@plasius/gpu-demo-viewer 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -18,6 +18,20 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 - **Security**
   - (placeholder)
 
+## [0.4.1] - 2026-10-23
+
+- **Added**
+  - Approved unsigned legal templates and security/contribution policies in the npm artifact, with fail-closed compliance checks, pinned template hashes and regression tests.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.4.0] - 2026-10-21
 
 - **Added**
@@ -368,3 +382,4 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 [0.2.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.3
 [0.3.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.3.0
 [0.4.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.0
+[0.4.1]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.1

package/CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing to @plasius/gpu-demo-viewer
+
+This workspace utility exists to accelerate validation across the Plasius
+`gpu-*` packages.
+
+## Local Development
+
+### Prerequisites
+
+- Node.js 24 (`nvm use`)
+- npm
+
+### Validate
+
+```bash
+npm run lint
+npm test
+```
+
+### Demo
+
+```bash
+npm run demo
+```
+
+Then open `http://localhost:8000/gpu-demo-viewer/`.
+
+## Expectations
+
+- Keep the viewer aligned with the real package demos; do not let the manifest drift.
+- Add or update tests when browser target paths or shared showcase assets change.
+- Update `README.md` and `CHANGELOG.md` whenever demo behavior or structure changes.

package/README.md

@@ -56,6 +56,31 @@ See [the design and validation contract](docs/consented-diagnostics.md) and
 The npm package includes the viewer source, manifest and build-time acquisition
 helper and typed composite layout definitions. Model binaries are downloaded separately; they are not bundled in npm.
 
+## Package compliance documents
+
+The npm artifact includes `LICENSE`, `SECURITY.md`, `CONTRIBUTING.md` and the
+unsigned [CLA guide](legal/CLA.md), [Individual CLA](legal/INDIVIDUAL_CLA.md)
+and [Corporate CLA](legal/CORPORATE_CLA.md) templates from the approved schema
+baseline. Only package-name references are adapted. These documents describe
+contribution and reporting policies; model-specific credits and licences remain
+with their existing catalogue records.
+
+Run `npm ci`, `npm run build`, `npm test`, `npm run test:coverage` and
+`npm run pack:check` to validate the contract. The pack check requires non-empty
+regular compliance files and a real `legal/` directory, then verifies their
+presence in the actual npm dry-run manifest. SHA-256 checks pin the exact bytes
+of all three templates to schema commit `d8f8eb430c77b8a98da496a3d8382d73d6297394`
+after package-name substitution. Future legal changes require explicit review
+of the approved baseline, pinned digests and regression expectations together.
+CI and the approved CD path run this check. It fails on missing documents,
+omitted package entries, symlinks, altered template terms or unexpected legal
+files in the artifact. The package allowlist names each legal template individually.
+
+Signed agreements and contributor acceptance records belong in the approved
+access-controlled system outside source control. Never add them to this
+repository, package or public build artifacts. See [ADR 0008](docs/adrs/adr-0008-public-compliance-artifact-contract.md)
+for the packaging decision and release checks.
+
 ## Run the model workshop
 
 Use Node.js 24 or later, npm, and a WebGPU-capable browser on localhost or HTTPS.

package/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+We currently support the latest major version of this project. Older versions may not receive security updates.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately by emailing us at [security@plasius.co.uk](mailto:security@plasius.co.uk). Please do not create a public issue for security-related matters.
+
+## Response Timeline
+
+We aim to acknowledge your report within 2 business days and to provide a more detailed response (including next steps and, if applicable, a timeline for a fix) within 7 business days.
+
+## Disclosure Policy
+
+We request that you give us the opportunity to address the vulnerability before publicly disclosing it. We will coordinate with you on public disclosure once a fix is available and deployed.

