motionloom 2.4.0 → 2.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "motionloom",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "type": "module",
   "packageManager": "pnpm@11.20.0",
   "description": "MotionLoom: project-aware animation Skill with Agent interoperability, graph, provenance, Motion IR, runtime telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, external evidence verification and Dev Lab review.",
@@ -19,6 +19,7 @@
     "SKILL.md",
     "LICENSE",
     "agent-card.json",
+    "capability-registry.json",
     "bin",
     "scripts",
     "src",
@@ -32,6 +33,10 @@
     "schemas/asset-provenance.schema.json",
     "examples/agent-consumer/ai-generated-pilot-provenance.json",
     "project-context.example.json",
+    "requirements.txt",
+    "dev-lab/public/index.html",
+    "dev-lab/public/devlab.js",
+    "tests/runtime-harness",
     "tests/evals",
     "tests/scripts/run_tests.py",
     "tests/scripts/test_attestation.py",
@@ -123,7 +128,7 @@
   },
   "scripts": {
     "prepack": "node scripts/prepack-clean.mjs",
-    "test": "node bin/motionloom.mjs test",
+    "test": "python3 tests/scripts/run_tests.py",
     "validate": "npm run quality:attestation",
     "doctor": "node bin/motionloom.mjs doctor --json",
     "init": "node bin/motionloom.mjs init",
@@ -142,10 +147,12 @@
     "intelligence": "node bin/motionloom.mjs intelligence",
     "intelligence:registry": "node bin/motionloom.mjs intelligence capabilities build --output capability-registry.json",
     "intelligence:registry:check": "node bin/motionloom.mjs intelligence capabilities validate --path capability-registry.json",
+    "intelligence:card": "node bin/motionloom.mjs capability card --format json",
     "intelligence:p1": "node bin/motionloom.mjs intelligence",
     "quality:p1": "node bin/motionloom.mjs quality-gate --require-intelligence --require-p1 --require-benchmark",
     "eval:intelligence": "node bin/motionloom.mjs eval-intelligence",
-    "audit:deep": "node bin/motionloom.mjs deep-audit --iterations 5000 --seed 20260813 --report docs/audits/data/deep-stress-latest.json",
+    "audit:deep": "python3 tests/scripts/deep-stress.py --iterations 5000 --seed 20260813 --report docs/audits/data/deep-stress-latest.json",
+    "package:smoke": "node scripts/package-consumer-smoke.mjs",
     "memory:init": "node bin/motionloom.mjs memory init --project-root .",
     "memory:bootstrap": "node bin/motionloom.mjs analyze . --init-memory",
     "memory:recover": "node bin/motionloom.mjs memory recover --project-root .",
@@ -189,9 +196,10 @@
     "react": "^19.2.8",
     "react-dom": "^19.2.8"
   },
-  "devDependencies": {
+  "optionalDependencies": {
     "playwright": "^1.62.1",
     "vite": "^8.2.1"
   },
+  "devDependencies": {},
   "license": "MIT"
 }

package/requirements.txt

@@ -0,0 +1 @@
+cryptography>=42.0,<47.0

package/rig-adapter-registry.json

@@ -16,7 +16,7 @@
       "target": "rive",
       "framework": "rive",
       "status": "project_integrated",
-      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d"}],
       "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
     },
     {
@@ -24,7 +24,7 @@
       "target": "gsap",
       "framework": "gsap",
       "status": "project_integrated",
-      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d"}],
       "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
     },
     {
@@ -32,7 +32,7 @@
       "target": "framer-motion",
       "framework": "framer-motion",
       "status": "project_integrated",
-      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d"}],
       "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
     }
   ]

package/scripts/attestation.py

@@ -41,6 +41,11 @@ def dsse_pae(payload_type: str, body: bytes) -> bytes:
     return b"DSSEv1 " + str(len(payload_type_bytes)).encode("ascii") + b" " + payload_type_bytes + b" " + str(len(body)).encode("ascii") + b" " + body
 
