@plasius/gpu-demo-viewer 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -10,7 +10,46 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
   - (placeholder)
 
 - **Changed**
-  - Routed trusted validation through the organization-owned quarantined
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.1.7] - 2026-10-18
+
+- Exclude Gem at user request and record the original Amber fixed-transport qualification; the production target is 74 models.
+
+- Track all 75 model candidates, their first-twelve/seven-batch membership and explicit acquisition, held and production states before the later voxel pass.
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.1.6] - 2026-10-14
+
+- Bind fixed progressive/UHD model review to published renderer and shared inspection APIs; retain experimental adaptive controls in their qualification branch.
+
+- Add exact Full HD, QHD and 4K UHD model-review presets, one-sample inspection and aspect-preserving canvas presentation.
+
+- Model-library sample target, bounce, resolution and denoising controls with progressive still-camera refinement and completed-sample progress.
+
+- **Added**
+  - Local model-library review with eleven acquired fixtures, including the manually supplied Medieval house GLB, source credits, integrity manifests, shared camera inspection and explicit visual-defect/deferred states.
+
+- **Changed**
+  - Refreshed compatible @plasius/* lockfile resolutions to the latest published releases.
+ - Routed trusted validation through the organization-owned quarantined
     self-hosted runner group while continuing to reject fork pull-request code.
   - (placeholder)
 
@@ -165,3 +204,5 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 [0.1.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.3
 [0.1.4]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.4
 [0.1.5]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.5
+[0.1.6]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.6
+[0.1.7]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.1.7

package/NFR.md

@@ -30,3 +30,7 @@ entry surfaces.
 - This viewer is intentionally non-user-facing runtime infrastructure.
 - Baseline operations are governed by the parent feature flag:
   `platform.repo-hardening-sweep.enabled`.
+
+## Model library review
+
+Inherits `gpu-demo.scene-fidelity.enabled` with a localhost-only fixture override. Model changes abort prior work and release its GPU resources. Downloads use trusted reviewed hosts, no redirects, strict byte/hash limits and bounded concurrency. Preserve source licences. Keep missing downloads and renderer defects visible. Keyboard, touch, reduced-motion and 320px layouts must remain usable.

