# Matrix-Game 4.0 scene download planning audit

An original, offline Python standard-library analysis of two upstream manifests.
No upstream source code, complete manifest, model weights, game assets or images
are redistributed here. Inputs must be obtained separately from the source links.

## Pinned sources

GitHub source commit: `56c61df7a3b1e63bed2340ebf7417ab1e1bdf67b`.

- [models.json](https://github.com/SkyworkAI/Matrix-Game/blob/56c61df7a3b1e63bed2340ebf7417ab1e1bdf67b/Matrix-Game-4/releases/models.json)
- [game-assets.json](https://github.com/SkyworkAI/Matrix-Game/blob/56c61df7a3b1e63bed2340ebf7417ab1e1bdf67b/Matrix-Game-4/releases/game-assets.json)
- [Release documentation](https://github.com/SkyworkAI/Matrix-Game/blob/56c61df7a3b1e63bed2340ebf7417ab1e1bdf67b/Matrix-Game-4/releases/README.md)
- [Downloader selection and override semantics](https://github.com/SkyworkAI/Matrix-Game/blob/56c61df7a3b1e63bed2340ebf7417ab1e1bdf67b/Matrix-Game-4/matrix_game/resources.py)

The default payload repository is `Skywork/Matrix-Game-4.0`, type `model`,
revision `2c53100457da7abcf0e966f75637c644d3423a63` per the pinned release
documentation. This is a different revision from the GitHub source commit.
Explicit per-entry overrides point selected base components to
`alibaba-pai/Wan2.2-Fun-5B-Control`, revision
`b8bc1a65ab71d054ba4636dc0dac104aa4df2686`.

Exact input-file SHA256 values used for the checked-in outputs:

- models.json: `6c363a55eb4b84ebba4d8aa9fa3f93b24beb9e101c1719fb286f76f4a19c4604`
- game-assets.json: `c4931f203e8668f15dc73f69d3efc57e7e8c6344bf105ead8668eb76ba6ea1a4`

These are hashes of the JSON files, not hashes of model payloads. Reformatting
JSON changes these hashes. The script records the supplied file hashes; it does
not authenticate the source or require the inputs to match these published hashes.

## Reproduce

Save the raw pinned JSON files above as `models.json` and `game-assets.json` in a
separate working directory. Keep their original bytes if comparing input hashes.
Download this script and its test file together, then run with Python 3:

```sh
python3 -m unittest -v test_manifest_plan
python3 manifest_plan.py --models /path/to/models.json \
  --assets /path/to/game-assets.json --out ./results
```

The planner has no network calls. It does not download, open, checksum, install or
execute any model or game payload. It reads only the supplied manifest files and
writes three analytical outputs:

- `byte-budget.csv`: exact declared byte totals and file counts for shared-only,
  each scene including shared, and all scenes including shared once.
- `renamed-paths.csv`: the 19 explicit model-manifest source/local path renames,
  with effective repository coordinates. Local paths are relative to a resources
  directory. This intentionally omits unrenamed entries and payload hashes/sizes;
  it is not a download manifest.
- `input-sha256.json`: hashes of the two input JSON byte streams.

## Accounting and interpretation

Scene selection follows the pinned downloader's `files_for`: shared plus the
selected scene; `all` means shared plus all three scene bundles. Shared shooter
assets are consequently counted for Racing too. `shared` is an analysis-only row,
not an upstream CLI scene option. Do not add the three scene rows to estimate a
complete install: that repeats shared resources three times. Equivalently,
`all = castle + ancient-egypt + racing - 2 * shared` for bytes and counts here.

For these inputs, all scenes total 58 files and 44,428,406,818 declared bytes:
44,235,963,680 model-manifest bytes plus 192,443,138 game-asset bytes. A
model-manifest count includes configs, images and notices as well as tensor files.
It is not a count of model checkpoints. Shared-only totals 23 files and
14,247,231,143 bytes.

GB uses 1,000,000,000 bytes; GiB uses 1,073,741,824 bytes. Integer byte columns
are authoritative; displayed unit conversions are rounded to six decimals.
These totals are nominal selected payload sizes for a cold, complete selection.
They do not estimate transfer time, cache reuse, duplicate cache/install copies,
filesystem overhead, temporary files, dependencies, peak disk use, RAM, VRAM,
frame rate, inference speed or whether any hardware can run the release.

## Validation and limits

The audit checks integer schema 1, expected model/asset kind, version agreement,
nonempty version/license strings, exact expected bundle names, entry/list types,
nonnegative integer sizes (booleans rejected), safe relative POSIX paths,
lowercase 64-character SHA256 syntax, and repository override completeness and
pinned revision syntax. It rejects duplicate JSON keys, duplicate local paths
within a manifest and all cross-manifest local-path collisions, even identical
ones. External overrides follow the upstream model/dataset restriction.

Validation is deliberately stricter than upstream selection: every bundle is
checked, both manifests must contain the expected four bundles, kinds/versions
must agree, and cross-manifest collisions fail before any outputs are written.
Unknown extra metadata fields are ignored. This is not a full upstream schema
implementation or a replacement for the downloader's file verification. POSIX
path validation does not model case-insensitive filesystem aliases or symlinks;
no installation paths are touched. SHA256 syntax does not establish actual file
integrity, availability, license compatibility or successful runtime operation.

Tests use tiny synthetic metadata, not redistributed upstream fixtures. The
suite exercises shared-once accounting, scene selection, duplicate and combined
conflicts, paths, sizes, schema, hashes, kinds, versions, JSON keys, source-path
mapping and external repository overrides. No GPU or third-party Python package
is required. This audit makes no runtime or hardware claims.