motionloom 2.4.0 → 2.5.1

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable MotionLoom changes are documented here. The project follows semantic
 
 ## [Unreleased]
 
+## [2.5.1] - 2026-08-18
+
+### Fixed
+
+- Preserve the caller's working directory through the npm CLI router, so default onboarding targets the consumer project instead of the installed package directory.
+- Ship Dev Lab assets, the runtime harness, Python requirements and optional browser runtime dependencies in the npm tarball; verify the installed package from an isolated consumer project before release.
+- Render Dev Lab metadata and checks with safe DOM APIs, enforce a same-origin script CSP, and reject invalid, terminal or expired browser-review candidates before enabling review.
+- Restrict runtime evidence cleanup to a dedicated child of an explicit policy root and preserve caller data outside that boundary.
+- Read the CLI version from `package.json` so displayed status stays aligned with release metadata.
+- Publish from GitHub Actions through npm Trusted Publishing/OIDC with a pinned compatible npm client, without a long-lived `NPM_TOKEN`; provenance is generated automatically by npm.
+
+### Verified
+
+- Pass the full Python/Node regression suite, quality and signed-attestation gate, isolated installed-package smoke test, Dev Lab browser-security smoke test, real Rive/GSAP/Framer Motion runtime capture, 6,900-case deep stress run and twelve Swift package tests.
+- Pass the pull-request Quality, Security Analysis, Documentation and Package Hygiene, Dev Lab and Apple workflows before preparing this patch release.
+
+### Boundary
+
+- This patch does not add framework capability, Apple signing, TestFlight distribution or production approval. Browser review and remote release actions remain explicit human-governed steps.
+
+## [2.5.0] - 2026-08-17
+
+### Added
+
+- Read-only `motionloom capability card --format json` discovery surface. It exports the evidence-validated runtime registry for an Agent, including runtime status, adapter/version, compatibility, verification timestamp, inputs/outputs, evidence references, limitations, fallback, risk and side-effect metadata.
+- `pnpm intelligence:card` shortcut and `agent-card.json` command/capability declarations for machine-readable discovery without a parallel capability policy.
+- `capability-registry.json` is included in the npm package allowlist, so the default card command has its verified registry after a normal package installation.
+- Benchmark research ledger comparing public agent workflow, model-serving and AI/video repositories; the release applies the low-risk capability-card lesson and records deferred generation-profile and hash-bound workflow-template work with explicit gates.
+- Native `apps/apple/` alpha in the GitHub source release: shared Swift packages for contracts, review state, macOS bridge, review UI and local-first CloudKit metadata sync, plus unsigned macOS Studio and iOS/iPadOS Review build targets and Apple CI.
+
+### Verified
+
+- Capability-card export validates registry evidence before output and fails closed for missing, altered or out-of-repository evidence. It does not select a runtime or infer review/production approval.
+- The repository release target passes the full regression suite, Skill/doctor and documentation gates, package artifact inspection, and GitHub Quality, Security, Documentation and Apple CI checks.
+
+### Boundary
+
+- The Apple deliverable is an alpha source release. It has no Apple Developer signing, CloudKit production container, TestFlight distribution or iOS Simulator UI-smoke claim.
+- Capability discovery is not execution authority. Runtime selection still validates current evidence, and attestation/production approval remain non-derived human decisions.
+
 ## [2.4.0] - 2026-08-15
 
 ### Added
@@ -109,6 +149,7 @@ See the [2.0.0 release note](docs/releases/2.0.0.md).
 The 1.5.0–1.9.0 milestones established runtime evidence, browser review, Intelligence Core, semantic lint, continuity, telemetry and trust-boundary hardening. Their detailed notes are available in [`docs/releases/`](docs/releases/).
 
