motionloom 2.2.0 → 2.4.0

package/bin/motionloom.mjs

@@ -37,16 +37,35 @@ const PYTHON_COMMANDS = {
   discovery: "scripts/discovery.py",
   "visual-truth": "scripts/visual-truth.py",
   "remediation-learning": "scripts/remediation-learning.py",
+  "asset-provenance": "scripts/asset-provenance.py",
+  "asset-consistency": "scripts/asset-consistency.py",
+  "artifact-intake": "scripts/artifact-intake.py",
+  "runtime-candidate": "scripts/runtime-candidate.py",
+  "rig-compatibility": "scripts/rig-compatibility.py",
+  "rive-package-gate": "scripts/rive-package-gate.py",
+  "pilot-build": "scripts/build-ai-pilot.py",
+  "alpha-isolate": "scripts/isolate-alpha-background.py",
+};
+
+const NODE_COMMANDS = {
+  init: "scripts/setup.mjs",
+  setup: "scripts/setup.mjs",
+  status: "scripts/setup.mjs",
+  repair: "scripts/setup.mjs",
 };
 
 function printHelp() {
-  console.log(`MotionLoom 2.2.0 — project-aware animation production and evidence contracts
+  console.log(`MotionLoom 2.4.0 — project-aware animation production and evidence contracts
 
 Usage:
   motionloom <command> [args...]
 
-Commands:
+Start here:
+  init                   One safe project setup; no animation gate runs
+  status                 Short read-only readiness report
   doctor                 Validate the installed Skill package
+
+Use when an animation task needs it:
   analyze                Run project analysis and refresh Project Memory
   memory                 Initialize, inspect, refresh, recover or validate memory
   intelligence           Build or validate Intelligence Core artifacts
@@ -65,6 +84,16 @@ Commands:
   discovery              Check Agent surfaces, source identity and install matrix
   visual-truth           Build or validate provenance-bound visual comparisons
   remediation-learning   Record or summarize user-confirmed remediation and benchmark history
+  asset-provenance       Validate, classify or report asset origin and production readiness
+  asset-consistency      Validate frame geometry, atlas contamination and layered-map contracts
+  artifact-intake        Bind generation controls, provenance, adapter metadata and exported bytes
+  runtime-candidate      Bind intake exports to consistency contracts before runtime testing
+  rig-compatibility      Validate rig bones, sockets, actions, events and runtime adapter evidence
+  rive-package-gate      Verify a real .riv package, runtime proof and provenance before testing
+  pilot-build            Build a review-only hash-bound AI scout pilot from true-alpha PNG sources
+  alpha-isolate          Isolate an edge-connected flat background; block residual edge contamination
+  setup                  Alias for init (kept for compatibility)
+  repair                 Re-apply safe missing setup pieces
 
 Cross-platform examples:
   motionloom analyze . --init-memory
@@ -76,6 +105,13 @@ Cross-platform examples:
   motionloom discovery install-matrix --root . --json
   motionloom visual-truth validate --root . --input src/output/<scene>/visual-truth.json
   motionloom remediation-learning summary --history artifacts/remediation-history.jsonl --json
+  motionloom asset-provenance check --input <asset-provenance.json> --root <scene-dir> --mode runtime --json
+  motionloom asset-consistency validate --kind frame-geometry --input <frame-geometry.json> --root <scene-dir> --json
+  motionloom artifact-intake intake --root <asset-dir> --registry artifact-adapter-registry.json \\
+    --receipt <generation-receipt.json> --controls <control-track.json> --export-manifest <export-manifest.json> --json
+  motionloom alpha-isolate <opaque.png> <isolated.png> --report <alpha-report.json>
+  motionloom rive-package-gate validate --root <package-dir> --registry rig-adapter-registry.json \\
+    --input <rive-package-manifest.json> --strict --json
 
 The CLI never grants approval or opens a pull request by itself. User review
 and explicit repository side-effect confirmation remain separate gates.
@@ -88,7 +124,7 @@ if (!command || command === "help" || command === "--help" || command === "-h")
   process.exit(0);
 }
 
