motionloom 2.2.0 → 2.4.0

package/CHANGELOG.md

@@ -4,7 +4,52 @@ All notable MotionLoom changes are documented here. The project follows semantic
 
 ## [Unreleased]
 
-- No unreleased changes are currently tracked.
+## [2.4.0] - 2026-08-15
+
+### Added
+
+- Deterministic Asset Consistency Compiler with identity, action-set, frame-geometry, atlas and layered-map schemas.
+- Standard-library PNG measurement for alpha bounds, pivot/footline/bbox drift, frame/atlas contamination, region overlap, tile seams, parallax ordering and camera-safe bounds.
+- Cross-platform `motionloom asset-consistency validate|analyze|report` commands, npm smoke scripts, public examples and regression coverage.
+- Provider-neutral Artifact Intake contracts for generation receipts, control tracks, export manifests and hash-bound adapter registry evidence, including an internal-ImageGen-shaped scaffold that makes no provider API call.
+- Control-to-runtime `runtime-candidate` bridge, rig compatibility contracts/registry, public fixtures and cross-platform CLI smoke scripts for skeleton/socket/action/event/export bindings.
+- Dev Lab evidence rail and Pipeline handoff support for Artifact Intake, runtime candidate and rig compatibility findings before a user review decision.
+- Truthful `code_authored` provenance lane for runtime scenes, with a hash-bound Framer Motion pilot rendered by Playwright at 0/50/100%, integrity verification, local-only attestation and a pending human Dev Lab review.
+- Fail-closed task-bundle resolver for Quality CI that binds `task.json.scene` to the changed scene rather than inferring a directory name from the scene slug.
+
+### Fixed
+
+- Quality Gate and task reports can validate an explicitly declared `consistency_ref` without forcing legacy scenes to invent a contract; strict production runs fail closed on a non-ready contract.
+- Quality Gate and reports accept explicitly declared Artifact Intake evidence without breaking legacy scenes, and preserve `review_required` rather than flattening adapter/candidate/rig findings to a pass.
+- Quality CI correctly discovers valid task bundles whose task ID differs from the scene slug, including the runtime-first pilot shape.
+
+### Boundary
+
+- Consistency evidence measures and reports artifact agreement only. It never grants artist authority, production eligibility, production approval or PR authorization.
+- A provider name, internal-skill metadata, generation receipt, control plan, compatible rig or runtime candidate never grants artist authority, production eligibility, production approval or PR authorization.
+
+## [2.3.0] - 2026-08-14
+
+### Added
+
+- AI-first, human-governed asset provenance contract with explicit authority/origin tiers, readiness states, generator/derivation metadata, per-file SHA-256, license/source records, runtime evidence and human-review boundaries.
+- Cross-platform `motionloom asset-provenance` commands for validation, classification, reporting and runtime/production checks, plus a transparent AI-generated pilot fixture.
+- One-command `npx --yes motionloom setup` onboarding for real projects, with package-manager detection, local devDependency installation, project-bound context and durable Project Memory bootstrap.
+- Read-only `motionloom status`, safe `motionloom repair`, dry-run JSON output and an idempotent managed `AGENTS.md` router for Agent integration.
+- Canonical `npx` installation recipe in Agent discovery plus Ubuntu/macOS/Windows onboarding regressions and package/docs guards.
+
+### Fixed
+
+- Production quality and PR preflight now fail closed when an asset is unknown, self-asserted as artist-authored, not production-eligible or missing a manifest-bound provenance record; `production_approved` remains human-only.
+- Setup JSON output no longer mixes package-manager logs with machine-readable results, and repair/status routing does not trigger an unintended full setup.
+
+### Verified
+
+- Full regression, onboarding and installation-matrix tests, discovery contract, docs audit, Skill Doctor, skill-creator validation, quality validation, npm tarball dry-run and diff hygiene pass.
+
+### Boundary
+
+- Setup never commits, pushes, opens a PR, grants approval or promotes asset provenance. User review remains required before any PR handoff.
 
 ## [2.2.0] - 2026-08-13
 
@@ -64,5 +109,7 @@ See the [2.0.0 release note](docs/releases/2.0.0.md).
 The 1.5.0–1.9.0 milestones established runtime evidence, browser review, Intelligence Core, semantic lint, continuity, telemetry and trust-boundary hardening. Their detailed notes are available in [`docs/releases/`](docs/releases/).
 
 [2.2.0]: docs/releases/2.2.0.md
+[2.4.0]: docs/releases/2.4.0.md
+[2.3.0]: docs/releases/2.3.0.md
 [2.1.0]: docs/releases/2.1.0.md
 [2.0.0]: docs/releases/2.0.0.md

package/README.md

@@ -14,7 +14,7 @@ MotionLoom is an independent open-source Agent Skill for building UI motion, Lot
 
 > **MotionLoom is not an auto-approval layer.** A valid signature, a passing heuristic, or a successful render proves only the contract it checks. Visual quality, intent, accessibility and PR authorization remain reviewable human decisions.
 
-> **Release posture:** the repository source and `package.json` are at **2.1.0**. The public npm registry currently serves **2.0.0** and no GitHub tag/Release for 2.1.0 exists yet; a maintainer must perform the protected manual release before the registry and GitHub release state change.
+> **Release posture:** `motionloom@2.4.0` is the next release target. It adds a truthful `code_authored` runtime-first lane, a Framer Motion end-to-end reference candidate, identity-bound Dev Lab review evidence and task-bundle discovery that binds by declared scene identity rather than an inferred directory name. Verify npm/GitHub publication metadata separately; passing evidence never implies user approval.
 
 ## Why MotionLoom
 
@@ -29,6 +29,7 @@ MotionLoom turns that fragile sequence into a bounded production system. Its dur
 | **Project binding** | Project context, package/design-token discovery and durable `.motionloom/project-memory.json` | Reuse memory across projects or silently continue through missing context |
 | **Motion planning** | Framework-aware Motion Spec, timing/easing/accessibility budgets and framework selection | Present a template as a project-integrated result |
 | **Asset provenance** | Required `source_binding`, authority, license and SHA-256 traceability | Promote unknown, unlicensed or placeholder production assets |
+| **Asset consistency** | Measured multi-frame geometry, pivot/footline stability, atlas boundaries and layered-map contracts | Treat a heuristic warning or deterministic pass as artist approval or production authorization |
 | **Runtime truth** | Lottie/dotLottie, SVG cutout rig, Rive, GSAP and Framer Motion evidence from real runtime paths | Call scaffold, static validation or a heuristic score visual approval |
 | **Agent intelligence** | Project graph, provenance, Motion IR, replay, semantic lint, continuity and fix plan | Convert confidence, benchmark output or warnings into approval |
 | **Human review** | Exact candidate URL, frame checkpoints, checklist, review artifact and handoff report in Dev Lab | Confirm, push or open a PR without explicit user authorization |
@@ -55,47 +56,69 @@ Every handoff is machine-readable. The typical bundle under `artifacts/<task-id>
 
