motionloom 2.2.0 → 2.4.0

package/examples/agent-consumer/runtime-pilot/action-set.json

@@ -0,0 +1,19 @@
+{
+  "schema_version": "0.1",
+  "asset_identity": "runtime/framer-motion-pilot",
+  "actions": [
+    {
+      "action_id": "scrubbable-trajectory",
+      "frames": ["src/output/runtime-pilot-framer/scene.jsx"],
+      "fps": 60,
+      "loop": true,
+      "events": ["checkpoint-00", "checkpoint-50", "checkpoint-100"],
+      "required_sockets": []
+    }
+  ],
+  "invariants": {
+    "checkpoint_percentages": [0, 50, 100],
+    "progress_domain": [0, 1],
+    "runtime_target": "framer-motion"
+  }
+}

package/examples/agent-consumer/runtime-pilot/asset-identity.json

@@ -0,0 +1,44 @@
+{
+  "schema_version": "0.1",
+  "asset_id": "runtime/framer-motion-pilot",
+  "asset_kind": "ui",
+  "identity": {
+    "subject_id": "framer-motion-runtime-pilot",
+    "reference_hashes": [
+      "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b"
+    ],
+    "camera": {
+      "projection": "orthographic",
+      "width": 512,
+      "height": 512,
+      "focal_length": 50
+    },
+    "coordinate_system": "screen_y_down",
+    "scale": 1,
+    "pivot": {
+      "x": 0.5,
+      "y": 0.5,
+      "space": "normalized_canvas"
+    },
+    "palette_lock": {
+      "colors": ["#2563eb", "#f59e0b", "#0f172a"],
+      "delta_e_tolerance": 0
+    },
+    "style_profile": "code-authored-runtime-pilot",
+    "lighting_profile": "not-applicable"
+  },
+  "derivation": {
+    "origin": "code_authored",
+    "source_refs": ["src/output/runtime-pilot-framer/scene.jsx"],
+    "derivation_chain": [
+      {
+        "step": 0,
+        "operation": "repository-code-authoring",
+        "input_hashes": [],
+        "output_hash": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b"
+      }
+    ]
+  },
+  "provenance_ref": "provenance.json",
+  "notes": "Code-authored Framer Motion pilot. Runtime evidence can establish runtime verification only; human review remains required."
+}

package/examples/agent-consumer/runtime-pilot/candidate.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": "0.1",
+  "candidate_id": "runtime-pilot-framer-001",
+  "asset_id": "runtime/framer-motion-pilot",
+  "created_at": "2026-08-15T00:00:00Z",
+  "artifact_intake": {
+    "registry": "artifact-adapter-registry.json",
+    "receipt": "examples/agent-consumer/runtime-pilot/receipt.json",
+    "controls": "examples/agent-consumer/runtime-pilot/controls.json",
+    "export_manifest": "examples/agent-consumer/runtime-pilot/export.json"
+  },
+  "consistency": {
+    "asset_identity": "examples/agent-consumer/runtime-pilot/asset-identity.json",
+    "action_set": "examples/agent-consumer/runtime-pilot/action-set.json"
+  },
+  "runtime": {
+    "target": "framer-motion",
+    "runtime_evidence_ref": "src/output/runtime-pilot-framer/runtime-evidence.json",
+    "review_required": true
+  }
+}

package/examples/agent-consumer/runtime-pilot/controls.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "0.1",
+  "control_id": "runtime-pilot-framer-controls",
+  "asset_id": "runtime/framer-motion-pilot",
+  "created_at": "2026-08-15T00:00:00Z",
+  "references": [
+    {
+      "id": "framer-runtime-source",
+      "path": "src/output/runtime-pilot-framer/scene.jsx",
+      "sha256": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b",
+      "role": "motion"
+    }
+  ],
+  "tracks": [
+    {
+      "id": "source-binding",
+      "kind": "source",
+      "binding": "required",
+      "value_hash": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b"
+    },
+    {
+      "id": "scrub-progress",
+      "kind": "motion",
+      "binding": "required",
+      "value_hash": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b",
+      "samples": 3
+    }
+  ],
+  "output_profile": {
+    "kind": "runtime_scene",
+    "fps": 60,
+    "expected_frame_count": 3,
+    "loop": true
+  }
+}