-const script = PYTHON_COMMANDS[command];
+const script = NODE_COMMANDS[command] || PYTHON_COMMANDS[command];
 if (!script) {
   console.error(`Unknown MotionLoom command: ${command}`);
   printHelp();
@@ -96,7 +132,8 @@ if (!script) {
 }
 
 const executable = script.endsWith(".mjs") ? process.execPath : PYTHON;
-const result = spawnSync(executable, [resolve(ROOT, script), ...args], {
+  const delegatedArgs = NODE_COMMANDS[command] && !["setup", "init"].includes(command) ? [command, ...args] : command === "init" ? ["init", ...args] : args;
+const result = spawnSync(executable, [resolve(ROOT, script), ...delegatedArgs], {
   cwd: ROOT,
   stdio: "inherit",
   env: process.env,

package/docs/AGENT-INTEGRATION.md

@@ -6,11 +6,12 @@ MotionLoom is distributed as one Skill with several **discovery surfaces**, not
 
 | Source | Typical command | Verification | Provenance to retain |
 |---|---|---|---|
+| One-command onboarding | `npx --yes motionloom setup` | `npx --no-install motionloom status --json` | project lockfile, setup JSON and generated project identity |
 | npm registry | `npm install --save-dev motionloom` | `motionloom discovery check --root . --json` | lockfile and resolved package version |
 | Git checkout | `git clone https://github.com/lenhonbp/MotionLoom.git` | `node bin/motionloom.mjs discovery check --root . --json` | remote URL and commit SHA |
 | Local source | invoke `<checkout>/bin/motionloom.mjs` | `python3 scripts/discovery.py check --root . --json` | source path and local commit if present |
 
-The check is offline and read-only. Installation, source identity and capability compatibility are separate from network authentication. A passing check means that the package is structurally discoverable; it does not mean that a scene is runtime-verified or approved.
+The check is offline and read-only. Installation, source identity and capability compatibility are separate from network authentication. A passing check means that the package is structurally discoverable; it does not mean that a scene is runtime-verified or approved. For a new host project, prefer `npx --yes motionloom setup`; use `--dry-run --json` to preview and `status --json` to inspect without mutation. `repair --yes` only restores missing managed pieces.
 
 ## Agent surfaces
 
@@ -36,7 +37,19 @@ Support here means that the repository exposes a deterministic discovery contrac
 
 ## Required first-run sequence
 
-Run `motionloom discovery check --root <checkout> --json`, inspect `source`, then run project analysis with `motionloom analyze <project> --init-memory`. Load the project context and durable Project Memory before planning. After rendering, prepare a task-bound browser candidate and suggest or trigger the internal Dev Lab. Capture user feedback separately from runtime evidence. A valid signature, quality gate or screenshot is not a user approval.
+For a new host project, run `npx --yes motionloom setup --json`, inspect the returned `status`, then use `npx --no-install motionloom status --json` before planning. Setup performs project analysis, discovery and durable-memory bootstrap without copying artifacts from the MotionLoom checkout. For an existing installation, run `motionloom discovery check --root <checkout> --json`, then refresh with `motionloom analyze <project> --init-memory` when needed. Load the project context and durable Project Memory before planning. After selecting or generating an asset, create `asset-provenance.json` and run the runtime-mode check before ingest. An AI-generated pilot may proceed to the real runtime and Dev Lab, but it must remain non-production-eligible. After rendering, prepare a task-bound browser candidate and suggest or trigger the internal Dev Lab. Capture user feedback separately from runtime evidence. A valid signature, quality gate or screenshot is not a user approval.
+
+## AI-first asset workflow
+
+The Agent must distinguish these transitions rather than collapsing them into one `approved` flag:
+
+| Transition | Allowed actor | Required evidence |
+|---|---|---|
+| `blocked` → `runtime_ready` | Agent or runtime validator | Safe paths, valid schema, license/source, file hashes and real runtime evidence |
+| `runtime_ready` → `production_eligible` | Contract gate plus human review where the authority tier requires it | Full quality/visual/runtime gate and valid authority record |
+| `production_eligible` → `production_approved` | User or designated human reviewer only | Explicit review decision persisted outside the Agent's self-assertion |
+
+Never rewrite `ai_generated` as `artist_authored`, never infer human review from a signature, and never set `production_approved` from `quality-gate`. Use `motionloom asset-provenance report` to show the boundary in a handoff.
 