 [2.2.0]: docs/releases/2.2.0.md
+[2.5.0]: docs/releases/2.5.0.md
 [2.4.0]: docs/releases/2.4.0.md
 [2.3.0]: docs/releases/2.3.0.md
 [2.1.0]: docs/releases/2.1.0.md

package/README.md

@@ -6,6 +6,7 @@
 [![License](https://img.shields.io/github/license/lenhonbp/MotionLoom)](LICENSE)
 [![Node.js 18+](https://img.shields.io/badge/Node.js-18%2B-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
 [![Python 3.11+](https://img.shields.io/badge/Python-3.11%2B-3776AB?logo=python&logoColor=white)](https://www.python.org/)
+[![Apple](https://github.com/lenhonbp/MotionLoom/actions/workflows/apple.yml/badge.svg)](https://github.com/lenhonbp/MotionLoom/actions/workflows/apple.yml)
 [![Agent Skills](https://img.shields.io/badge/Agent%20Skill-compatible-5B5BD6)](https://agentskills.io/specification)
 
 **Project-aware animation production and runtime verification for coding agents.**
@@ -14,7 +15,7 @@ MotionLoom is an independent open-source Agent Skill for building UI motion, Lot
 
 > **MotionLoom is not an auto-approval layer.** A valid signature, a passing heuristic, or a successful render proves only the contract it checks. Visual quality, intent, accessibility and PR authorization remain reviewable human decisions.
 
-> **Release posture:** `motionloom@2.4.0` is the next release target. It adds a truthful `code_authored` runtime-first lane, a Framer Motion end-to-end reference candidate, identity-bound Dev Lab review evidence and task-bundle discovery that binds by declared scene identity rather than an inferred directory name. Verify npm/GitHub publication metadata separately; passing evidence never implies user approval.
+> **Release posture:** MotionLoom 2.5.1 hardens installed-package onboarding, Dev Lab browser review, runtime-output cleanup and consumer-package acceptance. The native macOS/iOS review app remains an unsigned source alpha under `apps/apple/`; the npm package remains the cross-platform Node/Python Skill and documentation surface. Verify npm/GitHub publication metadata separately; passing evidence never implies user approval.
 
