@plasius/gpu-demo-viewer 0.2.3 → 0.4.0

package/CHANGELOG.md

@@ -18,6 +18,34 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 - **Security**
   - (placeholder)
 
+## [0.4.0] - 2026-10-21
+
+- **Added**
+  - Source-owned curated showcase diagnostics with integrity-pinned public assets, remote access checks, explicit consent, accessible preview/copy, and fail-closed provenance; no client-pixel capture or diagnostic transport.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.3.0] - 2026-10-21
+
+- **Added**
+  - Typed, data-only composite study definitions for host applications, sharing the four workshop arrangements without copying placements.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.2.3] - 2026-10-21
 
 - **Added**
@@ -338,3 +366,5 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 [0.2.1]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.1
 [0.2.2]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.2
 [0.2.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.3
+[0.3.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.3.0
+[0.4.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.0

package/NFR.md

@@ -34,3 +34,17 @@ entry surfaces.
 ## Model library review
 
 Inherits `gpu-demo.scene-fidelity.enabled` with a localhost-only fixture override. Model changes abort prior work and release its GPU resources. Downloads use trusted reviewed hosts, no redirects, strict byte/hash limits and bounded concurrency. Preserve source licences. Keep missing downloads and renderer defects visible. Keyboard, touch, reduced-motion and 320px layouts must remain usable.
+
+## Consented diagnostics
+
+Task #42 inherits `feedback.game-diagnostics.enabled` and the host-evaluated
+`feedback.game-diagnostics.attach` capability. The separate diagnostics mount
+has no local/query override. Source-owned native mounts use four SRI-pinned
+public baseline assets from published shared 1.3.0; fallback or unqualified
+surfaces are ineligible. No scene/canvas/DOM/debug snapshot crosses the
+diagnostics boundary. Timing is unknown rather than synthetic precision.
+No automatic collection, diagnostic request, cache, storage or analytics is
+permitted. Explicit preview/copy must remain keyboard accessible at 320px;
+consent/access changes and disposal cancel pending work. Preserve the ordinary
+structured-only reporting path on denial or rollback. Requirements and evidence
+are recorded in [the design](docs/consented-diagnostics.md) and ADR 0007.

package/README.md

@@ -11,8 +11,50 @@ A browser workshop for inspecting source models with the Plasius GPU renderer,
 plus a workspace launcher for the `gpu-*` package demos. The workshop provides
 camera gestures, progressive rendering, quality controls and model credits.
 
+## Optional consented renderer diagnostics
+
+Hosts can mount the fixed public baseline harbour and an accessible optional
+diagnostics panel through the focused subpath:
+
+```js
+import { mountDiagnosticShowcase } from '@plasius/gpu-demo-viewer/feedback-diagnostics';
+
+const viewer = await mountDiagnosticShowcase({
+  root: document.getElementById('scene'),
+  feedbackRoot: document.getElementById('feedback'),
+  resolveAccess: async () => {
+    const decisions = await readCurrentRemoteAccess(); // host source-of-truth evaluator
+    return {
+      featureEnabled: decisions.flags['feedback.game-diagnostics.enabled'] === true,
+      capabilityGranted: decisions.capabilities['feedback.game-diagnostics.attach'] === true,
+      sceneEnabled: decisions.flags['gpu-demo.scene-fidelity.enabled'] === true,
+    };
+  },
+});
+// On a pushed access/flag change: viewer.refreshAccess();
+// On route exit: viewer.destroy(); remount after changing the scene rollout.
+```
+
+Approved routes are exactly `/gpu-demo`, `/gpu-demo/`, and the workspace
+`/gpu-demo-viewer/showcase/` (including its `index.html`). The API accepts no
+surface ID, existing runtime, model, renderer loader or provenance override.
+Only the fixed four integrity-pinned procedural public assets and a live native
+WebGPU frame are eligible. Open model-library studies, generator and
+`/player-system` are excluded. This does not add controls to the existing demo
+launcher or grant a product capability; downstream site integration is tracked
+in site#1677.
+
+Consent starts unchecked. Preview and copy both verify current remote access;
+copy also verifies that the surface still matches the reviewed packet. Only
+coarse renderer/backend/viewport fields and closed codes leave this module;
+synthetic timing stays unknown. Nothing is automatically captured, sent,
+logged or stored. Clipboard denial leaves a selectable read-only preview.
+Disabling `feedback.game-diagnostics.enabled` restores structured-only reporting.
+See [the design and validation contract](docs/consented-diagnostics.md) and
+[ADR 0007](docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md).
+
 The npm package includes the viewer source, manifest and build-time acquisition
-helper. Model binaries are downloaded separately; they are not bundled in npm.
+helper and typed composite layout definitions. Model binaries are downloaded separately; they are not bundled in npm.
 