package/examples/agent-consumer/runtime-pilot/export.json

@@ -0,0 +1,17 @@
+{
+  "schema_version": "0.1",
+  "manifest_id": "runtime-pilot-framer-export",
+  "asset_id": "runtime/framer-motion-pilot",
+  "created_at": "2026-08-15T00:00:00Z",
+  "receipt_ref": "examples/agent-consumer/runtime-pilot/receipt.json",
+  "control_track_ref": "examples/agent-consumer/runtime-pilot/controls.json",
+  "outputs": [
+    {
+      "path": "src/output/runtime-pilot-framer/scene.jsx",
+      "role": "runtime-source",
+      "sha256": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b",
+      "bytes": 1769,
+      "target": "runtime_candidate"
+    }
+  ]
+}

package/examples/agent-consumer/runtime-pilot/provenance.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.0",
+  "provenance_id": "runtime-pilot-framer-provenance",
+  "task_id": "runtime-pilot-001",
+  "scene": "runtime-pilot-framer",
+  "created_at": "2026-08-15T00:00:00Z",
+  "asset": {
+    "id": "runtime/framer-motion-pilot",
+    "path": "src/output/runtime-pilot-framer/scene.jsx",
+    "type": "runtime_scene",
+    "framework": "framer-motion",
+    "version": "13.1.0"
+  },
+  "authority": "code_authored",
+  "readiness": "review_required",
+  "license": {
+    "spdx": "MIT",
+    "source": "MotionLoom repository source",
+    "attribution": "MotionLoom contributors"
+  },
+  "files": [
+    {
+      "path": "src/output/runtime-pilot-framer/scene.jsx",
+      "role": "runtime-source",
+      "sha256": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b",
+      "bytes": 1769
+    }
+  ],
+  "provenance_chain": [
+    {
+      "step": "code-authoring",
+      "actor": "MotionLoom runtime-pilot author",
+      "source": "src/output/runtime-pilot-framer/scene.jsx",
+      "timestamp": "2026-08-15T00:00:00Z",
+      "sha256": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b"
+    }
+  ]
+}