 
+def is_macos_var_alias(path: Path) -> bool:
+    """Allow only macOS's documented lexical alias `/var` -> `/private/var`."""
+    return path == Path("/var") and path.is_symlink() and path.resolve() == Path("/private/var")
+
+
 def reject_symlink_components(path: Path) -> None:
     current = Path(path.anchor) if path.anchor else Path(".")
     for part in path.parts:
@@ -48,6 +53,9 @@ def reject_symlink_components(path: Path) -> None:
             continue
         current = current / part
         if current.is_symlink():
+            if is_macos_var_alias(current):
+                current = current.resolve()
+                continue
             raise ValueError(f"symlink path component is not allowed: {path}")
 
 

package/scripts/capture-runtime-telemetry.py

@@ -47,9 +47,15 @@ def main() -> int:
         print("capture-runtime-telemetry: --max-age-days must be non-negative", file=sys.stderr)
         return 2
 
-    root = Path(__file__).resolve().parents[1]
+    package_root = Path(__file__).resolve().parents[1]
+    root = Path(os.environ.get("MOTIONLOOM_PROJECT_ROOT") or Path.cwd()).expanduser().resolve()
     task_dir = Path(args.task_dir).expanduser()
     task_dir = task_dir.resolve() if task_dir.is_absolute() else (root / task_dir).resolve()
+    try:
+        task_dir.relative_to(root)
+    except ValueError:
+        print("capture-runtime-telemetry: task directory must remain inside the project root", file=sys.stderr)
+        return 2
     scene_dir = (root / "src" / "output" / args.scene).resolve()
     manifest_path = scene_dir / "manifest.json"
     task_path = task_dir / "task.json"
@@ -74,10 +80,6 @@ def main() -> int:
         return 2
 
     output_dir = task_dir / "runtime-adapters"
-    if output_dir.exists():
-        shutil.rmtree(output_dir)
-    output_dir.mkdir(parents=True, exist_ok=True)
-
     env = os.environ.copy()
     env.update(
         {
@@ -87,17 +89,23 @@ def main() -> int:
             "RUNTIME_SOURCE_PATH": str(source_path),
             "RUNTIME_MANIFEST_PATH": str(manifest_path),
             "RUNTIME_MOTION_IR_PATH": str(task_dir / "motion-ir.json"),
+            "MOTIONLOOM_RUNTIME_OUTPUT_ROOT": str(root),
         }
     )
-    npm = "npm.cmd" if os.name == "nt" else "npm"
-    runtime = subprocess.run([npm, "run", "runtime:test"], cwd=root, env=env, check=False)
+    node = shutil.which("node") or ("node.exe" if os.name == "nt" else "node")
+    runtime = subprocess.run(
+        [node, str(package_root / "scripts" / "runtime-adapters.mjs")],
+        cwd=root,
+        env=env,
+        check=False,
+    )
     if runtime.returncode != 0:
         return runtime.returncode
 
     verifier = subprocess.run(
         [
             sys.executable,
-            str(root / "scripts" / "evidence-verifier.py"),
+            str(package_root / "scripts" / "evidence-verifier.py"),
             "--scene-dir",
             str(scene_dir),
             "--task-dir",

package/scripts/devlab.py

@@ -87,17 +87,9 @@ def prepare_scene(root: Path, lab: Path, scene: str, task_dir: Path | None) -> t
     return destination, task_destination, task_id
 
 
-def pnpm_executable() -> str:
-    candidate = "pnpm.cmd" if os.name == "nt" else "pnpm"
-    return shutil.which(candidate) or candidate
-
-
 def serve(lab: Path, port: int) -> int:
     if not (lab / "public").is_dir():
         fail(f"Dev Lab public directory not found: {lab / 'public'}")
-    if not (lab / "node_modules").is_dir():
-        print("== installing Dev Lab dependencies (first run) ==")
-        subprocess.run([pnpm_executable(), "install", "--silent"], cwd=lab, check=True)
     print(f"== Dev Lab ready: http://localhost:{port}/ ==")
     return subprocess.run([sys.executable, "-m", "http.server", str(port), "--directory", str(lab / "public")], check=False).returncode
 