package/README.md

@@ -148,3 +148,33 @@ npm 11.5.1 or newer, uses the protected `production` environment and
 short-lived npm OIDC with provenance, and has no long-lived npm write-token
 fallback. Rollback disables CD; it never rewrites published package history.
 <!-- END PLASIUS RELEASE INTEGRITY -->
+
+## Model library review
+
+`npm run models:download` installs the ten reviewed, freely licensed Poly Haven and Khronos fixtures from `model-library/catalogue.json`, including all buffer/image dependencies. Downloads are bounded and SHA-256 checked; binaries are ignored by Git and npm. `npm run models:dev` opens the localhost server on port 5291. Visit `http://127.0.0.1:5291/?review=first-twelve`. The Medieval house is a manually supplied eleventh asset; Gem is excluded from the rollout by request. Source links, creators and licences are available beside each model.
+
+For Medieval house, obtain the original GLB from its credited Sketchfab source and place it at `model-library/assets/sf-house/medieval_house.glb`, then run `npm run models:download` to verify its pinned size and SHA-256 and write its credits. This command never downloads manual assets; a missing file produces an explicit placement message. The catalogue stores no private local paths.
+
+This page consumes the shared model-inspection package entrypoint. While its upstream release is pending, development testing can set `PLASIUS_SHARED_INSPECTION_SOURCE` to an absolute path to the reviewed sibling `src/model-inspection.js`; this explicit source override is for localhost development only, not a released dependency or production deployment.
+
+Mouse/touch/keyboard inspection reuses the material-study camera. The view progressively refines while the camera is still, stopping at the selected sample target. `Home` restores framing and `?` displays a brief gesture reminder. Resizing updates resolution while preserving the camera. Fox is static here; its Survey, Walk and Run clips remain in the original download. Amber uses the fixed-continuation correction in renderer 0.2.50; its original materials are unchanged. See `docs/model-library-review.md` for the initial findings; none of these fixtures is implicitly approved for the production showcase.
+
+Render-quality controls select 8–256 total samples, 2–12 light bounces, 480/800/1280px render width and denoising. Defaults are 64/6/800/on. The first pass is one sample; idle refinement adds up to four samples per batch. Camera and quality changes restart history. Hidden tabs pause further work; the progress bar reports completed samples and actual dimensions. Settings do not reload the source model.
+
+During upstream progressive-renderer development, also set `PLASIUS_RENDERER_SOURCE` to an absolute reviewed `src/index.js` or built `dist/index.js`. Both source overrides are development-only; PRs remain dependency-blocked until approved package CD and final released-version validation. To use another local port: `npm run models:dev -- --port 5292`.
+
+The model review includes native 1920 × 1080, 2560 × 1440 and 3840 × 2160 quality presets. These trace the exact selected pixel dimensions independently of viewport size; the canvas contains the image without stretching. A one-sample target supports quick full-resolution checks. See [UHD inspection design](docs/model-inspection-uhd.md).
+
+The released model review uses fixed progressive sampling with native UHD sizes and requires renderer0.2.49/shared1.1.7 or newer. Adaptive controls remain in a separate qualification branch. See [release scope](docs/model-review-release.md); the local inspection catalogue explicitly retains unresolved visual findings.
+
+## Complete model catalogue rollout
+
+The [74-model production rollout](docs/catalogue-production-rollout.md) tracks the
+eleven retained originals and seven subsequent batches of nine. The research
+manifest retains the excluded Gem identity, making 75 research records. `model-library/rollout.json`
+records acquisition/qualification state separately from production entitlement;
+`research-catalogue.json` preserves the original source identities and credits.
+Ten models are currently production-verified. Amber is locally qualified with renderer 0.2.50 and awaits production verification; Gem is excluded by request. Research entries are not a claim of downloaded or working
+models. Voxel conversion is the following pass after original-model production
+qualification. GitHub Story [2308](https://github.com/Plasius-LTD/plasius-ltd-site/issues/2308)
+owns delivery and acceptance.

package/docs/adrs/adr-0003-reviewed-model-library.md

@@ -0,0 +1,13 @@
+# ADR 0003: Reviewed model library
+
+Status: Accepted for local inspection.
+
+The viewer acquires the exact first-twelve shortlist with pinned provenance, file sizes and SHA-256 hashes. Eleven are available: ten automatic downloads and the user-supplied Medieval house GLB. Gem remains deferred. Asset binaries remain outside Git and npm. `models:download` retrieves only the reviewed Poly Haven and pinned Khronos URLs, with two workers, sixty-second requests, no redirects and a 200 MiB aggregate budget. Existing files must match the manifest. Credits travel with each installed model.
+
+Manual files have `acquisition: "manual"` and no download URL in the file record. Acquisition verifies their installed bytes and checksum exactly as it does automatic downloads; a missing manual file produces an actionable local destination message without a network request. User download paths are never stored in the catalogue. This supports supplied files without expanding the approved remote-source allowlist or attempting authenticated downloads.
+
+Rendering, glTF decoding, material projection and input gestures belong to the shared `model-inspection` package entry. The viewer owns selection, cancellation, readable errors, credits and review observations. It does not replace missing assets or apply the chest-specific ageing system indiscriminately. Only one model is active. Resize remounts a bounded render target; hidden/missing assets have explicit states.
+
+The parent control is `gpu-demo.scene-fidelity.enabled`. This validation surface uses the explicit localhost-only `?review=first-twelve` override. It adds no production route or entitlement. Product integration must use the remote flag and existing route capabilities. Rollback: omit the query override, stop the local server, or revert the viewer entry.
+
+Tests cover acquisition rejection/integrity, rapid selection races, cleanup, missing assets, source credits, static-animation caveats and disabled state. Browser screenshots and review notes distinguish files loaded from visual fidelity achieved.