 ## Portability policy
 

package/docs/CHECKLIST.md

@@ -24,9 +24,30 @@ A scene is only ready for the confirm-into-PR step when every item below passes.
 ## Source traceability
 - [ ] Every geometric asset references an authoritative source (`assets/library/` or the host project) — flagged if invented.
 - [ ] `manifest.json` records framework, source path, license note, spec hash, visual-truth path, and completed checklist entries.
+- [ ] `asset-provenance.json` records origin/authority, generator or derivation chain, license/source, per-file SHA-256 and runtime evidence.
+- [ ] `ai_generated` assets may be runtime-ready but are not production-eligible; `unknown` assets are blocked.
+- [ ] `artist_authored` is backed by a verifiable human/artist record and is not merely an Agent-authored field.
+
+## Asset consistency
+- [ ] Multi-frame actions declare an `identity` and `action-set` contract when the asset has shared character/style identity or loop/event requirements.
+- [ ] `frame-geometry` measures the real PNG bytes: canvas size, alpha bounds, frame SHA-256, pivot/footline drift and opaque pixels outside each frame rect.
+- [ ] Sprite atlases declare non-overlapping regions, explicit rotation policy and transparent pixels outside regions; contamination is blocking in strict runs.
+- [ ] Layered maps declare unique layer IDs/z-order, intentional parallax order, tile seam policy, layer/world bounds and camera-safe bounds.
+- [ ] Consistency output is stored with the task evidence and remains separate from provenance authority, production eligibility and user approval.
+
+## Provider-neutral intake and runtime candidate
+- [ ] Every Agent/internal-skill/provider output used by the scene has a hash-bound generation receipt, control track and export manifest; no receipt stores secrets or self-asserts approval.
+- [ ] The selected artifact adapter is declared in `artifact-adapter-registry.json`; `scaffold` or `static-validated` status is not presented as runtime verification or production eligibility.
+- [ ] `runtime-candidate.json` binds the intake bundle to the matching asset identity, action-set and frame geometry/atlas/map contracts; mismatched refs or hashes block the candidate.
+- [ ] A rigmed or motion-capture candidate declares skeleton, sockets, action/event coverage, export target and adapter evidence in `rig-compatibility.json`.
+- [ ] Artifact Intake, runtime candidate and rig findings are present in the task handoff/Dev Lab rail and visibly retain `review_required` until the user records a decision.
 
 ## PR readiness
 - [ ] Snapshot PNGs exist for 0/50/100%.
 - [ ] `visual-truth.json` binds real baseline/candidate frames to source, manifest and available runtime/Motion IR hashes; `approval` remains `false`.
 - [ ] `motion-spec.json` is bound to the exact `project-context.json` hash (implements == planned).
 - [ ] Dev Lab URL tested on mobile viewport and desktop.
+- [ ] The production provenance check passes with `--mode production` and reports `production_eligible: true`.
+- [ ] If `manifest.json` declares `consistency_ref`, `quality-gate.py --require-asset-consistency` passes for its declared `consistency_kind`.
+- [ ] If `manifest.json` declares an Artifact Intake bundle, `quality-gate.py --require-artifact-intake` passes and the selected adapter/runtime evidence meets the requested mode.
+- [ ] `production_approved` and browser-review approval are recorded only from the user's explicit review; attestation approval remains `false`.