 ## Run the model workshop
 
@@ -202,3 +244,26 @@ npm 11.5.1 or newer, uses the protected `production` environment and
 short-lived npm OIDC with provenance, and has no long-lived npm write-token
 fallback. Rollback disables CD; it never rewrites published package history.
 <!-- END PLASIUS RELEASE INTEGRITY -->
+
+## Reuse composite layouts
+
+Import the small data-only subpath to offer the workshop's four arrangements in
+another application:
+
+```ts
+import { compositeStudyDefinitions } from '@plasius/gpu-demo-viewer/model-library/studies';
+
+const layouts = compositeStudyDefinitions();
+const interior = layouts.find(layout => layout.key === 'study-furnished-interior');
+// Each placement is [sourceKey, bottomCentreAnchor, longestDimension, yawRadians].
+console.log(interior?.placements);
+```
+
+Every call returns independent arrays. The import performs no asset requests,
+DOM work or GPU allocation. Resolve each source key against your admitted asset
+catalogue and pass its URL, complete integrity map and placement to
+`createSceneInspection` from `@plasius/gpu-shared/model-inspection`. Omit a layout
+if any source is unavailable. Keep source licences/credits, translate the supplied
+review copy as needed, and enforce the host application's access controls before
+loading models. Dimensions are illustrative scene units. See the
+[host integration contract](https://github.com/Plasius-LTD/gpu-demo-viewer/blob/main/docs/public-composite-definitions.md).

package/diagnostics/assets.js

@@ -0,0 +1,7 @@
+// Reviewed procedural public baseline from @plasius/gpu-shared@1.3.0.
+export const showcaseAssetIntegrity = Object.freeze({
+  "brigantine": "sha384-iK6Q3rfU7L0mtjE/pgOJWrAaS0X56xrnmomRuGQkHaA24TvKra4BffwwDjhOxaNG",
+  "lighthouse": "sha384-rm8vGSiRziQ4V3IAFGJNiZqEzyvEpJDg/FvZNa2MxOrThSQ9HYIEVGzz9dN0S8Qb",
+  "harbor-dock": "sha384-4FJzP1Rk0Ll0IokVbzBWpY06m6zfWAUeALPC7Lh7refibUKF3Am+JWStJSlcC7cV",
+  "shoreline": "sha384-/hcbf3/xM+bdGaDnQliQ2r45WoCmZ769s1fpKneZ6QhIZGTDPGH2YNDQjKKP3MMO"
+});

package/diagnostics/index.js

@@ -0,0 +1,20 @@
+import { createCuratedShowcaseSource } from './source.js';
+import { createFeedbackPanel } from './panel.js';
+
+export async function mountDiagnosticShowcase(options) {
+  const keys=['root','feedbackRoot','resolveAccess'];
+  if(!options || Object.getPrototypeOf(options)!==Object.prototype ||
+    Reflect.ownKeys(options).length!==keys.length || keys.some(key=>!Object.hasOwn(options,key)) ||
+    typeof options.resolveAccess!=='function')throw new TypeError('Invalid diagnostics mount options.');
+  const pathname=globalThis.location?.pathname;
+  if(!['/gpu-demo','/gpu-demo/','/gpu-demo-viewer/showcase/','/gpu-demo-viewer/showcase/index.html'].includes(pathname)) {
+    throw new TypeError('This route is not registered for diagnostics.');
+  }
+  let access;
+  try {access=await options.resolveAccess();}catch {access=undefined;}
+  const source=await createCuratedShowcaseSource({root:options.root,sceneEnabled:access?.sceneEnabled===true});
+  try {
+    const panel=createFeedbackPanel({root:options.feedbackRoot,source,resolveAccess:options.resolveAccess,initialAccess:access});
+    return Object.freeze({refreshAccess:panel.refreshAccess,destroy(){panel.destroy();source.destroy();}});
+  } catch {source.destroy();throw new Error('Diagnostics controls could not be mounted.');}
+}