 ## Quick start
 
-### Install the public CLI
+### Start once. Continue your normal work.
 
 ```bash
-npm install --global motionloom
-motionloom doctor --json
-motionloom --help
+cd /path/to/your/project
+npx --yes motionloom setup
+npx --no-install motionloom status
 ```
 
-MotionLoom supports **Node.js 18+** and **Python 3.11+** on Ubuntu, macOS and Windows. The npm wrapper is the cross-platform surface: it discovers the platform Python executable and delegates to the same canonical contracts used by a repository checkout.
+This is the entire first-run path. MotionLoom detects the host project and package manager, installs a local development dependency, creates project-bound memory, and adds a small Agent router without overwriting existing guidance. `motionloom init` is an equivalent alias when an Agent or user prefers that wording. It never creates a scene, calls a generator, runs an asset gate, opens Dev Lab, commits, pushes, opens a PR, or grants approval.
+
+After this, keep building your application normally. When you actually begin an animation task, tell your Agent to use MotionLoom. The Agent then reads the relevant workflow rather than showing every schema, contract, or production rule up front.
+
+Use these only if you need them:
+
+```bash
+npx --yes motionloom init --dry-run --json     # preview; no install or file changes
+npx --no-install motionloom doctor             # check the installed package
+npx --no-install motionloom repair --yes       # restore only missing managed pieces
+```
+
+MotionLoom supports **Node.js 18+** and **Python 3.11+** on Ubuntu, macOS and Windows. `npx` is the recommended first-run surface; after setup, use the project-local binary through `npx --no-install motionloom ...`. A global install remains optional, not required.
+
+### When you begin animation work
+
+The detail level follows the job rather than the installation. A simple interface motion task starts with a scene plan and runtime render. Importing a third-party or AI-generated visual asset adds the intake path. A production runtime package adds rig, provenance and runtime-specific checks. These are safeguards for the affected artifact, not rules imposed on unrelated product work.
 
-### Start from a real project
+| Your task | Start with | MotionLoom reveals next |
+|---|---|---|
+| UI motion, loading state, page transition | `motionloom analyze . --init-memory` | Scene plan, runtime render and Dev Lab review |
+| Imported or AI-generated frames, sprite atlas, layered map | The same project analysis | Provenance and measured asset-consistency/intake steps |
+| Rive, Spine or other packaged runtime asset | The same project analysis | Package, rig and runtime evidence steps |
+
+### Advanced: start from a real project
 
 Run the first commands from the project that owns the animation. Do not copy the example context into production; generate a fresh context from the host project.
 
 ```bash
 cd /path/to/your/project
 
-# Understand the project and bootstrap/recover durable memory.
-motionloom analyze . --init-memory
-motionloom memory inspect --project-root . --json
+# Setup already analyzed the project and bootstrapped durable memory.
+npx --no-install motionloom status --json
+npx --no-install motionloom memory inspect --project-root . --json
 
 # Bound traversal when the host project is large; truncation is reported, never hidden.
-motionloom analyze . --max-files 2500 --max-bytes 25000000 --max-seconds 10
+npx --no-install motionloom analyze . --max-files 2500 --max-bytes 25000000 --max-seconds 10
 
 # Plan and generate the scene using the selected framework.
 python3 /path/to/MotionLoom/src/core/spec.py generate loading \
   --context project-context.json --output motion-spec.json --loop
 
 # Render real runtime evidence and prepare the Dev Lab review handoff.
-motionloom render loading
-motionloom devlab loading
+npx --no-install motionloom render loading
+npx --no-install motionloom devlab loading
 
 # Validate the exact task bundle before any Git side effect.
-motionloom quality-gate --scene loading \
+npx --no-install motionloom quality-gate --scene loading \
   --context project-context.json \
-  --task-dir artifacts/loading-task \
+  --task-dir artifacts/<task-id> \
   --require-browser-review --require-intelligence --require-p1 \
-  --require-benchmark --require-telemetry --require-attestation
+  --require-benchmark --require-telemetry --require-attestation --require-asset-provenance
 
 # Local-only by default. A user must review and explicitly authorize side effects.
-motionloom pr loading --task-dir artifacts/loading-task
+npx --no-install motionloom pr loading --task-dir artifacts/<task-id>
 ```
 
 For a source checkout, use `git clone https://github.com/lenhonbp/MotionLoom.git`, run `npm install`, and replace the global command with `node bin/motionloom.mjs` or the corresponding Python/Node script shown in the [development guide](CONTRIBUTING.md).
@@ -147,6 +170,82 @@ MotionLoom keeps distinct layers distinct:
 
 `approval` remains `false` in attestation and verifier artifacts. The default PR mode is local-only (`OPEN_PR=0`); commit, push and pull-request operations remain explicit side effects.
 