package/docs/STATUS.md

@@ -4,7 +4,7 @@
 
 ## Current release posture
 
-MotionLoom's repository source and package manifest are at **2.2.0 release-candidate metadata**. The public npm registry currently serves **2.1.0**, while the latest published GitHub Release/tag remains **v2.1.0**; the 2.2.0 tag, GitHub Release and npm publication are intentionally pending explicit maintainer approval. The repository has a cross-platform CLI, durable Project Memory, Agent interoperability surfaces, artifact-first handoff, runtime evidence, Visual Truth, Remediation Learning, signed attestation and a browser-based Dev Lab review contract. The protected manual release workflow verifies package/changelog/release-note alignment before publication.
+MotionLoom's repository source and package manifest are prepared for **2.4.0 release metadata**. The publication state of the npm registry and GitHub Release/tag must be verified against the latest release workflow rather than inferred from this document. The repository has a cross-platform CLI, one-command project onboarding, durable Project Memory, Agent interoperability surfaces, artifact-first handoff, runtime evidence, Visual Truth, Remediation Learning, signed attestation, AI-first asset provenance, a truthful code-authored runtime lane and a browser-based Dev Lab review contract. The protected manual release workflow verifies package/changelog/release-note alignment before publication.
 
 The repository is **engineering-ready for continued integration work**, not a universal production certification for every animation framework or every host project. CI status must be read from the latest GitHub Actions run, not inferred from historical audit prose.
 
@@ -30,4 +30,4 @@ Use the following order when sources disagree:
 
 ## Known next work
 
-The bounded analyzer has now been exercised against a labeled external corpus; see the [dated evidence note](audits/external-project-corpus-2026-08-13.md). The highest-value remaining evidence work is paired product evaluation across more real projects, then closing version–tag–GitHub Release–npm provenance traceability through an approved manual release. Missing external projects are reported as `insufficient_evidence`, never as a pass. None of these items should weaken the user-review gate or convert heuristic warnings into approval.
+The bounded analyzer has now been exercised against a labeled external corpus; see the [dated evidence note](audits/external-project-corpus-2026-08-13.md). The highest-value remaining evidence work is paired product evaluation across more real projects and verification of the 2.4.0 version–tag–GitHub Release–npm provenance chain. Missing external projects are reported as `insufficient_evidence`, never as a pass. None of these items should weaken the user-review gate or convert heuristic warnings into approval.

