@plasius/gpu-demo-viewer 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -18,6 +18,34 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 - **Security**
   - (placeholder)
 
+## [0.4.1] - 2026-10-23
+
+- **Added**
+  - Approved unsigned legal templates and security/contribution policies in the npm artifact, with fail-closed compliance checks, pinned template hashes and regression tests.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.4.0] - 2026-10-21
+
+- **Added**
+  - Source-owned curated showcase diagnostics with integrity-pinned public assets, remote access checks, explicit consent, accessible preview/copy, and fail-closed provenance; no client-pixel capture or diagnostic transport.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.3.0] - 2026-10-21
 
 - **Added**
@@ -353,3 +381,5 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 [0.2.2]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.2
 [0.2.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.3
 [0.3.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.3.0
+[0.4.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.0
+[0.4.1]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.1

package/CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing to @plasius/gpu-demo-viewer
+
+This workspace utility exists to accelerate validation across the Plasius
+`gpu-*` packages.
+
+## Local Development
+
+### Prerequisites
+
+- Node.js 24 (`nvm use`)
+- npm
+
+### Validate
+
+```bash
+npm run lint
+npm test
+```
+
+### Demo
+
+```bash
+npm run demo
+```
+
+Then open `http://localhost:8000/gpu-demo-viewer/`.
+
+## Expectations
+
+- Keep the viewer aligned with the real package demos; do not let the manifest drift.
+- Add or update tests when browser target paths or shared showcase assets change.
+- Update `README.md` and `CHANGELOG.md` whenever demo behavior or structure changes.

package/NFR.md

@@ -34,3 +34,17 @@ entry surfaces.
 ## Model library review
 
 Inherits `gpu-demo.scene-fidelity.enabled` with a localhost-only fixture override. Model changes abort prior work and release its GPU resources. Downloads use trusted reviewed hosts, no redirects, strict byte/hash limits and bounded concurrency. Preserve source licences. Keep missing downloads and renderer defects visible. Keyboard, touch, reduced-motion and 320px layouts must remain usable.
+
+## Consented diagnostics
+
+Task #42 inherits `feedback.game-diagnostics.enabled` and the host-evaluated
+`feedback.game-diagnostics.attach` capability. The separate diagnostics mount
+has no local/query override. Source-owned native mounts use four SRI-pinned
+public baseline assets from published shared 1.3.0; fallback or unqualified
+surfaces are ineligible. No scene/canvas/DOM/debug snapshot crosses the
+diagnostics boundary. Timing is unknown rather than synthetic precision.
+No automatic collection, diagnostic request, cache, storage or analytics is
+permitted. Explicit preview/copy must remain keyboard accessible at 320px;
+consent/access changes and disposal cancel pending work. Preserve the ordinary
+structured-only reporting path on denial or rollback. Requirements and evidence
+are recorded in [the design](docs/consented-diagnostics.md) and ADR 0007.

package/README.md

@@ -11,9 +11,76 @@ A browser workshop for inspecting source models with the Plasius GPU renderer,
 plus a workspace launcher for the `gpu-*` package demos. The workshop provides
 camera gestures, progressive rendering, quality controls and model credits.
 
+## Optional consented renderer diagnostics
+
+Hosts can mount the fixed public baseline harbour and an accessible optional
+diagnostics panel through the focused subpath:
+
+```js
+import { mountDiagnosticShowcase } from '@plasius/gpu-demo-viewer/feedback-diagnostics';
+
+const viewer = await mountDiagnosticShowcase({
+  root: document.getElementById('scene'),
+  feedbackRoot: document.getElementById('feedback'),
+  resolveAccess: async () => {
+    const decisions = await readCurrentRemoteAccess(); // host source-of-truth evaluator
+    return {
+      featureEnabled: decisions.flags['feedback.game-diagnostics.enabled'] === true,
+      capabilityGranted: decisions.capabilities['feedback.game-diagnostics.attach'] === true,
+      sceneEnabled: decisions.flags['gpu-demo.scene-fidelity.enabled'] === true,
+    };
+  },
+});
+// On a pushed access/flag change: viewer.refreshAccess();
+// On route exit: viewer.destroy(); remount after changing the scene rollout.
+```
+
+Approved routes are exactly `/gpu-demo`, `/gpu-demo/`, and the workspace
+`/gpu-demo-viewer/showcase/` (including its `index.html`). The API accepts no
+surface ID, existing runtime, model, renderer loader or provenance override.
+Only the fixed four integrity-pinned procedural public assets and a live native
+WebGPU frame are eligible. Open model-library studies, generator and
+`/player-system` are excluded. This does not add controls to the existing demo
+launcher or grant a product capability; downstream site integration is tracked
+in site#1677.
+
+Consent starts unchecked. Preview and copy both verify current remote access;
+copy also verifies that the surface still matches the reviewed packet. Only
+coarse renderer/backend/viewport fields and closed codes leave this module;
+synthetic timing stays unknown. Nothing is automatically captured, sent,
+logged or stored. Clipboard denial leaves a selectable read-only preview.
+Disabling `feedback.game-diagnostics.enabled` restores structured-only reporting.
+See [the design and validation contract](docs/consented-diagnostics.md) and
+[ADR 0007](docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md).
+
 The npm package includes the viewer source, manifest and build-time acquisition
 helper and typed composite layout definitions. Model binaries are downloaded separately; they are not bundled in npm.
 