package/examples/agent-consumer/runtime-pilot/receipt.json

@@ -0,0 +1,30 @@
+{
+  "schema_version": "0.1",
+  "receipt_id": "runtime-pilot-framer-receipt",
+  "created_at": "2026-08-15T00:00:00Z",
+  "asset": {
+    "id": "runtime/framer-motion-pilot",
+    "kind": "runtime_scene",
+    "intended_use": "runtime_candidate"
+  },
+  "authority": "code_authored",
+  "provider": {
+    "adapter_id": "fixture.local-artifact-intake",
+    "kind": "fixture",
+    "invocation_mode": "none",
+    "task_id": "runtime-pilot-001",
+    "model": "code-authored-repository-source",
+    "generated_at": "2026-08-15T00:00:00Z",
+    "cost_class": "included"
+  },
+  "control_track_ref": "examples/agent-consumer/runtime-pilot/controls.json",
+  "provenance_ref": "examples/agent-consumer/runtime-pilot/provenance.json",
+  "outputs": [
+    {
+      "path": "src/output/runtime-pilot-framer/scene.jsx",
+      "role": "runtime-source",
+      "sha256": "f4c0e56de842cae6b234566b556e4f07154f8109dde382a474218a9de8b45a8b",
+      "bytes": 1769
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "motionloom",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "type": "module",
   "packageManager": "pnpm@11.20.0",
   "description": "MotionLoom: project-aware animation Skill with Agent interoperability, graph, provenance, Motion IR, runtime telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, external evidence verification and Dev Lab review.",
@@ -28,6 +28,9 @@
     "references",
     "docs",
     "examples",
+    "scripts/asset-provenance.py",
+    "schemas/asset-provenance.schema.json",
+    "examples/agent-consumer/ai-generated-pilot-provenance.json",
     "project-context.example.json",
     "tests/evals",
     "tests/scripts/run_tests.py",
@@ -37,7 +40,40 @@
     ".claude",
     ".codex",
     "AGENTS.md",
-    "agent-surfaces.json"
+    "agent-surfaces.json",
+    "scripts/asset-consistency.py",
+    "schemas/asset-identity.schema.json",
+    "schemas/action-set.schema.json",
+    "schemas/frame-geometry.schema.json",
+    "schemas/atlas-contract.schema.json",
+    "schemas/layered-map.schema.json",
+    "tests/scripts/test_asset_consistency.py",
+    "scripts/artifact-intake.py",
+    "schemas/generation-receipt.schema.json",
+    "schemas/control-track.schema.json",
+    "schemas/export-manifest.schema.json",
+    "schemas/artifact-adapter-registry.schema.json",
+    "artifact-adapter-registry.json",
+    "examples/agent-consumer/artifact-intake",
+    "tests/scripts/test_artifact_intake.py",
+    "scripts/runtime-candidate.py",
+    "schemas/runtime-candidate.schema.json",
+    "examples/agent-consumer/runtime-candidate",
+    "tests/scripts/test_runtime_candidate.py",
+    "scripts/rig-compatibility.py",
+    "schemas/rig-compatibility.schema.json",
+    "schemas/rig-adapter-registry.schema.json",
+    "rig-adapter-registry.json",
+    "examples/agent-consumer/rig-compatibility",
+    "tests/scripts/test_rig_compatibility.py",
+    "scripts/rive-package-gate.py",
+    "schemas/rive-package-manifest.schema.json",
+    "examples/agent-consumer/rive-package-gate",
+    "tests/scripts/test_rive_package_gate.py"
+    ,"scripts/build-ai-pilot.py"
+    ,"scripts/isolate-alpha-background.py"
+    ,"tests/scripts/test_ai_pilot_builder.py"
+    ,"tests/scripts/test_alpha_isolation.py"
   ],
   "keywords": [
     "animation",
@@ -58,7 +94,17 @@
     "dev-lab",
     "visual-truth",
     "remediation-learning",
-    "agent-interoperability"
+    "agent-interoperability",
+    "asset-consistency",
+    "sprite-atlas",
+    "layered-map",
+    "artifact-intake",
+    "generation-receipt",
+    "runtime-candidate",
+    "rig-compatibility",
+    "rive-package-gate",
+    "provider-neutral",
+    "agent-skills"
   ],
   "repository": {
     "type": "git",
@@ -80,6 +126,11 @@
     "test": "node bin/motionloom.mjs test",
     "validate": "npm run quality:attestation",
     "doctor": "node bin/motionloom.mjs doctor --json",
+    "init": "node bin/motionloom.mjs init",
+    "setup": "node bin/motionloom.mjs setup",
+    "setup:dry": "node bin/motionloom.mjs setup --dry-run",
+    "status": "node bin/motionloom.mjs status",
+    "repair": "node bin/motionloom.mjs repair",
     "docs:check": "python3 scripts/docs-audit.py",
     "eval:projects": "python3 scripts/eval-projects.py --allow-insufficient",
     "release:verify": "python3 scripts/release-verify.py",
@@ -116,7 +167,17 @@
     "remediation:summary": "node bin/motionloom.mjs remediation-learning summary --history artifacts/remediation-history.jsonl --output artifacts/remediation-summary.json --json",
     "discovery:check": "node bin/motionloom.mjs discovery check --root . --json",
     "discovery:show": "node bin/motionloom.mjs discovery show --root . --json",
-    "install:matrix": "node bin/motionloom.mjs discovery install-matrix --root . --json"
+    "install:matrix": "node bin/motionloom.mjs discovery install-matrix --root . --json",
+    "asset-provenance:validate": "node bin/motionloom.mjs asset-provenance validate --input examples/agent-consumer/ai-generated-pilot-provenance.json --json",
+    "asset-provenance:check": "node bin/motionloom.mjs asset-provenance check --input examples/agent-consumer/ai-generated-pilot-provenance.json --root examples/agent-consumer --mode runtime --json",
+    "asset:consistency": "node bin/motionloom.mjs asset-consistency validate --kind frame-geometry --input examples/agent-consumer/asset-consistency/hero-walk-frame-geometry.json --root examples/agent-consumer/asset-consistency --json",
+    "asset:audit": "node bin/motionloom.mjs asset-consistency report --kind frame-geometry --input examples/agent-consumer/asset-consistency/hero-walk-frame-geometry.json --root examples/agent-consumer/asset-consistency --json",
+    "artifact:intake": "node bin/motionloom.mjs artifact-intake intake --root . --registry artifact-adapter-registry.json --receipt examples/agent-consumer/artifact-intake/hero-motion-receipt.json --controls examples/agent-consumer/artifact-intake/hero-motion-controls.json --export-manifest examples/agent-consumer/artifact-intake/hero-motion-export.json --json",
+    "runtime:candidate": "node bin/motionloom.mjs runtime-candidate validate --root . --input examples/agent-consumer/runtime-candidate/hero-walk-candidate.json --json",
+    "rig:compatibility": "node bin/motionloom.mjs rig-compatibility validate --root . --registry rig-adapter-registry.json --input examples/agent-consumer/rig-compatibility/hero-walk-fixture-rig.json --json",
+    "rive:gate": "node bin/motionloom.mjs rive-package-gate --help"
+    ,"pilot:build": "node bin/motionloom.mjs pilot-build --help"
+    ,"alpha:isolate": "node bin/motionloom.mjs alpha-isolate --help"
   },
   "dependencies": {
     "@lottiefiles/dotlottie-web": "^0.79.0",