package/docs/adrs/adr-0008-public-compliance-artifact-contract.md

@@ -0,0 +1,60 @@
+# ADR 0008: Public compliance artifact contract
+
+Status: Accepted 2026-10-23
+
+## Context
+
+Project Task gpu-demo-viewer#35 under operational task site#847 requires the
+schema-template legal baseline and package-level guarantees. The previous
+verifier allowed publication without security/contribution policies or legal
+templates. This is repository-operational compliance maintenance; it changes no
+product Feature, remotely controlled behaviour or entitlement. Flags and
+capabilities are N/A for this packaging-only task.
+
+## Decision
+
+Reuse the three unsigned templates from @plasius/schema main
+`d8f8eb430c77b8a98da496a3d8382d73d6297394`, substituting only the package name.
+Preserve Apache-2.0 package licensing and existing model-specific licences.
+Include SECURITY.md and CONTRIBUTING.md and explicitly list each legal template
+in package.json. Do not include a broad legal directory glob. Signed agreements
+and acceptance records stay outside source control in the approved restricted
+system; they are never package inputs.
+
+The Node-built-in verifier checks metadata for non-empty regular compliance
+files and a real legal directory. It pins SHA-256 digests of all three adapted
+templates to exact approved bytes before invoking a bounded npm dry-run. Future
+legal changes require reviewed baseline/digest and test updates together;
+non-empty truncation, rewording or added terms must fail. It then
+requires all six documents in the manifest and rejects any unapproved legal
+entry. It does not read private contributor records. Its root argument permits
+isolated test fixtures without mutating the working checkout. CI and CD invoke
+the same pack check; no new runtime dependency or public runtime API is needed.
+
+## Alternatives
+
+Repository-only documents would not satisfy the requested artifact baseline.
+Including all of legal/ would make accidental document additions package inputs.
+Checking source presence alone would miss package allowlist regressions. A new
+shared package is unnecessary for these local filesystem checks.
+
+## Tests and NFR implications
+
+Requirements-derived regressions remove, empty, symlink or omit each required
+document and exercise actual npm dry-runs. Tampering regressions truncate,
+reword and append to every template, and independently pin their approved hashes.
+Positive fixtures prove the complete contract passes, while synthetic unlisted records stay excluded or fail packing.
+Tests never create actual agreements or personal information. Source/helper
+coverage, frozen install, audit, build and package checks establish reproducible
+and maintainable validation. Viewer runtime, browser/GPU behaviour, accessibility,
+SEO and performance are unchanged; no browser qualification or Azure secretref
+change applies. Existing NFR.md remains the runtime baseline.
+
+## Release and rollback
+
+Deliver through PR, successful CI, protected main and the existing cd.yml
+production/OIDC prepare-publish route. Verify a fresh package version and compare
+all required document bytes with the released source and sealed tarball. Do not
+manually promote changelog sections or publish locally. Correct packaging defects
+through an ordinary forward release; never roll back by publishing private
+records or restoring fail-open validation. No site consumer deployment is needed.

package/docs/adrs/index.md

@@ -10,3 +10,5 @@
 - [ADR 0005: Build-time model acquisition subpath](adr-0005-build-time-model-acquisition-subpath.md)
 - [ADR 0006: Composite study consumer](adr-0006-composite-study-consumer.md)
 - [ADR 0007: Consented curated showcase diagnostics](adr-0007-consented-curated-showcase-diagnostics.md)
+
+- [ADR 0008: Public compliance artifact contract](adr-0008-public-compliance-artifact-contract.md)

package/legal/CLA.md

@@ -0,0 +1,25 @@
+# Contributor License Agreements (CLA)
+
+To protect the intellectual property of this project and ensure clarity of rights, all contributors must sign a Contributor License Agreement (CLA) before their first contribution.
+
+## Which CLA should I sign?
+
+- **Individual CLA**: If you are contributing personally and not on behalf of an employer, sign the [Individual CLA](INDIVIDUAL_CLA.md).
+- **Corporate CLA**: If you are contributing as part of your work for a company, the company should sign the [Corporate CLA](CORPORATE_CLA.md).
+
+## How to sign
+
+1. Download the appropriate CLA file (Individual or Corporate).
+2. Fill in the required details, sign, and date it.
+3. Email a PDF copy of the signed document to **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)** with subject: `CLA – Individual` or `CLA – Corporate`.
+
+## Registry
+
+Signed agreements and acceptance records are stored in an access-controlled
+system outside source control. They must never be committed to a repository,
+included in a package, or copied into issues, pull requests, build logs, or
+other public artifacts.
+
+## Questions?
+
+If you have any questions about which CLA to sign or how the process works, please email **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)**.