package/diagnostics/panel.js

@@ -0,0 +1,88 @@
+import { parseFeedbackGameDiagnostics } from '@plasius/gpu-shared/feedback-diagnostics';
+
+const available = value => value?.featureEnabled===true && value?.capabilityGranted===true && value?.sceneEnabled===true;
+
+// Source is private to the public mount; this internal seam permits hostile-data
+// and race tests without making arbitrary registrations a supported public API.
+export function createFeedbackPanel({root,source,resolveAccess,initialAccess,document=globalThis.document,
+  copy=text=>globalThis.navigator.clipboard.writeText(text)}) {
+  const make=(tag,text)=>{const e=document.createElement(tag);if(text)e.textContent=text;return e;};
+  const section=make('section'),heading=make('h2','Optional renderer diagnostics');
+  const help=make('p','Share coarse renderer health only. No image, page content, names, locations or device identity is collected. Nothing is sent automatically.');
+  const label=make('label'),consent=make('input');consent.type='checkbox';consent.checked=false;
+  label.append(consent,make('span','I consent to preview and copy renderer diagnostics.'));
+  const prepare=make('button','Preview diagnostics'),copyButton=make('button','Copy diagnostics');
+  prepare.type=copyButton.type='button';copyButton.disabled=true;
+  const previewLabel=make('label','Diagnostics preview'),preview=make('textarea');
+  preview.readOnly=true;preview.value='';preview.rows=12;previewLabel.append(preview);
+  const status=make('p','Diagnostics are optional. Select consent to prepare a preview.');
+  status.setAttribute('role','status');status.setAttribute('aria-live','polite');
+  const style=make('style',`[data-feedback-diagnostics] {box-sizing:border-box;max-width:42rem;padding:1rem;color:#f4f7fb;background:#152234;font:1rem/1.5 system-ui;overflow-wrap:anywhere}
+    [data-feedback-diagnostics] label {display:block;min-height:44px;margin:.75rem 0}
+    [data-feedback-diagnostics] textarea {box-sizing:border-box;display:block;width:100%;max-width:100%;color:#f4f7fb;background:#101925;font:0.85rem/1.5 monospace}
+    [data-feedback-diagnostics] input {margin-right:.5rem}
+    [data-feedback-diagnostics] button {min-height:44px;margin:.25rem;padding:.5rem;color:#101925;background:#d7e7fa;border:2px solid #a3c6ed;border-radius:.25rem}
+    [data-feedback-diagnostics] :focus-visible {outline:3px solid #ffce64;outline-offset:3px}
+    [data-feedback-diagnostics] button:disabled {color:#526071;background:#d7e7fa}`);
+  section.setAttribute('data-feedback-diagnostics','');
+  section.hidden=!available(initialAccess);
+  section.append(style,heading,help,label,prepare,copyButton,previewLabel,status);root.append(section);
+  let revision=0,destroyed=false,text='';
+  function clear(message) {
+    revision++;text='';preview.value='';copyButton.disabled=true;
+    if(message)status.textContent=message;
+  }
+  function revoke(message) {consent.checked=false;section.hidden=true;clear(message);}
+  const consentChanged=()=>clear('Consent changed. Prepare a new preview before copying.');
+  async function permitted(token) {
+    try {
+      const decision=await resolveAccess();
+      if(destroyed || token!==revision || !consent.checked)return false;
+      if(!available(decision)){revoke('Diagnostics are unavailable. Ordinary bug reporting remains available.');return false;}
+      return true;
+    } catch {
+      if(!destroyed && token===revision)revoke('Diagnostics access could not be verified. Try again later.');
+      return false;
+    }
+  }
+  async function preparePreview() {
+    clear();const token=revision;
+    if(destroyed || !consent.checked){status.textContent='Select consent before preparing diagnostics.';return;}
+    if(!await permitted(token))return;
+    try {
+      const packet=await source.observe(true,()=>!destroyed && token===revision && consent.checked);
+      if(destroyed || token!==revision || !consent.checked)return;
+      if(!packet){revoke('This surface is not eligible for diagnostics.');return;}
+      text=JSON.stringify(parseFeedbackGameDiagnostics(packet),null,2);preview.value=text;
+      copyButton.disabled=false;status.textContent='Preview ready. Review these exact fields before copying.';
+    } catch {if(!destroyed && token===revision)revoke('Diagnostics could not be prepared safely.');}
+  }
+  async function copyPreview() {
+    if(destroyed || !text || !consent.checked)return;
+    const token=++revision;
+    if(!await permitted(token))return;
+    try {
+      const packet=await source.observe(true,()=>!destroyed && token===revision && consent.checked);
+      if(destroyed || token!==revision || !consent.checked)return;
+      if(!packet || JSON.stringify(parseFeedbackGameDiagnostics(packet),null,2)!==text){
+        clear('The surface changed. Prepare and review a new preview.');return;
+      }
+      // No await between the last consent check and invoking the explicit copy.
+      await copy(text);
+      if(!destroyed && token===revision)status.textContent='Diagnostics copied. Paste them only where you choose.';
+    } catch {if(!destroyed && token===revision)status.textContent='Copy unavailable. Select the preview text and copy it manually.';}
+  }
+  consent.addEventListener('change',consentChanged);
+  prepare.addEventListener('click',preparePreview);copyButton.addEventListener('click',copyPreview);
+  return Object.freeze({
+    async refreshAccess() {
+      revoke('Access changed. Select consent and prepare a new preview.');const token=revision;
+      try {
+        const decision=await resolveAccess();
+        if(!destroyed && token===revision)section.hidden=!available(decision);
+      } catch { /* Missing remote decisions leave the controls hidden. */ }
+    },
+    destroy() {if(destroyed)return;destroyed=true;revoke();consent.removeEventListener('change',consentChanged);
+      prepare.removeEventListener('click',preparePreview);copyButton.removeEventListener('click',copyPreview);section.remove();},
+  });
+}

