motionloom 2.0.0 → 2.1.0

package/docs/releases/2.1.0.md

@@ -0,0 +1,23 @@
+## Summary
+
+MotionLoom 2.1.0 adds durable, relocatable **Project Memory** and a cross-platform execution layer for Ubuntu, macOS and Windows. The memory restores project identity, motion decisions, rejected patterns, remediation outcomes, runtime policy and freshness state after long periods without animation work or after an Agent context reset. It remains project context rather than approval: stale, invalid or cross-project memory is never treated as permission to generate, confirm or open a PR.
+
+## Added
+
+The release adds `schemas/project-memory.schema.json`, the `memory init`, `inspect`, `validate`, `refresh`, `recover`, `record-decision` and `record-outcome` lifecycle, atomic writes, canonical integrity checking, stable exit codes and a loader API for other MotionLoom scripts. Durable outcomes require `--user-confirmed`; unreviewed outcomes cannot become learning signals. Project identity binds to a normalized Git remote when available and falls back to the package/project name, so the memory is not tied to an absolute checkout path.
+
+The integrity contract treats `project.root_path` as runtime metadata. A relocated checkout can be rebound to its current path during recovery without invalidating the durable payload, while meaningful direct edits still fail the integrity guard. Recovery also refreshes the current repository and package metadata atomically. Cross-project recovery remains fail-closed through identity comparison.
+
+The npm CLI now routes memory, analyze, Dev Lab, render, PR preflight and runtime telemetry commands through platform-neutral Node/Python entrypoints. The implementation avoids Bash-only orchestration, hard-coded temporary paths, shell-string execution and system `zip`/`unzip` requirements in the user-facing workflow. The CI workflow includes an Ubuntu/macOS/Windows matrix for the cross-platform contract.
+
+## Verified behavior
+
+The release acceptance suite passes Python compilation, Project Memory recovery/relocation contracts, the full regression harness, intelligence evaluation, Skill Doctor, report contract, strict quality gate with browser review/intelligence/P1/benchmark/telemetry/attestation requirements, npm packaging dry-run and the Animation Dev Lab production build. The relocation fixture covers Unicode and space-containing paths, Git remote identity, user-confirmed decisions/outcomes, stale context detection and current-path rebinding.
+
+`npm publish --dry-run --access public` produces the intended public tarball `motionloom-2.1.0.tgz` with package version `2.1.0`. Actual publication must be performed from the maintainer workstation using the authenticated npm account; this sandbox run does not publish the package.
+
+## Trust boundary and remaining scope
+
+Project Memory is a continuity and context mechanism, not a user-review substitute. It does not approve animation quality, visual fidelity, accessibility, source licensing, runtime evidence or PR side effects. Dev Lab review, artifact binding, attestation verification and explicit user confirmation remain required before any PR operation.
+
+Visual comparison with provenance-labeled fixtures, append-only benchmark history, multi-project/browser/device corpus and remediation metrics for first-pass acceptance and rerender avoidance remain the next roadmap slice. The Dev Lab build still reports a bundle-size advisory for the main JavaScript chunk; it is a performance warning, not an acceptance failure.

package/docs/releases/npm-publish-from-workstation.md

@@ -1,6 +1,6 @@
 # Publish MotionLoom to npm from your workstation
 
-This guide publishes the prepared `motionloom@2.0.0` package from your own computer. The npm password, authenticator code and access token must stay on your computer; never paste them into chat, GitHub issues or repository files.
+This guide publishes the prepared `motionloom@2.1.0` package from your own computer. The npm password, authenticator code and access token must stay on your computer; never paste them into chat, GitHub issues or repository files.
 
 ## 1. Install prerequisites
 
@@ -48,7 +48,7 @@ npm pack --dry-run --json --ignore-scripts
 npm publish --dry-run --access public
 ```
 
-The dry-run should report `motionloom@2.0.0`, public access, approximately 260 kB compressed size and 111 files. The prepack hook removes generated Python bytecode before packaging. Do not publish if the dry-run shows private keys, `.env` files, `artifacts/`, `dev-lab/` or `__pycache__/` entries.