package/docs/adrs/adr-0004-model-quality-controls.md

@@ -0,0 +1,13 @@
+# ADR 0004: Model-library quality controls
+
+Accepted for implementation, 2026-10-14. Parent Feature Plasius-LTD/plasius-ltd-site#1170, Story #2303, viewer Task #58. Inherited flag `gpu-demo.scene-fidelity.enabled`; the existing localhost review override remains the only exposure in this delivery.
+
+The viewer supplies semantic native controls for sample target, bounce depth, render width and denoising. gpu-shared owns camera/renderer lifecycle and idle scheduling; gpu-renderer accumulates linear samples before presentation. No duplicate rendering implementation lives here. The sample counter reflects GPU-completed work and the progress element has an accessible label. Controls reflow at 320px and inherit native keyboard/touch behavior. Quality changes retain the current camera and model; document visibility pauses refinement.
+
+Default: 64 samples, six bounces, 800px width and denoising. Width options 480/800/1280 preserve the visible canvas aspect ratio within the shared 1440px dimension bound. GPU work stops at the selected target. Source credits, deferred assets and known defects remain visible.
+
+`PLASIUS_RENDERER_SOURCE` permits an explicit absolute development entrypoint alongside the shared source override, only on the localhost development server. Published dependencies must replace both overrides after approved upstream CD. No production route or capability is added. Rollback removes the review query/overrides or disables the inherited remote flag in public hosts.
+
+## UHD extension (2026-10-14)
+
+Add exact HD/QHD/UHD presets alongside viewport-shaped widths. Fixed presets do not change on viewport resize. Use contained presentation to avoid stretching and retain exact traced dimensions in the progress label. Shared admission caps the total at UHD pixels. See [design](../model-inspection-uhd.md).

package/docs/adrs/index.md

@@ -4,3 +4,5 @@
 
 - [ADR 0001: Define static viewer governance baseline and build checks](./adr-0001-gpu-demo-viewer-governance-baseline.md)
 - [ADR-0002: Hosted OIDC Package Publication](./adr-0002-hosted-oidc-package-publication.md)
+
+- [ADR 0003: Reviewed model library](adr-0003-reviewed-model-library.md)

package/docs/amber-fixed-qualification.json

@@ -0,0 +1,54 @@
+{
+  "date": "2026-10-18",
+  "rendererCorrectionCommit": "ad52d1124455807cc1355525ab9ec0c2a9b9637b",
+  "releasedBaseline": "0.2.49",
+  "candidateVersion": "0.2.50",
+  "sourceAssetsUnchanged": true,
+  "matchedComparison": {
+    "samples": 256,
+    "maxDepth": 6,
+    "width": 800,
+    "height": 282,
+    "denoise": false
+  },
+  "nativeUhd": {
+    "width": 3840,
+    "height": 2160,
+    "samples": 1,
+    "maxDepth": 6,
+    "denoise": true
+  },
+  "cameraReset": {
+    "before": 256,
+    "afterMovement": 0,
+    "refined": 256
+  },
+  "proof": [
+    {
+      "file": "released-256.png",
+      "sha256": "98e8243c5deb8bd80352af9ea24bdaf924b981be0f3495f6920530b6bccdc881"
+    },
+    {
+      "file": "bounded-256.png",
+      "sha256": "981c87a2780b779a9fc54f6d18b1cf920538aea08b5f062f5c1828cc5f23988a"
+    },
+    {
+      "file": "bounded-256-denoised.png",
+      "sha256": "23f414fe11cc727057d8b81e0c9533c8cbbcfd91f10e9a33a51126afb20bd61b"
+    },
+    {
+      "file": "Amber-UHD-1.png",
+      "sha256": "58ac9b4cda4df5f21ad21e7d7ce9718f3606646af0535cf8412b4471e29a2961"
+    },
+    {
+      "file": "Amber-camera-refined.png",
+      "sha256": "e3670b2bbc302206f533a661388177069e1d61dd382121c39e5b50de43139e0d"
+    }
+  ],
+  "limits": [
+    "Fixed sampling only; experimental adaptive transport remains unqualified.",
+    "UHD at one sample demonstrates admission and dimensions, not matched-quality or real-time performance.",
+    "Fox is static; source animations are retained but not played.",
+    "Physical touch and screen-reader speech have not been tested."
+  ]
+}