@@ -110,8 +102,9 @@ def main() -> int:
     parser.add_argument("--port", type=int, default=int(os.environ.get("PORT", "3300")))
     parser.add_argument("--prepare-only", action="store_true")
     args = parser.parse_args()
-    root = Path(__file__).resolve().parents[1]
-    lab = Path(args.lab_dir or os.environ.get("MOTIONLOOM_DEV_LAB") or root / "dev-lab").expanduser().resolve()
+    package_root = Path(__file__).resolve().parents[1]
+    root = Path(os.environ.get("MOTIONLOOM_PROJECT_ROOT") or Path.cwd()).expanduser().resolve()
+    lab = Path(args.lab_dir or os.environ.get("MOTIONLOOM_DEV_LAB") or package_root / "dev-lab").expanduser().resolve()
     task_dir = Path(args.task_dir).expanduser().resolve() if args.task_dir else None
     destination, task_destination, task_id = prepare_scene(root, lab, args.scene, task_dir)
     print(f"== Dev Lab scene prepared: {destination} ==")

package/scripts/docs-audit.py

@@ -93,9 +93,21 @@ if "--require-asset-provenance" not in (workflow_dir / "quality.yml").read_text(
         errors.append(f"{workflow.relative_to(ROOT)}: secrets referenced in pull_request workflow")
 
 release = (workflow_dir / "release.yml").read_text(encoding="utf-8")
-for required in ["workflow_dispatch:", "environment: npm-release", "id-token: write", "release_version:", "scripts/release-verify.py"]:
+for required in [
+    "workflow_dispatch:",
+    "environment: npm-release",
+    "id-token: write",
+    "release_version:",
+    "scripts/release-verify.py",
+    'node-version: "24"',
+    "npm@11.19.0",
+    'npm publish --access public --tag "$NPM_TAG"',
+]:
     if required not in release:
         errors.append(f"release.yml: missing release safety control {required}")
+for forbidden in ["NODE_AUTH_TOKEN", "secrets.NPM_TOKEN", "--provenance"]:
+    if forbidden in release:
+        errors.append(f"release.yml: token-based or redundant trusted-publishing control remains: {forbidden}")
 
 devlab = (workflow_dir / "devlab.yml").read_text(encoding="utf-8")
 for required in [

package/scripts/evidence-verifier.py

@@ -34,14 +34,21 @@ def parse_json(path: Path) -> object:
     return json.loads(path.read_text(encoding="utf-8"))
 
 
-def reject_symlink_components(path: Path) -> None:
-    current = Path(path.anchor) if path.anchor else Path(".")
-    for part in path.parts:
-        if part in (path.anchor, ""):
-            continue
+def reject_symlink_within_root(root: Path, relative: Path, label: str) -> None:
+    """Reject links inside an untrusted root, not symlinked system parents.
+
+    macOS exposes /var as a symlink to /private/var. A fixture rooted in mktemp
+    must be valid when the root itself is a real directory, while an evidence
+    path must never traverse a symlink at or below that root.
+    """
+    root = root.absolute()
+    if root.is_symlink():
+        raise ValueError(f"symlink root is not allowed: {label}")
+    current = root
+    for part in relative.parts:
         current = current / part
         if current.is_symlink():
-            raise ValueError(f"symlink path component is not allowed: {path}")
+            raise ValueError(f"symlink path component is not allowed: {label}")
 