 ## Why MotionLoom
 
@@ -76,7 +77,7 @@ npx --no-install motionloom doctor             # check the installed package
 npx --no-install motionloom repair --yes       # restore only missing managed pieces
 ```
 
-MotionLoom supports **Node.js 18+** and **Python 3.11+** on Ubuntu, macOS and Windows. `npx` is the recommended first-run surface; after setup, use the project-local binary through `npx --no-install motionloom ...`. A global install remains optional, not required.
+MotionLoom's onboarding and contract CLI supports **Node.js 18+** and **Python 3.11+** on Ubuntu, macOS and Windows. Browser-runtime capture uses the separately declared optional Playwright/Vite dependencies and follows the capability contract's Node.js 22 requirement. Signed-attestation commands additionally require the Python `cryptography` package declared in the shipped `requirements.txt`; `motionloom doctor` reports missing runtime prerequisites. `npx` is the recommended first-run surface; after setup, use the project-local binary through `npx --no-install motionloom ...`. A global install remains optional, not required.
 
 ### When you begin animation work
 
@@ -154,6 +155,14 @@ Read the [Project Memory schema](schemas/project-memory.schema.json), [2.1.0 rel
 
 Capability selection uses `agent-card.json` and the capability registry. A runtime is not promoted from `scaffold_only` to `verified` because a template exists; its adapter evidence and CI contract must pass.
 
+An Agent can inspect the read-only capability card before choosing a renderer:
+
+```bash
+motionloom capability card --format json
+```
+
+The card exposes declared compatibility, evidence references, limitations and fallback paths. It does **not** select a runtime, refresh evidence, infer production approval or replace the verification step; use `motionloom intelligence capabilities select --registry capability-registry.json --capability runtime.<id>` immediately before execution.
+
 ## Evidence, trust and review
 
 MotionLoom keeps distinct layers distinct:
@@ -257,6 +266,14 @@ The public integration surfaces are intentionally small and inspectable:
 
 The Skill can trigger or suggest an internal browser-capable Agent to open the Dev Lab after rendering. Dev Lab is post-render review infrastructure, not a competing Skill. The user can request changes, receive a structured fix plan and rerender selectively, or explicitly confirm the PR path.
 
+## Native companion apps (alpha)
+
+`apps/apple/` contains the native-first Apple companion surface. **MotionLoom Studio for macOS** opens a scoped project, exposes the evidence and timeline inspection surface, and can request only allow-listed local checks. **MotionLoom Review for iPhone and iPad** reads a hash-bound review launch descriptor, scrubs evidence, records annotations, and exports a human review decision.
+
+These apps do not replace the Agent, the npm CLI or Dev Lab. They make a project’s artifact state and human review decision visible between Agent sessions. They cannot grant `production_approved`, set `OPEN_PR=1`, push Git changes, publish npm packages, or turn an AI-generated asset into artist-authored material.
+
+Read [the Apple workspace guide](apps/apple/README.md), [the contract boundary](docs/architecture/apple/contracts.md), and [the TestFlight preparation guide](docs/apple-distribution.md) before building locally.
+
 ## Repository map
 
 | Path | Purpose |
@@ -273,6 +290,7 @@ The Skill can trigger or suggest an internal browser-capable Agent to open the D
 | `references/` | Progressive-disclosure implementation references |
 | `docs/` | Framework selection, checklists, audits and release notes |
 | `dev-lab/` | Self-contained browser review workbench and harness |
+| `apps/apple/` | macOS Studio and iOS/iPadOS Review companion sources, Swift packages, Xcode project and local build guide |
 | `artifacts/<task-id>/` | Per-task evidence, report and handoff bundle |
 | `schemas/visual-truth.schema.json`, `scripts/visual-truth.py` | Provenance-bound visual comparison and review explanation contract |
 | `schemas/remediation-history.schema.json`, `scripts/remediation-learning.py` | Append-only remediation/benchmark ledger and aggregate learning metrics |
@@ -297,6 +315,7 @@ The Skill can trigger or suggest an internal browser-capable Agent to open the D
 | Check control-to-runtime and rig compatibility | `motionloom runtime-candidate`, `motionloom rig-compatibility`, and [production checklist](docs/CHECKLIST.md) |
 | Validate visual truth before review/PR | `motionloom visual-truth build|validate` and [production checklist](docs/CHECKLIST.md) |
 | Check current evidence posture | [Current status](docs/STATUS.md), [external corpus evidence](docs/audits/external-project-corpus-2026-08-13.md) and [historical audit snapshot](AUDIT-REPORT.md) |
+| Build the native review companions | [Apple workspace guide](apps/apple/README.md), [Studio architecture](docs/architecture/apple/studio.md), and [distribution preparation](docs/apple-distribution.md) |
 | Contribute code or docs | [CONTRIBUTING.md](CONTRIBUTING.md) |
 | Report a vulnerability or request help | [SECURITY.md](SECURITY.md) and [SUPPORT.md](SUPPORT.md) |
 | See version history | [CHANGELOG.md](CHANGELOG.md) and [release notes](docs/releases/) |
@@ -305,6 +324,7 @@ The Skill can trigger or suggest an internal browser-capable Agent to open the D
 
 ```bash
 npm install
+python3 -m pip install --requirement requirements.txt
 python3 scripts/skill-doctor.py --json
 python3 tests/scripts/run_tests.py
 python3 scripts/eval-intelligence.py

package/SKILL.md

@@ -7,7 +7,7 @@ description: >-
   validate, review, or deliver animation inside an existing project.
 license: MIT
 metadata:
-  version: "2.4.0"
+  version: "2.5.1"
   target_frameworks: "lottie,dotlottie,rive,gsap,framer-motion,spine,threejs"
   verified_runtimes: "lottie-json,dotlottie-package,svg-cutout-rig,rive,gsap,framer-motion"
 ---

