part: data / mutators / requests / broadcasts / lifecycle) is identical regardless of MCP availability.
+
+---
+
+This spec runs via `/skill-test host-authoritative-state spec` (see `_meta/skill-test/SKILL.md`).