+The dry-run should report `motionloom@2.1.0`, public access, and the current package file list. Do not hard-code a historical file count: inspect the JSON output and compare it with the checked-in package allowlist. The prepack hook removes generated Python bytecode before packaging. Do not publish if the dry-run shows private keys, `.env` files, `artifacts/`, `dev-lab/` or `__pycache__/` entries.
 
 ## 5. Publish the package
 
@@ -58,15 +58,15 @@ When the dry-run is correct and `npm whoami` shows the intended account, publish
 npm publish --access public
 ```
 
-The version `2.0.0` becomes immutable on npm after a successful publish. If npm reports that the version already exists, stop and verify the registry instead of trying to overwrite it.
+The version `2.1.0` becomes immutable on npm after a successful publish. If npm reports that the version already exists, stop and verify the registry instead of trying to overwrite it.
 
 ## 6. Verify the registry publication
 
-Run the following commands and confirm that they return `2.0.0` and a tarball URL:
+Run the following commands and confirm that they return `2.1.0` and a tarball URL:
 
 ```bash
 npm view motionloom version --registry=https://registry.npmjs.org/
-npm view motionloom@2.0.0 name version license dist.tarball dist.shasum --json \
+npm view motionloom@2.1.0 name version license dist.tarball dist.shasum --json \
   --registry=https://registry.npmjs.org/
 ```
 
@@ -76,7 +76,7 @@ Then test installation in a clean temporary directory:
 TMP_DIR="$(mktemp -d)"
 cd "$TMP_DIR"
 npm init --yes
-npm install motionloom@2.0.0
+npm install motionloom@2.1.0
 motionloom --help
 motionloom doctor
 ```

package/package.json

@@ -1,13 +1,21 @@
 {
   "name": "motionloom",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "type": "module",
+  "packageManager": "pnpm@11.20.0",
   "description": "MotionLoom: project-aware animation Skill with graph, provenance, Motion IR, runtime telemetry, DSSE-compatible signed attestation, external evidence verification and Dev Lab review.",
+  "author": "lenhonbp",
   "bin": {
     "motionloom": "bin/motionloom.mjs"
   },
   "files": [
     "README.md",
+    "CHANGELOG.md",
+    "ROADMAP.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md",
+    "SECURITY.md",
+    "SUPPORT.md",
     "SKILL.md",
     "LICENSE",
     "agent-card.json",
@@ -23,7 +31,8 @@
     "project-context.example.json",
     "tests/evals",
     "tests/scripts/run_tests.py",
-    "tests/scripts/test_attestation.py"
+    "tests/scripts/test_attestation.py",
+    "tests/scripts/test_project_memory.py"
   ],
   "keywords": [
     "animation",
@@ -35,7 +44,13 @@
     "gsap",
     "framer-motion",
     "runtime-evidence",
-    "developer-tools"
+    "developer-tools",
+    "project-memory",
+    "motion-ir",
+    "provenance",
+    "attestation",
+    "browser-review",
+    "dev-lab"
   ],
   "repository": {
     "type": "git",
@@ -53,35 +68,46 @@
     "python": ">=3.11"
   },
   "scripts": {
-    "prepack": "find . -type d -name __pycache__ -prune -exec rm -rf {} + && find . -type f \\( -name '*.pyc' -o -name '*.pyo' \\) -delete",
-    "test": "python3 tests/scripts/run_tests.py",
-    "validate": "python3 scripts/quality-gate.py --all",
-    "doctor": "python3 scripts/skill-doctor.py --json",
-    "report": "python3 scripts/report.py",
-    "report:check": "python3 scripts/report-contract.py",
-    "review": "python3 scripts/review-hook.py",
-    "manifest": "python3 scripts/manifest.py",
-    "intelligence": "python3 scripts/intelligence.py",
-    "intelligence:registry": "python3 scripts/intelligence.py capabilities build --output capability-registry.json",
-    "intelligence:registry:check": "python3 scripts/intelligence.py capabilities validate --path capability-registry.json",
-    "intelligence:p1": "python3 scripts/intelligence.py",
-    "quality:p1": "python3 scripts/quality-gate.py --require-intelligence --require-p1 --require-benchmark",
-    "eval:intelligence": "python3 scripts/eval-intelligence.py",
