Sources were reviewed on 2026-09-18. Primary project documentation is used where available.
SDL describes itself as a cross-platform low-level library for input, audio, and graphics that is written in C and works natively with C++. The project therefore uses SDL3 only at the adapter edge; the portable core remains ordinary C++20. The selected 3.4.16 release is a current stable bugfix release and its official archive digest is pinned in CMake.
SDL's modern GPU API supports explicit device/buffer/texture workflows, but that complexity is not needed for the primitive sample. The ADR selects SDL Renderer now and preserves a backend seam.
CMake recommends declaring dependency details before making content available. This project has one optional external dependency, declared by official release URL and SHA-256, and permits an explicit local source override for controlled/offline builds.
Clang documents AddressSanitizer as compiler/runtime instrumentation for out-of-bounds,
use-after-free, double-free, and related failures, with frame pointers improving traces. CI combines
ASan with UndefinedBehaviorSanitizer for the full suite. LLVM documents libFuzzer as an in-process,
coverage-guided engine that repeatedly calls LLVMFuzzerTestOneInput; the scene parser target uses
the recommended combined fuzzer/address/undefined instrumentation and a small valid seed corpus.
Clang-tidy uses the CMake-generated compilation database to diagnose bug-prone, analyzer, performance, portability, and modernization issues. Gcovr 8.6 produces line/branch XML and HTML evidence around GCC instrumentation.
- Keep clocks, devices, and third-party APIs outside canonical simulation.
- Optimize only against a simple correctness oracle where practical.
- Treat asset parsers and allocator arithmetic as security boundaries.
- Pin external sources by immutable digest.
- Separate measured regression budgets from unsupported frame-rate or production claims.