package/agent-card.json

@@ -1,7 +1,7 @@
 {
   "card_version": "1.0",
   "name": "motionloom",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "Project-aware animation production with durable Project Memory, provider-neutral Artifact Intake, hash-bound control-to-runtime candidates, tiered asset provenance, framework-neutral motion IR, rig compatibility, runtime verification and telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, internal browser review, trust-boundary hardening and deterministic Agent handoff.",
   "capabilities": [
     "project.setup",
@@ -41,6 +41,7 @@
     "provenance.emit",
     "provenance.verify",
     "capability.discover",
+    "capability.card",
     "capability.select",
     "replay.capture",
     "replay.verify",
@@ -121,6 +122,7 @@
     "project-graph",
     "provenance-attestation",
     "capability-registry",
+    "capability-card",
     "motion-ir",
     "replay-bundle",
     "semantic-lint-report",
@@ -203,6 +205,7 @@
     "intelligence_graph": "python3 scripts/intelligence.py graph build --task-dir artifacts/<task-id>",
     "intelligence_provenance": "python3 scripts/intelligence.py provenance build --task-dir artifacts/<task-id>",
     "intelligence_capabilities": "python3 scripts/intelligence.py capabilities build --output capability-registry.json",
+    "intelligence_capability_card": "motionloom capability card --format json",
     "intelligence_motion_ir": "python3 scripts/intelligence.py motion-ir build --task-dir artifacts/<task-id>",
     "intelligence_replay": "python3 scripts/intelligence.py replay capture --task-dir artifacts/<task-id>",
     "semantic_lint": "python3 scripts/intelligence.py semantic-lint build --task-dir artifacts/<task-id>",

package/agent-surfaces.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.0",
   "name": "motionloom",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "canonical": {
     "skill": "SKILL.md",
     "agent_card": "agent-card.json",

package/bin/motionloom.mjs

@@ -8,8 +8,11 @@
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const PACKAGE = JSON.parse(readFileSync(resolve(ROOT, "package.json"), "utf8"));
+const VERSION = PACKAGE.version || "unknown";
 const PYTHON = process.env.MOTIONLOOM_PYTHON || (process.platform === "win32" ? "python" : "python3");
 
 const PYTHON_COMMANDS = {
@@ -32,8 +35,6 @@ const PYTHON_COMMANDS = {
   pr: "scripts/pr.py",
   "validate-lottie": "scripts/validate-lottie.py",
   manifest: "scripts/manifest.py",
-  test: "tests/scripts/run_tests.py",
-  "deep-audit": "tests/scripts/deep-stress.py",
   discovery: "scripts/discovery.py",
   "visual-truth": "scripts/visual-truth.py",
   "remediation-learning": "scripts/remediation-learning.py",
@@ -54,8 +55,12 @@ const NODE_COMMANDS = {
   repair: "scripts/setup.mjs",
 };
 
+const COMMAND_ALIASES = {
+  capability: { script: "scripts/intelligence.py", args: ["capabilities"] },
+};
+
 function printHelp() {
-  console.log(`MotionLoom 2.4.0 — project-aware animation production and evidence contracts
+  console.log(`MotionLoom ${VERSION} — project-aware animation production and evidence contracts
 
 Usage:
   motionloom <command> [args...]
@@ -69,6 +74,7 @@ Use when an animation task needs it:
   analyze                Run project analysis and refresh Project Memory
   memory                 Initialize, inspect, refresh, recover or validate memory
   intelligence           Build or validate Intelligence Core artifacts
+  capability             Export or select evidence-bound runtime capabilities
   attestation            Build/validate canonical signed-attestation artifacts
   verify-attestation     Verify an attestation against a trust policy
   evidence-verify        Verify runtime evidence externally
@@ -103,6 +109,7 @@ Cross-platform examples:
     --status accepted --summary "Use ease-out for UI entry" --user-confirmed
   motionloom discovery check --root . --json
   motionloom discovery install-matrix --root . --json
+  motionloom capability card --format json
   motionloom visual-truth validate --root . --input src/output/<scene>/visual-truth.json
   motionloom remediation-learning summary --history artifacts/remediation-history.jsonl --json
   motionloom asset-provenance check --input <asset-provenance.json> --root <scene-dir> --mode runtime --json
@@ -124,7 +131,8 @@ if (!command || command === "help" || command === "--help" || command === "-h")
   process.exit(0);
 }
 