package/legal/CORPORATE_CLA.md

@@ -0,0 +1,57 @@
+# Corporate Contributor License Agreement (CLA)
+
+## Purpose
+
+This Corporate Contributor License Agreement ("Agreement") is intended to protect the intellectual property rights of the contributors and the project, ensure clear licensing terms for contributions, and maintain trust within the community. By signing this Agreement, the corporation agrees to the terms that facilitate the use, distribution, and modification of contributions under the project's licensing framework.
+
+## Agreement
+
+1. **Representation of Authority**  
+   The undersigned individual represents and warrants that they have the full legal authority to enter into this Agreement on behalf of the corporation named below ("Corporation") and to grant the rights contained herein.
+
+2. **Grant of Copyright License**  
+   The Corporation hereby grants to the project maintainers and users a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to use, reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the contributions submitted to the project.
+
+3. **Grant of Patent License**  
+   The Corporation hereby grants to the project maintainers and users a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under any patent claims that are necessarily infringed by the contributions to make, use, sell, offer for sale, import, and otherwise dispose of the contributions or derivative works thereof.
+
+4. **Warranties and Representations**  
+   The Corporation represents and warrants that:
+
+- The contributions are the original work of the Corporation or that the Corporation has sufficient rights to grant the licenses herein.
+- The submission of the contributions does not violate any agreements or rights of third parties.
+
+5. **No Revocation**  
+   This license is granted on a perpetual basis and cannot be revoked, provided that the terms of this Agreement are met.
+
+6. **Governing Law**
+   This Agreement shall be governed by and construed in accordance with the laws of the United Kingdom, without regard to its conflict of laws principles.
+
+7. **Execution**
+
+This Agreement is effective upon signature by the authorized representative of the Corporation. Please sign and date this document, then email a scanned PDF copy to [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk).
+
+---
+
+### **@plasius/gpu-demo-viewer**
+
+**Corporation Legal Name:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Authorized Representative:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Title:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Email:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Date:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Signature:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+---
+
+## How to Sign
+
+- Download this file as a template.
+- Fill in the Corporation’s legal name, authorized representative, title, email, date, and provide a signature.
+- Sign and date the document.
+- Send a scanned copy of the signed Agreement to [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk).

