@plasius/gpu-demo-viewer 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -18,6 +18,36 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 - **Security**
   - (placeholder)
 
+## [0.5.0] - 2026-10-27
+
+- Keep quality controls available after resource/device failures and add explicit scene retry with the latest settings.
+
+- **Added**
+  - Static 50/100-astronaut grove studies using shared geometry, trees and complete shrub groups; typed dense layout definitions and a separate integrity-pinned, attributed benchmark source.
+
+- **Changed**
+  - Report requested GPU resource storage and distinct instance/source counts; deduplicate repeated source credits while preserving placement counts and the original catalogue rollout.
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.4.1] - 2026-10-23
+
+- **Added**
+  - Approved unsigned legal templates and security/contribution policies in the npm artifact, with fail-closed compliance checks, pinned template hashes and regression tests.
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.4.0] - 2026-10-21
 
 - **Added**
@@ -368,3 +398,5 @@ The format is based on Keep a Changelog and this project adheres to SemVer.
 [0.2.3]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.2.3
 [0.3.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.3.0
 [0.4.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.0
+[0.4.1]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.4.1
+[0.5.0]: https://github.com/Plasius-LTD/gpu-demo-viewer/releases/tag/v0.5.0

package/CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing to @plasius/gpu-demo-viewer
+
+This workspace utility exists to accelerate validation across the Plasius
+`gpu-*` packages.
+
+## Local Development
+
+### Prerequisites
+
+- Node.js 24 (`nvm use`)
+- npm
+
+### Validate
+
+```bash
+npm run lint
+npm test
+```
+
+### Demo
+
+```bash
+npm run demo
+```
+
+Then open `http://localhost:8000/gpu-demo-viewer/`.
+
+## Expectations
+
+- Keep the viewer aligned with the real package demos; do not let the manifest drift.
+- Add or update tests when browser target paths or shared showcase assets change.
+- Update `README.md` and `CHANGELOG.md` whenever demo behavior or structure changes.

package/README.md

@@ -56,6 +56,31 @@ See [the design and validation contract](docs/consented-diagnostics.md) and
 The npm package includes the viewer source, manifest and build-time acquisition
 helper and typed composite layout definitions. Model binaries are downloaded separately; they are not bundled in npm.
 
+## Package compliance documents
+
+The npm artifact includes `LICENSE`, `SECURITY.md`, `CONTRIBUTING.md` and the
+unsigned [CLA guide](legal/CLA.md), [Individual CLA](legal/INDIVIDUAL_CLA.md)
+and [Corporate CLA](legal/CORPORATE_CLA.md) templates from the approved schema
+baseline. Only package-name references are adapted. These documents describe
+contribution and reporting policies; model-specific credits and licences remain
+with their existing catalogue records.
+
+Run `npm ci`, `npm run build`, `npm test`, `npm run test:coverage` and
+`npm run pack:check` to validate the contract. The pack check requires non-empty
+regular compliance files and a real `legal/` directory, then verifies their
+presence in the actual npm dry-run manifest. SHA-256 checks pin the exact bytes
+of all three templates to schema commit `d8f8eb430c77b8a98da496a3d8382d73d6297394`
+after package-name substitution. Future legal changes require explicit review
+of the approved baseline, pinned digests and regression expectations together.
+CI and the approved CD path run this check. It fails on missing documents,
+omitted package entries, symlinks, altered template terms or unexpected legal
+files in the artifact. The package allowlist names each legal template individually.
+
+Signed agreements and contributor acceptance records belong in the approved
+access-controlled system outside source control. Never add them to this
+repository, package or public build artifacts. See [ADR 0008](docs/adrs/adr-0008-public-compliance-artifact-contract.md)
+for the packaging decision and release checks.
+
 ## Run the model workshop
 
 Use Node.js 24 or later, npm, and a WebGPU-capable browser on localhost or HTTPS.
@@ -245,6 +270,16 @@ short-lived npm OIDC with provenance, and has no long-lived npm write-token
 fallback. Rollback disables CD; it never rewrites published package history.
 <!-- END PLASIUS RELEASE INTEGRITY -->
 
+## Dense scene studies
+
+Use `npm run models:download -- crowd` to acquire the separately tracked Poly
+Astronaut benchmark and the two existing vegetation sources. The workshop adds
+50- and 100-astronaut groves using shared geometry, six trees and twelve full shrub
+groups. Credits, unique geometry counts and requested GPU allocation bytes remain
+visible. These static studies do not alter the original model-release target.
+See the [dense-scene guide](docs/dense-scene-studies.md) for controls, instancing
+options, limits and qualification requirements.
+
 ## Reuse composite layouts
 
 Import the small data-only subpath to offer the workshop's four arrangements in

package/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+We currently support the latest major version of this project. Older versions may not receive security updates.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately by emailing us at [security@plasius.co.uk](mailto:security@plasius.co.uk). Please do not create a public issue for security-related matters.
+
+## Response Timeline
+
+We aim to acknowledge your report within 2 business days and to provide a more detailed response (including next steps and, if applicable, a timeline for a fix) within 7 business days.
+
+## Disclosure Policy
+
+We request that you give us the opportunity to address the vulnerability before publicly disclosing it. We will coordinate with you on public disclosure once a fix is available and deployed.

package/docs/adrs/adr-0007-consented-curated-showcase-diagnostics.md

@@ -40,3 +40,7 @@ cover explicit user flow, mobile/keyboard access and network/cache isolation.
 Release uses PR CI followed by exact-main `cd.yml` in `production`; verify the
 npm artifact before downstream site#1677 adopts it. No backend or secret mapping
 changes occur in this static package release.
+
+The 27 October 2026 dependency update in ADR 0009 preserves all four asset hashes
+against published shared 1.4.0. The source-admission and consent decisions above
+remain unchanged; model-library stress scenes are still excluded.