+## Asset provenance tiers
+
+MotionLoom separates **asset origin**, **runtime readiness**, **production eligibility** and **human approval**. This is essential for AI-first workflows: an Agent may create a valid pilot, ingest it into the real runtime and expose it in Dev Lab without being allowed to call that pilot artist-authored or approved for production.
+
+| Authority / origin | Runtime behavior | Production behavior |
+|---|---|---|
+| `ai_generated` | `runtime_ready` when hashes, license metadata and runtime evidence pass | Never `production_eligible` |
+| `ai_assisted` | `runtime_ready` after contract validation | Eligible only after recorded human sign-off and full gate |
+| `ai_assisted_human_reviewed` | `runtime_ready` | `review_required` until the declared production gate is complete; no automatic approval |
+| `artist_authored` | Runtime-testable when the package is valid | Eligible after verified authority, license, runtime and quality checks; not from Agent self-assertion |
+| `unknown` | `blocked` | Blocked |
+
+The readiness value `production_approved` is reserved for a human decision and is not minted by `asset-provenance`, `quality-gate`, attestation or any Agent. Use the following commands against the exact scene artifact:
+
+```bash
+motionloom asset-provenance validate --input src/output/<scene>/asset-provenance.json --json
+motionloom asset-provenance check --input src/output/<scene>/asset-provenance.json \
+  --root src/output/<scene> --mode runtime \
+  --manifest src/output/<scene>/manifest.json --json
+motionloom asset-provenance check --input src/output/<scene>/asset-provenance.json \
+  --root src/output/<scene> --mode production \
+  --manifest src/output/<scene>/manifest.json --json
+```
+
+The [AI-generated pilot fixture](examples/agent-consumer/ai-generated-pilot-provenance.json) demonstrates the intended boundary: it is transparent and runtime-ingestible, but it cannot pass a production gate merely because an Agent declared it complete.
+
+## Asset consistency compiler
+
+When an Agent creates a character action across many frames, packs a sprite atlas or builds a parallax background, visual plausibility is not enough. MotionLoom accepts a machine-readable contract and measures the referenced artifacts instead of trusting declared dimensions. The standard-library analyzer supports RGBA, RGB with `tRNS`, indexed PNG palettes and grayscale-with-alpha PNGs, so the npm package remains usable on Ubuntu, macOS and Windows without Pillow or native image dependencies.
+
+| Contract | Deterministic checks | Typical failure surfaced |
+|---|---|---|
+| `identity` | Asset ID, style profile, palette/camera/scale/pivot and reference hash | Frame set silently changes character identity or visual rules |
+| `action-set` | FPS, frame count, explicit loop seam, pose timeline, sockets and events | A loop claims continuity without matching first/last frame or required event contract |
+| `frame-geometry` | Canvas size, alpha bounds, SHA-256, pivot/footline drift, bbox drift and opaque pixels outside frame rect | One frame contains bleed from a neighboring frame or shifts the feet/pivot |
+| `atlas` | Region bounds/overlap, rotation policy and opaque pixels outside declared regions | Packing leaves contamination, overlap or ambiguous UV ownership |
+| `layered-map` | Z-order uniqueness, parallax ordering, tile seams, layer/world bounds and camera-safe bounds | A background layer seams at loop edges or the camera can leave world bounds |
+
+Run one contract at a time and keep its JSON result in the task bundle:
+
+```bash
+motionloom asset-consistency validate --kind action-set \
+  --input src/output/<scene>/hero-walk-action-set.json --root src/output/<scene> --json
+motionloom asset-consistency validate --kind atlas \
+  --input src/output/<scene>/hero-atlas-contract.json --root src/output/<scene> --strict --json
+motionloom asset-consistency report --kind layered-map \
+  --input src/output/<scene>/forest-layered-map.json --root src/output/<scene> --json
+```
+
+For a production scene, add `consistency_ref` and `consistency_kind` to `manifest.json`. The quality gate and report then bind the contract to the scene only when it is declared; use `--require-asset-consistency` when the task requires the contract to pass. Consistency results expose measured evidence and block mismatches, but they do not grant `artist_authored`, `production_eligible`, `production_approved` or PR authorization.
+
+The repository keeps pass/fail examples under [`examples/agent-consumer/asset-consistency/`](examples/agent-consumer/asset-consistency/) and regression coverage in [`tests/scripts/test_asset_consistency.py`](tests/scripts/test_asset_consistency.py). The npm package exposes `asset:consistency` and `asset:audit` for a quick local smoke check.
+
+## Provider-neutral Artifact Intake and runtime candidates
+
+An AI image, video, pixel-art, rigging or motion-capture tool can contribute an asset without becoming the source of truth for production. MotionLoom records a **generation receipt** (what generated or transformed the asset), a **control track** (reference/style/pose/camera/action controls) and an **export manifest** (exact emitted files and hashes). The provider-neutral registry then checks whether the adapter is evidence-backed, scaffold-only or blocked; it does not invoke a provider API or hold provider credentials.
+
+```bash
+# Bind an Agent-managed ImageGen-style output or another provider to deterministic artifacts.
+motionloom artifact-intake intake --root <project-root> \
+  --registry artifact-adapter-registry.json \
+  --receipt <generation-receipt.json> \
+  --controls <control-track.json> \
+  --export-manifest <export-manifest.json> --json
+
+# Permit only an intake bundle and consistency contracts whose refs/hashes agree.
+motionloom runtime-candidate validate --root <project-root> \
+  --input <runtime-candidate.json> --json
+
+# Validate skeleton/action/socket/event/export compatibility against an adapter registry.
+motionloom rig-compatibility validate --root <project-root> \
+  --registry rig-adapter-registry.json --input <rig-compatibility.json> --json
+```
+
+The public bundle under [`examples/agent-consumer/artifact-intake/`](examples/agent-consumer/artifact-intake/) demonstrates an ImageGen-shaped receipt without relying on an external API. It advances only to **`runtime_test_ready`** when hashes and corresponding identity/action/frame contracts agree. The companion rig contract demonstrates adapter/skeleton/socket/event checks. Both evidence classes remain **review-required**: they never promote `ai_generated` material, claim `artist_authored`, replace real runtime evidence or approve a pull request. Dev Lab displays their adapter status, bound paths and findings before the user can record review.
+
 ## How an Agent uses the Skill
 
 The public integration surfaces are intentionally small and inspectable:
@@ -177,6 +276,10 @@ The Skill can trigger or suggest an internal browser-capable Agent to open the D
 | `artifacts/<task-id>/` | Per-task evidence, report and handoff bundle |
 | `schemas/visual-truth.schema.json`, `scripts/visual-truth.py` | Provenance-bound visual comparison and review explanation contract |
 | `schemas/remediation-history.schema.json`, `scripts/remediation-learning.py` | Append-only remediation/benchmark ledger and aggregate learning metrics |
+| `schemas/asset-provenance.schema.json`, `scripts/asset-provenance.py` | Tiered origin, authority, readiness, license, hash and human-review gate for asset candidates |
+| `schemas/generation-receipt.schema.json`, `scripts/artifact-intake.py` | Provider-neutral receipt/control/export intake with hash-bound adapter evidence |
+| `schemas/runtime-candidate.schema.json`, `scripts/runtime-candidate.py` | Control-to-consistency bridge that permits only hash-compatible runtime test candidates |
+| `schemas/rig-compatibility.schema.json`, `scripts/rig-compatibility.py` | Skeleton/socket/action/event/export compatibility evidence for runtime adapters |
 | `tests/` | Regression, adversarial and deep-stress evaluation harnesses |
 