package/docs/catalogue-production-rollout.md

@@ -0,0 +1,80 @@
+# Complete catalogue rollout
+
+Status: delivery in progress, 18 October 2026. Parent Epic: site#2271;
+Feature: site#1170. First-batch Story: site#2303; production Task: site#2305.
+
+The research catalogue contains 75 distinct source assets/sets. Gem is explicitly
+excluded by the user, leaving 74 production candidates: eleven retained from
+the original twelve and 63 further models. Eleven have been acquired and ten
+are currently selectable in production.
+The 52 deployed files are geometry/texture resources, not 52 models.
+
+## Delivery sequence
+
+1. Diagnose Mosquito In Amber using its unchanged source geometry, textures and
+   material properties. Compare released rendering with isolated corrections;
+   retain known-bad evidence. Resolve transport/import faults with tests in the
+   owning `@plasius/*` package before updating consumers. Do not whiten the
+   material, remove transmission, replace the model or hide defects with filtering.
+2. Retain the excluded Gem research identity for provenance. Do not download or
+   substitute it. Verify all eleven retained originals and their source credits.
+3. Release qualified owning packages through approved main `cd.yml`, consume
+   registry versions, and publish the eleven retained first-group models through site CI/CD.
+4. Process the remaining 63 candidates in seven batches of nine, preserving
+   catalogue order. An individual dependency or unresolved licence is explicitly
+   held; it must not prevent unrelated candidates being inspected. Batch membership
+   and per-model status are version controlled; GitHub Project issues own delivery.
+5. Only after this original-model pass is available in production, begin a
+   separately designed PVOX conversion pass using the existing Plasius voxel
+   packages. Preserve original hashes/credits to support source-versus-voxel
+   comparisons. No voxel runtime or format is reimplemented here.
+
+## Qualification and publication
+
+For every model record source identity, author, licence, original hashes,
+chosen LOD, dependencies, transformations, triangle/texture/memory budgets,
+supported extensions and any animation limitation. Floating Castle still needs
+its upstream scan credits resolved. Large tree source bundles need suitable LODs;
+do not increase existing runtime/download limits merely to admit them.
+
+Reuse gpu-shared import/inspection, gpu-renderer, camera and model packages.
+Keep one selected model in flight, cancel stale work and dispose GPU resources.
+Lazy-load selected assets only; catalogue expansion must not download every asset
+or add renderer code to the homepage. Acquisition retains strict hashes, source
+allowlists, timeout, byte limits and bounded concurrency. Original binaries stay
+out of npm packages and private file paths stay out of committed metadata.
+
+Before public enablement: compare texture/material/silhouette appearance with
+the source; test completed fixed sampling, progressive refinement, camera reset,
+denoising off/on, errors, teardown, keyboard, 320px layout and UHD admission.
+Record actual dimensions/counts and timings; a completed render is not evidence
+of physical material accuracy or animation playback. Preserve source materials.
+
+Tests cover batch identity/completeness, pending and failed assets, integrity,
+cancellation, selection and release-manifest exclusion of unqualified entries.
+Require relevant tests, type/lint/build/package checks, >=80% coverage and every
+changed runtime source in LCOV. Shader coverage retains the standing exception.
+
+Production inherits the stored `gpu-demo.scene-fidelity.enabled` feature flag
+and existing GPU-route capability. Source catalogue qualification is distinct
+from rollout authorization. No production environment-variable bypass is added.
+Rollback uses the stored flag/capability and the prior approved deployment.
+Record exact successful CI/CD, production asset hashes and sensitive backend
+secretref mappings before closing any release-bearing item. Keep adaptive
+transport qualification separate; its draft packages are not production inputs.
+
+## Completion evidence
+
+This document is the design, not a claim of additional published models. Batch
+tracking must distinguish researched, acquired, imported, visually qualified and
+production-verified counts. Missing/held models keep the overall work open.
+
+## Fixed Amber qualification
+
+The [qualification record](amber-fixed-qualification.json) binds the renderer
+source and exact screenshot hashes for the original-source comparison. The
+enclosed insect is now visible without the previous severe dark shell or bands.
+All retained fixture categories completed fixed64 checks; Amber additionally
+completed fixed256 with denoising off/on, camera reset/refinement and native
+3840×2160 at one sample. These checks do not qualify adaptive transport or claim
+complete cinematic presentation. Production verification remains a separate gate.