package/docs/adrs/adr-0008-public-compliance-artifact-contract.md

@@ -0,0 +1,60 @@
+# ADR 0008: Public compliance artifact contract
+
+Status: Accepted 2026-10-23
+
+## Context
+
+Project Task gpu-demo-viewer#35 under operational task site#847 requires the
+schema-template legal baseline and package-level guarantees. The previous
+verifier allowed publication without security/contribution policies or legal
+templates. This is repository-operational compliance maintenance; it changes no
+product Feature, remotely controlled behaviour or entitlement. Flags and
+capabilities are N/A for this packaging-only task.
+
+## Decision
+
+Reuse the three unsigned templates from @plasius/schema main
+`d8f8eb430c77b8a98da496a3d8382d73d6297394`, substituting only the package name.
+Preserve Apache-2.0 package licensing and existing model-specific licences.
+Include SECURITY.md and CONTRIBUTING.md and explicitly list each legal template
+in package.json. Do not include a broad legal directory glob. Signed agreements
+and acceptance records stay outside source control in the approved restricted
+system; they are never package inputs.
+
+The Node-built-in verifier checks metadata for non-empty regular compliance
+files and a real legal directory. It pins SHA-256 digests of all three adapted
+templates to exact approved bytes before invoking a bounded npm dry-run. Future
+legal changes require reviewed baseline/digest and test updates together;
+non-empty truncation, rewording or added terms must fail. It then
+requires all six documents in the manifest and rejects any unapproved legal
+entry. It does not read private contributor records. Its root argument permits
+isolated test fixtures without mutating the working checkout. CI and CD invoke
+the same pack check; no new runtime dependency or public runtime API is needed.
+
+## Alternatives
+
+Repository-only documents would not satisfy the requested artifact baseline.
+Including all of legal/ would make accidental document additions package inputs.
+Checking source presence alone would miss package allowlist regressions. A new
+shared package is unnecessary for these local filesystem checks.
+
+## Tests and NFR implications
+
+Requirements-derived regressions remove, empty, symlink or omit each required
+document and exercise actual npm dry-runs. Tampering regressions truncate,
+reword and append to every template, and independently pin their approved hashes.
+Positive fixtures prove the complete contract passes, while synthetic unlisted records stay excluded or fail packing.
+Tests never create actual agreements or personal information. Source/helper
+coverage, frozen install, audit, build and package checks establish reproducible
+and maintainable validation. Viewer runtime, browser/GPU behaviour, accessibility,
+SEO and performance are unchanged; no browser qualification or Azure secretref
+change applies. Existing NFR.md remains the runtime baseline.
+
+## Release and rollback
+
+Deliver through PR, successful CI, protected main and the existing cd.yml
+production/OIDC prepare-publish route. Verify a fresh package version and compare
+all required document bytes with the released source and sealed tarball. Do not
+manually promote changelog sections or publish locally. Correct packaging defects
+through an ordinary forward release; never roll back by publishing private
+records or restoring fail-open validation. No site consumer deployment is needed.

package/docs/adrs/adr-0009-instanced-crowd-studies.md

@@ -0,0 +1,31 @@
+# ADR 0009: Instanced crowd studies
+
+Status: Accepted. Date: 2026-10-27. Task #90; Story site#2336; Feature site#1170.
+
+Add two explicit static stress studies: 50 and 100 astronauts, each with six
+Quiver Tree placements and twelve complete Searsia Lucida shrub groups. Each
+shrub source includes seven authored variants; preserve them and label groups
+accurately. Layout definitions are fresh data returned by `denseStudyDefinitions`
+in the existing typed studies export. Existing four composite definitions remain
+stable. Hosts resolve only their admitted sources and own rollout/access decisions.
+
+Use gpu-shared's explicit instancing option and renderer allocation reports. Do not
+expand copies, duplicate shader logic or substitute lower-detail vegetation. Show
+unique geometry, source/placement/mesh-instance counts and requested GPU resource
+storage distinctly. The displayed byte figure is not physical VRAM or total browser
+memory. Retain source credits once per unique asset with placement counts.
+
+The Poly Astronaut GLB is a separately pinned, integrity-checked CC-BY-2.0 benchmark
+source. Keep it in `benchmarkAssets` so the original 75 research identities and
+74-model production target are not changed. `models:download -- crowd` acquires only
+this asset plus the two existing vegetation sources through the bounded acquisition
+helper. The original batch downloader and Gem exclusion retain their semantics.
+
+No public access is enabled locally. The site continues to use
+`gpu-demo.scene-fidelity.enabled` and `site.studio-coming-soon.view`. Complete
+registry-package GPU qualification and approved production release before marking
+this delivery complete. Static instances do not imply animation or voxel traversal.
+
+Consume released shared 1.4.0 and renderer 0.2.57. The existing consented diagnostics
+asset hashes are unchanged and verified against the new shared package; no wider
+scene admission or diagnostics collection is introduced.

package/docs/adrs/index.md

@@ -10,3 +10,7 @@
 - [ADR 0005: Build-time model acquisition subpath](adr-0005-build-time-model-acquisition-subpath.md)
 - [ADR 0006: Composite study consumer](adr-0006-composite-study-consumer.md)
 - [ADR 0007: Consented curated showcase diagnostics](adr-0007-consented-curated-showcase-diagnostics.md)
+
+- [ADR 0008: Public compliance artifact contract](adr-0008-public-compliance-artifact-contract.md)
+
+- [ADR 0009: Instanced crowd studies](adr-0009-instanced-crowd-studies.md)

package/docs/catalogue-production-rollout.md

@@ -225,3 +225,11 @@ raise resource limits to make qualification pass.
 
 The candidate contains 61 models. Production remains at the last independently
 verified release until package publication, site CD and public checks complete.
+
+## Instanced scene admission — 27 October 2026
+
+Shared 1.4.0 replaces the historical 500,000-triangle guard with requested GPU
+resource accounting and device limits. The four large tree sources above remain
+unqualified: removing that guard does not establish their performance or memory
+suitability. Dense studies reuse already reviewed vegetation and a separate pinned
+Astronaut fixture; see [the dense-scene guide](dense-scene-studies.md).

package/docs/consented-diagnostics.md

@@ -50,6 +50,15 @@ signature/attestation verification cover the new locked graph. A future shared
 version requires an explicit asset/hash compatibility review rather than
 silently accepting changed assets.
 