-    "benchmark:semantic": "python3 scripts/intelligence.py semantic-lint benchmark --task-dir artifacts/professional-review-e2e --iterations 25 --threshold-ms 500",
-    "evidence:verify": "python3 scripts/evidence-verifier.py --scene-dir src/output/browser-review-smoke --task-dir artifacts/browser-review-smoke-task --runtime-evidence runtime-adapters/runtime-evidence.json --max-age-days 1 --output artifacts/browser-review-smoke-task/evidence-verifier-report.json",
-    "attestation:build": "python3 scripts/attestation.py build",
-    "attestation:verify": "python3 scripts/attestation-verifier.py",
-    "attestation:policy": "python3 scripts/attestation.py validate-policy",
-    "attestation:keygen": "python3 scripts/attestation-keygen.py",
-    "quality:telemetry": "python3 scripts/quality-gate.py --scene browser-review-smoke --context artifacts/browser-review-smoke-task/project-context.json --task-dir artifacts/browser-review-smoke-task --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry",
-    "quality:attestation": "python3 scripts/quality-gate.py --scene browser-review-smoke --context artifacts/browser-review-smoke-task/project-context.json --task-dir artifacts/browser-review-smoke-task --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation",
-    "pack:dotlottie": "bash scripts/to-dotlottie.sh",
+    "prepack": "node scripts/prepack-clean.mjs",
+    "test": "node bin/motionloom.mjs test",
+    "validate": "node bin/motionloom.mjs quality-gate --all",
+    "doctor": "node bin/motionloom.mjs doctor --json",
+    "docs:check": "python3 scripts/docs-audit.py",
+    "eval:projects": "python3 scripts/eval-projects.py --allow-insufficient",
+    "release:verify": "python3 scripts/release-verify.py",
+    "report": "node bin/motionloom.mjs report",
+    "report:check": "node bin/motionloom.mjs report-contract",
+    "review": "node bin/motionloom.mjs review-hook",
+    "devlab": "node bin/motionloom.mjs devlab",
+    "manifest": "node bin/motionloom.mjs manifest",
+    "intelligence": "node bin/motionloom.mjs intelligence",
+    "intelligence:registry": "node bin/motionloom.mjs intelligence capabilities build --output capability-registry.json",
+    "intelligence:registry:check": "node bin/motionloom.mjs intelligence capabilities validate --path capability-registry.json",
+    "intelligence:p1": "node bin/motionloom.mjs intelligence",
+    "quality:p1": "node bin/motionloom.mjs quality-gate --require-intelligence --require-p1 --require-benchmark",
+    "eval:intelligence": "node bin/motionloom.mjs eval-intelligence",
+    "audit:deep": "node bin/motionloom.mjs deep-audit --iterations 5000 --seed 20260813 --report docs/audits/data/deep-stress-latest.json",
+    "memory:init": "node bin/motionloom.mjs memory init --project-root .",
+    "memory:bootstrap": "node bin/motionloom.mjs analyze . --init-memory",
+    "memory:recover": "node bin/motionloom.mjs memory recover --project-root .",
+    "memory:validate": "node bin/motionloom.mjs memory validate --project-root . --json",
+    "memory:refresh": "node bin/motionloom.mjs memory refresh --project-root . --json",
+    "benchmark:semantic": "node bin/motionloom.mjs intelligence semantic-lint benchmark --task-dir artifacts/professional-review-e2e --iterations 25 --threshold-ms 500",
+    "evidence:verify": "node bin/motionloom.mjs evidence-verify --scene-dir src/output/browser-review-smoke --task-dir artifacts/browser-review-smoke-task --runtime-evidence runtime-adapters/runtime-evidence.json --max-age-days 1 --output artifacts/browser-review-smoke-task/evidence-verifier-report.json",
+    "attestation:build": "node bin/motionloom.mjs attestation build",
+    "attestation:verify": "node bin/motionloom.mjs verify-attestation",
+    "attestation:policy": "node bin/motionloom.mjs attestation validate-policy",
+    "attestation:keygen": "node bin/motionloom.mjs attestation-keygen",