package/docs/model-inspection-uhd.md

@@ -0,0 +1,11 @@
+# Model inspection at UHD resolution
+
+Parent Feature: Plasius-LTD/plasius-ltd-site#1170; Story #2303; shared Task #143; viewer Task #58. Inherited flag `gpu-demo.scene-fidelity.enabled`; explicit localhost review override only.
+
+Add exact 1920×1080, 2560×1440 and 3840×2160 render targets alongside existing viewport-shaped quick sizes. UHD is actual traced pixels, independent of browser DPR or CSS size. Preserve aspect using contained canvas presentation. Shared quality admission accepts dimensions up to 3840 with a total cap of 3840×2160 pixels. Reject oversized inputs before resource allocation; do not silently downscale. Existing renderer adapter/storage admission remains authoritative. At UHD, progressive float32 history is 132,710,400 bytes plus a 16-byte count uniform, below the default 128 MiB binding limit; other textures and scene resources are additional.
+
+Preserve single-flight scheduling, camera state, visible GPU errors, cancellation and cleanup. Expose a one-sample option for expensive full-resolution inspection. Test native dimensions, viewport independence of fixed presets, aspect-preserving display, pixel-budget admission and reset/cleanup. Validate a real 4K frame and changed-source LCOV before delivery.
+
+Adaptive per-pixel integration depends on renderer Task #173 (canonical configuration/statistics API), shared Task #118 (forwarding contract) and the experimental runtime in renderer PR #216. The current native adaptive runner is a diagnostic harness that intercepts GPU resource creation; the public compute renderer has no adaptive option. Do not import this test harness into the showcase, label uniform batches as per-pixel adaptive sampling, or enable the default-off `renderer.sampling.adaptivePerPixel.enabled` flag. Qualification and API integration remain open in the adaptive workstream; this resolution change is independent. Existing fixed SPP progressive rendering remains the available mode.
+
+Validation: requirements-first tests failed on the old size bounds/preset parsing and on redundant history resets. The corrected runtime preserves completed history when identical settings are reapplied (including fixed-preset viewport changes). Physical browser validation completed one and eight samples at actual canvas size 3840×2160, six bounces, denoising on; 320px layout retained native dimensions with no horizontal overflow. This is output/interaction validation, not a 60 Hz or image-quality qualification. No production rollout or upstream package release is claimed.