+## Instancing dependency qualification — 27 October 2026
+
+The dense-scene release advances the exact shared dependency to 1.4.0 and the
+renderer range/lock to ^0.2.57/0.2.57. The existing four SHA-384 asset pins match
+the published 1.4.0 bytes without changes; tests also confirm their resources
+remain self-contained. The diagnostics public exports, access/consent boundaries
+and source-owned mount are unchanged. Instanced model studies do not become
+eligible diagnostics sources. See [ADR 0009](adrs/adr-0009-instanced-crowd-studies.md).
+
 ## Browser qualification — 21 October 2026
 
 An isolated in-app Chromium tab mounted the actual published shared/native

package/docs/dense-scene-studies.md

@@ -0,0 +1,55 @@
+# Dense scene studies
+
+The astronaut grove studies place 50 or 100 astronauts among six trees and twelve
+shrub groups. Each group retains the complete seven-variant Searsia source. This
+is a static instancing test: source meshes and acceleration structures are shared,
+with distinct transforms per placement. Original geometry and textures are kept.
+
+Acquire the three integrity-pinned sources with:
+
+```sh
+npm run models:download -- crowd
+npm run models:dev
+```
+
+Open the local workshop with `?review=first-twelve&model=study-astronaut-grove-100`
+and choose the requested sample count, bounces, image size and denoising. Pause
+when hidden, move/reset the camera to invalidate history, and compare the 50- and
+100-placement study. An allocation or GPU failure must remain visible; choose a
+smaller quality target or retry explicitly rather than silently changing the scene.
+
+The `model-library/studies` export provides `denseStudyDefinitions()` alongside
+the original `compositeStudyDefinitions()`. Dense definitions carry `instancing`
+and `camera` as well as placement data. Resolve each source through your reviewed
+catalogue, pass those options to `createSceneInspection`, and display the returned
+source/instance counts and allocation report. Repeated models need one source
+attribution, with a placement count, rather than a hundred duplicate credits.
+
+The 100-astronaut scene has 118 model placements, 365 mesh instances including its
+ground, 25 unique mesh primitives and 528,922 unique triangles. The expanded
+geometry equivalent is 5,587,450 triangles. More instances still require TLAS and
+transform storage and add ray traversal/shading work. Requested GPU storage also
+depends on image size and denoising. It excludes driver overhead, other tabs and
+physical-memory residency; it is not a measure of available VRAM.
+
+Astronaut is credited to Poly under CC-BY-2.0, from the pinned Google model-viewer
+source and attribution record in `catalogue.json`. Quiver Tree and Searsia Lucida
+retain their existing Poly Haven CC0 source records and authors. Benchmark assets
+are additional fixtures, separate from the original 74-model production target.
+
+Qualification requirements: deterministic counts and fresh layout data; complete
+integrity manifests; visible attribution; unchanged original composites; allocation
+and device-loss errors; source cleanup; keyboard/touch/mouse and mobile layout;
+registry-based 50/100 GPU review; approved release and public verification. Local
+source-injected results alone do not establish production readiness. Track evidence
+under Task #90 and Story site#2336.
+
+After a resource allocation or device failure, adjust the quality settings and
+choose **Retry selected scene**. Changes while failed do not submit further GPU
+work; retry disposes the previous scene and uses the latest settings.
+
+Registry consumer qualification on 27 October 2026 used renderer 0.2.57 and shared
+1.4.0 with no source overrides. Both 50/100 studies completed 64 samples/six
+bounces/denoising at the workshop's 800x283 viewport. The existing diagnostics
+asset pins also match shared 1.4.0. This establishes local released-dependency
+behavior; public deployment remains a separate gate.

package/legal/CLA.md

@@ -0,0 +1,25 @@
+# Contributor License Agreements (CLA)
+
+To protect the intellectual property of this project and ensure clarity of rights, all contributors must sign a Contributor License Agreement (CLA) before their first contribution.
+
+## Which CLA should I sign?
+
+- **Individual CLA**: If you are contributing personally and not on behalf of an employer, sign the [Individual CLA](INDIVIDUAL_CLA.md).
+- **Corporate CLA**: If you are contributing as part of your work for a company, the company should sign the [Corporate CLA](CORPORATE_CLA.md).
+
+## How to sign
+
+1. Download the appropriate CLA file (Individual or Corporate).
+2. Fill in the required details, sign, and date it.
+3. Email a PDF copy of the signed document to **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)** with subject: `CLA – Individual` or `CLA – Corporate`.
+
+## Registry
+
+Signed agreements and acceptance records are stored in an access-controlled
+system outside source control. They must never be committed to a repository,
+included in a package, or copied into issues, pull requests, build logs, or
+other public artifacts.
+
+## Questions?
+
+If you have any questions about which CLA to sign or how the process works, please email **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)**.