package/references/agent-interoperability.md

@@ -16,6 +16,17 @@ Do not put divergent workflow rules into an Agent-specific file. Add reusable do
 
 The JSON result contains `status`, `source`, `surface_count`, `installation_count`, `errors` and `warnings`. `status=pass` means the local package has the expected files and contract values. It does not assert that the host project has been analyzed, that runtime dependencies are installed, that a candidate rendered correctly or that a user approved a change.
 
+## One-command onboarding
+
+For a host project that has not installed MotionLoom, prefer:
+
+```bash
+npx --yes motionloom setup --project-root <project-path>
+npx --no-install motionloom status --project-root <project-path> --json
+```
+
+`setup` is idempotent. It detects the project root and package manager, installs a local development dependency when needed, merges only the managed router block in `AGENTS.md`, runs discovery and bootstraps project context plus `.motionloom/project-memory.json`. Use `--dry-run --json` to preview and `repair --yes --json` to restore missing managed pieces. A setup result of `blocked` is actionable failure, not permission to continue with guessed context. Setup never commits, pushes, opens a PR or infers approval.
+
 ## Adding a new Agent surface
 
 Add one manifest entry with a safe relative path, a supported agent identifier, `canonical: SKILL.md` and either `load_mode: alias` or `load_mode: router`. Create a short file at that path. Add or update the installation/discovery test and run `motionloom discovery check --root . --json`, `python3 scripts/docs-audit.py` and the full test suite. Never silently overwrite an existing surface with a copied version of `SKILL.md`.

package/references/browser-review-contract.md

@@ -13,9 +13,15 @@ Prepare a candidate with:
 ```bash
 python3 scripts/review-hook.py prepare \
   --task-dir artifacts/<task-id> \
-  --lab-url http://127.0.0.1:3300
+  --lab-url https://animdevlab-hcxnxr9c.manus.space/lab
 ```
 
+`--lab-url` là **browser review route thực tế**. Dev Lab React dùng
+`https://…/lab`; Dev Lab static cục bộ dùng `http://127.0.0.1:3300/`. Command
+tự gắn `scene`, `task_id`, `candidate_id`, `artifact_base` và `task_base` vào
+URL cùng origin; Dev Lab từ chối URL thiếu field, foreign origin hoặc path sai
+trước khi tải artifact.
+
 The command writes `browser-review.json` into the task bundle and scene output, records a deterministic `candidate_id`, binds the candidate to the context and animation source SHA-256, and emits JSON containing the exact URL and the next browser Agent action.
 