 
 def safe_relative_file(root: Path, relative: object, label: str) -> Path:
@@ -53,7 +60,7 @@ def safe_relative_file(root: Path, relative: object, label: str) -> Path:
     if any(part in ("", ".", "..") for part in candidate.parts):
         raise ValueError(f"{label} contains unsafe path components")
     joined = root / candidate
-    reject_symlink_components(joined)
+    reject_symlink_within_root(root, candidate, label)
     resolved_root = root.resolve()
     resolved = joined.resolve(strict=False)
     if resolved != resolved_root and resolved_root not in resolved.parents:
@@ -81,8 +88,10 @@ def verify(scene_dir: Path, task_dir: Path, runtime_evidence_name: str, max_age_
             raise ValueError("scene directory name is unsafe")
         if not SAFE_NAME.fullmatch(task_dir.name):
             raise ValueError("task directory name is unsafe")
-        reject_symlink_components(scene_dir)
-        reject_symlink_components(task_dir)
+        if scene_dir.is_symlink():
+            raise ValueError("scene directory symlink is not allowed")
+        if task_dir.is_symlink():
+            raise ValueError("task directory symlink is not allowed")
         manifest_path = safe_relative_file(scene_dir, "manifest.json", "manifest.json")
         source_manifest = parse_json(manifest_path)
         if not isinstance(source_manifest, dict):

package/scripts/intelligence.py

@@ -82,14 +82,22 @@ def safe_relative(value: str) -> Path:
     return path
 
 
-def has_symlink_component(path: Path) -> bool:
-    current = path
-    while True:
+def has_symlink_component(path: Path, root: Path) -> bool:
+    """Reject symlinks at or below a trusted root, not system parent aliases."""
+    root = root.absolute()
+    path = path.absolute()
+    try:
+        relative = path.relative_to(root)
+    except ValueError:
+        return True
+    if root.is_symlink():
+        return True
+    current = root
+    for component in relative.parts:
+        current = current / component
         if current.is_symlink():
             return True
-        if current.parent == current:
-            return False
-        current = current.parent
+    return False
 
 
 def within(root: Path, candidate: Path) -> bool:
@@ -104,7 +112,7 @@ def task_artifact(task_dir: Path, relative: str) -> dict[str, Any]:
     safe = safe_relative(relative)
     raw_path = task_dir / safe
     path = raw_path.resolve()
-    if has_symlink_component(raw_path) or not within(task_dir, path) or not path.is_file():
+    if has_symlink_component(raw_path, task_dir) or not within(task_dir, path) or not path.is_file():
         raise ValueError(f"artifact is missing or outside task bundle: {relative}")
     return {
         "id": relative.replace("/", ":"),
@@ -179,7 +187,7 @@ def graph_build(args: argparse.Namespace) -> int:
 