package/legal/CORPORATE_CLA.md

@@ -0,0 +1,57 @@
+# Corporate Contributor License Agreement (CLA)
+
+## Purpose
+
+This Corporate Contributor License Agreement ("Agreement") is intended to protect the intellectual property rights of the contributors and the project, ensure clear licensing terms for contributions, and maintain trust within the community. By signing this Agreement, the corporation agrees to the terms that facilitate the use, distribution, and modification of contributions under the project's licensing framework.
+
+## Agreement
+
+1. **Representation of Authority**  
+   The undersigned individual represents and warrants that they have the full legal authority to enter into this Agreement on behalf of the corporation named below ("Corporation") and to grant the rights contained herein.
+
+2. **Grant of Copyright License**  
+   The Corporation hereby grants to the project maintainers and users a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to use, reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the contributions submitted to the project.
+
+3. **Grant of Patent License**  
+   The Corporation hereby grants to the project maintainers and users a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under any patent claims that are necessarily infringed by the contributions to make, use, sell, offer for sale, import, and otherwise dispose of the contributions or derivative works thereof.
+
+4. **Warranties and Representations**  
+   The Corporation represents and warrants that:
+
+- The contributions are the original work of the Corporation or that the Corporation has sufficient rights to grant the licenses herein.
+- The submission of the contributions does not violate any agreements or rights of third parties.
+
+5. **No Revocation**  
+   This license is granted on a perpetual basis and cannot be revoked, provided that the terms of this Agreement are met.
+
+6. **Governing Law**
+   This Agreement shall be governed by and construed in accordance with the laws of the United Kingdom, without regard to its conflict of laws principles.
+
+7. **Execution**
+
+This Agreement is effective upon signature by the authorized representative of the Corporation. Please sign and date this document, then email a scanned PDF copy to [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk).
+
+---
+
+### **@plasius/gpu-demo-viewer**
+
+**Corporation Legal Name:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Authorized Representative:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Title:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Email:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Date:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Signature:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+---
+
+## How to Sign
+
+- Download this file as a template.
+- Fill in the Corporation’s legal name, authorized representative, title, email, date, and provide a signature.
+- Sign and date the document.
+- Send a scanned copy of the signed Agreement to [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk).

package/legal/INDIVIDUAL_CLA.md

@@ -0,0 +1,91 @@
+# Individual Contributor License Agreement (CLA)
+
+**Project:** @plasius/gpu-demo-viewer (Plasius LTD)  
+**Version:** 1.0 — 2025‑09‑12  
+**Contact:** [contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)
+
+---
+
+## 1. Definitions
+
+- **"You"** (or **"Contributor"**) means the individual signing this CLA and submitting Contributions to the Project.
+- **"Contribution"** means any original work of authorship, including code, documentation, data, designs, or feedback that You submit to the Project in any form (e.g., pull request, issue comment, email, file upload).
+- **"Project"** means the @plasius/gpu-demo-viewer repositories and related materials owned or managed by **Plasius LTD**.
+
+## 2. Copyright License Grant
+
+You hereby grant to Plasius LTD a **perpetual, worldwide, non‑exclusive, transferable, sublicensable, royalty‑free, irrevocable** copyright license to:
+
+- use, reproduce, publicly display, publicly perform, modify, create derivative works of, and
+- distribute Contributions in source and object form,
+- and to **sublicense** these rights under any terms Plasius LTD chooses, including proprietary or open‑source licenses.
+
+## 3. Patent License Grant
+
+You hereby grant to Plasius LTD and its sublicensees a **perpetual, worldwide, non‑exclusive, transferable, royalty‑free, irrevocable** patent license to **make, have made, use, offer to sell, sell, import, and otherwise transfer** the Contribution and derivative works thereof, where such license applies only to patent claims that You **own or control** and that would be infringed by Your Contribution or its combination with the Project.
+
+## 4. Moral Rights & Attribution
+
+To the maximum extent permitted by applicable law, You **waive** and agree not to assert any moral rights (e.g., rights of attribution or integrity) in or to the Contribution against Plasius LTD. Plasius LTD may, but is not required to, credit You.
+
+## 5. Representations & Warranties
+
+You represent that:
+
+1. **Originality / Rights:** Each Contribution is Your original creation, or You have sufficient rights to submit it and grant the licenses above.
+2. **No Confidential Info:** Contributions **do not** include confidential information or trade secrets of any third party.
+3. **No Infringement:** To the best of Your knowledge, Contributions do not infringe any third‑party IP rights.
+4. **Employment / Contractor Status:** If Your employer or a third party might claim rights in Your Contribution, You have obtained **written permission** to make the Contribution and grant these licenses (attach or reference below), or Your Contribution is made **outside the scope** of your employment and without using your employer’s confidential information or resources.
+5. **Compliance:** You will follow the Project’s policies (e.g., Code of Conduct, Security Policy) and applicable laws.
+
+## 6. Third‑Party Code
+
+If Your Contribution includes code, data, or other material from a third party, You will **identify the material and its license** in the pull request or submission, and ensure it is **compatible** with the Project’s licensing model. You will not submit material subject to terms that require the Project to disclose proprietary source code (e.g., certain copyleft obligations) unless the Project has **pre‑approved** such inclusion in writing.
+
+## 7. Scope & Duration
+
+- This CLA covers **all past and future** Contributions You submit to the Project, unless and until You provide written notice to **revoke** it.
+- Revocation is **not retroactive**: rights granted for prior Contributions remain in effect.
+
+## 8. Disclaimer
+
+THE CONTRIBUTION IS PROVIDED “AS IS” WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON‑INFRINGEMENT.
+
+## 9. Governing Law & Jurisdiction
+
+This CLA is governed by the **laws of England and Wales**, and the courts of England and Wales shall have **exclusive jurisdiction** over any dispute arising out of or relating to it.
+
+## 10. Entire Agreement
+
+This CLA is the entire agreement between You and Plasius LTD regarding Contributions. It supersedes any prior discussions relating to Contributions. If any provision is held unenforceable, the remaining provisions remain in full force.
+
+---
+
+## 11. Contributor Information & Signature
+
+By signing below, You agree to the terms of this CLA for Your Contributions to the Project.
+
+**Full Name:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Email:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**GitHub Handle:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Address (optional):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Employer (if applicable):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**If employed:** ☐ I confirm Contributions are made outside the scope of employment **or** ☐ I have attached my employer’s written permission.
+
+**Signature:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+**Date (YYYY‑MM‑DD):** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
+
+_Electronic signatures are accepted. You may type your name in the Signature field and email a PDF copy._
+
+**Submission:** Please email the signed CLA to **[contributors@plasius.co.uk](mailto:contributors@plasius.co.uk)** with subject line: `CLA – Individual – <GitHubHandle>`.
+
+**(Optional) Attachments / Notes:**
+
+- Employer permission letter (if required)
+- Third‑party license disclosures (if any)