+## Package compliance documents
+
+The npm artifact includes `LICENSE`, `SECURITY.md`, `CONTRIBUTING.md` and the
+unsigned [CLA guide](legal/CLA.md), [Individual CLA](legal/INDIVIDUAL_CLA.md)
+and [Corporate CLA](legal/CORPORATE_CLA.md) templates from the approved schema
+baseline. Only package-name references are adapted. These documents describe
+contribution and reporting policies; model-specific credits and licences remain
+with their existing catalogue records.
+
+Run `npm ci`, `npm run build`, `npm test`, `npm run test:coverage` and
+`npm run pack:check` to validate the contract. The pack check requires non-empty
+regular compliance files and a real `legal/` directory, then verifies their
+presence in the actual npm dry-run manifest. SHA-256 checks pin the exact bytes
+of all three templates to schema commit `d8f8eb430c77b8a98da496a3d8382d73d6297394`
+after package-name substitution. Future legal changes require explicit review
+of the approved baseline, pinned digests and regression expectations together.
+CI and the approved CD path run this check. It fails on missing documents,
+omitted package entries, symlinks, altered template terms or unexpected legal
+files in the artifact. The package allowlist names each legal template individually.
+
+Signed agreements and contributor acceptance records belong in the approved
+access-controlled system outside source control. Never add them to this
+repository, package or public build artifacts. See [ADR 0008](docs/adrs/adr-0008-public-compliance-artifact-contract.md)
+for the packaging decision and release checks.
+
 ## Run the model workshop
 
 Use Node.js 24 or later, npm, and a WebGPU-capable browser on localhost or HTTPS.

package/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+We currently support the latest major version of this project. Older versions may not receive security updates.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately by emailing us at [security@plasius.co.uk](mailto:security@plasius.co.uk). Please do not create a public issue for security-related matters.
+
+## Response Timeline
+
+We aim to acknowledge your report within 2 business days and to provide a more detailed response (including next steps and, if applicable, a timeline for a fix) within 7 business days.
+
+## Disclosure Policy
+
+We request that you give us the opportunity to address the vulnerability before publicly disclosing it. We will coordinate with you on public disclosure once a fix is available and deployed.

package/diagnostics/assets.js

@@ -0,0 +1,7 @@
+// Reviewed procedural public baseline from @plasius/gpu-shared@1.3.0.
+export const showcaseAssetIntegrity = Object.freeze({
+  "brigantine": "sha384-iK6Q3rfU7L0mtjE/pgOJWrAaS0X56xrnmomRuGQkHaA24TvKra4BffwwDjhOxaNG",
+  "lighthouse": "sha384-rm8vGSiRziQ4V3IAFGJNiZqEzyvEpJDg/FvZNa2MxOrThSQ9HYIEVGzz9dN0S8Qb",
+  "harbor-dock": "sha384-4FJzP1Rk0Ll0IokVbzBWpY06m6zfWAUeALPC7Lh7refibUKF3Am+JWStJSlcC7cV",
+  "shoreline": "sha384-/hcbf3/xM+bdGaDnQliQ2r45WoCmZ769s1fpKneZ6QhIZGTDPGH2YNDQjKKP3MMO"
+});

package/diagnostics/index.js

@@ -0,0 +1,20 @@
+import { createCuratedShowcaseSource } from './source.js';
+import { createFeedbackPanel } from './panel.js';
+
+export async function mountDiagnosticShowcase(options) {
+  const keys=['root','feedbackRoot','resolveAccess'];
+  if(!options || Object.getPrototypeOf(options)!==Object.prototype ||
+    Reflect.ownKeys(options).length!==keys.length || keys.some(key=>!Object.hasOwn(options,key)) ||
+    typeof options.resolveAccess!=='function')throw new TypeError('Invalid diagnostics mount options.');
+  const pathname=globalThis.location?.pathname;
+  if(!['/gpu-demo','/gpu-demo/','/gpu-demo-viewer/showcase/','/gpu-demo-viewer/showcase/index.html'].includes(pathname)) {
+    throw new TypeError('This route is not registered for diagnostics.');
+  }
+  let access;
+  try {access=await options.resolveAccess();}catch {access=undefined;}
+  const source=await createCuratedShowcaseSource({root:options.root,sceneEnabled:access?.sceneEnabled===true});
+  try {
+    const panel=createFeedbackPanel({root:options.feedbackRoot,source,resolveAccess:options.resolveAccess,initialAccess:access});
+    return Object.freeze({refreshAccess:panel.refreshAccess,destroy(){panel.destroy();source.destroy();}});
+  } catch {source.destroy();throw new Error('Diagnostics controls could not be mounted.');}
+}

