sparkengine-assets-import-and-package-integrity

Start with the AssetPipeline::LoadAsset path, which reads the OS filesystem directly and consults the in-process LRU AssetCache. Collect console output from pak_status and assetvalidate.dir, and reproduce with ImportFromMemory using the captured bytes for a deterministic test.

SparkPak is an MPQ-inspired binary format with a 32-byte header, raw data blobs, and a deflate/zstd-compressed TOC at the end of file. Lookups use a 64-bit FNV-1a hash of the virtual path, and the reader caps TOC size, file count, and per-entry sizes to reject corrupt archives.

Not currently. The engine auto-mounts .spk files from the Data directory at startup, but AssetPipeline reads the OS filesystem directly and bypasses the VFS, so pak-only content is invisible to the load path. Wiring AssetPipeline through VirtualFileSystem is an open design task.

LocalFileProvider::ResolvePath rejects any path containing '..' or a leading slash, logging a traversal or absolute-path rejection. This check only protects VFS consumers; AssetPipeline and script loaders using raw paths bypass it entirely.

The in-process AssetCache is an LRU over loaded Asset objects on the real load path. The daemon asset cache is an out-of-process (path, platform)-keyed blob store in SparkDaemon, currently Phase 3a cache operations only and not consulted by any load path.

Use other skills for RHI/render-graph/shader work, CMake or CPack build breakage, save-file format migrations, and test registration mechanics. Promoting any packaging readiness claim belongs to the change-control and release-readiness skill with same-SHA evidence.