package/model-library/catalogue.json

@@ -6088,5 +6088,45 @@
         ]
       }
     }
+  ],
+  "benchmarkAssets": [
+    {
+      "key": "Astronaut",
+      "name": "Astronaut",
+      "category": "Benchmark source",
+      "priority": "Dense scene benchmark",
+      "provider": "Poly / Google model-viewer",
+      "source_url": "https://github.com/google/model-viewer/blob/626f7498f3b8bf1130d0ca0c7b7bb756d6fb89ee/packages/modelviewer.dev/ATTRIBUTIONS.md",
+      "authors": "Poly",
+      "licence": "CC-BY-2.0",
+      "licence_url": "https://creativecommons.org/licenses/by/2.0/",
+      "attribution_required": true,
+      "original_source_url": "https://poly.google.com/view/dLHpzNdygsg",
+      "source_revision": "626f7498f3b8bf1130d0ca0c7b7bb756d6fb89ee",
+      "renderer_target": "Shared geometry, suit material and silhouette in dense scenes.",
+      "preparation": "Static original model; source animation is not present.",
+      "review_status": "local-review",
+      "entry": "Astronaut.glb",
+      "files": [
+        {
+          "path": "Astronaut.glb",
+          "url": "https://raw.githubusercontent.com/google/model-viewer/626f7498f3b8bf1130d0ca0c7b7bb756d6fb89ee/packages/shared-assets/models/Astronaut.glb",
+          "bytes": 2869044,
+          "sha256": "313d48882e2ba7bb25a340dbfd3d6f9bbc7f012372d54f518dc52e4299e3a24e",
+          "integrity": "sha256-MT1IiC4rp7slo0Db/T1vm7x/ASNy1U9RjcUuQpnjok4="
+        }
+      ],
+      "inspection": {
+        "triangles": 1604,
+        "primitives": 1,
+        "materials": 1,
+        "extensions": [],
+        "animations": [],
+        "alphaModes": [
+          "OPAQUE"
+        ]
+      },
+      "checked": "2026-10-27"
+    }
   ]
 }

package/model-library/index.html

@@ -29,7 +29,7 @@
 <p id="quality-help">Hold the camera still to refine. Higher targets reduce noise; more bounces reveal indirect light. HD, QHD and 4K trace at the selected size, even in a smaller window. Higher resolution costs more GPU time; use one sample for a quick inspection.</p>
 </fieldset>
 <div class="refinement"><label id="refinement" for="sample-progress">Waiting for a model…</label><progress id="sample-progress" max="64" value="0"></progress></div>
-<div class="canvas-wrap"><canvas id="canvas" width="800" height="600" tabindex="0" aria-label="Interactive Plasius model view" aria-describedby="help"></canvas><p id="hint" hidden>Drag to orbit · Shift-drag to move · Scroll to approach<br>Touch: drag or pinch · Keyboard: arrows, + / −, Home</p></div><p id="status" role="status" aria-live="polite">Preparing the review…</p></section></div>
+<div class="canvas-wrap"><canvas id="canvas" width="800" height="600" tabindex="0" aria-label="Interactive Plasius model view" aria-describedby="help"></canvas><p id="hint" hidden>Drag to orbit · Shift-drag to move · Scroll to approach<br>Touch: drag or pinch · Keyboard: arrows, + / −, Home</p></div><p id="status" role="status" aria-live="polite">Preparing the review…</p><button id="retry" type="button" hidden>Retry selected scene</button></section></div>
 <p class="footnote">Source models join this workshop in review batches. Gem is excluded from this rollout; no substitute is shown.</p></main>
 <script type="module">import { mountLibrary } from './main.js'; mountLibrary().catch(error => { document.querySelector('#status').textContent = `Unable to open review: ${error.message}`; });</script>
 </body></html>

package/model-library/main.js

@@ -1,5 +1,5 @@
 import { createReviewController, fixtureRequest, reviewEnabled } from './controller.js';
-import { compositeStudies, compositeRequest, renderCompositeCredits } from './scenes.js';
+import { compositeStudies, denseStudies, compositeRequest, renderCompositeCredits } from './scenes.js';
 