package/docs/audits/data/deep-stress-latest.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.0",
   "audit": "motionloom-deep-stress",
-  "generated_at": "2026-08-13T10:13:55.979988Z",
+  "generated_at": "2026-08-14T18:59:00.435638Z",
   "seed": 20260813,
   "requested_iterations": 5000,
   "actual_iterations": 6900,
@@ -29,9 +29,9 @@
       "codes": {
         "equal": 600
       },
-      "p50_ms": 0.018526,
-      "p95_ms": 0.019782,
-      "max_ms": 0.034744,
+      "p50_ms": 0.01868,
+      "p95_ms": 0.022651,
+      "max_ms": 0.041323,
       "pass_rate": 1.0
     },
     "dsse-ed25519-roundtrip": {
@@ -43,9 +43,9 @@
       "codes": {
         "verified": 250
       },
-      "p50_ms": 0.127995,
-      "p95_ms": 0.141972,
-      "max_ms": 0.244296,
+      "p50_ms": 0.129434,
+      "p95_ms": 0.145666,
+      "max_ms": 0.186531,
       "pass_rate": 1.0
     },
     "dsse-ed25519-tamper": {
@@ -57,9 +57,9 @@
       "codes": {
         "invalid-signature": 250
       },
-      "p50_ms": 0.131456,
-      "p95_ms": 0.144911,
-      "max_ms": 0.257528,
+      "p50_ms": 0.131737,
+      "p95_ms": 0.155588,
+      "max_ms": 0.218171,
       "pass_rate": 1.0
     },
     "statement-contract": {
@@ -72,9 +72,9 @@
         "valid": 200,
         "rejected": 400
       },
-      "p50_ms": 0.007304,
-      "p95_ms": 0.008605,
-      "max_ms": 0.063033,
+      "p50_ms": 0.007154,
+      "p95_ms": 0.008546,
+      "max_ms": 0.06488,
       "pass_rate": 1.0
     },
     "attestation-verifier-boundary": {
@@ -89,9 +89,9 @@
         "14": 375,
         "13": 375
       },
-      "p50_ms": 0.300549,
-      "p95_ms": 0.484133,
-      "max_ms": 0.866072,
+      "p50_ms": 0.297953,
+      "p95_ms": 0.485624,
+      "max_ms": 0.742145,
       "pass_rate": 1.0
     },
     "strict-quality-gate-clean": {
@@ -103,9 +103,9 @@
       "codes": {
         "accepted": 400
       },
-      "p50_ms": 25.817357,
-      "p95_ms": 28.37167,
-      "max_ms": 35.746459,
+      "p50_ms": 25.03624,
+      "p95_ms": 26.647454,
+      "max_ms": 36.626597,
       "pass_rate": 1.0
     },
     "intelligence-p1-clean": {
@@ -117,9 +117,9 @@
       "codes": {
         "accepted": 400
       },
-      "p50_ms": 19.18085,
-      "p95_ms": 21.672868,
-      "max_ms": 29.969583,
+      "p50_ms": 18.137953,
+      "p95_ms": 18.818408,
+      "max_ms": 22.29844,
       "pass_rate": 1.0
     },
     "replay-hash-clean": {
@@ -131,9 +131,9 @@
       "codes": {
         "clean": 475
       },
-      "p50_ms": 7.51816,
-      "p95_ms": 7.916555,
-      "max_ms": 11.545468,
+      "p50_ms": 8.196194,
+      "p95_ms": 8.346516,
+      "max_ms": 9.307598,
       "pass_rate": 1.0
     },
     "semantic-lint-clean": {
@@ -145,9 +145,9 @@
       "codes": {
         "clean": 475
       },
-      "p50_ms": 0.024703,
-      "p95_ms": 0.03313,
-      "max_ms": 0.08727,
+      "p50_ms": 0.02188,
+      "p95_ms": 0.025799,
+      "max_ms": 0.048701,
       "pass_rate": 1.0
     },
     "continuity-clean": {
@@ -159,9 +159,9 @@
       "codes": {
         "clean": 475
       },
-      "p50_ms": 0.024346,
-      "p95_ms": 0.033119,
-      "max_ms": 0.052678,
+      "p50_ms": 0.023042,
+      "p95_ms": 0.026202,
+      "max_ms": 0.045252,
       "pass_rate": 1.0
     },
     "approval-invariant": {
@@ -173,9 +173,9 @@
       "codes": {
         "approval=false": 475
       },
-      "p50_ms": 0.063713,
-      "p95_ms": 0.080847,
-      "max_ms": 0.1211,
+      "p50_ms": 0.056737,
+      "p95_ms": 0.067291,
+      "max_ms": 0.099394,
       "pass_rate": 1.0
     },
     "fault-graph-task-id": {
@@ -187,9 +187,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 13.765242,
-      "p95_ms": 15.757552,
-      "max_ms": 17.026196,
+      "p50_ms": 14.317844,
+      "p95_ms": 14.713064,
+      "max_ms": 15.184861,
       "pass_rate": 1.0
     },
     "fault-motion-ir-scene": {
@@ -201,9 +201,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 2.148835,
-      "p95_ms": 2.448147,
-      "max_ms": 2.860418,
+      "p50_ms": 2.077654,
+      "p95_ms": 2.140575,
+      "max_ms": 2.284035,
       "pass_rate": 1.0
     },
     "fault-provenance-task-id": {
@@ -215,9 +215,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 0.857105,
-      "p95_ms": 1.049827,
-      "max_ms": 1.36859,
+      "p50_ms": 0.849407,
+      "p95_ms": 0.886464,
+      "max_ms": 0.94938,
       "pass_rate": 1.0
     },
     "fault-replay-path-escape": {
@@ -229,9 +229,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 8.091177,
-      "p95_ms": 9.353946,
-      "max_ms": 10.112846,
+      "p50_ms": 8.246496,
+      "p95_ms": 8.347693,
+      "max_ms": 9.112055,
       "pass_rate": 1.0
     },
     "fault-p1-fix-plan-hash": {
@@ -243,9 +243,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 0.730294,
-      "p95_ms": 0.866361,
-      "max_ms": 1.132574,
+      "p50_ms": 0.735113,
+      "p95_ms": 0.772903,
+      "max_ms": 0.896587,
       "pass_rate": 1.0
     },
     "fault-p1-wrong-scene": {
@@ -257,9 +257,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 0.675249,
-      "p95_ms": 0.807189,
-      "max_ms": 1.103894,
+      "p50_ms": 0.709162,
+      "p95_ms": 0.732217,
+      "max_ms": 0.772478,
       "pass_rate": 1.0
     },
     "fault-continuity-structure": {
@@ -271,9 +271,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 0.066832,
-      "p95_ms": 0.081028,
-      "max_ms": 0.100648,
+      "p50_ms": 0.098924,
+      "p95_ms": 0.10896,
+      "max_ms": 0.126946,
       "pass_rate": 1.0
     },
     "fault-semantic-structure": {
@@ -285,9 +285,9 @@
       "codes": {
         "rejected": 100
       },
-      "p50_ms": 0.064075,
-      "p95_ms": 0.081449,
-      "max_ms": 0.116428,
+      "p50_ms": 0.094954,
+      "p95_ms": 0.102869,
+      "max_ms": 0.109556,
       "pass_rate": 1.0
     },
     "fault-attestation-approval": {
@@ -299,9 +299,9 @@
       "codes": {
         "10": 100
       },
-      "p50_ms": 0.204615,
-      "p95_ms": 0.265782,
-      "max_ms": 0.341527,
+      "p50_ms": 0.224069,
+      "p95_ms": 0.2494,
+      "max_ms": 0.264081,
       "pass_rate": 1.0
     },
     "fault-attestation-payload": {
@@ -313,9 +313,9 @@
       "codes": {
         "11": 100
       },
-      "p50_ms": 0.262104,
-      "p95_ms": 0.301103,
-      "max_ms": 0.414031,
+      "p50_ms": 0.283996,
+      "p95_ms": 0.310437,
+      "max_ms": 0.370236,
       "pass_rate": 1.0
     }
   },
@@ -325,5 +325,5 @@
     "false_positive": "A clean canonical case was rejected.",
     "false_negative": "A controlled tamper, binding, revocation or invalid-contract case was accepted."
   },
-  "wall_time_s": 25.354826
+  "wall_time_s": 25.466197
 }