package/legal/INDIVIDUAL_CLA.md

@@ -0,0 +1,91 @@
+# Individual Contributor License Agreement (CLA)
+
+**Project:** @plasius/gpu-demo-viewer (Plasius LTD)  
+**Version:** 1.0 — 2025‑09‑12  
+**Contact:** [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)
+
+---
+
+## 1. Definitions
+
+- **"You"** (or **"Contributor"**) means the individual signing this CLA and submitting Contributions to the Project.
+- **"Contribution"** means any original work of authorship, including code, documentation, data, designs, or feedback that You submit to the Project in any form (e.g., pull request, issue comment, email, file upload).
+- **"Project"** means the @plasius/gpu-demo-viewer repositories and related materials owned or managed by **Plasius LTD**.
+
+## 2. Copyright License Grant
+
+You hereby grant to Plasius LTD a **perpetual, worldwide, non‑exclusive, transferable, sublicensable, royalty‑free, irrevocable** copyright license to:
+
+- use, reproduce, publicly display, publicly perform, modify, create derivative works of, and
+- distribute Contributions in source and object form,
+- and to **sublicense** these rights under any terms Plasius LTD chooses, including proprietary or open‑source licenses.
+
+## 3. Patent License Grant
+
+You hereby grant to Plasius LTD and its sublicensees a **perpetual, worldwide, non‑exclusive, transferable, royalty‑free, irrevocable** patent license to **make, have made, use, offer to sell, sell, import, and otherwise transfer** the Contribution and derivative works thereof, where such license applies only to patent claims that You **own or control** and that would be infringed by Your Contribution or its combination with the Project.
+
+## 4. Moral Rights & Attribution
+
+To the maximum extent permitted by applicable law, You **waive** and agree not to assert any moral rights (e.g., rights of attribution or integrity) in or to the Contribution against Plasius LTD. Plasius LTD may, but is not required to, credit You.
+
+## 5. Representations & Warranties
+
+You represent that:
+
+1. **Originality / Rights:** Each Contribution is Your original creation, or You have sufficient rights to submit it and grant the licenses above.
+2. **No Confidential Info:** Contributions **do not** include confidential information or trade secrets of any third party.
+3. **No Infringement:** To the best of Your knowledge, Contributions do not infringe any third‑party IP rights.
+4. **Employment / Contractor Status:** If Your employer or a third party might claim rights in Your Contribution, You have obtained **written permission** to make the Contribution and grant these licenses (attach or reference below), or Your Contribution is made **outside the scope** of your employment and without using your employer’s confidential information or resources.
+5. **Compliance:** You will follow the Project’s policies (e.g., Code of Conduct, Security Policy) and applicable laws.
+
+## 6. Third‑Party Code
+
+If Your Contribution includes code, data, or other material from a third party, You will **identify the material and its license** in the pull request or submission, and ensure it is **compatible** with the Project’s licensing model. You will not submit material subject to terms that require the Project to disclose proprietary source code (e.g., certain copyleft obligations) unless the Project has **pre‑approved** such inclusion in writing.
+
+## 7. Scope & Duration
+
+- This CLA covers **all past and future** Contributions You submit to the Project, unless and until You provide written notice to **revoke** it.
+- Revocation is **not retroactive**: rights granted for prior Contributions remain in effect.
+
+## 8. Disclaimer
+
+THE CONTRIBUTION IS PROVIDED “AS IS” WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON‑INFRINGEMENT.
+
+## 9. Governing Law & Jurisdiction
+
+This CLA is governed by the **laws of England and Wales**, and the courts of England and Wales shall have **exclusive jurisdiction** over any dispute arising out of or relating to it.
+
+## 10. Entire Agreement
+
+This CLA is the entire agreement between You and Plasius LTD regarding Contributions. It supersedes any prior discussions relating to Contributions. If any provision is held unenforceable, the remaining provisions remain in full force.
+
+---
+
+## 11. Contributor Information & Signature
+
+By signing below, You agree to the terms of this CLA for Your Contributions to the Project.
+
+**Full Name:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Email:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**GitHub Handle:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Address (optional):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Employer (if applicable):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**If employed:** ☐ I confirm Contributions are made outside the scope of employment **or** ☐ I have attached my employer’s written permission.
+
+**Signature:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Date (YYYY‑MM‑DD):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+_Electronic signatures are accepted. You may type your name in the Signature field and email a PDF copy._
+
+**Submission:** Please email the signed CLA to **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)** with subject line: `CLA – Individual – <GitHubHandle>`.
+
+**(Optional) Attachments / Notes:**
+
+- Employer permission letter (if required)
+- Third‑party license disclosures (if any)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-demo-viewer",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Root validation viewer for Plasius gpu-* demos.",
   "license": "Apache-2.0",
@@ -41,7 +41,12 @@
     "styles.css",
     "viewer-manifest.js",
     "model-library/",
-    "diagnostics/"
+    "diagnostics/",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "legal/CLA.md",
+    "legal/INDIVIDUAL_CLA.md",
+    "legal/CORPORATE_CLA.md"
   ],
   "engines": {
     "node": ">=24"

