| name | verify-by-playing |
| description | The gameplay acceptance gate — prove interactive software works by PLAYING it with real input, not by green gates, passing tests, code inspection or screenshots of stills. Load this whenever a gameplay change is claimed done, before shipping or demoing any playable build, after integrating a character, controls, camera, level geometry, combat or any input path, and whenever a test suite or validator is green on interactive software. Also load it when writing acceptance checks for a game, so the checks exercise the shipped input boundary rather than the internals. Exists because every gameplay defect one project shipped — dead keyboard, sealed level, hijacked camera, unclimbable stair, non-slicing enemies — passed every green gate and was found by a human playing. |
Green gates cannot see whether the thing is playable
The record that justifies the rule
One project shipped, in sequence, past a fully green harness (capture green, validator 20/20,
selftest 15/15): a keyboard that did nothing, a level sealed by its own colliders, a camera
that hijacked the view seconds into play, a stair that could not be climbed, and enemies whose
signature death effect silently did not happen. Every one was found by the operator playing.
The common cause was always the same: acceptance ran a scripted path with the camera locked, so
nothing ever pressed a key, walked the route, or checked which camera was rendering. A judge
grades a frame; a validator grades artifacts; neither can see playability.
The gate — five proofs, all from REAL input
Run these against the live, running build — never an offscreen path, never a headless shortcut
that bypasses the input layer, never teleport() in place of walking.
- Input-liveness. Dispatch genuine key/button events through the platform's real input
path (browser: Playwright/CDP key events on the page; Unity: play-mode with driven
Input; a debug API that injects events as events is acceptable — one that sets
velocities directly is not). Assert the character actually moved, with positions. A safe
probe: bind nothing to an unused key and assert the app's input layer saw press and
release — that proves the path without moving the player.
- Route traversal. Walk the actual route a player must walk — spawn to objective, through
every gate, up every stair — and assert arrival by coordinates against the layout's own
landmarks. Stairs specifically: a 0.17 m riser reading as a wall has shipped twice; "the
route exists in the data" is not "the route can be walked".
- Camera ownership. Assert, per frame across the session, that the gameplay camera owns
the view and no capture/debug camera is enabled. The hijack failure was a capture camera
left enabled after one screenshot — invisible to every artifact check.
- Exercise every verb. Each ability, attack, interaction — pressed for real, its effect
asserted by MEASUREMENT, not by state ("clip is playing" passes for a character frozen in
bind pose; accumulated joint rotation does not; "swings:1 hits:1 health 2→1" is evidence).
- Screenshot the result and LOOK at it. Numbers confirm mechanics; only the frame shows
the sword in the wrong hand, the body not slicing, the effect rendering nothing. A claim of
"screenshot-checked" by the agent that built the thing is unverified by definition — it
has been wrong on this exact phrase before. Verified means reproduced by someone (or some
agent) who did not build it, or by the operator.
Rules that keep the gate honest
- Automation must not strand the player. Whatever the harness arms (scripted drive, locked
camera, input capture) it must disarm and PROVE restored: transform back, lock released,
frames advancing, a held key still reaching the app. Two shipped defects were harness state
left armed.
- The sim must run when the pane is hidden. rAF stops in a hidden tab; a gate that holds W
for 3 s and reads position would conclude the keyboard is dead on working code. Drive the sim
from a fixed-step source, or require visibility, or use the app's own step API — but know
which, and say so.
- Every check must be able to go red. Before trusting any probe: if this stopped working
right now, would it fail? Replay the known defects (dead input, sealed route, stolen camera)
as fault injections and watch each one fail. A self-test harness once reported 6/7 red cases
passing while its own path to the validator was broken — every "red" was a crash, not a
detection. Refuse to count a crash or a missing verdict as a red gate.
- Provenance. The build you played must be the build you ship: assert the capture/session
postdates every source file, and that the dev server is serving current bytes. A judge once
scored a 40-minute-stale frame; two of its three findings were already fixed.
- The operator's report outranks every gate. When a human says "it doesn't slice" and the
gates say it does, the human is right until proven otherwise — treat their words as the
ground truth to reproduce, not a claim to argue with. This has been the correct call every
single time.
When it runs
At every stage exit that produces something playable (see game-production-stages), after any
change to input, camera, collision, character or level geometry — and always immediately before
handing the operator a build. Cost is minutes; each skipped run has historically cost a
shipped defect.