package/diagnostics/panel.js

@@ -0,0 +1,88 @@
+import { parseFeedbackGameDiagnostics } from '@plasius/gpu-shared/feedback-diagnostics';
+
+const available = value => value?.featureEnabled===true && value?.capabilityGranted===true && value?.sceneEnabled===true;
+
+// Source is private to the public mount; this internal seam permits hostile-data
+// and race tests without making arbitrary registrations a supported public API.
+export function createFeedbackPanel({root,source,resolveAccess,initialAccess,document=globalThis.document,
+  copy=text=>globalThis.navigator.clipboard.writeText(text)}) {
+  const make=(tag,text)=>{const e=document.createElement(tag);if(text)e.textContent=text;return e;};
+  const section=make('section'),heading=make('h2','Optional renderer diagnostics');
+  const help=make('p','Share coarse renderer health only. No image, page content, names, locations or device identity is collected. Nothing is sent automatically.');
+  const label=make('label'),consent=make('input');consent.type='checkbox';consent.checked=false;
+  label.append(consent,make('span','I consent to preview and copy renderer diagnostics.'));
+  const prepare=make('button','Preview diagnostics'),copyButton=make('button','Copy diagnostics');
+  prepare.type=copyButton.type='button';copyButton.disabled=true;
+  const previewLabel=make('label','Diagnostics preview'),preview=make('textarea');
+  preview.readOnly=true;preview.value='';preview.rows=12;previewLabel.append(preview);
+  const status=make('p','Diagnostics are optional. Select consent to prepare a preview.');
+  status.setAttribute('role','status');status.setAttribute('aria-live','polite');
+  const style=make('style',`[data-feedback-diagnostics] {box-sizing:border-box;max-width:42rem;padding:1rem;color:#f4f7fb;background:#152234;font:1rem/1.5 system-ui;overflow-wrap:anywhere}
+    [data-feedback-diagnostics] label {display:block;min-height:44px;margin:.75rem 0}
+    [data-feedback-diagnostics] textarea {box-sizing:border-box;display:block;width:100%;max-width:100%;color:#f4f7fb;background:#101925;font:0.85rem/1.5 monospace}
+    [data-feedback-diagnostics] input {margin-right:.5rem}
+    [data-feedback-diagnostics] button {min-height:44px;margin:.25rem;padding:.5rem;color:#101925;background:#d7e7fa;border:2px solid #a3c6ed;border-radius:.25rem}
+    [data-feedback-diagnostics] :focus-visible {outline:3px solid #ffce64;outline-offset:3px}
+    [data-feedback-diagnostics] button:disabled {color:#526071;background:#d7e7fa}`);
+  section.setAttribute('data-feedback-diagnostics','');
+  section.hidden=!available(initialAccess);
+  section.append(style,heading,help,label,prepare,copyButton,previewLabel,status);root.append(section);
+  let revision=0,destroyed=false,text='';
+  function clear(message) {
+    revision++;text='';preview.value='';copyButton.disabled=true;
+    if(message)status.textContent=message;
+  }
+  function revoke(message) {consent.checked=false;section.hidden=true;clear(message);}
+  const consentChanged=()=>clear('Consent changed. Prepare a new preview before copying.');
+  async function permitted(token) {
+    try {
+      const decision=await resolveAccess();
+      if(destroyed || token!==revision || !consent.checked)return false;
+      if(!available(decision)){revoke('Diagnostics are unavailable. Ordinary bug reporting remains available.');return false;}
+      return true;
+    } catch {
+      if(!destroyed && token===revision)revoke('Diagnostics access could not be verified. Try again later.');
+      return false;
+    }
+  }
+  async function preparePreview() {
+    clear();const token=revision;
+    if(destroyed || !consent.checked){status.textContent='Select consent before preparing diagnostics.';return;}
+    if(!await permitted(token))return;
+    try {
+      const packet=await source.observe(true,()=>!destroyed && token===revision && consent.checked);
+      if(destroyed || token!==revision || !consent.checked)return;
+      if(!packet){revoke('This surface is not eligible for diagnostics.');return;}
+      text=JSON.stringify(parseFeedbackGameDiagnostics(packet),null,2);preview.value=text;
+      copyButton.disabled=false;status.textContent='Preview ready. Review these exact fields before copying.';
+    } catch {if(!destroyed && token===revision)revoke('Diagnostics could not be prepared safely.');}
+  }
+  async function copyPreview() {
+    if(destroyed || !text || !consent.checked)return;
+    const token=++revision;
+    if(!await permitted(token))return;
+    try {
+      const packet=await source.observe(true,()=>!destroyed && token===revision && consent.checked);
+      if(destroyed || token!==revision || !consent.checked)return;
+      if(!packet || JSON.stringify(parseFeedbackGameDiagnostics(packet),null,2)!==text){
+        clear('The surface changed. Prepare and review a new preview.');return;
+      }
+      // No await between the last consent check and invoking the explicit copy.
+      await copy(text);
+      if(!destroyed && token===revision)status.textContent='Diagnostics copied. Paste them only where you choose.';
+    } catch {if(!destroyed && token===revision)status.textContent='Copy unavailable. Select the preview text and copy it manually.';}
+  }
+  consent.addEventListener('change',consentChanged);
+  prepare.addEventListener('click',preparePreview);copyButton.addEventListener('click',copyPreview);
+  return Object.freeze({
+    async refreshAccess() {
+      revoke('Access changed. Select consent and prepare a new preview.');const token=revision;
+      try {
+        const decision=await resolveAccess();
+        if(!destroyed && token===revision)section.hidden=!available(decision);
+      } catch { /* Missing remote decisions leave the controls hidden. */ }
+    },
+    destroy() {if(destroyed)return;destroyed=true;revoke();consent.removeEventListener('change',consentChanged);
+      prepare.removeEventListener('click',preparePreview);copyButton.removeEventListener('click',copyPreview);section.remove();},
+  });
+}