+    "quality:telemetry": "node bin/motionloom.mjs quality-gate --scene browser-review-smoke --context artifacts/browser-review-smoke-task/project-context.json --task-dir artifacts/browser-review-smoke-task --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry",
+    "quality:attestation": "node bin/motionloom.mjs quality-gate --scene browser-review-smoke --context artifacts/browser-review-smoke-task/project-context.json --task-dir artifacts/browser-review-smoke-task --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation",
+    "pack:dotlottie": "node scripts/to-dotlottie.mjs",
     "runtime:test": "node scripts/runtime-adapters.mjs"
   },
   "dependencies": {
     "@lottiefiles/dotlottie-web": "^0.79.0",
     "@napi-rs/canvas": "^1.0.5",
     "@rive-app/canvas": "^2.39.2",
+    "fflate": "^0.8.3",
     "framer-motion": "^13.1.0",
     "gsap": "^3.15.0",
     "react": "^19.2.8",

package/references/intelligence-core.md

@@ -13,7 +13,7 @@ Use this reference when an Agent needs to understand or extend MotionLoom's task
 | `replay-bundle.json` | `python3 scripts/intelligence.py replay capture --root <root> --task-dir <task>` | Captures clean-root artifact hashes and environment metadata; verification fails on mutation or omission. |
 | `semantic-lint-report.json` | `python3 scripts/intelligence.py semantic-lint build --task-dir <task>` | Reports intent, timing, easing, accessibility, performance and anti-pattern findings with severity, confidence and evidence. |
 | `semantic-lint-benchmark.json` | `python3 scripts/intelligence.py semantic-lint benchmark --task-dir <task>` | Measures in-process semantic-lint execution, rule coverage and p95 against a deterministic threshold; it is a performance contract, not visual approval. |
-| `runtime-telemetry.json` | `bash scripts/capture-runtime-telemetry.sh <scene> artifacts/<task-id>` | Records deterministic scrub-point observations, RAF timing, runtime state hashes and source/manifest/Motion IR bindings from the real adapter harness. |
+| `runtime-telemetry.json` | `motionloom runtime-telemetry <scene> artifacts/<task-id>` | Records deterministic scrub-point observations, RAF timing, runtime state hashes and source/manifest/Motion IR bindings from the real adapter harness. The npm CLI is the cross-platform entrypoint; the legacy `.sh` wrapper remains for Unix compatibility. |
 | `evidence-verifier-report.json` | `python3 scripts/evidence-verifier.py --scene-dir <scene-dir> --task-dir <task> --runtime-evidence <path>` | Read-only external verification result for task/scene/path/hash/age integrity; `approval` is always `false`. |
 | `attestation-statement.json` | `python3 scripts/attestation.py statement --scene-dir <scene-dir> --task-dir <task> --context <context>` | Derives canonical task/scene/source/manifest/Motion IR/evidence hash bindings before signing. |
 | `attestation.json` | `python3 scripts/attestation.py build --statement <statement> --private-key <key> --key-id <id>` | DSSE-compatible Ed25519 envelope over the versioned statement; `approval` is always `false`. |

package/schemas/project-memory.schema.json

@@ -0,0 +1,180 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://motionloom.dev/schemas/project-memory.schema.json",
+  "title": "MotionLoom Project Memory",
+  "description": "Durable, relocatable project memory for recovering animation decisions and context across Agent sessions.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "memory_id",
+    "created_at",
+    "updated_at",
+    "project",
+    "context",
+    "motion_principles",
+    "policies",
+    "decisions",
+    "rejected_patterns",
+    "remediation",
+    "freshness",
+    "recovery"
+  ],
+  "properties": {
+    "schema_version": { "const": "1.0" },
+    "memory_id": { "type": "string", "pattern": "^pm-[a-z0-9][a-z0-9._-]*$" },
+    "created_at": { "type": "string", "format": "date-time" },
+    "updated_at": { "type": "string", "format": "date-time" },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["project_id", "name", "root_path", "repository"],
+      "properties": {
+        "project_id": { "type": "string", "minLength": 3 },