     task_files = []
     for path in sorted(task_dir.rglob("*")):
-        if has_symlink_component(path):
+        if has_symlink_component(path, task_dir):
             raise ValueError(f"task bundle cannot contain symlinked artifact: {path.relative_to(task_dir)}")
         if not path.is_file():
             continue
@@ -363,7 +371,7 @@ def provenance_validate(args: argparse.Namespace) -> int:
     if not isinstance(attestation, dict) or not isinstance(attestation.get("steps"), list):
         raise ValueError("provenance attestation must contain steps")
     task_dir = task_dir_from(args.task_dir)
-    if has_symlink_component(raw_path) or not within(task_dir, path):
+    if has_symlink_component(path, task_dir) or not within(task_dir, path):
         raise ValueError("provenance attestation must be a non-symlink file inside task bundle")
     if attestation.get("task_id") != read_json(task_dir / "task.json").get("task_id"):
         raise ValueError("provenance task_id does not match task.json")
@@ -400,13 +408,13 @@ def capability_build(args: argparse.Namespace) -> int:
     if not isinstance(card, dict):
         raise ValueError("agent-card must be an object")
     raw_evidence_path = Path(args.evidence).expanduser() if args.evidence else ROOT / "scripts" / "runtime-adapters.mjs"
-    if has_symlink_component(raw_evidence_path):
-        raise ValueError("capability evidence cannot traverse symlinks")
     evidence_path = raw_evidence_path.resolve()
     if not evidence_path.is_file():
         raise ValueError(f"capability evidence path does not exist: {evidence_path}")
     if not within(ROOT, evidence_path):
         raise ValueError("capability evidence must be inside the repository")
+    if has_symlink_component(raw_evidence_path, ROOT):
+        raise ValueError("capability evidence cannot traverse symlinks")
     evidence_ref = evidence_path.relative_to(ROOT).as_posix()
     evidence_kind = args.evidence_kind
     entries = []
@@ -445,6 +453,13 @@ def capability_build(args: argparse.Namespace) -> int:
 def capability_validate(args: argparse.Namespace) -> int:
     registry_path = Path(args.path).expanduser().resolve()
     registry = read_json(registry_path)
+    capability_registry_validate(registry)
+    ids = [entry.get("id") for entry in registry["capabilities"]]
+    print(json.dumps({"status": "valid", "kind": "capability-registry", "capability_count": len(ids)}, ensure_ascii=False))
+    return 0
+
+
+def capability_registry_validate(registry: Any) -> None:
     if not isinstance(registry, dict) or not isinstance(registry.get("capabilities"), list):
         raise ValueError("capability registry must contain capabilities")
     ids = [entry.get("id") for entry in registry["capabilities"]]
@@ -453,13 +468,61 @@ def capability_validate(args: argparse.Namespace) -> int:
     for entry in registry["capabilities"]:
         for evidence in entry.get("evidence", []):
             evidence_path = ROOT / safe_relative(str(evidence.get("path", "")))
-            if has_symlink_component(evidence_path) or not within(ROOT, evidence_path):
+            if has_symlink_component(evidence_path, ROOT) or not within(ROOT, evidence_path):
                 raise ValueError(f"capability evidence escapes repository: {evidence.get('path')}")
             if not evidence_path.is_file():
                 raise ValueError(f"capability evidence missing: {evidence.get('path')}")
             if digest_file(evidence_path) != evidence.get("sha256"):
                 raise ValueError(f"capability evidence hash mismatch: {evidence.get('path')}")
-    print(json.dumps({"status": "valid", "kind": "capability-registry", "capability_count": len(ids)}, ensure_ascii=False))
+
+
+def capability_card(args: argparse.Namespace) -> int:
+    """Export a read-only, evidence-bound capability projection for Agents.
+
+    The card deliberately exposes declared registry state only. It does not
+    select a runtime, refresh evidence, grant approval, or change policy.
+    Callers must run ``capabilities select`` before execution.
+    """
+    registry = read_json(Path(args.registry).expanduser().resolve())
+    capability_registry_validate(registry)
+    capabilities = []
+    for entry in registry["capabilities"]:
+        capabilities.append({
+            "id": entry.get("id"),
+            "kind": entry.get("kind"),
+            "declared_status": entry.get("status"),
+            "adapter_version": entry.get("adapter_version"),
+            "last_verified_at": entry.get("last_verified_at"),
+            "inputs": entry.get("inputs", []),
+            "outputs": entry.get("outputs", []),
+            "compatibility": entry.get("compatibility", {}),
+            "evidence": entry.get("evidence", []),
+            "limitations": entry.get("limitations", []),
+            "fallback": entry.get("fallback", ""),
+            "risk_level": entry.get("risk_level"),
+            "side_effect_level": entry.get("side_effect_level"),
+        })
+    card = {
+        "schema_version": "0.1",
+        "kind": "motionloom-capability-card",
+        "registry": {
+            "registry_id": registry.get("registry_id"),
+            "schema_version": registry.get("schema_version"),
+            "generated_at": registry.get("generated_at"),
+            "selection_policy": registry.get("selection_policy", {}),
+        },
+        "capabilities": capabilities,
+        "selection": {
+            "required": True,
+            "command": "motionloom capability select --registry <capability-registry.json> --capability <runtime.id>",
+            "note": "This card is discovery metadata. Select validates evidence freshness and integrity before a runtime may be used.",
+        },
+        "review": {
+            "production_approval": "not_derived",
+            "attestation_approval": "not_derived",
+        },
+    }
+    print(json.dumps(card, ensure_ascii=False))
     return 0
 