package/docs/model-library-review.md

@@ -0,0 +1,38 @@
+# First model review — 13 October 2026
+
+Eleven original assets are installed with 56 verified files (70,599,653 bytes, about 67.3 MiB). The first-twelve shortlist remains intact; the user supplied Medieval house after the initial ten-model review. Only Gem remains deferred. Files and credits remain in `model-library/assets/`; `catalogue.json` records their source URLs, exact sizes and SHA-256 checksums. Source files have not been altered.
+
+The initial review used the Plasius wavefront renderer at eight samples per pixel and six bounces, with shared glTF import and camera gestures. Geometry is uniformly normalized to the inspection frame. It has no model-specific ageing or environment staging. “Rendered” is not a visual-fidelity approval.
+
+| Model | Rendered triangles | Result / next improvement |
+|---|---:|---|
+| Large Castle Door | 12,640 | Geometry and weathered textures render. Improve separation of iron and wood under varied lighting. |
+| Medieval house | 83,046 | User-supplied original GLB renders with six mesh primitives and five materials. Roof, timber and stone textures are present; dark recesses and sampling noise need a lighting pass. Attribution to Vanuartw and CC BY 4.0 are retained. |
+| Fern 02 | 6,232 | Four clumps render. Source materials are opaque; this fixture alone does not prove alpha-mask support. Inspect backlighting and small-leaf shading. |
+| Quiver Tree 01 | 150,124 | Trunk and foliage render; the heaviest geometry in this pass. Review LOD selection, fine-leaf shading and responsiveness. |
+| Rock Moss Set 01 | 63,127 | Six rock primitives render. Need per-rock framing and ground-contact lighting for presentation. |
+| Garden Gloves 01 | 6,822 | Fabric/rubber colour and detail render. No fibre groom is authored; region masks and cloth shading need a later pass. |
+| Wooden Crate 02 | 5,176 | Wood and rope detail render. The original chest’s wear/fray masks are deliberately not applied to a different mesh. |
+| Bronze Whale Statue | 3,816 | Geometry and patina render, but metal reads too flat under this lighting. Needs reference comparisons and better reflected surroundings. |
+| Antique Ceramic Vase 01 | 9,408 | Pattern and silhouette render; glaze appearance and visible sampling noise need improvement. |
+| Mosquito In Amber | 14,349 | **Visual defect:** almost-black surface and horizontal bands. Investigate transmission, volume scaling and the renderer path before public use. |
+| Fox | 576 | Static textured mesh renders. Survey, Walk and Run clips are retained but not played by this importer. |
+
+## Priorities exposed
+
+1. Amber transmission/volume correctness and banding. Use this unchanged fixture as a regression case; do not replace its material to hide the defect.
+2. Cleaner sampling and controlled environment/reflection lighting. Noise and low material contrast are visible across several models.
+3. Skinning and source-animation playback for Fox; bone transforms must be verified before motion can be claimed.
+4. Per-object framing for sets, grounded presentation and model-specific ageing/fibre masks.
+
+## Validation and limits
+
+All eleven were selected and visually inspected in the local browser. Desktop, 320px reflow, visible load/deferred states and keyboard inspection are checked. Shared camera unit coverage exercises mouse and multitouch handling; physical touchscreen hardware and screen-reader speech were not tested. This is not a WCAG or visual-quality certification. Browser captures are retained with the local review output.
+
+Local validation passed: 33 viewer tests, 100% changed-source line coverage (97.7% overall measured branches), lint/type checks, build, package checks and a dependency audit with zero reported vulnerabilities. The shared runtime passed 177 tests; its two added source modules have 100% line coverage. The package dry run excludes downloaded asset binaries. Keyboard orbit, approach and Home reset were visually checked; the final browser error log was empty.
+
+No production route or entitlement was changed. The shared-package release and consumer final dependency pin remain blocked while the organisational runners are offline. The consumer PR must stay draft until the upstream package is published, its dependency is updated and the published runtime is revalidated. See ADR 0003 for the local-only rollout and rollback controls.
+
+## Progressive quality review (2026-10-14)
+
+The preview now defaults to a 64-sample target, six bounces, 800px width and denoising. Quality controls adjust all four, retain the camera and restart accumulation. It refines unfiltered linear radiance in bounded GPU batches while still and pauses when hidden. Existing model findings above describe the initial eight-sample review; higher sampling does not resolve importer, material or animation defects automatically. Upstream renderer/shared releases and final package-pin validation are still required before publication.

package/docs/model-review-release.md

@@ -0,0 +1,11 @@
+# Fixed progressive model review release
+
+Task #58 / Story Plasius-LTD/plasius-ltd-site#2303 / Feature #1170. Release the existing reviewed acquisition catalogue, static-model inspection journey and fixed quality controls (samples, bounces, denoising, native UHD). Use published renderer0.2.49 and shared1.1.7; no local source aliases are part of the package dependency contract.
+
+The localhost `?review=first-twelve` opt-in remains limited to local development. The website uses its separate server-side rollout and capability projection; the local viewer is not a production access-control mechanism. Adaptive controls from draftPR59 remain unreleased pending renderer qualification. This staged release does not close those open requirements.
+
+The catalogue retains eleven acquired assets and one deferred Gem with exact source/licence/hash records; binaries remain acquired separately and are excluded from npm. Known visual findings remain visible, including amber transport banding and static-only Fox. Do not label the local review catalogue a visual approval. Validate tests/coverage, changed-source LCOV, syntax/build/package integrity, exact-head CI and approved main/production CD before publication.
+
+## Acquisition review
+
+CodeQL alert 3 (`js/file-access-to-http`) traces the checked-in `model-library/catalogue.json` URL into the fixture downloader. This is intentional inbound asset acquisition, not transmission of local asset contents: the request is a GET without a body or file-derived headers, its HTTPS host is checked against `dl.polyhaven.org` and `raw.githubusercontent.com`, and redirects are rejected. Existing file contents are used only for local size/SHA-256 verification; manual assets never make network requests. The catalogue is public package content and contains reviewed source URLs, not credentials. Existing acquisition regressions cover rejected hosts/protocols, destination traversal, byte/hash bounds and manual-file network exclusion. The alert therefore does not demonstrate information disclosure. No scan rule or security gate is disabled.