+        "name": { "type": "string", "minLength": 1 },
+        "root_path": { "type": "string", "minLength": 1 },
+        "repository": { "type": ["string", "null"] },
+        "package_name": { "type": ["string", "null"] }
+      }
+    },
+    "context": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256", "schema_version"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "sha256": { "type": ["string", "null"], "pattern": "^$|^[a-f0-9]{64}$" },
+        "schema_version": { "type": ["string", "null"] },
+        "generated_at": { "type": ["string", "null"] }
+      }
+    },
+    "motion_principles": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["duration_ms", "easing", "rhythm", "reduced_motion", "notes"],
+      "properties": {
+        "duration_ms": { "type": ["number", "null"], "minimum": 0 },
+        "easing": { "type": ["string", "null"] },
+        "rhythm": { "type": ["string", "null"] },
+        "reduced_motion": { "type": ["string", "null"] },
+        "notes": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "policies": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["asset", "runtime"],
+      "properties": {
+        "asset": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["authoritative_sources", "license_required", "unknown_asset_policy"],
+          "properties": {
+            "authoritative_sources": { "type": "array", "items": { "type": "string" } },
+            "license_required": { "type": "boolean" },
+            "unknown_asset_policy": { "type": "string", "enum": ["block", "review", "allow"] }
+          }
+        },
+        "runtime": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["preferred_frameworks", "verified_runtimes", "browser_matrix"],
+          "properties": {
+            "preferred_frameworks": { "type": "array", "items": { "type": "string" } },
+            "verified_runtimes": { "type": "array", "items": { "type": "string" } },
+            "browser_matrix": { "type": "array", "items": { "type": "string" } }
+          }
+        }
+      }
+    },
+    "decisions": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/decision" }
+    },
+    "rejected_patterns": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/rejectedPattern" }
+    },
+    "remediation": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/remediation" }
+    },
+    "freshness": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "checked_at", "context_hash", "project_fingerprint", "reason"],
+      "properties": {
+        "status": { "type": "string", "enum": ["fresh", "stale", "needs_context", "invalid"] },
+        "checked_at": { "type": "string", "format": "date-time" },
+        "context_hash": { "type": ["string", "null"], "pattern": "^$|^[a-f0-9]{64}$" },
+        "project_fingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "reason": { "type": "string", "minLength": 1 }
+      }
+    },
+    "recovery": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["last_task_id", "next_actions"],
+      "properties": {
+        "last_task_id": { "type": ["string", "null"] },
+        "next_actions": { "type": "array", "items": { "type": "string" } },
+        "last_review_state": { "type": ["string", "null"] }
+      }
+    },
+    "integrity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["canonical_sha256"],
+      "properties": {
+        "canonical_sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+      }
+    }
+  },
+  "$defs": {
+    "decision": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "recorded_at", "status", "summary", "rationale", "user_confirmed", "source_task_id", "evidence"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]*$" },
+        "recorded_at": { "type": "string", "format": "date-time" },
+        "status": { "type": "string", "enum": ["accepted", "rejected", "superseded"] },
+        "summary": { "type": "string", "minLength": 1 },
+        "rationale": { "type": "string" },
+        "user_confirmed": { "type": "boolean" },