package/diagnostics/source.js

@@ -0,0 +1,39 @@
+import { showcaseAssetIntegrity } from './assets.js';
+
+// Internal mount seam for tests. The public entrypoint never accepts loaders or
+// an existing runtime. Registration is a consequence of this fixed source mount.
+export async function createCuratedShowcaseSource({root,sceneEnabled,
+  loadShared=()=>import('@plasius/gpu-shared'),
+  loadRenderer=()=>import('@plasius/gpu-renderer')}) {
+  let destroyed=false, runtime;
+  if(sceneEnabled===true) {
+    const shared=await loadShared();
+    const integrity=Object.fromEntries(Object.entries(showcaseAssetIntegrity).map(
+      ([key,digest])=>[String(shared.resolveShowcaseAssetUrl(key)),digest]));
+    runtime=await shared.mountGpuShowcase({root,focus:'integrated',
+      packageName:'@plasius/gpu-demo-viewer',
+      __featureFlags:{'gpu-demo.scene-fidelity.enabled':true,gpu_showcase_realistic_models_v1:false,
+        'gpu.model.conversion.enabled':false},gltfLoadOptions:{integrity}});
+  }
+  function eligible() {
+    const state=runtime?.state;
+    return !destroyed && state?.assetCatalog?.mode==='modeled-baseline' &&
+      state.assetCatalog.fallbackReason===null && state.rendererUnavailable!==true &&
+      state.nativeRenderer?.backend==='webgpu-raster' && state.nativeRenderer.submittedFrames>0;
+  }
+  return Object.freeze({
+    async observe(consent,isCurrent=()=>true) {
+      if(consent!==true || !isCurrent() || !eligible())return null;
+      const {createFeedbackGameDiagnosticSnapshot}=await loadRenderer();
+      if(!isCurrent() || !eligible())return null;
+      const frame=runtime.state.nativeRenderer;
+      // Never pass the frame, canvas, telemetry, raw errors or other scene state
+      // across the renderer diagnostics boundary. Synthetic timing stays unknown.
+      return createFeedbackGameDiagnosticSnapshot({featureEnabled:true,capabilityGranted:true,
+        consentConfirmed:true,surfaceId:'site.gpu-demo',renderer:'webgpu',backend:'browser',
+        viewportWidth:frame.width,viewportHeight:frame.height,frameRate:undefined,frameTimeMs:undefined,
+        featureIds:['renderer.frame-loop'],counters:[],errorCodes:[]});
+    },
+    destroy() { if(destroyed)return;destroyed=true;runtime?.destroy();runtime=undefined; },
+  });
+}

package/docs/adrs/adr-0006-composite-study-consumer.md

@@ -19,3 +19,12 @@ browser review with the registry package before release.
 The existing scene-fidelity feature flag and route capability continue to govern
 hosted product access. This local review does not add public-site navigation or
 change the existing localhost review gate.
+
+## Host-consumer contract — 21 October 2026
+
+Story site#2321 / viewer Task #83 adds the typed `model-library/studies` subpath.
+A pure function returns fresh copies of the same four layout definitions used by
+the workshop. This keeps placement ownership here without coupling host apps to
+the workshop UI, catalogue loading or its localhost gate. Hosts resolve their
+own admitted sources and retain capability/rollout ownership. Shared inspection
+still owns all rendering and resource limits. The local gate remains unchanged.