 
@@ -488,7 +551,7 @@ def capability_select(args: argparse.Namespace) -> int:
         for evidence in entry.get("evidence", []):
             try:
                 evidence_path = ROOT / safe_relative(str(evidence.get("path", "")))
-                if has_symlink_component(evidence_path) or not within(ROOT, evidence_path) or not evidence_path.is_file() or digest_file(evidence_path) != evidence.get("sha256"):
+                if has_symlink_component(evidence_path, ROOT) or not within(ROOT, evidence_path) or not evidence_path.is_file() or digest_file(evidence_path) != evidence.get("sha256"):
                     evidence_ok = False
                     break
             except (OSError, ValueError):
@@ -1383,7 +1446,7 @@ def replay_capture(args: argparse.Namespace) -> int:
     task_rel = task_dir.relative_to(root).as_posix()
     records = []
     for path in sorted(task_dir.rglob("*")):
-        if has_symlink_component(path):
+        if has_symlink_component(path, task_dir):
             raise ValueError(f"task bundle cannot contain symlinked artifact: {path.relative_to(task_dir)}")
         if not path.is_file():
             continue
@@ -1417,7 +1480,7 @@ def replay_verify(args: argparse.Namespace) -> int:
         task_rel = safe_relative(str(bundle.get("task_dir", "")))
         task_dir = (root / task_rel).resolve()
         task = read_json(task_dir / "task.json")
-        if has_symlink_component(root / task_rel) or not within(root, task_dir) or not task_dir.is_dir():
+        if has_symlink_component(root / task_rel, root) or not within(root, task_dir) or not task_dir.is_dir():
             mismatches.append({"path": str(task_rel), "reason": "task_dir_invalid"})
         else:
             if bundle.get("task_id") != task.get("task_id"):
@@ -1430,7 +1493,7 @@ def replay_verify(args: argparse.Namespace) -> int:
         safe = safe_relative(str(record.get("path", "")))
         raw_path = root / safe
         path = raw_path.resolve()
-        if has_symlink_component(raw_path) or not within(root, path) or "task_dir" in locals() and not within(task_dir, path) or not path.is_file():
+        if has_symlink_component(raw_path, root) or not within(root, path) or "task_dir" in locals() and not within(task_dir, path) or not path.is_file():
             mismatches.append({"path": str(safe), "reason": "missing"})
             continue
         actual = digest_file(path)
@@ -1449,7 +1512,7 @@ def replay_mismatches(bundle: dict[str, Any], root: Path) -> list[dict[str, Any]
         safe = safe_relative(str(record.get("path", "")))
         raw_path = root / safe
         path = raw_path.resolve()
-        if has_symlink_component(raw_path) or not within(root, path) or not path.is_file():
+        if has_symlink_component(raw_path, root) or not within(root, path) or not path.is_file():
             mismatches.append({"path": str(safe), "reason": "missing"})
             continue
         actual = digest_file(path)
@@ -1563,6 +1626,10 @@ def add_subcommands(parser: argparse.ArgumentParser) -> None:
     capabilities_select_parser.add_argument("--status", default="verified")
     capabilities_select_parser.add_argument("--allow-scaffold-only", action="store_true")
     capabilities_select_parser.set_defaults(func=capability_select)
+    capabilities_card_parser = capabilities_sub.add_parser("card", help="export a read-only capability card for Agent discovery")
+    capabilities_card_parser.add_argument("--registry", default=str(ROOT / "capability-registry.json"))
+    capabilities_card_parser.add_argument("--format", choices=["json"], default="json")
+    capabilities_card_parser.set_defaults(func=capability_card)
 
     replay = sub.add_parser("replay", help="capture or verify clean-root integrity replay bundle")
     replay_sub = replay.add_subparsers(dest="action", required=True)