+        "source_task_id": { "type": ["string", "null"] },
+        "evidence": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "rejectedPattern": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "recorded_at", "pattern", "reason", "source_task_id"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]*$" },
+        "recorded_at": { "type": "string", "format": "date-time" },
+        "pattern": { "type": "string", "minLength": 1 },
+        "reason": { "type": "string" },
+        "source_task_id": { "type": ["string", "null"] }
+      }
+    },
+    "remediation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "recorded_at", "issue_id", "summary", "root_cause", "resolution", "result", "correction_count", "rerun_scope", "user_confirmed", "source_task_id"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]*$" },
+        "recorded_at": { "type": "string", "format": "date-time" },
+        "issue_id": { "type": "string", "minLength": 1 },
+        "summary": { "type": "string", "minLength": 1 },
+        "root_cause": { "type": "string" },
+        "resolution": { "type": "string" },
+        "result": { "type": "string", "enum": ["pass", "fail", "partial", "unknown"] },
+        "correction_count": { "type": "integer", "minimum": 0 },
+        "rerun_scope": { "type": "array", "items": { "type": "string" } },
+        "user_confirmed": { "type": "boolean" },
+        "source_task_id": { "type": ["string", "null"] }
+      }
+    }
+  }
+}

package/scripts/analyze.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""Cross-platform project analyzer entrypoint.
+
+This replaces the npm CLI's Bash-only analyzer path while preserving the
+existing analyzer implementation and refreshing Project Memory when present.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+
+from src.core.analyzer import analyze  # noqa: E402
+from project_memory_loader import refresh_if_present  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Analyze a host project and refresh MotionLoom Project Memory.")
+    parser.add_argument("project_root", nargs="?", default=".")
+    parser.add_argument("--output")
+    parser.add_argument("--init-memory", action="store_true", help="Create .motionloom/project-memory.json if it does not exist")
+    parser.add_argument("--max-files", type=int, default=2500, help="Maximum files to inspect")
+    parser.add_argument("--max-bytes", type=int, default=25_000_000, help="Maximum file bytes to inspect")
+    parser.add_argument("--max-seconds", type=float, default=10.0, help="Maximum traversal time")
+    parser.add_argument("--ignore-dir", action="append", default=[], help="Directory name to skip; repeatable")
+    parser.add_argument("--ignore-glob", action="append", default=[], help="Relative path glob to skip; repeatable")
+    args = parser.parse_args()
+    root = Path(args.project_root).expanduser().resolve()
+    if not root.is_dir():
+        parser.error(f"project root is not a directory: {root}")
+    context_path = Path(args.output).expanduser().resolve() if args.output else root / "project-context.json"
+    context = analyze(
+        str(root),
+        max_files=args.max_files,
+        max_bytes=args.max_bytes,
+        max_seconds=args.max_seconds,
+        ignore_dirs=args.ignore_dir or None,
+        ignore_globs=args.ignore_glob or None,
+    )
+    context_path.parent.mkdir(parents=True, exist_ok=True)
+    context_path.write_text(json.dumps(context, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    print(f"{context_path} written ({len(json.dumps(context, ensure_ascii=False))} bytes)")
+    memory_result = refresh_if_present(root, context_path, initialize=args.init_memory)
+    if memory_result:
+        print(json.dumps({"project_memory": memory_result}, ensure_ascii=False))
+    print("== MotionLoom analysis complete: review assumptions before generating ==")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/capture-runtime-telemetry.py

@@ -0,0 +1,119 @@
+"""Cross-platform runtime telemetry capture for MotionLoom.
