@plasius/gpu-debug 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -20,6 +20,29 @@ The format is based on **[Keep a Changelog](https://keepachangelog.com/en/1.1.0/
 - **Security**
   - (placeholder)
 
+## [0.2.5] - 2026-08-30
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - Updated to the released `@plasius/gpu-shared` 1.1.0 immutable Zero-Three
+    evidence line and the fixed esbuild resolution.
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - Added permanent fail-closed Zero-Three validation across manifests,
+    dependency graphs, imports, declarations, aliases, optional debug bundles,
+    npm tarballs, SBOMs, and active documentation, with immutable CI/CD evidence
+    and no compatibility fallback.
+  - Replaced the legacy write-token publication path with exact-main npm OIDC
+    publication of a sealed tarball, SBOM, and attested Zero-Three evidence.
+  - Pinned patched transitive npm dependencies to clear the current audit baseline.
+  - Added fail-closed source and npm-package admission for the administrative contributor registry and pinned the CI/CD runtime to Node.js 24.18.0 LTS.
+  - (placeholder)
+
 ## [0.2.4] - 2026-06-29
 
 - **Added**
@@ -229,3 +252,4 @@ The format is based on **[Keep a Changelog](https://keepachangelog.com/en/1.1.0/
 [0.2.2]: https://github.com/Plasius-LTD/gpu-debug/releases/tag/v0.2.2
 [0.2.3]: https://github.com/Plasius-LTD/gpu-debug/releases/tag/v0.2.3
 [0.2.4]: https://github.com/Plasius-LTD/gpu-debug/releases/tag/v0.2.4
+[0.2.5]: https://github.com/Plasius-LTD/gpu-debug/releases/tag/v0.2.5

package/README.md

@@ -310,8 +310,23 @@ npm run typecheck
 npm run test:coverage
 npm run build
 npm run pack:check
+npm run zero-three
 ```
 
+## Permanent Zero-Three invariant
+
+`@plasius/gpu-debug` provides optional local-first WebGPU instrumentation.
+Three.js, Three.js subpaths, TSL, `@types/three`, `@react-three/*`, and packages
+whose dependency graph reaches Three.js are permanently prohibited from source,
+manifests, locks, installed dependency graphs, declarations, optional debug
+bundles, npm tarballs, SBOMs, tests, tooling, and active usage documentation.
+There is no compatibility mode, waiver, rollback, or fallback.
+
+Run `npm run zero-three:source` before dependency installation and `npm run
+zero-three` after building and installing to generate complete package evidence.
+The canonical architectural decision is the site ADR
+[ADR 0168](https://github.com/Plasius-LTD/plasius-ltd-site/blob/main/docs/adrs/adr-0168-three-js-is-prohibited-from-gpu-native-rendering.md).
+
 ## Release Automation
 
 GitHub Actions now carries the package delivery path:
@@ -330,3 +345,15 @@ GitHub Actions now carries the package delivery path:
 - `docs/adrs/*`: package architecture decisions.
 - `docs/tdrs/*`: implementation design records.
 - `docs/design/*`: integration and NFR design detail.
+
+<!-- BEGIN PLASIUS RELEASE INTEGRITY -->
+## Release integrity
+
+CI keeps the administrative contributor registry outside Git and npm package
+artifacts using exact, case-normalised path checks. Repository-owned pull
+requests and `main` execute on GitHub-hosted runners with Node.js 24.18.0 LTS.
+Release preparation lands metadata through the protected branch, waits for
+successful exact-commit CI, and then publishes the sealed package through npm
+OIDC from the `production` environment. The release retains and attests the
+SBOM and complete Zero-Three evidence; there is no legacy npm token fallback.
+<!-- END PLASIUS RELEASE INTEGRITY -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-debug",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Opt-in GPU debug instrumentation for tracked memory, dispatch, queue, and frame-budget metrics in Plasius WebGPU runtimes.",
   "type": "module",
   "sideEffects": false,
@@ -30,15 +30,20 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
+    "zero-three": "node scripts/verify-zero-three.cjs --package --evidence-out release-artifacts/zero-three-evidence.json",
+    "zero-three:source": "node scripts/verify-zero-three.cjs --source-only",
+    "zero-three:test": "node --test tests/zero-three.test.cjs",
     "audit:eslint": "eslint . --max-warnings=0",
     "audit:deps": "npm ls --all --omit=optional --omit=peer > /dev/null 2>&1 || true",
     "audit:npm": "npm audit --audit-level=high --omit=dev",
     "audit:test": "vitest run --coverage",
     "lint": "eslint . --max-warnings=0",
     "prepare": "npm run build",
+    "test:privacy": "node --test tests/public-package-policy.test.cjs",
     "test:coverage": "vitest run --coverage",
-    "pack:check": "node scripts/verify-public-package.cjs",
-    "prepublishOnly": "npm run build && npm run pack:check"
+    "pack:check": "npm run privacy:check && node scripts/verify-public-package.cjs",
+    "privacy:check": "node scripts/verify-public-artifacts.cjs --source-only",
+    "prepublishOnly": "npm run build && npm run pack:check && npm run zero-three"
   },
   "keywords": [
     "webgpu",
@@ -61,7 +66,7 @@
   },
   "homepage": "https://github.com/Plasius-LTD/gpu-debug#readme",
   "dependencies": {
-    "@plasius/gpu-shared": "^1.0.1"
+    "@plasius/gpu-shared": "^1.1.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -91,6 +96,9 @@
     }
   ],
   "overrides": {
+    "brace-expansion": "5.0.9",
+    "nanoid": "3.3.18",
+    "esbuild": "^0.28.1",
     "minimatch": "^10.2.1"
   },
   "engines": {

package/legal/CLA-REGISTRY.csv

@@ -1,2 +0,0 @@
-type,github_handle,full_name,company,email,date,approver
-corporate,Zephod111r,Phillip Hounslow,Plasius LTD,zephod@plasius.co.uk,2025-09-12,Phillip Hounslow (Maintainer)