package/scripts/verify-public-package.cjs

@@ -1,9 +1,25 @@
 const fs = require("node:fs");
 const os = require("node:os");
+const { createHash } = require("node:crypto");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 
-const repoRoot = path.resolve(__dirname, "..");
+const complianceFiles = [
+  "LICENSE",
+  "SECURITY.md",
+  "CONTRIBUTING.md",
+  "legal/CLA.md",
+  "legal/INDIVIDUAL_CLA.md",
+  "legal/CORPORATE_CLA.md"
+];
+
+// Approved schema d8f8eb430c77b8a98da496a3d8382d73d6297394, with only
+// @plasius/schema replaced by @plasius/gpu-demo-viewer. Hash exact bytes.
+const approvedTemplates = {
+  "legal/CLA.md": "8e7de8348013f65a551d9a3179d4927cdce4ae15497ba209a0cf2c1098ba489c",
+  "legal/INDIVIDUAL_CLA.md": "6ce945a06ee88d3c3103a6094123465440d8e9890a84956f257555cc9994fb39",
+  "legal/CORPORATE_CLA.md": "f56606b1a8a563ca1bae67a9335f32ced1ce3827dec500bc28617de604c66608"
+};
 
 function assert(condition, message) {
   if (!condition) {
@@ -11,14 +27,15 @@ function assert(condition, message) {
   }
 }
 
-function readJson(relativePath) {
+function readJson(repoRoot, relativePath) {
   return JSON.parse(fs.readFileSync(path.join(repoRoot, relativePath), "utf8"));
 }
 
-function packDryRunFiles() {
+function packDryRunFiles(repoRoot) {
   const result = spawnSync("npm", ["pack", "--dry-run", "--json"], {
     cwd: repoRoot,
     encoding: "utf8",
+    timeout: 30000,
     env: {
       ...process.env,
       npm_config_cache:
@@ -38,8 +55,8 @@ function packDryRunFiles() {
   return packInfo.files.map((file) => file.path).sort();
 }
 
-function main() {
-  const packageJson = readJson("package.json");
+function verifyPublicPackage(repoRoot = path.resolve(__dirname, "..")) {
+  const packageJson = readJson(repoRoot, "package.json");
 
   assert(packageJson.name === "@plasius/gpu-demo-viewer", "package name must remain scoped");
   assert(packageJson.private !== true, "public package must not set private=true");
@@ -51,11 +68,24 @@ function main() {
   assert(packageJson.repository?.url?.includes("Plasius-LTD/gpu-demo-viewer"), "repository metadata is required");
   assert(packageJson.exports?.["."] === "./viewer-manifest.js", "viewer manifest must be the package root export");
 
-  const files = packDryRunFiles();
+  // Inspect metadata before packing; never read contributor acceptance records.
+  const legalDirectory = fs.lstatSync(path.join(repoRoot, "legal"));
+  assert(legalDirectory.isDirectory(), "legal must be a real directory");
+  for (const file of complianceFiles) {
+    const stat = fs.lstatSync(path.join(repoRoot, file));
+    assert(stat.isFile() && stat.size > 0, `${file} must be a non-empty regular file`);
+  }
+
+  for (const [file, expected] of Object.entries(approvedTemplates)) {
+    const digest = createHash("sha256").update(fs.readFileSync(path.join(repoRoot, file))).digest("hex");
+    assert(digest === expected, `${file} must match approved schema template`);
+  }
+
+  const files = packDryRunFiles(repoRoot);
   const fileSet = new Set(files);
   const requiredFiles = [
     "CHANGELOG.md",
-    "LICENSE",
+    ...complianceFiles,
     "README.md",
     "assets/brigantine.gltf",
     "docs/adrs/index.md",
@@ -73,6 +103,10 @@ function main() {
   }
 
   for (const file of files) {
+    assert(
+      !file.startsWith("legal/") || complianceFiles.includes(file),
+      `package tarball contains unapproved legal document: ${file}`
+    );
     assert(!file.startsWith("node_modules/"), `package tarball must not include ${file}`);
     assert(!file.startsWith("tests/"), `package tarball must not include ${file}`);
     assert(!file.startsWith(".git/"), `package tarball must not include ${file}`);
@@ -82,9 +116,13 @@ function main() {
   process.stdout.write("Public package contract verified.\n");
 }
 
-try {
-  main();
-} catch (error) {
-  process.stderr.write(`${error.message}\n`);
-  process.exitCode = 1;
+module.exports = { verifyPublicPackage };
+
+if (require.main === module) {
+  try {
+    verifyPublicPackage();
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
 }