 ## Documentation map
@@ -189,6 +292,9 @@ The Skill can trigger or suggest an internal browser-capable Agent to open the D
 | Understand Agent intelligence | [Intelligence Core](references/intelligence-core.md) and [roadmap](ROADMAP.md) |
 | Run labeled project evaluation | [Project corpus manifest](tests/evals/project-corpus.json) and `python3 scripts/eval-projects.py --allow-insufficient` |
 | Understand trust boundaries | [Signed attestation](references/signed-attestation.md) and [2.0.0 release note](docs/releases/2.0.0.md) |
+| Classify AI-generated or assisted assets | [Asset provenance tiers](schemas/asset-provenance.schema.json), `motionloom asset-provenance`, and the [production checklist](docs/CHECKLIST.md) |
+| Bind an internal skill or provider output before runtime testing | [Artifact Intake examples](examples/agent-consumer/artifact-intake/), `motionloom artifact-intake`, and [AI/Agent research](docs/research/ai-animation-tools-2026-report.md) |
+| Check control-to-runtime and rig compatibility | `motionloom runtime-candidate`, `motionloom rig-compatibility`, and [production checklist](docs/CHECKLIST.md) |
 | Validate visual truth before review/PR | `motionloom visual-truth build|validate` and [production checklist](docs/CHECKLIST.md) |
 | Check current evidence posture | [Current status](docs/STATUS.md), [external corpus evidence](docs/audits/external-project-corpus-2026-08-13.md) and [historical audit snapshot](AUDIT-REPORT.md) |
 | Contribute code or docs | [CONTRIBUTING.md](CONTRIBUTING.md) |

package/ROADMAP.md

@@ -2,9 +2,9 @@
 
 MotionLoom's roadmap is organized around one question: **does this reduce incorrect animation iterations while keeping the user in control of quality and Git side effects?** A roadmap item is not complete because a prompt or template exists; it is complete when the contract, evidence, regression coverage and Agent handoff are inspectable.
 
-## Current baseline: 2.2.0 release candidate
+## Current baseline: 2.4.0 release target
 
-The current repository baseline includes project-aware analysis, durable Project Memory, context-bound Motion Spec, source binding, real runtime adapters for Lottie/dotLottie/SVG cutout/Rive/GSAP/Framer Motion, Dev Lab browser review, Intelligence Core, semantic and continuity feedback, runtime telemetry, external evidence verification, signed attestation, Agent interoperability surfaces, Visual Truth, Remediation Learning and cross-platform CLI/CI contracts. The package metadata is at `2.2.0`; remote publication remains pending explicit release approval.
+The current repository baseline includes project-aware analysis, durable Project Memory, context-bound Motion Spec, source binding, real runtime adapters for Lottie/dotLottie/SVG cutout/Rive/GSAP/Framer Motion, Dev Lab browser review, Intelligence Core, semantic and continuity feedback, runtime telemetry, external evidence verification, signed attestation, Agent interoperability surfaces, Visual Truth, Remediation Learning, AI-first asset provenance and cross-platform CLI/CI contracts. The `2.4.0` release target adds a code-authored runtime-first lane with a review-first Framer Motion pilot and task resolution by declared scene identity, without weakening review or Git side-effect boundaries.
 
 ## Next milestones
 
@@ -14,10 +14,15 @@ The current repository baseline includes project-aware analysis, durable Project
 | **2.3** | Remediation Learning | User-confirmed correction count, first-pass acceptance and rerender-avoidance ledger | Included in 2.2.0 candidate |
 | **2.4** | Runtime Scale | Multi-project, browser and device corpus with capability compatibility explanations | Planned |
 | **2.5** | Agent Interoperability | Versioned schemas, compatibility matrix and replayable task bundles across Agents | Included in 2.2.0 candidate |
+| **2.6** | Agent-created Asset Provenance | Explicit origin/authority/readiness tiers; runtime ingest without automatic production approval; fail-closed production gate | Included in 2.3.0 release |
+| **2.7** | One-command Onboarding | Project-bound setup/status/repair, Agent router merge, durable memory bootstrap and cross-platform installation recipe | Included in 2.3.0 release |
+| **2.8** | Asset Consistency Compiler | Measured frame geometry, atlas contamination and layered-map contracts with fail-closed regression and optional scene quality-gate binding | Implemented in working tree; pending validation/release |
+| **2.9** | Provider-neutral Artifact Intake | Hash-bound generation receipt, control track and export manifest for internal skills/providers, with no embedded credentials or automatic authority | Implemented in working tree; pending validation/release |
+| **3.0** | Control-to-runtime and rig evidence | Runtime candidate bridge plus skeleton/socket/action/event/export compatibility evidence surfaced in Dev Lab before user review | Implemented in working tree; pending validation/release |
 
 ## Working-tree implementation status
 
-The current implementation pass has delivered the contracts behind milestones 2.2, 2.3 and 2.5: canonical Agent discovery/install surfaces, consumer fixtures and a Ubuntu/macOS/Windows matrix; Visual Truth is bound into scene manifests, Dev Lab handoff and the review-first quality gate; Remediation Learning records hash-chained benchmark/outcome history; and CI replay evidence is rebuilt after generated artifacts. The remaining release work is remote tag/Release creation, npm publication and paired evaluation on additional real projects.
+The current implementation pass has delivered the contracts behind milestones 2.2, 2.3, 2.5, 2.6 and 2.7, and has implemented the 2.8–3.0 layers in the working tree: canonical Agent discovery/install surfaces, consumer fixtures and a Ubuntu/macOS/Windows matrix; Visual Truth is bound into scene manifests, Dev Lab handoff and the review-first quality gate; Remediation Learning records hash-chained benchmark/outcome history; CI replay evidence is rebuilt after generated artifacts; asset provenance remains production fail-closed; `npx --yes motionloom setup` bootstraps a project without overwriting its Agent guidance; consistency contracts measure actual frame/atlas/map artifacts; Artifact Intake binds provider/internal-skill records to actual exports; runtime candidates require compatible contract references; and rig evidence validates adapter/skeleton/socket/event compatibility before review. The remaining work is full validation, maintainer release verification and paired evaluation on additional real projects.
 
 ## Product principles
 

package/SKILL.md

@@ -7,7 +7,7 @@ description: >-
   validate, review, or deliver animation inside an existing project.
 license: MIT
 metadata:
-  version: "2.2.0"
+  version: "2.4.0"
   target_frameworks: "lottie,dotlottie,rive,gsap,framer-motion,spine,threejs"
   verified_runtimes: "lottie-json,dotlottie-package,svg-cutout-rig,rive,gsap,framer-motion"
 ---
@@ -18,19 +18,31 @@ metadata:
 
 Treat every animation request as a production task, not as an isolated asset-generation prompt. Always bind the work to the host project's context, emit machine-readable artifacts, render through the target runtime, expose review evidence in Dev Lab, and stop before commit when a required gate or user confirmation is missing.
 