package/docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md

@@ -0,0 +1,42 @@
+# ADR 0007: Consented diagnostics from a source-owned curated showcase
+
+Status: accepted for Task gpu-demo-viewer#42, Story site#1671, Feature site#1665.
+
+The shared registration contract and renderer bucketing API do not establish
+that a caller's arbitrary canvas or scene is curated. The open model library
+can contain private or unqualified assets. Existing debug snapshots contain
+coordinates, names and broad runtime state.
+
+The new `feedback-diagnostics` package subpath owns a fixed baseline showcase
+mount. Its public API accepts only render/control roots and a remote access
+resolver. Source registration is fixed to `site.gpu-demo` on exact approved
+routes; generator, `/player-system`, model-library and arbitrary runtime
+injection are excluded. Four procedural public shared-package assets are
+integrity-pinned to the published 1.3.0 release. Missing assets, fallback,
+unsubmitted frames, unavailable renderers and destroyed mounts fail closed.
+The raw runtime stays in a closure. Only explicit native backend and viewport
+numbers reach the released renderer bucketing helper. Synthetic timing is
+reported as unknown. The resulting packet is validated by the shared parser.
+
+The host resolves `feedback.game-diagnostics.enabled`, capability
+`feedback.game-diagnostics.attach`, and `gpu-demo.scene-fidelity.enabled`.
+Publishing does not grant access. No environment or query override exists.
+Explicit consent and preview precede observation. Copy rechecks access and
+surface eligibility, and requires a packet identical to the reviewed preview.
+Revocation, access refresh and disposal invalidate pending asynchronous work.
+Disable the diagnostics flag to roll back; ordinary structured reports remain.
+Hosts must call `refreshAccess()` on pushed control changes and destroy on route
+exit. Remount after changing the scene rollout decision.
+
+Accepting caller-supplied IDs/provenance or filtering generic debug snapshots
+was rejected because neither proves a curated source. Adding capture or
+transport was rejected because the Feature prohibits client pixels. The new
+boundary exposes an accessible optional preview/copy UI and performs no upload,
+storage, diagnostic logging or automatic collection.
+
+Tests cover denial/allow/rollback, exact routes, source provenance, immutable
+schema output, forbidden fields, race cancellation and lifetime. Browser checks
+cover explicit user flow, mobile/keyboard access and network/cache isolation.
+Release uses PR CI followed by exact-main `cd.yml` in `production`; verify the
+npm artifact before downstream site#1677 adopts it. No backend or secret mapping
+changes occur in this static package release.

package/docs/adrs/index.md

@@ -9,3 +9,4 @@
 
 - [ADR 0005: Build-time model acquisition subpath](adr-0005-build-time-model-acquisition-subpath.md)
 - [ADR 0006: Composite study consumer](adr-0006-composite-study-consumer.md)
+- [ADR 0007: Consented curated showcase diagnostics](adr-0007-consented-curated-showcase-diagnostics.md)