 The browser-capable Agent must open the emitted URL, inspect frames 0/50/100, scrub the timeline, check the quality checklist, record notes, and ask the user for approval. The page exposes `window.__lab.getReview()` so the Agent can capture the review payload without relying on a downloaded file. Persist the captured payload with:

package/references/intelligence-core.md

@@ -8,6 +8,11 @@ Use this reference when an Agent needs to understand or extend MotionLoom's task
 | --- | --- | --- |
 | `project-graph.json` | `python3 scripts/intelligence.py graph build --task-dir <task>` | Links project, intent, scene, context, artifacts and review with task identity and hashes. |
 | `provenance.json` | `python3 scripts/intelligence.py provenance build --task-dir <task>` | Records step actor, builder, materials, products, policy, result and parent chain hash. |
+| `asset-provenance.json` | `motionloom asset-provenance check --input <path> --root <scene-dir> --mode runtime|production` | Classifies asset origin/authority and effective readiness, binds file hashes and license/source metadata, and fails closed before production eligibility. It never grants `production_approved`. |
+| `asset-consistency-report` | `motionloom asset-consistency validate|analyze|report --kind <kind> --input <path> --root <asset-root> --json` | Measures declared identity, action timing, frame geometry, atlas ownership or layered-map bounds against real artifacts. It reports deterministic errors/warnings and never grants provenance authority or approval. |
+| `generation-receipt.json`, `control-track.json`, `export-manifest.json` | `motionloom artifact-intake intake --root <root> --registry <registry> --receipt <path> --controls <path> --export-manifest <path> --json` | Hash-binds an internal-skill/provider generation record, declared controls and emitted output to a provider-neutral adapter descriptor. It neither invokes a provider nor proves artist authority, runtime readiness or approval. |
+| `runtime-candidate.json` | `motionloom runtime-candidate validate --root <root> --input <path> --json` | Requires the intake bundle and referenced identity/action/geometry contracts to agree before allowing a `runtime_test_ready`, review-required candidate. |
+| `rig-compatibility.json` | `motionloom rig-compatibility validate --root <root> --registry <registry> --input <path> --json` | Checks adapter target/evidence, skeleton, sockets, action/event coverage and candidate binding. A pass is compatibility evidence, not a production-rig or approval claim. |
 | `capability-registry.json` | `python3 scripts/intelligence.py capabilities build --output <path>` | Describes verified/scaffold-only adapters, evidence freshness, compatibility, fallback and side effects. |
 | `motion-ir.json` | `python3 scripts/intelligence.py motion-ir build --task-dir <task>` | Binds framework-neutral tracks and accessibility policy to task, scene, context and source. |
 | `replay-bundle.json` | `python3 scripts/intelligence.py replay capture --root <root> --task-dir <task>` | Captures clean-root artifact hashes and environment metadata; verification fails on mutation or omission. |
@@ -26,7 +31,11 @@ Use this reference when an Agent needs to understand or extend MotionLoom's task
 