+## Fast onboarding for a real project
+
+When MotionLoom is not installed in the host project, prefer the single cross-platform entrypoint `npx --yes motionloom init`. It detects the project root and package manager, installs a local devDependency, safely merges a marked MotionLoom router block into `AGENTS.md`, runs discovery, creates project-bound context and durable memory, and returns `ready`, `needs_setup` or `blocked`. `init` is a quiet quick start: it must not create a scene, trigger asset/runtime gates, open Dev Lab, commit, push, open a PR, grant approval or promote asset provenance. Use `npx --yes motionloom init --dry-run --json` before mutation, `npx --no-install motionloom status --json` for read-only checks, and `npx --no-install motionloom repair --yes` to re-apply only missing managed pieces. Keep `setup` as a compatible alias.
+
+For Agent or CI composition, consume JSON and preserve the exit code. If the project is already a source checkout, use `node bin/motionloom.mjs setup --project-root <project> --motionloom-root <motionloom-checkout> --skip-install`; do not copy `project-context.json` or `.motionloom/project-memory.json` from the MotionLoom repository.
+
 ## Required workflow
 
-1. **Understand** — read the host project manifest and run `motionloom analyze <project-path> --init-memory` (or `python scripts/analyze.py <project-path> --init-memory` in a repository checkout). Load `project-context.json` and `.motionloom/project-memory.json` from the audited project. If context is missing, stale or ambiguous, stop at `needs_context` and refresh before generation.
+1. **Understand** — run `motionloom init` once for a new host project, then continue normal product work until an animation task exists. At animation-task start, read the host project manifest and load the generated `project-context.json` and `.motionloom/project-memory.json`. For an already configured project, run `motionloom status --json` and refresh with `motionloom analyze <project-path> --init-memory` when context is missing, stale or ambiguous. In a repository checkout, the equivalent is `node bin/motionloom.mjs init` or `python scripts/analyze.py <project-path> --init-memory`.
 2. **Plan** — classify the animation, select a framework, and generate a context-bound `motion-spec.json` with timing, easing, loop, accessibility, performance and source authority.
 3. **Source** — resolve an authoritative asset from the project or `assets/library/`. Record attribution, license and checksum in the scene manifest's required `source_binding`; the binding's SHA-256 must match the bytes referenced by `manifest.file`. Do not promote an unknown or placeholder asset to production.
+3a. **Classify asset provenance** — create or load `asset-provenance.json` with `motionloom asset-provenance`. Treat Agent-created material as ingestible only when its origin, generator task, license, file hash and derivation chain are explicit. Use `code_authored` for an authored runtime scene such as GSAP or Framer Motion; it may be runtime-tested and marked `review_required`, but never self-promotes to production eligibility or approval. `ai_generated` may be runtime-tested but is never production-eligible; `ai_assisted` requires human sign-off; `artist_authored` and `production_approved` cannot be self-asserted by an Agent or quality gate. Use `check --mode runtime` for candidate ingest and `check --mode production` only for a full production gate.
+3b. **Compile asset consistency** — when a task contains multi-frame character actions, sprite sheets/atlases or layered maps, create the matching identity, action-set, frame-geometry, atlas and layered-map contracts from `schemas/`. Run `motionloom asset-consistency validate --kind <identity|action-set|frame-geometry|atlas|layered-map> --input <contract> --root <asset-root> --json`. The compiler measures actual PNG alpha bounds, pivot/footline/bbox drift, frame and atlas contamination, region overlap, parallax/z-order, tile seams and camera-safe bounds. A pass is deterministic contract evidence only; it never upgrades provenance, artist authority, production eligibility or human approval.
+3c. **Ingest generation artifacts** — before using output from an internal skill or external provider, bind it with a `generation-receipt`, `control-track` and `export-manifest`. Run `motionloom artifact-intake intake --root <project-root> --registry artifact-adapter-registry.json --receipt <receipt> --controls <controls> --export-manifest <export> --json`. For a single-character AI frame sequence, first run `motionloom build-ai-pilot`: it rejects painted checkerboards, all-opaque RGBA, insufficient measured padding and canvas-spanning detached residue. Visually inspect the isolated output too: edge-connected alpha removal cannot prove that disconnected opaque artifacts are absent. The core path makes no provider call and stores no secret; adapters are evidence descriptors. Use `--provider chatgpt` for user-provided ChatGPT bytes so the receipt records `openai.chatgpt` and `user-mediated`; never relabel them as `internal-imagegen`. Both adapters are scaffold-only metadata, not proof of runtime readiness, artist authority or approval.
+3d. **Build the runtime candidate and rig proof** — bind the intake bundle to identity/action/frame contracts with `motionloom runtime-candidate validate --root <project-root> --input <runtime-candidate.json> --json`, then validate the declared skeleton, sockets, actions, events, export target and runtime adapter with `motionloom rig-compatibility validate --root <project-root> --registry rig-adapter-registry.json --input <rig-contract.json> --json`. A passing candidate is `runtime_test_ready` and remains review-required; it cannot stand in for a production rig, human review or `production_approved`.
 4. **Generate** — use the matching template or rig implementation. For body animation, preserve named anatomy, pivot and parent-first hierarchy.
 5. **Render** — run the platform-neutral Node entrypoint for scene output, or `node scripts/runtime-adapters.mjs` for the verified Rive/GSAP/Framer Motion adapter matrix. Acceptance requires runtime evidence at 0/50/100%, not a static placeholder. Keep the render metadata beside the snapshots.
 6. **Bind Intelligence Core** — build a framework-neutral `motion-ir.json`, `project-graph.json`, `provenance.json`, `replay-bundle.json`, `semantic-lint-report.json` and `semantic-lint-benchmark.json` with `python3 scripts/intelligence.py`. Select only a capability registry entry whose status is `verified`, whose evidence is fresh and whose compatibility matches the target environment. A confidence score or benchmark result can prioritize investigation; neither can replace deterministic or human acceptance.
 6a. **Harden the trust boundary** — keep artifact and task bundles inside the repository/task root, reject symlinked evidence, bind replay to its exact `task_dir`, `task_id` and scene, select one deterministic report bundle per scene, and require browser candidate/review identity and expiry checks before readiness. The Dev Lab must reject cross-origin or identity-mismatched artifact bases. In strict runtime-observability runs, capture `runtime-telemetry.json` and a read-only `evidence-verifier-report.json`; verifier output must preserve `approval: false`. These checks expose risk and prevent evidence mixing, but do not turn heuristics or evidence integrity into approval.
 6b. **Attest** — derive a canonical statement from the exact scene/task hashes, sign it with an Ed25519 key through `scripts/attestation.py`, and verify it with the independent `scripts/attestation-verifier.py` against a fail-closed `trust-policy.json`. DSSE/SLSA-compatible attestation proves signer and binding integrity only; `approval` must remain `false` and never replaces user review.
 7. **Visual truth and browser review handoff** — after runtime rendering, build `visual-truth.json` from real baseline/candidate PNGs with `motionloom visual-truth build`. The contract records frame hashes, dimensions, runtime/source/manifest provenance and region-level review explanations; a changed frame means `review_required`, never automatic failure or approval. Then run `python3 scripts/review-hook.py prepare --task-dir artifacts/<task-id> --lab-url <internal-lab-url>`. The hook prepares the exact candidate and emits a JSON action for a browser-capable Agent. Trigger or suggest that Agent to open the emitted URL, inspect frames 0/50/100, scrub the timeline and ask the user to review. This is not a separate Dev Lab Skill; it is a required post-render handoff.
+
+> **Runtime-first reference:** `examples/agent-consumer/runtime-pilot/` and `src/output/runtime-pilot-framer/` demonstrate a code-authored Framer Motion lane with hash-bound Intake controls, deterministic 0/50/100 Playwright frames, strict runtime candidate validation, verifier and `approval: false` attestation before a prepared Dev Lab review. It is evidence of the pipeline, not a release approval or a substitute for an imported art package.
 8. **Review capture** — the browser Agent calls `window.__lab.getReview()` after the user approves or requests changes, then persists it with `python3 scripts/report.py review --task-dir artifacts/<task-id> --candidate-id <id> --decision approved|changes_requested --reviewer user`. A change request returns to generation; no approval means no PR.
-9. **Validate** — run `motionloom visual-truth validate --root . --input src/output/<scene>/visual-truth.json --scene <scene> --task-id <task-id>`, `motionloom review-hook validate --task-dir artifacts/<task-id>`, `motionloom intelligence semantic-lint benchmark --task-dir artifacts/<task-id> --iterations 25 --threshold-ms 500`, `motionloom runtime-telemetry <scene> artifacts/<task-id>`, the independent attestation verifier, `motionloom report-contract --root . --scenes-file <changed-scenes> --require-attestation`, `motionloom quality-gate --scene <scene> --context <context-path> --task-dir artifacts/<task-id> --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation --require-visual-truth`, and `motionloom doctor --json` when validating the Skill package itself.
+9. **Validate** — run `motionloom asset-provenance check --input src/output/<scene>/asset-provenance.json --root src/output/<scene> --mode runtime|production --manifest src/output/<scene>/manifest.json`, `motionloom visual-truth validate --root . --input src/output/<scene>/visual-truth.json --scene <scene> --task-id <task-id>`, `motionloom review-hook validate --task-dir artifacts/<task-id>`, `motionloom intelligence semantic-lint benchmark --task-dir artifacts/<task-id> --iterations 25 --threshold-ms 500`, `motionloom runtime-telemetry <scene> artifacts/<task-id>`, the independent attestation verifier, `motionloom report-contract --root . --scenes-file <changed-scenes> --require-attestation`, `motionloom quality-gate --scene <scene> --context <context-path> --task-dir artifacts/<task-id> --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation --require-visual-truth --require-asset-provenance`, and `motionloom doctor --json` when validating the Skill package itself.
 10. **Report** — create or update an artifact bundle with `python3 scripts/report.py`. Record facts with `report.py add`, structural defects with `report.py structure`, collect checksums with `report.py collect`, and run `report.py check` before rendering the final report. The final report must state completed, verified, not completed, blocked/failed, structure problems, browser candidate/review evidence and the recommended next Agent/Skill.
 11. **Learn** — after a user-confirmed fix or a deterministic benchmark, record it with `motionloom remediation-learning record-outcome|record-benchmark`. Run `summary` to expose correction count, first-pass acceptance, success rate, issue-class outliers and benchmark pass rate. Only `--user-confirmed` outcomes contribute to remediation acceptance metrics.
 12. **Confirm** — only after approved browser review and a passing quality gate run the platform-neutral PR preparation command. Commit, push and open PR are explicit side effects.
@@ -63,6 +75,7 @@ Only user-confirmed decisions and outcomes may become durable remediation memory
 - Read `references/intelligence-core.md` before building or validating Intelligence Core artifacts.
 - Read `docs/research/AGENT-PROTOCOL-FINDINGS.md` before exposing MotionLoom through Agent tools or MCP resources.
 - Read `references/agent-interoperability.md` when installing MotionLoom into Codex, Claude Code, Cursor, OpenCode or another Agent environment; run `motionloom discovery check --root <motionloom-checkout> --json` before relying on a surface.
+- Read `docs/research/agent-skill-ecosystem-notes.md` and `docs/research/ai-animation-tools-2026-report.md` before selecting a provider or internal capability; use its evidence to distinguish a scaffold adapter from a verified runtime path.
 