-const script = NODE_COMMANDS[command] || PYTHON_COMMANDS[command];
+const alias = COMMAND_ALIASES[command];
+const script = alias?.script || NODE_COMMANDS[command] || PYTHON_COMMANDS[command];
 if (!script) {
   console.error(`Unknown MotionLoom command: ${command}`);
   printHelp();
@@ -132,9 +140,15 @@ if (!script) {
 }
 
 const executable = script.endsWith(".mjs") ? process.execPath : PYTHON;
-  const delegatedArgs = NODE_COMMANDS[command] && !["setup", "init"].includes(command) ? [command, ...args] : command === "init" ? ["init", ...args] : args;
+const delegatedArgs = alias
+  ? [...alias.args, ...args]
+  : NODE_COMMANDS[command] && !["setup", "init"].includes(command)
+    ? [command, ...args]
+    : command === "init"
+      ? ["init", ...args]
+      : args;
 const result = spawnSync(executable, [resolve(ROOT, script), ...delegatedArgs], {
-  cwd: ROOT,
+  cwd: process.cwd(),
   stdio: "inherit",
   env: process.env,
 });

package/capability-registry.json

@@ -0,0 +1,308 @@
+{
+  "schema_version": "0.1",
+  "registry_id": "registry-motionloom-2.5.1",
+  "generated_at": "2026-08-17T23:50:53Z",
+  "selection_policy": {
+    "require_verified": true,
+    "allow_scaffold_only": false,
+    "max_evidence_age_seconds": 604800
+  },
+  "capabilities": [
+    {
+      "id": "runtime.lottie-json",
+      "kind": "renderer",
+      "status": "verified",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Capability evidence is refreshed by runtime:test."
+      ],
+      "fallback": "",
+      "risk_level": "low",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.dotlottie-package",
+      "kind": "packager",
+      "status": "verified",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Capability evidence is refreshed by runtime:test."
+      ],
+      "fallback": "",
+      "risk_level": "low",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.svg-cutout-rig",
+      "kind": "renderer",
+      "status": "verified",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Capability evidence is refreshed by runtime:test."
+      ],
+      "fallback": "",
+      "risk_level": "low",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.rive",
+      "kind": "runtime-adapter",
+      "status": "verified",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Capability evidence is refreshed by runtime:test."
+      ],
+      "fallback": "",
+      "risk_level": "low",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.gsap",
+      "kind": "runtime-adapter",
+      "status": "verified",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Capability evidence is refreshed by runtime:test."
+      ],
+      "fallback": "",
+      "risk_level": "low",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.framer-motion",
+      "kind": "runtime-adapter",
+      "status": "verified",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Capability evidence is refreshed by runtime:test."
+      ],
+      "fallback": "",
+      "risk_level": "low",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.spine",
+      "kind": "renderer",
+      "status": "scaffold_only",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Scaffold only; do not use for production acceptance."
+      ],
+      "fallback": "runtime.lottie-json",
+      "risk_level": "high",
+      "side_effect_level": "local_write"
+    },
+    {
+      "id": "runtime.threejs",
+      "kind": "renderer",
+      "status": "scaffold_only",
+      "adapter_version": "2.5.1",
+      "inputs": [
+        "project-context",
+        "motion-spec",
+        "source-binding"
+      ],
+      "outputs": [
+        "runtime-evidence"
+      ],
+      "compatibility": {
+        "browsers": [
+          "chromium"
+        ],
+        "os": [
+          "linux"
+        ],
+        "node": ">=22"
+      },
+      "last_verified_at": "2026-08-17T23:50:53Z",
+      "evidence": [
+        {
+          "path": "scripts/runtime-adapters.mjs",
+          "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d",
+          "kind": "ci"
+        }
+      ],
+      "limitations": [
+        "Scaffold only; do not use for production acceptance."
+      ],
+      "fallback": "runtime.lottie-json",
+      "risk_level": "high",
+      "side_effect_level": "local_write"
+    }
+  ]
+}