 ## Agent operating rules
 
-The Agent must build the graph, Motion IR, provenance, replay bundle, P1 feedback reports and semantic-lint benchmark after render and before the strict quality gate. For a strict observability run it must also capture runtime telemetry and run the external verifier before `--require-telemetry`. For a production trust run it must derive/sign `attestation.json`, copy or resolve a managed `trust-policy.json`, run the independent attestation verifier and use `--require-attestation`. It must run the report completeness contract for changed scenes; that contract selects one deterministic passing task bundle and fails on ambiguous ties. It may use a verified capability only when the registry evidence is fresh, its hash matches the referenced file and the target environment is compatible. `scaffold_only` is a planning option, never a production acceptance result.
+The Agent must build the graph, Motion IR, step-level provenance, asset provenance, replay bundle, P1 feedback reports and semantic-lint benchmark after render and before the strict quality gate. For a strict observability run it must also capture runtime telemetry and run the external verifier before `--require-telemetry`. For a production trust run it must derive/sign `attestation.json`, copy or resolve a managed `trust-policy.json`, run the independent attestation verifier and use `--require-attestation` plus `--require-asset-provenance`. It must run the report completeness contract for changed scenes; that contract selects one deterministic passing task bundle and fails on ambiguous ties. It may use a verified capability only when the registry evidence is fresh, its hash matches the referenced file and the target environment is compatible. `scaffold_only` is a planning option, never a production acceptance result.
+
+When the task includes multi-frame, atlas or layered-map material, the Agent must also build the applicable consistency contract and preserve its JSON result in the task bundle. The Agent should use `--strict` for a production-bound check, but must keep warnings and measurements visible in the report. A consistency pass is evidence that declared artifact boundaries agree; it is not a claim about aesthetics, provenance, artist authorship or user consent.
+
+When the task begins with an internal skill such as ImageGen or an external generation provider, the Agent must additionally preserve a receipt/control/export intake bundle. The registry only describes audited adapter evidence; it does not make a network call and it cannot elevate a provider's claim. Build the runtime candidate only after Intake and the referenced consistency contracts pass, then validate rig compatibility for skeleton-based output. Preserve all three result files in the task bundle and Dev Lab handoff; any `scaffold`, `static-validated`, `blocked` or `review_required` result must remain visible through review.
 
 The graph and provenance are evidence indexes, not approval tokens. A valid graph cannot bypass source binding, runtime assertions, browser review, reviewer consent or the `OPEN_PR=0` default. A confidence or risk value can prioritize investigation but cannot replace a deterministic rule or human decision.
 
@@ -72,7 +81,21 @@ python3 scripts/quality-gate.py \
   --scene <scene> \
   --context <project-context.json> \
   --task-dir artifacts/<task-id> \
-  --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation
+  --require-browser-review --require-intelligence --require-p1 --require-benchmark --require-telemetry --require-attestation --require-asset-provenance --require-asset-consistency
+motionloom asset-consistency validate \
+  --kind frame-geometry \
+  --input src/output/<scene>/hero-walk-frame-geometry.json \
+  --root src/output/<scene> --strict --json
+motionloom asset-provenance check \
+  --input src/output/<scene>/asset-provenance.json \
+  --root src/output/<scene> --mode production \
+  --manifest src/output/<scene>/manifest.json --json
+motionloom artifact-intake intake --root . --registry artifact-adapter-registry.json \
+  --receipt <generation-receipt.json> --controls <control-track.json> \
+  --export-manifest <export-manifest.json> --json
+motionloom runtime-candidate validate --root . --input <runtime-candidate.json> --json
+motionloom rig-compatibility validate --root . --registry rig-adapter-registry.json \
+  --input <rig-compatibility.json> --json
 python3 scripts/remediation-learning.py validate --history artifacts/remediation-history.jsonl --json
 python3 scripts/remediation-learning.py summary --history artifacts/remediation-history.jsonl --output artifacts/remediation-summary.json --json
 python3 scripts/eval-intelligence.py
@@ -98,5 +121,9 @@ The replay policy excludes generated reports and manifests because `report.py co
 | `artifact_base must share the Dev Lab origin` or identity binding failure | Dev Lab query parameters would mix an external or foreign task/candidate bundle | Reject the handoff and regenerate the review URL from the canonical task bundle. |
 | `runtime telemetry verification failed` | Scrub-point evidence is stale, tampered, missing, cross-task, path-escaped or bound to different source/manifest/Motion IR bytes | Re-run the real runtime capture from the canonical scene/task bundle, then verify again; never treat the verifier as approval. |
 | `attestation verification failed` | Payload hash, DSSE signature, signer validity/revocation, policy lookup, path binding or expected task/scene binding failed | Regenerate the statement from current artifacts, re-run the external verifier against a managed policy and investigate signer lifecycle; never flip `approval` or bypass user review. |
+| `asset provenance is blocked` or `production_eligible: false` | Origin is unknown/AI-generated without the required review, a file hash/license/runtime/full-gate record is missing, or an Agent self-asserted artist authority/approval | Keep the candidate runtime-only, fix the provenance record or obtain the required human review; never rewrite the authority tier or set `production_approved` automatically. |
+| `asset consistency is blocked` | Declared frame, atlas or map geometry disagrees with the referenced bytes, or a required image/contract is missing | Inspect the measured path/code, regenerate only the affected asset/contract, rerun the deterministic check and return to Dev Lab review; never bypass the finding with provenance or attestation. |
+| `artifact intake is blocked` | Receipt, controls, export, provenance, adapter evidence or output hash is missing, escaped, unknown or disagrees with the declared bundle | Recreate the intake bundle from the actual generator/export output, preserve the correct provenance tier and rerun the check; never set an adapter to verified or grant approval by hand. |
+| `runtime candidate is blocked` or rig compatibility fails | Intake, identity/action/geometry refs, runtime evidence, adapter target, skeleton, socket or event coverage is missing or incompatible | Repair/re-export only the affected asset or adapter binding, regenerate runtime evidence and return to Dev Lab review; do not substitute a placeholder rig or override the result. |
 