 export async function mountLibrary({document:doc=globalThis.document,window:win=globalThis.window,
   fetch:request=globalThis.fetch,importRuntime=()=>import('@plasius/gpu-shared/model-inspection')}={}) {
@@ -10,8 +10,8 @@ export async function mountLibrary({document:doc=globalThis.document,window:win=
   }
   const response=await request(new URL('./catalogue.json',win.location.href));
   if (!response.ok) throw new Error('Model catalogue could not be loaded.');
-  const {assets}=await response.json();
-  const studies=compositeStudies(assets), selections=[...assets,...studies];
+  const catalogue=await response.json(),assets=[...catalogue.assets,...(catalogue.benchmarkAssets??[])];
+  const studies=[...compositeStudies(assets),...denseStudies(assets)], selections=[...assets,...studies];
   for(const asset of selections) {
     const option=doc.createElement('option');option.value=asset.key;
     option.textContent=asset.name+(asset.models?' — composite study':asset.entry?'':' — deferred');el('model').append(option);
@@ -26,7 +26,13 @@ export async function mountLibrary({document:doc=globalThis.document,window:win=
   const refinement=p=>{
     el('sample-progress').max=p.target;el('sample-progress').value=p.samples;
     const phase={complete:'Complete',paused:'Paused',rendering:'Rendering',refining:'Refining'}[p.phase];
-    el('refinement').textContent=`${phase} · ${p.samples} / ${p.target} samples · ${p.width} × ${p.height}`;
+    el('refinement').textContent=`${phase} · ${p.samples} / ${p.target} samples · ${p.width} × ${p.height}${p.allocations?` · ${(p.allocations.allocatedBytes/1048576).toFixed(1)} MiB requested GPU storage${p.allocations.budgetBytes?` / ${(p.allocations.budgetBytes/1048576).toFixed(0)} MiB budget`:""}`:""}`;
+  };
+  let stateKind='loading';
+  const failed=error=>{
+    stateKind='error';status.textContent=`Render failed: ${error.message}`;
+    el('refinement').textContent='Refinement stopped. Adjust quality, then retry.';
+    el('quality').disabled=false;el('retry').hidden=false;
   };
   const controller=createReviewController({
     load:async(asset,signal)=>{
@@ -37,16 +43,17 @@ export async function mountLibrary({document:doc=globalThis.document,window:win=
       return inspect({canvas:el('canvas'),...request,signal,enabled:true,
         ...quality(),quality:quality(),
         onProgress:p=>{if(!signal.aborted)refinement(p);},
-        onHintChange:visible=>{el('hint').hidden=!visible;},
-        onError:error=>{if(signal.aborted)return;status.textContent=`Render failed: ${error.message}`;el('refinement').textContent='Refinement stopped';el('quality').disabled=true;}});
+        onHintChange:visible=>{if(!signal.aborted)el('hint').hidden=!visible;},
+        onError:error=>{if(!signal.aborted)failed(error);}});
     },
     onState:state=>{
-      el('hint').hidden=true;el('quality').disabled=state.kind!=='ready';
+      stateKind=state.kind;el('retry').hidden=state.kind!=='error';
+      el('hint').hidden=true;el('quality').disabled=!['ready','error'].includes(state.kind);
       if(state.kind==='loading'){el('sample-progress').value=0;el('refinement').textContent='Waiting for the first sample…';}
       if(state.kind==='loading')status.textContent=`Loading ${state.asset.name} and checking its files…`;
       else if(state.kind==='ready') {
         status.textContent=`${state.asset.review_status==='needs-fix'?'Rendered — visual defect recorded':'Ready'} · ${state.asset.name} · ${state.runtime.triangleCount.toLocaleString()} triangles · ${state.runtime.primitiveCount} mesh primitives`;
-        el('metrics').textContent=`${state.runtime.triangleCount.toLocaleString()} triangles · ${state.asset.inspection.materials} source materials${state.asset.models?` · ${state.asset.models.length} models + shared ground`:''}`;
+        el('metrics').textContent=`${state.runtime.triangleCount.toLocaleString()} triangles · ${state.asset.inspection.materials} source materials${state.asset.models?` · ${state.asset.models.length} models + shared ground${state.runtime.geometryMode==='instanced'?` · ${state.runtime.sourceCount} unique sources · ${state.runtime.instanceCount} mesh instances · shared geometry`:""}`:''}`;
       } else {status.textContent=state.message;el('canvas').hidden=true;el('refinement').textContent='Refinement unavailable';}
     },
   });
@@ -60,7 +67,7 @@ export async function mountLibrary({document:doc=globalThis.document,window:win=
     if(!asset.models){el('source').href=asset.source_url;el('licence').href=asset.licence_url;el('licence').textContent=asset.licence;}
     el('metrics').textContent=asset.entry?`${(asset.files.reduce((n,f)=>n+f.bytes,0)/1048576).toFixed(1)} MiB on disk`:'';
     const clips=asset.inspection?.animations??[];
-    el('note').textContent=asset.models?`${asset.models.length} original models share one camera, ground and lighting. Geometry counts include the ground.`:
+    el('note').textContent=asset.models?(asset.instancing?`${asset.models.length} model placements share three sources, one camera, ground and lighting. Geometry counts are unique; requested GPU storage excludes driver overhead and other tabs.`:`${asset.models.length} original models share one camera, ground and lighting. Geometry counts include the ground.`):
       clips.length?`Static pose only. ${clips.length} source clips are present: ${clips.join(', ')}. Animation playback needs importer work.`:
       asset.inspection?.extensions.length?`Material features to inspect: ${asset.inspection.extensions.join(', ')}.`:'Source materials under the same inspection lighting.';
     return controller.select(asset);
@@ -68,9 +75,11 @@ export async function mountLibrary({document:doc=globalThis.document,window:win=
   const requested=new URL(win.location.href).searchParams.get('model');
   el('model').value=selections.find(a=>a.key===requested&&(a.entry||a.models))?.key??assets.find(a=>a.entry).key;
   el('model').addEventListener('change',change);
+  el('retry').addEventListener('click',change);
   el('model').disabled=false;
   const qualityChange=async()=>{
-    try{await controller.setQuality(quality());}catch(error){status.textContent=`Render failed: ${error.message}`;}
+    if(stateKind!=='ready')return;
+    try{await controller.setQuality(quality());}catch(error){failed(error);}
   };
   for(const id of ['samples','bounces','resolution','denoise'])el(id).addEventListener('change',qualityChange);
   const visibility=()=>controller.setPaused(doc.hidden===true);
@@ -78,7 +87,7 @@ export async function mountLibrary({document:doc=globalThis.document,window:win=
   let resizeTimer;
   const resize=()=>{clearTimeout(resizeTimer);resizeTimer=setTimeout(qualityChange,250);};
   win.addEventListener('resize',resize);
-  const destroy=()=>{for(const id of ['samples','bounces','resolution','denoise'])el(id).removeEventListener('change',qualityChange);doc.removeEventListener('visibilitychange',visibility);clearTimeout(resizeTimer);controller.destroy();el('model').removeEventListener('change',change);win.removeEventListener('pagehide',destroy);win.removeEventListener('resize',resize);};
+  const destroy=()=>{for(const id of ['samples','bounces','resolution','denoise'])el(id).removeEventListener('change',qualityChange);doc.removeEventListener('visibilitychange',visibility);clearTimeout(resizeTimer);controller.destroy();el('model').removeEventListener('change',change);el('retry').removeEventListener('click',change);win.removeEventListener('pagehide',destroy);win.removeEventListener('resize',resize);};
   win.addEventListener('pagehide',destroy);
   await change();return {destroy};
 }

package/model-library/scenes.js

@@ -1,31 +1,44 @@
 import { fixtureRequest } from './controller.js';
-import { compositeStudyDefinitions } from './studies.js';
+import { compositeStudyDefinitions, denseStudyDefinitions } from './studies.js';
 