package/diagnostics/source.js

@@ -0,0 +1,39 @@
+import { showcaseAssetIntegrity } from './assets.js';
+
+// Internal mount seam for tests. The public entrypoint never accepts loaders or
+// an existing runtime. Registration is a consequence of this fixed source mount.
+export async function createCuratedShowcaseSource({root,sceneEnabled,
+  loadShared=()=>import('@plasius/gpu-shared'),
+  loadRenderer=()=>import('@plasius/gpu-renderer')}) {
+  let destroyed=false, runtime;
+  if(sceneEnabled===true) {
+    const shared=await loadShared();
+    const integrity=Object.fromEntries(Object.entries(showcaseAssetIntegrity).map(
+      ([key,digest])=>[String(shared.resolveShowcaseAssetUrl(key)),digest]));
+    runtime=await shared.mountGpuShowcase({root,focus:'integrated',
+      packageName:'@plasius/gpu-demo-viewer',
+      __featureFlags:{'gpu-demo.scene-fidelity.enabled':true,gpu_showcase_realistic_models_v1:false,
+        'gpu.model.conversion.enabled':false},gltfLoadOptions:{integrity}});
+  }
+  function eligible() {
+    const state=runtime?.state;
+    return !destroyed && state?.assetCatalog?.mode==='modeled-baseline' &&
+      state.assetCatalog.fallbackReason===null && state.rendererUnavailable!==true &&
+      state.nativeRenderer?.backend==='webgpu-raster' && state.nativeRenderer.submittedFrames>0;
+  }
+  return Object.freeze({
+    async observe(consent,isCurrent=()=>true) {
+      if(consent!==true || !isCurrent() || !eligible())return null;
+      const {createFeedbackGameDiagnosticSnapshot}=await loadRenderer();
+      if(!isCurrent() || !eligible())return null;
+      const frame=runtime.state.nativeRenderer;
+      // Never pass the frame, canvas, telemetry, raw errors or other scene state
+      // across the renderer diagnostics boundary. Synthetic timing stays unknown.
+      return createFeedbackGameDiagnosticSnapshot({featureEnabled:true,capabilityGranted:true,
+        consentConfirmed:true,surfaceId:'site.gpu-demo',renderer:'webgpu',backend:'browser',
+        viewportWidth:frame.width,viewportHeight:frame.height,frameRate:undefined,frameTimeMs:undefined,
+        featureIds:['renderer.frame-loop'],counters:[],errorCodes:[]});
+    },
+    destroy() { if(destroyed)return;destroyed=true;runtime?.destroy();runtime=undefined; },
+  });
+}

package/docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md

@@ -0,0 +1,42 @@
+# ADR 0007: Consented diagnostics from a source-owned curated showcase
+
+Status: accepted for Task gpu-demo-viewer#42, Story site#1671, Feature site#1665.
+
+The shared registration contract and renderer bucketing API do not establish
+that a caller's arbitrary canvas or scene is curated. The open model library
+can contain private or unqualified assets. Existing debug snapshots contain
+coordinates, names and broad runtime state.
+
+The new `feedback-diagnostics` package subpath owns a fixed baseline showcase
+mount. Its public API accepts only render/control roots and a remote access
+resolver. Source registration is fixed to `site.gpu-demo` on exact approved
+routes; generator, `/player-system`, model-library and arbitrary runtime
+injection are excluded. Four procedural public shared-package assets are
+integrity-pinned to the published 1.3.0 release. Missing assets, fallback,
+unsubmitted frames, unavailable renderers and destroyed mounts fail closed.
+The raw runtime stays in a closure. Only explicit native backend and viewport
+numbers reach the released renderer bucketing helper. Synthetic timing is
+reported as unknown. The resulting packet is validated by the shared parser.
+
+The host resolves `feedback.game-diagnostics.enabled`, capability
+`feedback.game-diagnostics.attach`, and `gpu-demo.scene-fidelity.enabled`.
+Publishing does not grant access. No environment or query override exists.
+Explicit consent and preview precede observation. Copy rechecks access and
+surface eligibility, and requires a packet identical to the reviewed preview.
+Revocation, access refresh and disposal invalidate pending asynchronous work.
+Disable the diagnostics flag to roll back; ordinary structured reports remain.
+Hosts must call `refreshAccess()` on pushed control changes and destroy on route
+exit. Remount after changing the scene rollout decision.
+
+Accepting caller-supplied IDs/provenance or filtering generic debug snapshots
+was rejected because neither proves a curated source. Adding capture or
+transport was rejected because the Feature prohibits client pixels. The new
+boundary exposes an accessible optional preview/copy UI and performs no upload,
+storage, diagnostic logging or automatic collection.
+
+Tests cover denial/allow/rollback, exact routes, source provenance, immutable
+schema output, forbidden fields, race cancellation and lifetime. Browser checks
+cover explicit user flow, mobile/keyboard access and network/cache isolation.
+Release uses PR CI followed by exact-main `cd.yml` in `production`; verify the
+npm artifact before downstream site#1677 adopts it. No backend or secret mapping
+changes occur in this static package release.