package/docs/consented-diagnostics.md

@@ -0,0 +1,82 @@
+# Consented showcase diagnostics
+
+Design for gpu-demo-viewer#42, Story site#1671, Feature site#1665.
+
+Only a mount owned by this package can register `site.gpu-demo`. A new focused
+entrypoint will mount the fixed baseline harbour using the published shared
+runtime, four integrity-pinned procedural public assets, and the native renderer.
+It will retain the runtime privately. It will accept no caller-provided surface
+ID, provenance, scene, model, renderer loader, snapshot, warning or URL. Open
+model-library studies, generator, arbitrary canvases and `/player-system` remain
+ineligible. Asset failure, fallback rendering, no submitted frame, disposal or
+unknown provenance disables diagnostics.
+
+The host supplies a fresh remote decision for `feedback.game-diagnostics.enabled`,
+`feedback.game-diagnostics.attach`, and `gpu-demo.scene-fidelity.enabled`.
+Missing decisions deny access. This package adds no service endpoint or local
+production override. The panel requires explicit unchecked consent and a preview
+action before reading observations. Copy rechecks remote access; consent changes,
+refresh, disposal and races clear or invalidate pending work. Normal structured
+reporting is independent. Rollback disables the diagnostics flag.
+
+Only native renderer/backend and coarse viewport buckets are observed. Timing is
+unknown because existing showcase telemetry includes synthetic stress values.
+No raw scene/debug snapshot is passed to the renderer helper. That released helper
+constructs the closed packet, then the shared parser validates it. Preview is
+read-only text; copying is an explicit clipboard operation. No automatic capture,
+upload, download, browser storage, cache entry, analytics or log is introduced.
+
+Alternatives: accepting any source-tagged object would permit forged provenance;
+using `render_game_to_text` would disclose scene details; collecting images would
+violate the Feature. This narrow mount adds a supported validation surface rather
+than assuming every existing demo is eligible. Site integration/reconstruction is
+the separate downstream site#1677.
+
+Validation: tests derive from deny/allow/rollback/provenance/consent/lifetime
+requirements, with changed-source LCOV, static package checks and real browser
+keyboard/320px/no-pixel network/storage/cache checks. Release only via PR CI and
+exact-main `cd.yml` in `production`, then verify npm artifact and provenance.
+
+## Dependency and compatibility decision
+
+The direct shared dependency changes from `^1.2.0` (locked 1.2.0) to exact 1.3.0.
+This adopts the published diagnostics contract verified under shared#101 and
+fixes the bytes used by the four SRI entries. The renderer remains locked to
+0.2.54, with its existing compatible manifest range. Shared 1.3.0 brings its
+declared model-conversion dependency graph; this mount explicitly disables
+conversion and lazily loads the shared runtime only for a positive scene
+decision. No unrelated direct dependency is updated. Package audits and
+signature/attestation verification cover the new locked graph. A future shared
+version requires an explicit asset/hash compatibility review rather than
+silently accepting changed assets.
+
+## Browser qualification — 21 October 2026
+
+An isolated in-app Chromium tab mounted the actual published shared/native
+WebGPU renderer, with the four SRI-pinned assets. The local harness supplied
+test access decisions only; no production controls changed. Keyboard activation
+prepared the closed packet; explicit Copy reported success. No-consent preview
+was denied. Revoking access immediately before Copy cleared preview and consent;
+unchecking consent and disposal also removed retained diagnostics. A 320px-wide
+panel had no horizontal overflow. This is actual narrow-container validation,
+not an emulated 320px device viewport or a full multi-browser qualification.
+
+The harness trapped canvas export/readback and display capture. It recorded
+four public-asset fetches at mount, zero later fetches, zero non-GET requests,
+zero request bodies and zero pixel reads. Resource entries stayed at 36 across
+preview/copy/revocation; localStorage, sessionStorage, Cache Storage and IndexedDB
+stayed empty. This combines browser observations with source/invariant tests;
+it does not claim arbitrary third-party host code cannot perform network I/O.
+No Chrome/Firefox/Safari cross-browser pass is inferred. Clipboard denial has a
+tested selectable-preview fallback.
+
+NFR disposition: security/privacy checked by integrity, closed packet, no-pixel,
+rollback and race tests plus browser isolation evidence; accessibility checked
+for labels, keyboard activation, live status, visible focus, contrast and 44px
+action targets; performance checked through lazy loading and absence of new
+sampling loops; reliability/reproducibility checked by clean install, build,
+asset hashes and lifetime tests; maintainability/testability checked by ADR,
+focused public entrypoint and changed-source LCOV; observability uses fixed
+user-visible status messages without raw diagnostics logging. SEO is N/A for a
+package subpath that creates no public route. Backend sensitive-environment
+mapping is N/A because no backend or Azure resource changes are made.

package/docs/public-composite-definitions.md

@@ -0,0 +1,30 @@
+# Composite definitions for host applications
+
+Tracked work: site Story #2321 and viewer Task #83.
+
+Expose the four existing qualified arrangements through the typed package
+subpath `@plasius/gpu-demo-viewer/model-library/studies`. A pure
+`compositeStudyDefinitions()` function returns fresh definitions containing the
+stable key, source keys, bottom-centre anchors, longest dimensions, yaw and review
+copy. Extract the existing definitions without changing any value. The workshop
+and website then share one owner for placement.
+
+The module must import no renderer, DOM, acquisition helper or local-review
+bootstrap, and perform no I/O. Return independent arrays so consumer edits do not
+alter another call or the workshop. Hosts resolve keys against their own admitted
+catalogue, translate display copy, retain every credit/integrity entry, and apply
+their capability/feature controls before calling released shared scene inspection.
+The definitions are layout data, not entitlement decisions or additional models.
+
+Parent Feature site#1170 / Epic site#2271 and inherited flag
+`gpu-demo.scene-fidelity.enabled` apply. The local review gate stays unchanged;
+public access is governed by the website's existing studio capability and GPU
+runtime. Rollback uses those stored rules or reverts the consuming package version.
+
+Before implementation, require tests for the supported export, its type/file
+contract, exact unchanged scene membership and placement, isolated return values,
+and continued workshop composition. Keep existing rendering/credit tests. Update
+consumer README, Unreleased changelog and ADR0006. Run all package validation and
+coverage with changed-source LCOV, publish only through approved main/production
+CD after CI, and compare npm contents to the attested release artifact before
+the site consumes the new export.