 export function compositeStudies(assets) {
-  return compositeStudyDefinitions().flatMap(({ placements, ...definition }) => {
+  return resolveStudies(compositeStudyDefinitions(),assets);
+}
+
+export function denseStudies(assets) {
+  return resolveStudies(denseStudyDefinitions(),assets);
+}
+
+function resolveStudies(definitions,assets) {
+  return definitions.flatMap(({ placements, ...definition }) => {
     const models = placements.map(([key, anchor, size, yaw]) => ({
       asset: assets.find(a => a.key === key), anchor: [...anchor], size, yaw,
     }));
     if (models.some(model => !model.asset?.entry)) return [];
     return [{ ...definition, category: 'Composite study', models,
-      inspection: { materials: models.reduce((sum, model) => sum + model.asset.inspection.materials, 0) } }];
+      inspection: { materials: [...new Map(models.map(model=>[model.asset.key,model.asset])).values()].reduce((sum, asset) => sum + asset.inspection.materials, 0) } }];
   });
 }
 
 export function compositeRequest(study, base) {
-  return { models: study.models.map(({ asset, anchor, size, yaw }) => ({
+  return { ...(study.instancing?{instancing:true,camera:study.camera}:{}), models: study.models.map(({ asset, anchor, size, yaw }) => ({
     ...fixtureRequest(asset, base), anchor, size, yaw,
   })) };
 }
 
 export function renderCompositeCredits(doc, container, models) {
   container.replaceChildren();
-  for (const { asset, size } of models) {
+  const sources=new Map();
+  for(const {asset,size} of models) {
+    const source=sources.get(asset.key)??{asset,sizes:new Set(),count:0};
+    source.sizes.add(size);source.count++;sources.set(asset.key,source);
+  }
+  for (const { asset, sizes, count } of sources.values()) {
     const item = doc.createElement('li'), source = doc.createElement('a'), licence = doc.createElement('a');
     source.textContent = `${asset.name} — ${asset.authors}`; source.href = asset.source_url;
     licence.textContent = asset.licence; licence.href = asset.licence_url;
     for (const link of [source, licence]) { link.target = '_blank'; link.rel = 'noopener'; }
-    item.append(source, ' · ', licence, ` · longest dimension ${size} scene units`);
+    item.append(source, ' · ', licence, ` · ${count} placement${count===1?'':'s'} · longest dimension ${[...sizes].join(', ')} scene units`);
     container.append(item);
   }
 }

package/model-library/studies.d.ts

@@ -4,7 +4,11 @@ export interface CompositeStudyDefinition {
   name: string;
   renderer_target: string;
   preparation: string;
+  instancing?: boolean;
+  camera?: { eye: [number, number, number]; target: [number, number, number]; fov: number };
   /** Source key, bottom-centre anchor, longest dimension in scene units, Y rotation in radians. */
   placements: [string, [number, number, number], number, number][];
 }
 export function compositeStudyDefinitions(): CompositeStudyDefinition[];
+
+export function denseStudyDefinitions(): CompositeStudyDefinition[];

package/model-library/studies.js

@@ -49,3 +49,18 @@ export function compositeStudyDefinitions() {
     placements: placements.map(([key, anchor, size, yaw]) => [key, [...anchor], size, yaw]),
   }));
 }
+
+/** Dense static scenes share three source models; shrub placements retain all authored variants. */
+export function denseStudyDefinitions() {
+  return [50,100].map(count => ({
+    key: `study-astronaut-grove-${count}`, name: `Astronaut grove — ${count} astronauts`,
+    renderer_target: `Trace ${count} astronauts, six trees and twelve shrub groups with shared geometry.`,
+    preparation: 'Inspect overlapping silhouettes, vegetation transparency and contact shadows. Each shrub group retains seven authored variants. Static instances; dimensions are chosen scene units.',
+    instancing: true, camera: {eye:[25,22,33],target:[0,1,0],fov:42},
+    placements: [
+      ...Array.from({length:count},(_,i)=>['Astronaut',[(i%10-4.5)*1.75,0,(Math.floor(i/10)-(count/10-1)/2)*1.75],1.8,(i*.618)%(Math.PI*2)]),
+      ...Array.from({length:6},(_,i)=>['quiver_tree_01',[i%2?12:-12,0,Math.floor(i/2)*9-9],7,(i*.618)%(Math.PI*2)]),
+      ...Array.from({length:12},(_,i)=>['searsia_lucida',[i%2?10.5:-10.5,0,Math.floor(i/2)*4-10],3,(i*.618)%(Math.PI*2)]),
+    ],
+  }));
+}

package/model-library/styles.css

@@ -7,3 +7,5 @@
 
 /* Preserve the traced camera aspect when fixed-size frames fit the viewport. */
 canvas{object-fit:contain}
+
+#retry{min-height:44px;padding:.7rem 1rem;background:#222d37;color:#f2eee5;border:1px solid #dfc88d;border-radius:.35rem;font:inherit;cursor:pointer}#retry:focus-visible{outline:3px solid #edd7a1;outline-offset:3px}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-demo-viewer",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "Root validation viewer for Plasius gpu-* demos.",
   "license": "Apache-2.0",
@@ -41,7 +41,12 @@
     "styles.css",
     "viewer-manifest.js",
     "model-library/",
-    "diagnostics/"
+    "diagnostics/",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "legal/CLA.md",
+    "legal/INDIVIDUAL_CLA.md",
+    "legal/CORPORATE_CLA.md"
   ],
   "engines": {
     "node": ">=24"
@@ -60,8 +65,8 @@
     "test:coverage": "c8 --reporter=lcov --reporter=text node --test"
   },
   "dependencies": {
-    "@plasius/gpu-renderer": "^0.2.54",
-    "@plasius/gpu-shared": "1.3.0"
+    "@plasius/gpu-renderer": "^0.2.57",
+    "@plasius/gpu-shared": "1.4.0"
   },
   "devDependencies": {
     "c8": "^11.0.0",