package/docs/releases/2.3.0.md

@@ -0,0 +1,33 @@
+# MotionLoom 2.3.0
+
+## Summary
+
+MotionLoom 2.3.0 makes the project-aware animation Skill easier to install and resume in a real project. It introduces a canonical one-command onboarding path while preserving the evidence-first, review-first and local-only safety boundaries established by the previous releases.
+
+## Added
+
+### One-command project onboarding
+
+`npx --yes motionloom setup` detects the host project, selects npm/pnpm/yarn from the project contract, installs MotionLoom as a local development dependency, merges a marked router block into `AGENTS.md`, runs discovery and bootstraps project-bound context plus durable Project Memory. The operation is idempotent and never overwrites unmarked project guidance.
+
+Read-only and repair surfaces are available through `npx --no-install motionloom status --json` and `npx --no-install motionloom repair --yes`. `--dry-run --json` exposes the planned changes before mutation, which gives Agents and CI a machine-readable preview.
+
+### Agent interoperability
+
+The discovery manifest now advertises the `npx` recipe as the preferred onboarding path, while npm, Git checkout and local checkout remain available for contributors and controlled environments. The installation matrix explicitly covers setup, status and repair commands across Ubuntu, macOS and Windows.
+
+### Asset provenance
+
+The AI-first human-governed asset provenance contract from the 2.2.0 working tree is included in this release. Agents may create assets for runtime ingest and testing, but `ai_generated` does not become production-eligible; `production_approved` remains human-only.
+
+## Fixed
+
+Machine-readable setup output no longer mixes package-manager installation logs with JSON. Dispatcher routing keeps `status` read-only and prevents `repair` from accidentally becoming an unrestricted full setup. Managed router repair remains idempotent and package-manager agnostic.
+
+## Verified behavior
+
+The release target passes the full regression harness, onboarding and installation-matrix tests, discovery contract, docs audit, Skill Doctor, skill-creator validation, quality validation, npm tarball dry-run and diff hygiene.
+
+## Trust boundary
+
+Setup does not commit, push, open a PR, grant user approval or promote asset provenance. Runtime evidence, quality gates, attestations and heuristics remain evidence only. The user must inspect the Dev Lab candidate and explicitly authorize any Git side effect.