package/model-library/scenes.js

@@ -1,51 +1,8 @@
 import { fixtureRequest } from './controller.js';
-
-const definitions = [
-  { key: 'study-furnished-interior', name: 'Furnished interior',
-    renderer_target: 'Compare woven fabric, silk, leather, wicker and aged wood in one arrangement.',
-    preparation: 'Inspect relative scale, fabric response and contact shadows. Sizes are chosen scene units, not verified physical dimensions.',
-    placements: [
-      ['SheenWoodLeatherSofa', [0, 0, -.8], 2.4, 0],
-      ['vintage_cabinet_01', [-2.15, 0, -.8], 1.7, 0],
-      ['SpecularSilkPouf', [.55, 0, .85], .7, 0],
-      ['wicker_basket_01', [1.6, 0, -.3], .6, 0],
-    ] },
-  { key: 'study-workshop', name: 'Workshop still life',
-    renderer_target: 'Compare worked metal, rough timber and worn surfaces under shared light.',
-    preparation: 'Inspect object contact and the contrast between brass, painted metal and timber. These are static review arrangements.',
-    placements: [
-      ['spinning_wheel_01', [-1.1, 0, -.65], 1.8, 0],
-      ['wine_barrel_01', [1.15, 0, -.7], 1.25, 0],
-      ['wooden_crate_02', [0, 0, .7], 1.2, 0],
-      ['bench_vice_01', [-1.3, 0, 1.05], .55, .3],
-      // Crate lid height from the original accessor bounds and lid translation,
-      // uniformly scaled to its chosen 1.2-unit longest dimension.
-      ['brass_blowtorch', [0, .47735, .7], .55, 0],
-    ] },
-  { key: 'study-relic-collection', name: 'Relic collection',
-    renderer_target: 'Compare carved stone, chess pieces and aged metal under shared light.',
-    preparation: 'Inspect silhouette, surface detail and contact shadows across five originals. Dimensions are illustrative scene units.',
-    placements: [
-      ['gothic_statue', [-1.2, 0, -.7], 1.8, .15],
-      ['marble_bust_01', [.65, 0, -.7], .85, -.25],
-      ['chess_set', [0, 0, .8], 1.15, .1],
-      ['kite_shield', [1.5, 0, .15], 1.15, -.4],
-      ['antique_estoc', [-1.5, 0, .8], 1.25, .25],
-    ] },
-  { key: 'study-tool-chest', name: 'Tool-chest arrangement',
-    renderer_target: 'Compare painted metal, rust and wooden handles in one working collection.',
-    preparation: 'Inspect relative scale, worn surfaces and small contact shadows. These are static originals placed on a shared inspection floor.',
-    placements: [
-      ['metal_tool_chest', [0, 0, -.8], 1.7, 0],
-      ['hand_plane_no4', [-.65, 0, .8], .5, -.25],
-      ['vintage_hand_drill', [.25, 0, .9], .55, .3],
-      ['rusted_spade_01', [1.25, 0, .05], 1.5, -.3],
-      ['can_rusted', [-1.25, 0, .2], .4, 0],
-    ] },
-];
+import { compositeStudyDefinitions } from './studies.js';
 
 export function compositeStudies(assets) {
-  return definitions.flatMap(({ placements, ...definition }) => {
+  return compositeStudyDefinitions().flatMap(({ placements, ...definition }) => {
     const models = placements.map(([key, anchor, size, yaw]) => ({
       asset: assets.find(a => a.key === key), anchor: [...anchor], size, yaw,
     }));

package/model-library/studies.d.ts

@@ -0,0 +1,10 @@
+/** Layout data only. Host applications own assets, credits and access decisions. */
+export interface CompositeStudyDefinition {
+  key: string;
+  name: string;
+  renderer_target: string;
+  preparation: string;
+  /** Source key, bottom-centre anchor, longest dimension in scene units, Y rotation in radians. */
+  placements: [string, [number, number, number], number, number][];
+}
+export function compositeStudyDefinitions(): CompositeStudyDefinition[];