package/scripts/package-consumer-smoke.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const expectedVersion = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version;
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "motionloom-consumer-"));
+const consumer = path.join(temporary, "consumer");
+fs.mkdirSync(consumer);
+fs.writeFileSync(
+  path.join(consumer, "package.json"),
+  `${JSON.stringify({ name: "motionloom-package-smoke", private: true }, null, 2)}\n`,
+);
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd || root,
+    encoding: "utf8",
+    env: process.env,
+    ...options,
+  });
+  if (result.status !== 0) {
+    throw new Error(
+      `${command} ${args.join(" ")} failed (${result.status})\n${result.stdout || ""}\n${result.stderr || ""}`,
+    );
+  }
+  return result.stdout.trim();
+}
+
+try {
+  const packOutput = JSON.parse(run("npm", ["pack", "--json", "--pack-destination", temporary]));
+  const tarball = path.join(temporary, packOutput[0].filename);
+  run("npm", ["install", "--ignore-scripts", "--no-audit", "--no-fund", tarball], { cwd: consumer });
+
+  const bin = process.platform === "win32"
+    ? path.join(consumer, "node_modules", ".bin", "motionloom.cmd")
+    : path.join(consumer, "node_modules", ".bin", "motionloom");
+  const installedRoot = path.dirname(fs.realpathSync(path.join(consumer, "node_modules", "motionloom", "package.json")));
+  const help = run(bin, ["--help"], { cwd: consumer });
+  const init = JSON.parse(run(bin, ["init", "--dry-run", "--json"], { cwd: consumer }));
+  const doctor = JSON.parse(run(bin, ["doctor", "--json"], { cwd: consumer }));
+
+  if (!help.startsWith(`MotionLoom ${expectedVersion}`)) throw new Error(`unexpected help version: ${help.split("\n")[0]}`);
+  if (fs.realpathSync(init.project_root || ".") !== fs.realpathSync(consumer)) {
+    throw new Error(`installed CLI used the wrong project_root: ${init.project_root}`);
+  }
+  if (doctor.status !== "pass") throw new Error(`installed doctor failed: ${JSON.stringify(doctor.errors)}`);
+  for (const relative of [
+    "requirements.txt",
+    "dev-lab/public/index.html",
+    "dev-lab/public/devlab.js",
+    "tests/runtime-harness/index.html",
+  ]) {
+    if (!fs.existsSync(path.join(installedRoot, relative))) throw new Error(`tarball omitted ${relative}`);
+  }
+  const scene = "browser-review-smoke";
+  const consumerScene = path.join(consumer, "src", "output", scene);
+  fs.mkdirSync(path.dirname(consumerScene), { recursive: true });
+  fs.cpSync(path.join(installedRoot, "src", "output", scene), consumerScene, { recursive: true });
+  const candidatePath = path.join(consumerScene, "browser-review.json");
+  const candidate = JSON.parse(fs.readFileSync(candidatePath, "utf8"));
+  candidate.expires_at = "2099-01-01T00:00:00Z";
+  fs.writeFileSync(candidatePath, `${JSON.stringify(candidate, null, 2)}\n`);
+  run(bin, ["devlab", scene, "--prepare-only"], { cwd: consumer });
+  if (!fs.existsSync(path.join(installedRoot, "dev-lab", "public", "scenes", scene, "browser-review.json"))) {
+    throw new Error("installed Dev Lab did not prepare the consumer scene");
+  }
+  run(process.execPath, ["--input-type=module", "-e", "await import('playwright'); await import('vite');"], { cwd: consumer });
+  console.log(JSON.stringify({ status: "pass", project_root: init.project_root, installed_root: installedRoot }, null, 2));
+} finally {
+  fs.rmSync(temporary, { recursive: true, force: true });
+}

package/scripts/runtime-adapters.mjs

@@ -6,9 +6,11 @@ import { spawn } from "node:child_process";
 import { setTimeout as sleep } from "node:timers/promises";
 import { chromium } from "playwright";
 import crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
 
