@plasius/gpu-renderer 0.2.39 → 0.2.40

package/CHANGELOG.md

@@ -23,6 +23,27 @@ All notable changes to this project will be documented in this file.
 - **Security**
   - (placeholder)
 
+## [0.2.40] - 2026-08-30
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - Updated internal GPU dependencies to their surviving clean lines and refreshed the esbuild resolution.
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - Added permanent fail-closed Zero-Three validation for manifests, source,
+    locks, installed dependency graphs, declarations, bundles, npm tarballs,
+    CycloneDX SBOMs, and active documentation, with digest-bound evidence
+    retained and attested by CI/CD.
+  - Pinned patched transitive npm dependencies to clear the current audit baseline.
+  - Replaced token-based npm publication with a two-phase exact-main OIDC workflow, immutable tarball/SBOM hand-off, isolated pull-request validation, and fail-closed integrity checks.
+  - Added fail-closed source and npm-package admission for the administrative contributor registry and pinned the CI/CD runtime to Node.js 24.18.0 LTS.
+  - (placeholder)
+
 ## [0.2.39] - 2026-07-10
 
 - **Added**
@@ -984,3 +1005,4 @@ All notable changes to this project will be documented in this file.
 [0.2.37]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.37
 [0.2.38]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.38
 [0.2.39]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.39
+[0.2.40]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.40

package/README.md

@@ -27,6 +27,21 @@ Apache-2.0. ESM + CJS builds.
 npm install @plasius/gpu-renderer
 ```
 
+## Permanent Zero-Three boundary
+
+This WebGPU renderer and its complete production, development, test, tooling,
+peer, optional, and artifact dependency graphs permanently prohibit Three.js,
+R3F, TSL, their related packages, and any dependency path reaching them. There
+is no compatibility mode, fallback, waiver, or rollback to those renderers.
+
+Run `npm run zero-three:source` before installing dependencies, or run
+`npm run build && npm run zero-three` after `npm ci` for the installed graph,
+built bundle, actual npm tarball, and generated CycloneDX evidence. The full
+command writes digest-bound package/version evidence to
+`release-artifacts/zero-three-evidence.json`. CI retains it, and production CD
+passes it by immutable artifact ID, verifies it again, attaches it to the
+GitHub release, and attests it.
+
 ## Usage
 
 ```js
@@ -580,3 +595,18 @@ npm run pack:check
 - `docs/design/worker-manifest-integration.md`: renderer frame-stage DAG model.
 - `docs/adrs/*`: architecture decisions for renderer runtime design.
 - `docs/tdrs/*`: technical direction for frame hook integration.
+
+<!-- BEGIN PLASIUS RELEASE INTEGRITY -->
+## Release integrity
+
+CI keeps the administrative contributor registry outside Git and npm package
+artifacts using exact, case-normalised path checks. External fork heads are
+rejected; same-repository pull requests validate on GitHub-hosted runners and
+main pushes validate on approved self-hosted runners. Release preparation and
+publication use a two-run exact-main protocol on GitHub-hosted Node.js 24.18.0
+LTS. A read-only job seals the package tarball and SBOM before a dependency-free
+production job publishes that exact artifact through npm OIDC with provenance;
+there is no npm write-token fallback. CD remains disabled until the npm trusted
+publisher binding and protected-branch-only production environment are
+independently verified.
+<!-- END PLASIUS RELEASE INTEGRITY -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-renderer",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "description": "Framework-agnostic WebGPU renderer runtime for Plasius projects.",
   "type": "module",
   "sideEffects": false,
@@ -36,8 +36,11 @@
     "test": "npm run test:unit",
     "test:unit": "node --test",
     "test:coverage": "c8 --reporter=lcov --reporter=text node --test",
+    "zero-three": "node scripts/verify-zero-three.cjs --package --evidence-out release-artifacts/zero-three-evidence.json",
+    "zero-three:source": "node scripts/verify-zero-three.cjs --source-only",
+    "zero-three:test": "node --test tests/zero-three.test.cjs",
     "pack:check": "node scripts/verify-public-package.cjs",
-    "prepublishOnly": "npm run build && npm run pack:check"
+    "prepublishOnly": "npm run build && npm run pack:check && npm run zero-three"
   },
   "keywords": [
     "webgpu",
@@ -49,9 +52,9 @@
   "author": "Plasius LTD <development@plasius.co.uk>",
   "license": "Apache-2.0",
   "dependencies": {
-    "@plasius/gpu-camera": "^0.1.17",
-    "@plasius/gpu-shared": "^1.0.12",
-    "@plasius/gpu-xr": "^0.1.16"
+    "@plasius/gpu-camera": "^0.1.18",
+    "@plasius/gpu-shared": "^1.0.14",
+    "@plasius/gpu-xr": "^0.1.17"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -83,6 +86,8 @@
     }
   ],
   "overrides": {
+    "brace-expansion": "5.0.9",
+    "esbuild": "^0.28.1",
     "minimatch": "^10.2.1"
   },
   "engines": {

package/legal/CLA-REGISTRY.csv

@@ -1,2 +0,0 @@
-type,github_handle,full_name,company,email,date,approver
-corporate,Zephod111r,Phillip Hounslow,Plasius LTD,zephod@plasius.co.uk,2025-09-12,Phillip Hounslow (Maintainer)