package/model-library/studies.js

@@ -0,0 +1,51 @@
+const definitions = [
+  { key: 'study-furnished-interior', name: 'Furnished interior',
+    renderer_target: 'Compare woven fabric, silk, leather, wicker and aged wood in one arrangement.',
+    preparation: 'Inspect relative scale, fabric response and contact shadows. Sizes are chosen scene units, not verified physical dimensions.',
+    placements: [
+      ['SheenWoodLeatherSofa', [0, 0, -.8], 2.4, 0],
+      ['vintage_cabinet_01', [-2.15, 0, -.8], 1.7, 0],
+      ['SpecularSilkPouf', [.55, 0, .85], .7, 0],
+      ['wicker_basket_01', [1.6, 0, -.3], .6, 0],
+    ] },
+  { key: 'study-workshop', name: 'Workshop still life',
+    renderer_target: 'Compare worked metal, rough timber and worn surfaces under shared light.',
+    preparation: 'Inspect object contact and the contrast between brass, painted metal and timber. These are static review arrangements.',
+    placements: [
+      ['spinning_wheel_01', [-1.1, 0, -.65], 1.8, 0],
+      ['wine_barrel_01', [1.15, 0, -.7], 1.25, 0],
+      ['wooden_crate_02', [0, 0, .7], 1.2, 0],
+      ['bench_vice_01', [-1.3, 0, 1.05], .55, .3],
+      // Crate lid height from the original accessor bounds and lid translation,
+      // uniformly scaled to its chosen 1.2-unit longest dimension.
+      ['brass_blowtorch', [0, .47735, .7], .55, 0],
+    ] },
+  { key: 'study-relic-collection', name: 'Relic collection',
+    renderer_target: 'Compare carved stone, chess pieces and aged metal under shared light.',
+    preparation: 'Inspect silhouette, surface detail and contact shadows across five originals. Dimensions are illustrative scene units.',
+    placements: [
+      ['gothic_statue', [-1.2, 0, -.7], 1.8, .15],
+      ['marble_bust_01', [.65, 0, -.7], .85, -.25],
+      ['chess_set', [0, 0, .8], 1.15, .1],
+      ['kite_shield', [1.5, 0, .15], 1.15, -.4],
+      ['antique_estoc', [-1.5, 0, .8], 1.25, .25],
+    ] },
+  { key: 'study-tool-chest', name: 'Tool-chest arrangement',
+    renderer_target: 'Compare painted metal, rust and wooden handles in one working collection.',
+    preparation: 'Inspect relative scale, worn surfaces and small contact shadows. These are static originals placed on a shared inspection floor.',
+    placements: [
+      ['metal_tool_chest', [0, 0, -.8], 1.7, 0],
+      ['hand_plane_no4', [-.65, 0, .8], .5, -.25],
+      ['vintage_hand_drill', [.25, 0, .9], .55, .3],
+      ['rusted_spade_01', [1.25, 0, .05], 1.5, -.3],
+      ['can_rusted', [-1.25, 0, .2], .4, 0],
+    ] },
+];
+
+/** Independent layout data; the host resolves sources and controls access. */
+export function compositeStudyDefinitions() {
+  return definitions.map(({ placements, ...definition }) => ({
+    ...definition,
+    placements: placements.map(([key, anchor, size, yaw]) => [key, [...anchor], size, yaw]),
+  }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-demo-viewer",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "type": "module",
   "description": "Root validation viewer for Plasius gpu-* demos.",
   "license": "Apache-2.0",
@@ -19,7 +19,12 @@
     ".": "./viewer-manifest.js",
     "./viewer-manifest": "./viewer-manifest.js",
     "./package.json": "./package.json",
-    "./model-library/acquire": "./model-library/acquire.js"
+    "./model-library/acquire": "./model-library/acquire.js",
+    "./model-library/studies": {
+      "types": "./model-library/studies.d.ts",
+      "default": "./model-library/studies.js"
+    },
+    "./feedback-diagnostics": "./diagnostics/index.js"
   },
   "files": [
     "assets/",
@@ -35,7 +40,8 @@
     "main.js",
     "styles.css",
     "viewer-manifest.js",
-    "model-library/"
+    "model-library/",
+    "diagnostics/"
   ],
   "engines": {
     "node": ">=24"
@@ -47,7 +53,7 @@
     "lint": "npm run typecheck",
     "pack:check": "node scripts/verify-public-package.cjs",
     "prepublishOnly": "npm run build && npm run pack:check",
-    "typecheck": "node --check index.js && node --check main.js && node --check viewer-manifest.js && node --check showcase/index.js && node --check showcase/main.js && node --check wavefront/main.js && node --check model-library/main.js && node --check model-library/controller.js && node --check model-library/scenes.js && node --check model-library/acquire.js && node --check model-library/rollout.js",
+    "typecheck": "node --check index.js && node --check main.js && node --check viewer-manifest.js && node --check showcase/index.js && node --check showcase/main.js && node --check wavefront/main.js && node --check model-library/main.js && node --check model-library/controller.js && node --check model-library/scenes.js && node --check model-library/acquire.js && node --check model-library/rollout.js && node --check model-library/studies.js && node --check diagnostics/index.js && node --check diagnostics/source.js && node --check diagnostics/panel.js && node --check diagnostics/assets.js",
     "test": "node --test",
     "models:download": "node scripts/acquire-model-library.mjs",
     "models:dev": "vite --config model-library/vite.config.js",
@@ -55,7 +61,7 @@
   },
   "dependencies": {
     "@plasius/gpu-renderer": "^0.2.54",
-    "@plasius/gpu-shared": "^1.2.0"
+    "@plasius/gpu-shared": "1.3.0"
   },
   "devDependencies": {
     "c8": "^11.0.0",