package/scripts/acquire-model-library.mjs

@@ -3,9 +3,10 @@ import { fileURLToPath } from 'node:url';
 import { acquireFixtures } from '../model-library/acquire.js';
 import { selectBatch } from '../model-library/rollout.js';
 export async function run(acquire=acquireFixtures,batch=0) {
-  const {assets}=JSON.parse(await readFile(new URL('../model-library/catalogue.json',import.meta.url),'utf8'));
+  const {assets,benchmarkAssets=[]}=JSON.parse(await readFile(new URL('../model-library/catalogue.json',import.meta.url),'utf8'));
+  if(batch==='crowd')return acquire({assets:[...benchmarkAssets,...assets.filter(a=>['quiver_tree_01','searsia_lucida'].includes(a.key))],root:fileURLToPath(new URL('../model-library/assets/',import.meta.url))});
   const {entries}=JSON.parse(await readFile(new URL('../model-library/rollout.json',import.meta.url),'utf8'));
   const keys=new Set(selectBatch(entries,batch).map(entry=>entry.key));
   return acquire({assets:assets.filter(asset=>keys.has(asset.key)),root:fileURLToPath(new URL('../model-library/assets/',import.meta.url))});
 }
-if(process.argv[1]===fileURLToPath(import.meta.url))console.log(await run(undefined,process.argv[2]===undefined?0:Number(process.argv[2])));
+if(process.argv[1]===fileURLToPath(import.meta.url))console.log(await run(undefined,process.argv[2]===undefined?0:process.argv[2]==='crowd'?'crowd':Number(process.argv[2])));

package/scripts/verify-public-package.cjs

@@ -1,9 +1,25 @@
 const fs = require("node:fs");
 const os = require("node:os");
+const { createHash } = require("node:crypto");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 
-const repoRoot = path.resolve(__dirname, "..");
+const complianceFiles = [
+  "LICENSE",
+  "SECURITY.md",
+  "CONTRIBUTING.md",
+  "legal/CLA.md",
+  "legal/INDIVIDUAL_CLA.md",
+  "legal/CORPORATE_CLA.md"
+];
+
+// Approved schema d8f8eb430c77b8a98da496a3d8382d73d6297394, with only
+// @plasius/schema replaced by @plasius/gpu-demo-viewer. Hash exact bytes.
+const approvedTemplates = {
+  "legal/CLA.md": "8e7de8348013f65a551d9a3179d4927cdce4ae15497ba209a0cf2c1098ba489c",
+  "legal/INDIVIDUAL_CLA.md": "6ce945a06ee88d3c3103a6094123465440d8e9890a84956f257555cc9994fb39",
+  "legal/CORPORATE_CLA.md": "f56606b1a8a563ca1bae67a9335f32ced1ce3827dec500bc28617de604c66608"
+};
 
 function assert(condition, message) {
   if (!condition) {
@@ -11,14 +27,15 @@ function assert(condition, message) {
   }
 }
 
-function readJson(relativePath) {
+function readJson(repoRoot, relativePath) {
   return JSON.parse(fs.readFileSync(path.join(repoRoot, relativePath), "utf8"));
 }
 
-function packDryRunFiles() {
+function packDryRunFiles(repoRoot) {
   const result = spawnSync("npm", ["pack", "--dry-run", "--json"], {
     cwd: repoRoot,
     encoding: "utf8",
+    timeout: 30000,
     env: {
       ...process.env,
       npm_config_cache:
@@ -38,8 +55,8 @@ function packDryRunFiles() {
   return packInfo.files.map((file) => file.path).sort();
 }
 
-function main() {
-  const packageJson = readJson("package.json");
+function verifyPublicPackage(repoRoot = path.resolve(__dirname, "..")) {
+  const packageJson = readJson(repoRoot, "package.json");
 
   assert(packageJson.name === "@plasius/gpu-demo-viewer", "package name must remain scoped");
   assert(packageJson.private !== true, "public package must not set private=true");
@@ -51,11 +68,24 @@ function main() {
   assert(packageJson.repository?.url?.includes("Plasius-LTD/gpu-demo-viewer"), "repository metadata is required");
   assert(packageJson.exports?.["."] === "./viewer-manifest.js", "viewer manifest must be the package root export");
 
-  const files = packDryRunFiles();
+  // Inspect metadata before packing; never read contributor acceptance records.
+  const legalDirectory = fs.lstatSync(path.join(repoRoot, "legal"));
+  assert(legalDirectory.isDirectory(), "legal must be a real directory");
+  for (const file of complianceFiles) {
+    const stat = fs.lstatSync(path.join(repoRoot, file));
+    assert(stat.isFile() && stat.size > 0, `${file} must be a non-empty regular file`);
+  }
+
+  for (const [file, expected] of Object.entries(approvedTemplates)) {
+    const digest = createHash("sha256").update(fs.readFileSync(path.join(repoRoot, file))).digest("hex");
+    assert(digest === expected, `${file} must match approved schema template`);
+  }
+
+  const files = packDryRunFiles(repoRoot);
   const fileSet = new Set(files);
   const requiredFiles = [
     "CHANGELOG.md",
-    "LICENSE",
+    ...complianceFiles,
     "README.md",
     "assets/brigantine.gltf",
     "docs/adrs/index.md",
@@ -73,6 +103,10 @@ function main() {
   }
 
   for (const file of files) {
+    assert(
+      !file.startsWith("legal/") || complianceFiles.includes(file),
+      `package tarball contains unapproved legal document: ${file}`
+    );
     assert(!file.startsWith("node_modules/"), `package tarball must not include ${file}`);
     assert(!file.startsWith("tests/"), `package tarball must not include ${file}`);
     assert(!file.startsWith(".git/"), `package tarball must not include ${file}`);
@@ -82,9 +116,13 @@ function main() {
   process.stdout.write("Public package contract verified.\n");
 }
 
-try {
-  main();
-} catch (error) {
-  process.stderr.write(`${error.message}\n`);
-  process.exitCode = 1;
+module.exports = { verifyPublicPackage };
+
+if (require.main === module) {
+  try {
+    verifyPublicPackage();
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
 }