 ## Non-negotiable contracts
 
@@ -74,6 +87,12 @@ Only user-confirmed decisions and outcomes may become durable remediation memory
 - Destructive Git actions require explicit confirmation. Use `OPEN_PR=0` for local review-only runs.
 - Intelligence Core artifacts are task-bound: graph, provenance, Motion IR and replay evidence must not be reused across tasks without revalidation.
 - Provenance hashes materials and products; replay must fail on tampered or missing files; stale capability evidence must not be selected for production acceptance.
+- Asset provenance is tiered: `code_authored` is runtime-only and may be `review_required`; `ai_generated` is `runtime_ready` but not `production_eligible`; `ai_assisted` becomes eligible only after human sign-off; `ai_assisted_human_reviewed` remains review-bound; `artist_authored` requires a verified human/artist record and full gate; `unknown` is `blocked`.
+- `production_approved` is a human decision only. An Agent, generator metadata, signed attestation or quality gate may preserve or verify a decision but may never mint it; `approval` remains `false` in machine-generated evidence.
+- Asset provenance binds each declared file to a SHA-256, license/source metadata, generator or derivation chain, runtime evidence and, where applicable, human review. Production checks fail closed on unknown origin, self-asserted artist authority, missing evidence or hash drift.
+- Asset consistency is artifact-first and fail-closed: declared frame geometry, hashes, atlas regions and layered-map bounds must agree with measured runtime/source files. Heuristic warnings remain visible and may become blocking under `--strict`; no consistency result is an approval decision.
+- Artifact Intake is provider-neutral and hash-bound: receipt, control track, export manifest, provenance reference and adapter registry evidence must agree with the actual output bytes. Provider metadata, a prompt, a skill name, a model identifier or an adapter status cannot mint artist authority, production eligibility, runtime proof or approval.
+- A runtime candidate may become `runtime_test_ready` only when its intake and referenced consistency contracts pass. Rig compatibility must bind a supported adapter, skeleton/socket/action/event requirements and runtime evidence; `static-validated` and `scaffold` remain non-production states.
 - Browser-review candidates are single-use, time-bounded and bound to the exact task, scene and candidate identity; Dev Lab artifact/task bases must be same-origin and identity-consistent before staging a review decision.
 - Report completeness must select one deterministic passing task bundle per scene and fail on ambiguous ties; a valid artifact is never sufficient to bypass explicit user approval.
 - Runtime telemetry must bind task, scene, source, manifest, Motion IR and deterministic scrub points; tampered, stale, missing or cross-task telemetry is a verification failure.
@@ -89,6 +108,10 @@ The audited production paths are **Lottie JSON runtime rendering, dotLottie v2 p
 
 Every production `src/output/<scene>/manifest.json` must include a `source_binding` object matching `schemas/scene-manifest.schema.json`. The acceptance gate rejects a missing binding, a mismatched source path, an unknown license/authority or a stale SHA-256.
 