package/docs/adrs/adr-0008-public-compliance-artifact-contract.md

@@ -0,0 +1,60 @@
+# ADR 0008: Public compliance artifact contract
+
+Status: Accepted 2026-10-23
+
+## Context
+
+Project Task gpu-demo-viewer#35 under operational task site#847 requires the
+schema-template legal baseline and package-level guarantees. The previous
+verifier allowed publication without security/contribution policies or legal
+templates. This is repository-operational compliance maintenance; it changes no
+product Feature, remotely controlled behaviour or entitlement. Flags and
+capabilities are N/A for this packaging-only task.
+
+## Decision
+
+Reuse the three unsigned templates from @plasius/schema main
+`d8f8eb430c77b8a98da496a3d8382d73d6297394`, substituting only the package name.
+Preserve Apache-2.0 package licensing and existing model-specific licences.
+Include SECURITY.md and CONTRIBUTING.md and explicitly list each legal template
+in package.json. Do not include a broad legal directory glob. Signed agreements
+and acceptance records stay outside source control in the approved restricted
+system; they are never package inputs.
+
+The Node-built-in verifier checks metadata for non-empty regular compliance
+files and a real legal directory. It pins SHA-256 digests of all three adapted
+templates to exact approved bytes before invoking a bounded npm dry-run. Future
+legal changes require reviewed baseline/digest and test updates together;
+non-empty truncation, rewording or added terms must fail. It then
+requires all six documents in the manifest and rejects any unapproved legal
+entry. It does not read private contributor records. Its root argument permits
+isolated test fixtures without mutating the working checkout. CI and CD invoke
+the same pack check; no new runtime dependency or public runtime API is needed.
+
+## Alternatives
+
+Repository-only documents would not satisfy the requested artifact baseline.
+Including all of legal/ would make accidental document additions package inputs.
+Checking source presence alone would miss package allowlist regressions. A new
+shared package is unnecessary for these local filesystem checks.
+
+## Tests and NFR implications
+
+Requirements-derived regressions remove, empty, symlink or omit each required
+document and exercise actual npm dry-runs. Tampering regressions truncate,
+reword and append to every template, and independently pin their approved hashes.
+Positive fixtures prove the complete contract passes, while synthetic unlisted records stay excluded or fail packing.
+Tests never create actual agreements or personal information. Source/helper
+coverage, frozen install, audit, build and package checks establish reproducible
+and maintainable validation. Viewer runtime, browser/GPU behaviour, accessibility,
+SEO and performance are unchanged; no browser qualification or Azure secretref
+change applies. Existing NFR.md remains the runtime baseline.
+
+## Release and rollback
+
+Deliver through PR, successful CI, protected main and the existing cd.yml
+production/OIDC prepare-publish route. Verify a fresh package version and compare
+all required document bytes with the released source and sealed tarball. Do not
+manually promote changelog sections or publish locally. Correct packaging defects
+through an ordinary forward release; never roll back by publishing private
+records or restoring fail-open validation. No site consumer deployment is needed.

package/docs/adrs/index.md

@@ -9,3 +9,6 @@
 
 - [ADR 0005: Build-time model acquisition subpath](adr-0005-build-time-model-acquisition-subpath.md)
 - [ADR 0006: Composite study consumer](adr-0006-composite-study-consumer.md)
+- [ADR 0007: Consented curated showcase diagnostics](adr-0007-consented-curated-showcase-diagnostics.md)
+
+- [ADR 0008: Public compliance artifact contract](adr-0008-public-compliance-artifact-contract.md)

package/docs/consented-diagnostics.md

@@ -0,0 +1,82 @@
+# Consented showcase diagnostics
+
+Design for gpu-demo-viewer#42, Story site#1671, Feature site#1665.
+
+Only a mount owned by this package can register `site.gpu-demo`. A new focused
+entrypoint will mount the fixed baseline harbour using the published shared
+runtime, four integrity-pinned procedural public assets, and the native renderer.
+It will retain the runtime privately. It will accept no caller-provided surface
+ID, provenance, scene, model, renderer loader, snapshot, warning or URL. Open
+model-library studies, generator, arbitrary canvases and `/player-system` remain
+ineligible. Asset failure, fallback rendering, no submitted frame, disposal or
+unknown provenance disables diagnostics.
+
+The host supplies a fresh remote decision for `feedback.game-diagnostics.enabled`,
+`feedback.game-diagnostics.attach`, and `gpu-demo.scene-fidelity.enabled`.
+Missing decisions deny access. This package adds no service endpoint or local
+production override. The panel requires explicit unchecked consent and a preview
+action before reading observations. Copy rechecks remote access; consent changes,
+refresh, disposal and races clear or invalidate pending work. Normal structured
+reporting is independent. Rollback disables the diagnostics flag.
+
+Only native renderer/backend and coarse viewport buckets are observed. Timing is
+unknown because existing showcase telemetry includes synthetic stress values.
+No raw scene/debug snapshot is passed to the renderer helper. That released helper
+constructs the closed packet, then the shared parser validates it. Preview is
+read-only text; copying is an explicit clipboard operation. No automatic capture,
+upload, download, browser storage, cache entry, analytics or log is introduced.
+
+Alternatives: accepting any source-tagged object would permit forged provenance;
+using `render_game_to_text` would disclose scene details; collecting images would
+violate the Feature. This narrow mount adds a supported validation surface rather
+than assuming every existing demo is eligible. Site integration/reconstruction is
+the separate downstream site#1677.
+
+Validation: tests derive from deny/allow/rollback/provenance/consent/lifetime
+requirements, with changed-source LCOV, static package checks and real browser
+keyboard/320px/no-pixel network/storage/cache checks. Release only via PR CI and
+exact-main `cd.yml` in `production`, then verify npm artifact and provenance.
+
+## Dependency and compatibility decision
+
+The direct shared dependency changes from `^1.2.0` (locked 1.2.0) to exact 1.3.0.
+This adopts the published diagnostics contract verified under shared#101 and
+fixes the bytes used by the four SRI entries. The renderer remains locked to
+0.2.54, with its existing compatible manifest range. Shared 1.3.0 brings its
+declared model-conversion dependency graph; this mount explicitly disables
+conversion and lazily loads the shared runtime only for a positive scene
+decision. No unrelated direct dependency is updated. Package audits and
+signature/attestation verification cover the new locked graph. A future shared
+version requires an explicit asset/hash compatibility review rather than
+silently accepting changed assets.
+
+## Browser qualification — 21 October 2026
+
+An isolated in-app Chromium tab mounted the actual published shared/native
+WebGPU renderer, with the four SRI-pinned assets. The local harness supplied
+test access decisions only; no production controls changed. Keyboard activation
+prepared the closed packet; explicit Copy reported success. No-consent preview
+was denied. Revoking access immediately before Copy cleared preview and consent;
+unchecking consent and disposal also removed retained diagnostics. A 320px-wide
+panel had no horizontal overflow. This is actual narrow-container validation,
+not an emulated 320px device viewport or a full multi-browser qualification.
+
+The harness trapped canvas export/readback and display capture. It recorded
+four public-asset fetches at mount, zero later fetches, zero non-GET requests,
+zero request bodies and zero pixel reads. Resource entries stayed at 36 across
+preview/copy/revocation; localStorage, sessionStorage, Cache Storage and IndexedDB
+stayed empty. This combines browser observations with source/invariant tests;
+it does not claim arbitrary third-party host code cannot perform network I/O.
+No Chrome/Firefox/Safari cross-browser pass is inferred. Clipboard denial has a
+tested selectable-preview fallback.
+
+NFR disposition: security/privacy checked by integrity, closed packet, no-pixel,
+rollback and race tests plus browser isolation evidence; accessibility checked
+for labels, keyboard activation, live status, visible focus, contrast and 44px
+action targets; performance checked through lazy loading and absence of new
+sampling loops; reliability/reproducibility checked by clean install, build,
+asset hashes and lifetime tests; maintainability/testability checked by ADR,
+focused public entrypoint and changed-source LCOV; observability uses fixed
+user-visible status messages without raw diagnostics logging. SEO is N/A for a
+package subpath that creates no public route. Backend sensitive-environment
+mapping is N/A because no backend or Azure resource changes are made.