package/model-library/acquire.js

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto';
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { resolve, relative, isAbsolute } from 'node:path';
+
+export function acquisitionPlan(assets, root) {
+  const plan=[];let total=0;
+  for(const asset of assets) {
+    if(!asset.entry) continue;
+    for(const file of asset.files) {
+      if(file.acquisition==='manual') {
+        if(file.url!==undefined)throw new Error('Manual asset must not specify a download URL.');
+      } else {
+        const url=new URL(file.url);
+        if(url.protocol!=='https:' || !['dl.polyhaven.org','raw.githubusercontent.com'].includes(url.hostname)) throw new Error('Unapproved asset source.');
+      }
+      const path=resolve(root,asset.key,file.path),rel=relative(resolve(root),path);
+      if(!rel || rel.startsWith('..') || isAbsolute(rel)) throw new Error('Unsafe asset destination.');
+      if(!Number.isSafeInteger(file.bytes)||file.bytes<1||file.bytes>100*1048576||!/^[a-f0-9]{64}$/.test(file.sha256)) throw new Error('Invalid asset bounds or hash.');
+      total+=file.bytes;
+      if(total>200*1048576) throw new Error('Fixture set exceeds the download budget.');
+      plan.push({...file,path,asset});
+    }
+  }
+  return plan;
+}
+export async function acquireFixtures({assets,root,fetch:request=globalThis.fetch}) {
+  const plan=acquisitionPlan(assets,root);
+  const verify=(file,data)=>data.length===file.bytes && createHash('sha256').update(data).digest('hex')===file.sha256;
+  // Two sequential workers keep network and memory use bounded.
+  let cursor=0;
+  async function worker() {
+    while(cursor<plan.length) {
+      const file=plan[cursor++];let existing;
+      try{existing=await readFile(file.path);}catch(error){if(error.code!=='ENOENT')throw error;}
+      if(existing){if(!verify(file,existing))throw new Error(`Existing file failed integrity: ${file.asset.key}`);continue;}
+      if(file.acquisition==='manual')throw new Error(`Manual asset required: ${file.asset.key}. Place the reviewed file at ${file.path} and retry.`);
+      const response=await request(file.url,{redirect:'error',signal:AbortSignal.timeout(60000),headers:{'User-Agent':'Plasius-Renderer-Asset-Research/1.0 (https://plasius.co.uk)'}});
+      if(!response.ok)throw new Error(`Asset download failed: ${response.status}`);
+      const reader=response.body.getReader(),chunks=[];let length=0;
+      try{while(true){const {done,value}=await reader.read();if(done)break;length+=value.length;
+        if(length>file.bytes)throw new Error('Downloaded file exceeds its reviewed byte size.');chunks.push(value);}}
+      finally{await reader.cancel();}
+      const data=Buffer.concat(chunks);
+      if(!verify(file,data))throw new Error(`Downloaded file failed integrity: ${file.asset.key}`);
+      await mkdir(resolve(file.path,'..'),{recursive:true});await writeFile(file.path,data,{flag:'wx'});
+    }
+  }
+  const results=await Promise.allSettled([worker(),worker()]);
+  const failure=results.find(r=>r.status==='rejected');if(failure)throw failure.reason;
+  for(const asset of assets.filter(a=>a.entry)) {
+    await writeFile(resolve(root,asset.key,'CREDITS.txt'),`${asset.name} — ${asset.authors}\n${asset.source_url}\n${asset.licence}\n${asset.licence_url}\nSource files unchanged; runtime framing only.\n`);
+  }
+  return {models:assets.filter(a=>a.entry).length,files:plan.length,bytes:plan.reduce((n,f)=>n+f.bytes,0)};
+}