+Every production candidate that includes generated or assisted material must also reference `asset-provenance.json`. Validate it with `motionloom asset-provenance`; use runtime mode to allow safe ingest/testing and production mode to require `production_eligible`. This contract is deliberately separate from step-level `schemas/provenance.schema.json`: the former answers who/what created an asset and whether it may advance, while the latter records the pipeline steps that handled it.
+
+For multi-frame or layered assets, reference a consistency contract from the scene manifest with `consistency_ref` and `consistency_kind` (`identity`, `action-set`, `frame-geometry`, `atlas` or `layered-map`). `quality-gate.py --require-asset-consistency` and `report.py` validate the reference only when declared; missing references remain visible rather than being silently inferred.
+
 The Intelligence Core contracts are defined in `schemas/project-graph.schema.json`, `schemas/provenance.schema.json`, `schemas/capability-registry.schema.json`, `schemas/motion-ir.schema.json`, `schemas/signed-attestation.schema.json` and `schemas/trust-policy.schema.json`. They make project relationships, supply-chain steps, runtime selection, framework-neutral intent and signer trust inspectable without relying on prose.
 
 ```bash
@@ -99,6 +122,14 @@ node scripts/to-dotlottie.mjs --scene-dir src/output/<scene> --output src/output
 motionloom memory init --project-root <project-path>
 motionloom memory recover --project-root <project-path> --json
 
+# Measure multi-frame, atlas or layered-map consistency from real artifacts.
+motionloom asset-consistency validate --kind frame-geometry \
+  --input src/output/<scene>/hero-walk-frame-geometry.json \
+  --root src/output/<scene> --json
+motionloom asset-consistency validate --kind atlas \
+  --input src/output/<scene>/hero-atlas-contract.json \
+  --root src/output/<scene> --strict --json
+
 # Run the official runtime adapters in a real browser harness.
 node scripts/runtime-adapters.mjs
 

package/agent-card.json

@@ -1,9 +1,12 @@
 {
   "card_version": "1.0",
   "name": "motionloom",
-  "version": "2.2.0",
-  "description": "Project-aware animation production with durable Project Memory, graph, provenance, framework-neutral motion IR, runtime verification and telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, external evidence verification, semantic feedback, continuity checks, internal browser review, trust-boundary hardening and deterministic Agent handoff.",
+  "version": "2.4.0",
+  "description": "Project-aware animation production with durable Project Memory, provider-neutral Artifact Intake, hash-bound control-to-runtime candidates, tiered asset provenance, framework-neutral motion IR, rig compatibility, runtime verification and telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, internal browser review, trust-boundary hardening and deterministic Agent handoff.",
   "capabilities": [
+    "project.setup",
+    "project.status",
+    "project.repair",
     "agent.discovery.check",
     "agent.discovery.source",
     "agent.discovery.install-matrix",
@@ -21,6 +24,20 @@
     "motion.ir.build",
     "motion.ir.validate",
     "asset.provenance",
+    "asset.provenance.classify",
+    "asset.provenance.validate",
+    "asset.provenance.report",
+    "asset.provenance.production-gate",
+    "asset.consistency.validate",
+    "asset.consistency.frame-geometry",
+    "asset.consistency.atlas",
+    "asset.consistency.layered-map",
+    "artifact.intake.validate",
+    "artifact.intake.provider-neutral",
+    "artifact.intake.control-track",
+    "artifact.intake.export-manifest",
+    "runtime.candidate.validate",
+    "rig.compatibility.validate",
     "provenance.emit",
     "provenance.verify",
     "capability.discover",
@@ -69,7 +86,14 @@
     "host-project",
     "project-manifest",
     "animation-request",
-    "source-asset"
+    "source-asset",
+    "asset-provenance",
+    "asset-consistency-contract",
+    "generation-receipt",
+    "control-track",
+    "export-manifest",
+    "runtime-candidate",
+    "rig-compatibility-contract"
   ],
   "output_artifacts": [
     "agent-discovery-report",
@@ -77,6 +101,11 @@
     "motion-spec",
     "runtime-scene",
     "source-binding",
+    "asset-provenance",
+    "asset-consistency-report",
+    "artifact-intake-report",
+    "runtime-candidate-report",
+    "rig-compatibility-report",
     "dotlottie-package",
     "runtime-evidence",
     "runtime-telemetry",
@@ -145,6 +174,11 @@
     }
   ],
   "entrypoints": {
+    "init": "npx --yes motionloom init --project-root <project-path>",
+    "setup": "npx --yes motionloom setup --project-root <project-path>",
+    "setup_dry_run": "npx --yes motionloom setup --project-root <project-path> --dry-run --json",
+    "status": "npx --no-install motionloom status --project-root <project-path> --json",
+    "repair": "npx --no-install motionloom repair --project-root <project-path> --yes --json",
     "discovery_check": "motionloom discovery check --root <motionloom-checkout> --json",
     "discovery_source": "motionloom discovery source --root <motionloom-checkout> --json",
     "discovery_install_matrix": "motionloom discovery install-matrix --root <motionloom-checkout> --json",
@@ -175,12 +209,21 @@
     "semantic_lint_benchmark": "python3 scripts/intelligence.py semantic-lint benchmark --task-dir artifacts/<task-id> --iterations 25 --threshold-ms 500",
     "continuity": "python3 scripts/intelligence.py continuity build --task-dirs artifacts/<task-id>...",
     "fix_plan": "python3 scripts/intelligence.py fix-plan build --task-dir artifacts/<task-id> --reports semantic-lint-report.json continuity-report.json",
-    "quality_gate_p1": "python3 scripts/quality-gate.py --scene <scene> --context <path> --task-dir artifacts/<task-id> --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry",
+    "asset_provenance_check": "motionloom asset-provenance check --input src/output/<scene>/asset-provenance.json --root src/output/<scene> --mode runtime|production --manifest src/output/<scene>/manifest.json --json",
+    "asset_provenance_classify": "motionloom asset-provenance classify --input <asset-provenance.json> --json",
+    "asset_provenance_validate": "motionloom asset-provenance validate --input <asset-provenance.json> --json",
+    "asset_provenance_report": "motionloom asset-provenance report --input <asset-provenance.json> --json",