 The public eval corpus is `tests/evals/intelligence-cases.json`. It covers positive verified selection plus scaffold-only, stale evidence, tampering, graph corruption, replay tamper and foreign-task candidate failures. P1 extends the acceptance surface with semantic warning preservation, generic-intent detection, multi-scene context drift, selective rerun binding, performance budget/frame-rate warnings, perceptual easing/reduced-motion warnings and benchmark execution time. The 1.9.0 slice adds runtime telemetry happy-path, state tamper, cross-task identity, stale evidence and symlink escape cases. The 2.0.0 slice adds clean attestation, payload tamper, binding mismatch, revoked signer and unknown signer cases without weakening the approval=false and human-review invariants.

package/rig-adapter-registry.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "0.1",
+  "registry_id": "motionloom-rig-adapters",
+  "generated_at": "2026-08-15T00:00:00Z",
+  "adapters": [
+    {
+      "adapter_id": "motionloom.sprite-frame-sequence",
+      "target": "sprite",
+      "framework": "sprite",
+      "status": "static_validated",
+      "evidence": [{"path": "scripts/runtime-candidate.py", "sha256": "ec292a902de12c14dcc53442e15f6d7b8a8f8d22fd2bcdd7e522c15ca9d20af1"}],
+      "limitations": ["Contract-only adapter; requires runtime evidence before runtime verification."]
+    },
+    {
+      "adapter_id": "motionloom.rive-runtime",
+      "target": "rive",
+      "framework": "rive",
+      "status": "project_integrated",
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
+    },
+    {
+      "adapter_id": "motionloom.gsap-runtime",
+      "target": "gsap",
+      "framework": "gsap",
+      "status": "project_integrated",
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
+    },
+    {
+      "adapter_id": "motionloom.framer-motion-runtime",
+      "target": "framer-motion",
+      "framework": "framer-motion",
+      "status": "project_integrated",
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
+    }
+  ]
+}