-const ROOT = path.resolve(new URL("..", import.meta.url).pathname);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const outputRoot = path.resolve(process.env.RUNTIME_EVIDENCE_DIR || path.join(ROOT, "artifacts/runtime-adapters"));
+const outputPolicyRoot = path.resolve(process.env.MOTIONLOOM_RUNTIME_OUTPUT_ROOT || ROOT);
 const port = Number(process.env.RUNTIME_HARNESS_PORT || 4179);
 const supportedFrameworks = new Set(["rive", "gsap", "framer-motion"]);
 const frameworks = (process.env.RUNTIME_FRAMEWORKS || "rive,gsap,framer-motion")
@@ -17,8 +19,31 @@ const unsupported = frameworks.filter((name) => !supportedFrameworks.has(name));
 if (unsupported.length) {
   throw new Error(`unsupported runtime framework(s): ${unsupported.join(", ")}`);
 }
-if (outputRoot === ROOT || outputRoot === path.parse(outputRoot).root) {
-  throw new Error("RUNTIME_EVIDENCE_DIR must be a dedicated child output directory");
+function canonicalPath(target) {
+  let existing = target;
+  const missing = [];
+  while (!fs.existsSync(existing)) {
+    const parent = path.dirname(existing);
+    if (parent === existing) break;
+    missing.unshift(path.basename(existing));
+    existing = parent;
+  }
+  const base = fs.existsSync(existing) ? fs.realpathSync(existing) : path.resolve(existing);
+  return path.resolve(base, ...missing);
+}
+
+function isStrictChild(target, parent) {
+  const relative = path.relative(parent, target);
+  return Boolean(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+const canonicalOutputRoot = canonicalPath(outputRoot);
+const canonicalPolicyRoot = canonicalPath(outputPolicyRoot);
+if (!isStrictChild(canonicalOutputRoot, canonicalPolicyRoot)) {
+  throw new Error(
+    `RUNTIME_EVIDENCE_DIR must be a dedicated child of ${outputPolicyRoot}; ` +
+    "set MOTIONLOOM_RUNTIME_OUTPUT_ROOT explicitly to authorize another parent",
+  );
 }
 const baseUrl = `http://127.0.0.1:${port}`;
 const runId = `${Date.now()}-${process.pid}`;

package/scripts/skill-doctor.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import importlib.util
 import json
 import re
 import sys
@@ -11,7 +12,15 @@ from pathlib import Path
 
 
 ROOT = Path(__file__).resolve().parents[1]
-REQUIRED_FILES = ["SKILL.md", "agent-card.json", "package.json"]
+REQUIRED_FILES = [
+    "SKILL.md",
+    "agent-card.json",
+    "package.json",
+    "requirements.txt",
+    "dev-lab/public/index.html",
+    "dev-lab/public/devlab.js",
+    "tests/runtime-harness/index.html",
+]
 REQUIRED_DIRS = ["scripts", "templates", "references", "schemas"]
 REQUIRED_SCRIPT_FILES = [
     "scripts/report-contract.py",
@@ -135,9 +144,26 @@ def run() -> int:
         for script in ("test", "validate", "doctor", "setup", "setup:dry", "status", "repair", "report", "report:check", "review", "memory:bootstrap", "memory:recover", "memory:validate", "devlab", "pack:dotlottie"):
             if script not in package.get("scripts", {}):
                 warnings.append({"code": "missing_package_script", "message": f"package.json has no {script} script."})
+        runtime_dependencies = {
+            **package.get("dependencies", {}),
+            **package.get("optionalDependencies", {}),
+        }
+        for dependency in ("playwright", "vite"):
+            present = dependency in runtime_dependencies
+            checks.append({"id": f"runtime-dependency:{dependency}", "status": "pass" if present else "fail"})
+            if not present:
+                errors.append({"code": "missing_runtime_dependency", "message": f"package.json runtime dependencies omit {dependency}."})
     except (FileNotFoundError, json.JSONDecodeError) as exc:
         errors.append({"code": "invalid_package_json", "message": str(exc)})
 
+    cryptography_available = importlib.util.find_spec("cryptography") is not None
+    checks.append({"id": "python-dependency:cryptography", "status": "pass" if cryptography_available else "fail"})
+    if not cryptography_available:
+        errors.append({
+            "code": "missing_python_dependency",
+            "message": "Python package cryptography is required; install dependencies from requirements.txt.",
+        })
+
     result = {
         "doctor_version": "1.0",
         "skill_root": str(ROOT),