package/docs/releases/2.4.0.md

@@ -0,0 +1,31 @@
+# MotionLoom 2.4.0
+
+## Summary
+
+MotionLoom 2.4.0 adds a **runtime-first, code-authored** path for agents that need to prove animation behavior without misclassifying a code scene as an artist-authored or AI-generated visual asset. The reference Framer Motion pilot moves through Artifact Intake, runtime rendering, integrity verification and identity-bound Dev Lab review while maintaining the existing human-governed release boundary.
+
+## Added
+
+### Truthful runtime-first provenance
+
+The Artifact Intake and provenance surfaces now recognize `code_authored` runtime scenes explicitly. Source code, controls, export data and provenance are hash-bound, but this evidence only permits runtime review. It never grants `artist_authored`, `production_eligible`, `production_approved` or PR authorization.
+
+### Framer Motion end-to-end reference candidate
+
+The repository includes `runtime-pilot-framer`, a code-authored Framer Motion scene rendered by the production adapter at 0%, 50% and 100%. The candidate includes runtime telemetry, an evidence-verifier report, a local-only attestation with `approval: false`, and an identity-bound review handoff for the MotionLoom Dev Lab.
+
+### Identity-bound Quality task resolution
+
+Quality CI resolves the task bundle by the scene declared in `task.json`, instead of requiring a historical `artifacts/<scene>-task` naming convention. The resolver fails closed for absent, ambiguous or mismatched bindings, and its regression coverage includes a task ID that intentionally differs from the scene slug.
+
+## Fixed
+
+The Quality workflow no longer fails during runtime telemetry capture for a correctly bound task bundle whose directory name differs from its scene name. All task-aware steps now consume the resolver map rather than reconstructing task paths independently.
+
+## Verified behavior
+
+Before publication, the target is validated with the full regression harness, `doctor`, documentation audit, Skill validation, package dry-run, diff hygiene and the GitHub Quality, Documentation & Package Hygiene, Security Analysis and Dev Lab Build workflows.
+
+## Trust boundary
+
+The code-authored lane is **runtime-ready, not production-ready**. Runtime evidence, signature verification, task binding and Dev Lab staging do not replace human visual review. The default remains local-only: MotionLoom does not commit, push, open a pull request, tag a release or publish to npm without the relevant explicit user or maintainer action.

package/docs/releases/npm-publish-from-workstation.md

@@ -1,6 +1,6 @@
 # Publish MotionLoom to npm from your workstation
 
-This guide publishes the prepared `motionloom@2.2.0` package from your own computer. The npm password, authenticator code and access token must stay on your computer; never paste them into chat, GitHub issues or repository files.
+This guide publishes the prepared `motionloom@2.4.0` package from your own computer. The npm password, authenticator code and access token must stay on your computer; never paste them into chat, GitHub issues or repository files.
 
 ## 1. Install prerequisites
 
@@ -25,7 +25,7 @@ git pull --ff-only origin main
 git log -1 --oneline
 ```
 
-The latest commit must be the npm packaging release announced in the task. Do not publish from an older checkout or from a different fork.
+The latest commit must be the npm packaging release announced in the task. Do not publish from an older checkout or from a different fork. This repository declares `pnpm` as its package manager and intentionally does not ship a `package-lock.json`; do **not** run `npm ci` in the repository. The release verifier and package dry-run do not require a dependency install. If a full workspace install is needed, use the declared package manager with `pnpm install --frozen-lockfile`.
 
 ## 3. Authenticate npm locally
 
@@ -48,7 +48,7 @@ npm pack --dry-run --json --ignore-scripts
 npm publish --dry-run --access public
 ```
 
-The dry-run should report `motionloom@2.2.0`, public access, and the current package file list. Do not hard-code a historical file count: inspect the JSON output and compare it with the checked-in package allowlist. The prepack hook removes generated Python bytecode before packaging. Do not publish if the dry-run shows private keys, `.env` files, `artifacts/`, `dev-lab/` or `__pycache__/` entries.
+The dry-run should report `motionloom@2.4.0`, public access, and the current package file list. Do not hard-code a historical file count: inspect the JSON output and compare it with the checked-in package allowlist. The prepack hook removes generated Python bytecode before packaging. Do not publish if the dry-run shows private keys, `.env` files, `artifacts/`, `dev-lab/` or `__pycache__/` entries.
 