package/schemas/action-set.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://motionloom.dev/schemas/action-set.schema.json",
+  "title": "MotionLoom Action Set Contract",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "asset_identity", "actions", "invariants"],
+  "properties": {
+    "schema_version": { "const": "0.1" },
+    "asset_identity": { "type": "string", "minLength": 1 },
+    "actions": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["action_id", "fps", "frames", "loop"],
+        "properties": {
+          "action_id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{1,63}$" },
+          "fps": { "type": "number", "exclusiveMinimum": 0 },
+          "frames": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 },
+          "loop": { "type": "boolean" },
+          "events": { "type": "array", "items": { "type": "string" } },
+          "required_sockets": { "type": "array", "items": { "type": "string" } }
+        }
+      }
+    },
+    "invariants": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["canvas_width", "canvas_height", "pivot_tolerance_px", "footline_tolerance_px", "bbox_drift_tolerance_px"],
+      "properties": {
+        "canvas_width": { "type": "integer", "minimum": 1 },
+        "canvas_height": { "type": "integer", "minimum": 1 },
+        "pivot_tolerance_px": { "type": "number", "minimum": 0 },
+        "footline_tolerance_px": { "type": "number", "minimum": 0 },
+        "bbox_drift_tolerance_px": { "type": "number", "minimum": 0 },
+        "min_alpha_pixels": { "type": "integer", "minimum": 1 }
+      }
+    }
+  }
+}

package/schemas/agent-surfaces.schema.json

@@ -43,7 +43,7 @@
         "required": ["id", "source_kind", "command", "verification", "provenance"],
         "properties": {
           "id": {"type": "string"},
-          "source_kind": {"type": "string", "enum": ["npm", "git", "local"]},
+          "source_kind": {"type": "string", "enum": ["npm", "npx", "git", "local"]},
           "command": {"type": "string"},
           "verification": {"type": "string"},
           "provenance": {"type": "string"}

package/schemas/artifact-adapter-registry.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/lenhonbp/MotionLoom/blob/main/schemas/artifact-adapter-registry.schema.json",
+  "title": "MotionLoom artifact adapter registry",
+  "description": "Provider-neutral capability descriptors. Registry membership does not invoke a provider, transfer credentials or grant approval.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "registry_id", "generated_at", "selection_policy", "adapters"],
+  "properties": {
+    "schema_version": {"const": "0.1"},
+    "registry_id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{2,127}$"},
+    "generated_at": {"type": "string", "format": "date-time"},
+    "selection_policy": {"type": "object", "additionalProperties": false, "required": ["require_verified", "allow_scaffold_only"], "properties": {"require_verified": {"type": "boolean"}, "allow_scaffold_only": {"type": "boolean"}}},
+    "adapters": {"type": "array", "minItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["adapter_id", "kind", "status", "adapter_version", "invocation_mode", "cost_class", "inputs", "outputs", "compatibility", "evidence", "limitations", "risk_level", "side_effect_level"], "properties": {"adapter_id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{2,127}$"}, "kind": {"type": "string", "enum": ["fixture", "internal_skill", "external_provider", "manual_import"]}, "status": {"type": "string", "enum": ["verified", "scaffold_only", "static_validated", "project_integrated", "disabled"]}, "adapter_version": {"type": "string", "minLength": 1}, "invocation_mode": {"type": "string", "enum": ["none", "manual", "agent-mediated", "api"]}, "cost_class": {"type": "string", "enum": ["included", "metered", "external", "unknown"]}, "inputs": {"type": "array", "items": {"type": "string"}}, "outputs": {"type": "array", "items": {"type": "string"}}, "compatibility": {"type": "object", "additionalProperties": false, "required": ["os"], "properties": {"os": {"type": "array", "items": {"type": "string"}}, "browsers": {"type": "array", "items": {"type": "string"}}}}, "evidence": {"type": "array", "minItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["path", "sha256", "kind"], "properties": {"path": {"type": "string", "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+"}, "sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"}, "kind": {"type": "string", "enum": ["runtime", "ci", "browser", "static"]}}}}, "limitations": {"type": "array", "items": {"type": "string"}}, "risk_level": {"type": "string", "enum": ["low", "medium", "high"]}, "side_effect_level": {"type": "string", "enum": ["read", "local_write", "user_review_required", "remote_write"]}}}}
+  }
+}