package/legal/CLA.md

@@ -0,0 +1,25 @@
+# Contributor License Agreements (CLA)
+
+To protect the intellectual property of this project and ensure clarity of rights, all contributors must sign a Contributor License Agreement (CLA) before their first contribution.
+
+## Which CLA should I sign?
+
+- **Individual CLA**: If you are contributing personally and not on behalf of an employer, sign the [Individual CLA](INDIVIDUAL_CLA.md).
+- **Corporate CLA**: If you are contributing as part of your work for a company, the company should sign the [Corporate CLA](CORPORATE_CLA.md).
+
+## How to sign
+
+1. Download the appropriate CLA file (Individual or Corporate).
+2. Fill in the required details, sign, and date it.
+3. Email a PDF copy of the signed document to **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)** with subject: `CLA – Individual` or `CLA – Corporate`.
+
+## Registry
+
+Signed agreements and acceptance records are stored in an access-controlled
+system outside source control. They must never be committed to a repository,
+included in a package, or copied into issues, pull requests, build logs, or
+other public artifacts.
+
+## Questions?
+
+If you have any questions about which CLA to sign or how the process works, please email **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)**.

package/legal/CORPORATE_CLA.md

@@ -0,0 +1,57 @@
+# Corporate Contributor License Agreement (CLA)
+
+## Purpose
+
+This Corporate Contributor License Agreement ("Agreement") is intended to protect the intellectual property rights of the contributors and the project, ensure clear licensing terms for contributions, and maintain trust within the community. By signing this Agreement, the corporation agrees to the terms that facilitate the use, distribution, and modification of contributions under the project's licensing framework.
+
+## Agreement
+
+1. **Representation of Authority**  
+   The undersigned individual represents and warrants that they have the full legal authority to enter into this Agreement on behalf of the corporation named below ("Corporation") and to grant the rights contained herein.
+
+2. **Grant of Copyright License**  
+   The Corporation hereby grants to the project maintainers and users a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to use, reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the contributions submitted to the project.
+
+3. **Grant of Patent License**  
+   The Corporation hereby grants to the project maintainers and users a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under any patent claims that are necessarily infringed by the contributions to make, use, sell, offer for sale, import, and otherwise dispose of the contributions or derivative works thereof.
+
+4. **Warranties and Representations**  
+   The Corporation represents and warrants that:
+
+- The contributions are the original work of the Corporation or that the Corporation has sufficient rights to grant the licenses herein.
+- The submission of the contributions does not violate any agreements or rights of third parties.
+
+5. **No Revocation**  
+   This license is granted on a perpetual basis and cannot be revoked, provided that the terms of this Agreement are met.
+
+6. **Governing Law**
+   This Agreement shall be governed by and construed in accordance with the laws of the United Kingdom, without regard to its conflict of laws principles.
+
+7. **Execution**
+
+This Agreement is effective upon signature by the authorized representative of the Corporation. Please sign and date this document, then email a scanned PDF copy to [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk).
+
+---
+
+### **@plasius/gpu-demo-viewer**
+
+**Corporation Legal Name:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Authorized Representative:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Title:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Email:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Date:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Signature:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+---
+
+## How to Sign
+
+- Download this file as a template.
+- Fill in the Corporation’s legal name, authorized representative, title, email, date, and provide a signature.
+- Sign and date the document.
+- Send a scanned copy of the signed Agreement to [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk).