+
+This is the platform-neutral replacement for capture-runtime-telemetry.sh.
+It intentionally shells out only to the repository's npm runtime:test script,
+using pathlib and subprocess APIs that work on Ubuntu, macOS and Windows.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+
+SCENE_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Capture and verify runtime telemetry")
+    parser.add_argument("scene")
+    parser.add_argument("task_dir")
+    parser.add_argument("--max-age-days", type=int, default=1)
+    return parser.parse_args()
+
+
+def load_json(path: Path) -> dict:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise SystemExit(f"capture-runtime-telemetry: invalid JSON {path}: {exc}") from exc
+    if not isinstance(value, dict):
+        raise SystemExit(f"capture-runtime-telemetry: expected object in {path}")
+    return value
+
+
+def main() -> int:
+    args = parse_args()
+    if not SCENE_RE.fullmatch(args.scene):
+        print(f"capture-runtime-telemetry: unsafe scene identifier: {args.scene}", file=sys.stderr)
+        return 2
+    if args.max_age_days < 0:
+        print("capture-runtime-telemetry: --max-age-days must be non-negative", file=sys.stderr)
+        return 2
+
+    root = Path(__file__).resolve().parents[1]
+    task_dir = Path(args.task_dir).expanduser()
+    task_dir = task_dir.resolve() if task_dir.is_absolute() else (root / task_dir).resolve()
+    scene_dir = (root / "src" / "output" / args.scene).resolve()
+    manifest_path = scene_dir / "manifest.json"
+    task_path = task_dir / "task.json"
+    if not manifest_path.is_file() or not task_path.is_file():
+        print("capture-runtime-telemetry: missing scene manifest or task.json", file=sys.stderr)
+        return 2
+
+    manifest = load_json(manifest_path)
+    task = load_json(task_path)
+    source = manifest.get("file")
+    task_id = task.get("task_id")
+    if not isinstance(source, str) or not source or Path(source).is_absolute() or ".." in Path(source).parts:
+        print("capture-runtime-telemetry: manifest.file must be a safe relative path", file=sys.stderr)
+        return 2
+    if not isinstance(task_id, str) or not task_id:
+        print("capture-runtime-telemetry: task.json.task_id is required", file=sys.stderr)
+        return 2
+
+    source_path = (scene_dir / source).resolve()
+    if scene_dir not in source_path.parents or not source_path.is_file():
+        print("capture-runtime-telemetry: manifest source must remain inside scene directory", file=sys.stderr)
+        return 2
+
+    output_dir = task_dir / "runtime-adapters"
+    if output_dir.exists():
+        shutil.rmtree(output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+
+    env = os.environ.copy()
+    env.update(
+        {
+            "RUNTIME_EVIDENCE_DIR": str(output_dir),
+            "RUNTIME_SCENE": args.scene,
+            "RUNTIME_TASK_ID": task_id,
+            "RUNTIME_SOURCE_PATH": str(source_path),
+            "RUNTIME_MANIFEST_PATH": str(manifest_path),
+            "RUNTIME_MOTION_IR_PATH": str(task_dir / "motion-ir.json"),
+        }
+    )
+    npm = "npm.cmd" if os.name == "nt" else "npm"
+    runtime = subprocess.run([npm, "run", "runtime:test"], cwd=root, env=env, check=False)
+    if runtime.returncode != 0:
+        return runtime.returncode
+
+    verifier = subprocess.run(
+        [
+            sys.executable,
+            str(root / "scripts" / "evidence-verifier.py"),
+            "--scene-dir",
+            str(scene_dir),
+            "--task-dir",
+            str(task_dir),
+            "--runtime-evidence",
+            "runtime-adapters/runtime-evidence.json",
+            "--max-age-days",
+            str(args.max_age_days),
+            "--output",
+            str(task_dir / "evidence-verifier-report.json"),
+        ],
+        cwd=root,
+        check=False,
+    )
+    return verifier.returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())