+    "asset_consistency_validate": "motionloom asset-consistency validate --kind <identity|action-set|frame-geometry|atlas|layered-map> --input <contract.json> --root <asset-root> --json",
+    "asset_consistency_report": "motionloom asset-consistency report --kind <identity|action-set|frame-geometry|atlas|layered-map> --input <contract.json> --root <asset-root> --strict --json",
+    "artifact_intake": "motionloom artifact-intake intake --root <project-root> --registry artifact-adapter-registry.json --receipt <generation-receipt.json> --controls <control-track.json> --export-manifest <export-manifest.json> --json",
+    "runtime_candidate_validate": "motionloom runtime-candidate validate --root <project-root> --input <runtime-candidate.json> --json",
+    "rig_compatibility_validate": "motionloom rig-compatibility validate --root <project-root> --registry rig-adapter-registry.json --input <rig-compatibility.json> --json",
+    "quality_gate_p1": "python3 scripts/quality-gate.py --scene <scene> --context <path> --task-dir artifacts/<task-id> --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-asset-provenance --require-asset-consistency",
     "attestation_statement": "python3 scripts/attestation.py statement --scene-dir src/output/<scene> --task-dir artifacts/<task-id> --context <project-context.json> --output artifacts/<task-id>/attestation-statement.json",
     "attestation_build": "python3 scripts/attestation.py build --statement artifacts/<task-id>/attestation-statement.json --private-key <key> --key-id <key-id> --output artifacts/<task-id>/attestation.json",
     "attestation_verify": "python3 scripts/attestation-verifier.py --attestation artifacts/<task-id>/attestation.json --trust-policy artifacts/<task-id>/trust-policy.json --expected-task-id <task-id> --expected-scene <scene>",
     "attestation_report": "python3 scripts/attestation-verifier.py --attestation artifacts/<task-id>/attestation.json --trust-policy artifacts/<task-id>/trust-policy.json --expected-task-id <task-id> --expected-scene <scene> --output artifacts/<task-id>/attestation-verifier-report.json",
-    "quality_gate_attestation": "python3 scripts/quality-gate.py --scene <scene> --context <path> --task-dir artifacts/<task-id> --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation",
+    "quality_gate_attestation": "python3 scripts/quality-gate.py --scene <scene> --context <path> --task-dir artifacts/<task-id> --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation --require-asset-provenance",
     "visual_truth_build": "motionloom visual-truth build --root <project-path> --scene <scene> --baseline <baseline.png> --candidate <candidate.png> --output src/output/<scene>/visual-truth.json",
     "visual_truth_validate": "motionloom visual-truth validate --root <project-path> --input src/output/<scene>/visual-truth.json --scene <scene> --task-id <task-id>",
     "remediation_record_outcome": "motionloom remediation-learning record-outcome --history artifacts/remediation-history.jsonl --event-id <id> --issue-id <issue-id> --summary <summary> --result pass|fail|partial|unknown --correction-count <n> --user-confirmed",

package/agent-surfaces.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.0",
   "name": "motionloom",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "canonical": {
     "skill": "SKILL.md",
     "agent_card": "agent-card.json",
@@ -42,6 +42,13 @@
     }
   ],
   "installations": [
+    {
+      "id": "npx-onboarding",
+      "source_kind": "npx",
+      "command": "npx --yes motionloom setup",
+      "verification": "npx --no-install motionloom status --json",
+      "provenance": "npm-registry-resolution-and-project-lockfile"
+    },
     {
       "id": "npm-registry",
       "source_kind": "npm",

package/artifact-adapter-registry.json

@@ -0,0 +1,53 @@
+{
+  "schema_version": "0.1",
+  "registry_id": "motionloom-artifact-adapters",
+  "generated_at": "2026-08-15T00:00:00Z",
+  "selection_policy": {"require_verified": true, "allow_scaffold_only": false},
+  "adapters": [
+    {
+      "adapter_id": "fixture.local-artifact-intake",
+      "kind": "fixture",
+      "status": "static_validated",
+      "adapter_version": "0.1",
+      "invocation_mode": "none",
+      "cost_class": "included",
+      "inputs": ["hash-bound-fixture", "control-track"],
+      "outputs": ["generation-receipt", "export-manifest"],
+      "compatibility": {"os": ["linux", "macos", "windows"]},
+      "evidence": [{"path": "docs/research/agent-skill-ecosystem-notes.md", "sha256": "18472ccd959191a4e769675b142076fa3c0103629d67b5be992fa524730cc530", "kind": "static"}],
+      "limitations": ["Fixture adapter is regression evidence only and never generates an asset."],
+      "risk_level": "low",
+      "side_effect_level": "read"
+    },
+    {
+      "adapter_id": "internal.imagegen",
+      "kind": "internal_skill",
+      "status": "scaffold_only",
+      "adapter_version": "0.1",
+      "invocation_mode": "agent-mediated",
+      "cost_class": "included",
+      "inputs": ["reference-images", "control-track", "prompt-hash"],
+      "outputs": ["image", "frame-sequence", "generation-receipt"],
+      "compatibility": {"os": ["linux", "macos", "windows"]},
+      "evidence": [{"path": "docs/research/agent-skill-ecosystem-notes.md", "sha256": "18472ccd959191a4e769675b142076fa3c0103629d67b5be992fa524730cc530", "kind": "static"}],
+      "limitations": ["Adapter imports Agent-mediated ImageGen output only; it does not invoke ImageGen or prove a model, seed, license, rig compatibility, runtime quality or human approval."],
+      "risk_level": "medium",
+      "side_effect_level": "user_review_required"
+    },
+    {
+      "adapter_id": "openai.chatgpt",
+      "kind": "external_provider",
+      "status": "scaffold_only",
+      "adapter_version": "0.1",
+      "invocation_mode": "manual",
+      "cost_class": "external",
+      "inputs": ["user-provided-images", "reference-images", "control-track", "prompt-hash"],
+      "outputs": ["image", "frame-sequence", "generation-receipt"],
+      "compatibility": {"os": ["linux", "macos", "windows"]},
+      "evidence": [{"path": "docs/research/agent-skill-ecosystem-notes.md", "sha256": "18472ccd959191a4e769675b142076fa3c0103629d67b5be992fa524730cc530", "kind": "static"}],
+      "limitations": ["Adapter imports user-provided ChatGPT output only; it does not invoke ChatGPT, verify a provider-native task ID, prove a model, seed, license, rig compatibility, runtime quality or human approval."],
+      "risk_level": "medium",
+      "side_effect_level": "user_review_required"
+    }
+  ]
+}