package/legal/INDIVIDUAL_CLA.md

@@ -0,0 +1,91 @@
+# Individual Contributor License Agreement (CLA)
+
+**Project:** @plasius/gpu-demo-viewer (Plasius LTD)  
+**Version:** 1.0 — 2025‑09‑12  
+**Contact:** [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)
+
+---
+
+## 1. Definitions
+
+- **"You"** (or **"Contributor"**) means the individual signing this CLA and submitting Contributions to the Project.
+- **"Contribution"** means any original work of authorship, including code, documentation, data, designs, or feedback that You submit to the Project in any form (e.g., pull request, issue comment, email, file upload).
+- **"Project"** means the @plasius/gpu-demo-viewer repositories and related materials owned or managed by **Plasius LTD**.
+
+## 2. Copyright License Grant
+
+You hereby grant to Plasius LTD a **perpetual, worldwide, non‑exclusive, transferable, sublicensable, royalty‑free, irrevocable** copyright license to:
+
+- use, reproduce, publicly display, publicly perform, modify, create derivative works of, and
+- distribute Contributions in source and object form,
+- and to **sublicense** these rights under any terms Plasius LTD chooses, including proprietary or open‑source licenses.
+
+## 3. Patent License Grant
+
+You hereby grant to Plasius LTD and its sublicensees a **perpetual, worldwide, non‑exclusive, transferable, royalty‑free, irrevocable** patent license to **make, have made, use, offer to sell, sell, import, and otherwise transfer** the Contribution and derivative works thereof, where such license applies only to patent claims that You **own or control** and that would be infringed by Your Contribution or its combination with the Project.
+
+## 4. Moral Rights & Attribution
+
+To the maximum extent permitted by applicable law, You **waive** and agree not to assert any moral rights (e.g., rights of attribution or integrity) in or to the Contribution against Plasius LTD. Plasius LTD may, but is not required to, credit You.
+
+## 5. Representations & Warranties
+
+You represent that:
+
+1. **Originality / Rights:** Each Contribution is Your original creation, or You have sufficient rights to submit it and grant the licenses above.
+2. **No Confidential Info:** Contributions **do not** include confidential information or trade secrets of any third party.
+3. **No Infringement:** To the best of Your knowledge, Contributions do not infringe any third‑party IP rights.
+4. **Employment / Contractor Status:** If Your employer or a third party might claim rights in Your Contribution, You have obtained **written permission** to make the Contribution and grant these licenses (attach or reference below), or Your Contribution is made **outside the scope** of your employment and without using your employer’s confidential information or resources.
+5. **Compliance:** You will follow the Project’s policies (e.g., Code of Conduct, Security Policy) and applicable laws.
+
+## 6. Third‑Party Code
+
+If Your Contribution includes code, data, or other material from a third party, You will **identify the material and its license** in the pull request or submission, and ensure it is **compatible** with the Project’s licensing model. You will not submit material subject to terms that require the Project to disclose proprietary source code (e.g., certain copyleft obligations) unless the Project has **pre‑approved** such inclusion in writing.
+
+## 7. Scope & Duration
+
+- This CLA covers **all past and future** Contributions You submit to the Project, unless and until You provide written notice to **revoke** it.
+- Revocation is **not retroactive**: rights granted for prior Contributions remain in effect.
+
+## 8. Disclaimer
+
+THE CONTRIBUTION IS PROVIDED “AS IS” WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON‑INFRINGEMENT.
+
+## 9. Governing Law & Jurisdiction
+
+This CLA is governed by the **laws of England and Wales**, and the courts of England and Wales shall have **exclusive jurisdiction** over any dispute arising out of or relating to it.
+
+## 10. Entire Agreement
+
+This CLA is the entire agreement between You and Plasius LTD regarding Contributions. It supersedes any prior discussions relating to Contributions. If any provision is held unenforceable, the remaining provisions remain in full force.
+
+---
+
+## 11. Contributor Information & Signature
+
+By signing below, You agree to the terms of this CLA for Your Contributions to the Project.
+
+**Full Name:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Email:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**GitHub Handle:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Address (optional):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Employer (if applicable):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**If employed:** ☐ I confirm Contributions are made outside the scope of employment **or** ☐ I have attached my employer’s written permission.
+
+**Signature:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Date (YYYY‑MM‑DD):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+_Electronic signatures are accepted. You may type your name in the Signature field and email a PDF copy._
+
+**Submission:** Please email the signed CLA to **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)** with subject line: `CLA – Individual – <GitHubHandle>`.
+
+**(Optional) Attachments / Notes:**
+
+- Employer permission letter (if required)
+- Third‑party license disclosures (if any)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-demo-viewer",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Root validation viewer for Plasius gpu-* demos.",
   "license": "Apache-2.0",
@@ -23,7 +23,8 @@
     "./model-library/studies": {
       "types": "./model-library/studies.d.ts",
       "default": "./model-library/studies.js"
-    }
+    },
+    "./feedback-diagnostics": "./diagnostics/index.js"
   },
   "files": [
     "assets/",
@@ -39,7 +40,13 @@
     "main.js",
     "styles.css",
     "viewer-manifest.js",
-    "model-library/"
+    "model-library/",
+    "diagnostics/",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "legal/CLA.md",
+    "legal/INDIVIDUAL_CLA.md",
+    "legal/CORPORATE_CLA.md"
   ],
   "engines": {
     "node": ">=24"
@@ -51,7 +58,7 @@
     "lint": "npm run typecheck",
     "pack:check": "node scripts/verify-public-package.cjs",
     "prepublishOnly": "npm run build && npm run pack:check",
-    "typecheck": "node --check index.js && node --check main.js && node --check viewer-manifest.js && node --check showcase/index.js && node --check showcase/main.js && node --check wavefront/main.js && node --check model-library/main.js && node --check model-library/controller.js && node --check model-library/scenes.js && node --check model-library/acquire.js && node --check model-library/rollout.js && node --check model-library/studies.js",
+    "typecheck": "node --check index.js && node --check main.js && node --check viewer-manifest.js && node --check showcase/index.js && node --check showcase/main.js && node --check wavefront/main.js && node --check model-library/main.js && node --check model-library/controller.js && node --check model-library/scenes.js && node --check model-library/acquire.js && node --check model-library/rollout.js && node --check model-library/studies.js && node --check diagnostics/index.js && node --check diagnostics/source.js && node --check diagnostics/panel.js && node --check diagnostics/assets.js",
     "test": "node --test",
     "models:download": "node scripts/acquire-model-library.mjs",
     "models:dev": "vite --config model-library/vite.config.js",
@@ -59,7 +66,7 @@
   },
   "dependencies": {
     "@plasius/gpu-renderer": "^0.2.54",
-    "@plasius/gpu-shared": "^1.2.0"
+    "@plasius/gpu-shared": "1.3.0"
   },
   "devDependencies": {
     "c8": "^11.0.0",