 ## 5. Publish the package
 
@@ -58,15 +58,17 @@ When the dry-run is correct and `npm whoami` shows the intended account, publish
 npm publish --access public
 ```
 
-The version `2.2.0` becomes immutable on npm after a successful publish. If npm reports that the version already exists, stop and verify the registry instead of trying to overwrite it.
+Do not add `--provenance` unless the local npm client and its CI/provider integration explicitly support automatic npm provenance. Some workstation setups report `Automatic provenance generation not supported for provider: null`; in that case the package itself is still valid, and the supported fallback for this release is the command above without `--provenance`. Never retry by changing the version or by bypassing the package verification steps.
+
+The version `2.4.0` becomes immutable on npm after a successful publish. If npm reports that the version already exists, stop and verify the registry instead of trying to overwrite it.
 
 ## 6. Verify the registry publication
 
-Run the following commands and confirm that they return `2.2.0` and a tarball URL:
+Run the following commands and confirm that they return `2.4.0` and a tarball URL:
 
 ```bash
 npm view motionloom version --registry=https://registry.npmjs.org/
-npm view motionloom@2.2.0 name version license dist.tarball dist.shasum --json \
+npm view motionloom@2.4.0 name version license dist.tarball dist.shasum --json \
   --registry=https://registry.npmjs.org/
 ```
 
@@ -76,7 +78,7 @@ Then test installation in a clean temporary directory:
 TMP_DIR="$(mktemp -d)"
 cd "$TMP_DIR"
 npm init --yes
-npm install motionloom@2.2.0
+npm install motionloom@2.4.0
 motionloom --help
 motionloom doctor
 ```
@@ -85,4 +87,13 @@ The CLI should print the MotionLoom command surface. `motionloom doctor` should
 
 ## Troubleshooting
 
-If `npm whoami` returns `ENEEDAUTH`, repeat `npm login` on the same computer and registry. If publishing returns `E403`, check package ownership, organization publish permission and 2FA policy; do not disable security controls. If the package name is already claimed, stop and choose a scoped name such as `@your-npm-user/motionloom`, then update `name` and `publishConfig` before publishing a new package identity. Never place an npm token in `package.json`, `.npmrc` committed to Git, shell history or chat.
+If `npm whoami` returns `ENEEDAUTH`, repeat `npm login` on the same computer and registry. If `npm ci` reports that no `package-lock.json` exists, skip it and use the release verifier directly; this repository is pnpm-managed. If `npm publish --provenance` reports that the provider is `null` or unsupported, retry `npm publish --access public` without that flag. If publishing returns `E404` on the `PUT` request, do not change the package name or version yet. First run these read-only checks against the public registry:
+
+```bash
+npm config get registry
+npm whoami --registry=https://registry.npmjs.org/
+npm view motionloom name version maintainers --json --registry=https://registry.npmjs.org/
+npm access list collaborators motionloom --json --registry=https://registry.npmjs.org/
+```
+
+The `npm whoami` result must be the intended publisher, and the collaborators result must show that account with publish-capable access. A mismatch usually means the workstation is authenticated as a different npm user, is using a stale token, or the package is owned by another account or team. Re-authenticate only on the workstation with `npm logout` followed by `npm login --registry=https://registry.npmjs.org/`; never paste the token into chat. If the account is correct but publish access is absent, the package owner must grant the account read-write access or publish from the owner account. If publishing returns `E403`, check package ownership, organization publish permission and 2FA policy; do not disable security controls. If the package name is already claimed by an account you do not control, stop and do not rename this release without an explicit release decision. Never place an npm token in `package.json`, `.npmrc` committed to Git, shell history or chat.