package/scripts/verify-public-package.cjs

@@ -1,9 +1,25 @@
 const fs = require("node:fs");
 const os = require("node:os");
+const { createHash } = require("node:crypto");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 
-const repoRoot = path.resolve(__dirname, "..");
+const complianceFiles = [
+  "LICENSE",
+  "SECURITY.md",
+  "CONTRIBUTING.md",
+  "legal/CLA.md",
+  "legal/INDIVIDUAL_CLA.md",
+  "legal/CORPORATE_CLA.md"
+];
+
+// Approved schema d8f8eb430c77b8a98da496a3d8382d73d6297394, with only
+// @plasius/schema replaced by @plasius/gpu-demo-viewer. Hash exact bytes.
+const approvedTemplates = {
+  "legal/CLA.md": "8e7de8348013f65a551d9a3179d4927cdce4ae15497ba209a0cf2c1098ba489c",
+  "legal/INDIVIDUAL_CLA.md": "6ce945a06ee88d3c3103a6094123465440d8e9890a84956f257555cc9994fb39",
+  "legal/CORPORATE_CLA.md": "f56606b1a8a563ca1bae67a9335f32ced1ce3827dec500bc28617de604c66608"
+};
 
 function assert(condition, message) {
   if (!condition) {
@@ -11,14 +27,15 @@ function assert(condition, message) {
   }
 }
 
-function readJson(relativePath) {
+function readJson(repoRoot, relativePath) {
   return JSON.parse(fs.readFileSync(path.join(repoRoot, relativePath), "utf8"));
 }
 
-function packDryRunFiles() {
+function packDryRunFiles(repoRoot) {
   const result = spawnSync("npm", ["pack", "--dry-run", "--json"], {
     cwd: repoRoot,
     encoding: "utf8",
+    timeout: 30000,
     env: {
       ...process.env,
       npm_config_cache:
@@ -38,8 +55,8 @@ function packDryRunFiles() {
   return packInfo.files.map((file) => file.path).sort();
 }
 
-function main() {
-  const packageJson = readJson("package.json");
+function verifyPublicPackage(repoRoot = path.resolve(__dirname, "..")) {
+  const packageJson = readJson(repoRoot, "package.json");
 
   assert(packageJson.name === "@plasius/gpu-demo-viewer", "package name must remain scoped");
   assert(packageJson.private !== true, "public package must not set private=true");
@@ -51,11 +68,24 @@ function main() {
   assert(packageJson.repository?.url?.includes("Plasius-LTD/gpu-demo-viewer"), "repository metadata is required");
   assert(packageJson.exports?.["."] === "./viewer-manifest.js", "viewer manifest must be the package root export");
 
-  const files = packDryRunFiles();
+  // Inspect metadata before packing; never read contributor acceptance records.
+  const legalDirectory = fs.lstatSync(path.join(repoRoot, "legal"));
+  assert(legalDirectory.isDirectory(), "legal must be a real directory");
+  for (const file of complianceFiles) {
+    const stat = fs.lstatSync(path.join(repoRoot, file));
+    assert(stat.isFile() && stat.size > 0, `${file} must be a non-empty regular file`);
+  }
+
+  for (const [file, expected] of Object.entries(approvedTemplates)) {
+    const digest = createHash("sha256").update(fs.readFileSync(path.join(repoRoot, file))).digest("hex");
+    assert(digest === expected, `${file} must match approved schema template`);
+  }
+
+  const files = packDryRunFiles(repoRoot);
   const fileSet = new Set(files);
   const requiredFiles = [
     "CHANGELOG.md",
-    "LICENSE",
+    ...complianceFiles,
     "README.md",
     "assets/brigantine.gltf",
     "docs/adrs/index.md",
@@ -73,6 +103,10 @@ function main() {
   }
 
   for (const file of files) {
+    assert(
+      !file.startsWith("legal/") || complianceFiles.includes(file),
+      `package tarball contains unapproved legal document: ${file}`
+    );
     assert(!file.startsWith("node_modules/"), `package tarball must not include ${file}`);
     assert(!file.startsWith("tests/"), `package tarball must not include ${file}`);
     assert(!file.startsWith(".git/"), `package tarball must not include ${file}`);
@@ -82,9 +116,13 @@ function main() {
   process.stdout.write("Public package contract verified.\n");
 }
 
-try {
-  main();
-} catch (error) {
-  process.stderr.write(`${error.message}\n`);
-  process.exitCode = 1;
+module.exports = { verifyPublicPackage };
+
+if (require.main === module) {
+  try {
+    verifyPublicPackage();
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
 }