motionloom 2.5.0 → 2.6.0

package/docs/releases/2.5.1.md

@@ -0,0 +1,21 @@
+# MotionLoom 2.5.1
+
+## Summary
+
+MotionLoom 2.5.1 is a hardening patch for the installed npm package, browser review boundary and runtime-output policy. It preserves the 2.5.0 capability surface while making the advertised onboarding, Dev Lab and runtime evidence paths work safely from an isolated consumer project.
+
+## Fixed
+
+- The npm CLI preserves the caller's working directory, so default setup and onboarding target the consumer project instead of the installed package directory. The displayed CLI version is read from package metadata.
+- The npm tarball includes the Dev Lab assets, runtime harness, Python requirements and optional browser-runtime dependencies required by its documented commands. Release validation installs the packed tarball into an isolated consumer project.
+- Dev Lab renders manifest values through safe DOM APIs, enforces a same-origin script content-security policy and rejects invalid, expired or terminal browser-review candidates before review can be enabled.
+- Runtime evidence cleanup is constrained to a dedicated child directory below an explicit policy root and cannot remove caller data outside that boundary.
+- The protected GitHub Actions release uses npm Trusted Publishing/OIDC with a compatible pinned npm client instead of a long-lived publish token. npm generates public-package provenance automatically for the trusted workflow.
+
+## Verified behavior
+
+The release candidate passes the full regression harness, quality and signed-attestation gate, isolated package-consumer smoke test, Dev Lab browser-security smoke test, real Rive/GSAP/Framer Motion runtime capture at 0/50/100%, a 6,900-case deep stress run, twelve Swift package tests, Skill Doctor, documentation audit, discovery, release verification and package inspection. The pull request carrying the implementation passed all twelve GitHub checks before merge.
+
+## Trust boundary
+
+This patch does not add a framework capability, sign or distribute the Apple alpha, grant production approval or authorize a pull request or release from machine-generated evidence. Browser review remains identity-bound and human-governed. npm publication and GitHub Release creation remain explicit maintainer actions after the prepared commit is green on `main`.

package/docs/releases/2.6.0.md

@@ -0,0 +1,38 @@
+# MotionLoom 2.6.0
+
+## Summary
+
+MotionLoom 2.6.0 turns Dev Lab from a mostly checkpoint-oriented browser reviewer into an interactive runtime review workbench. The release keeps deterministic snapshots as evidence, but adds a live runtime lane for real playback, scalable project-defined action sets, and optional state/transition review flows so a user can inspect behavior much closer to the target runtime before approving a candidate.
+
+## Added
+
+- Interactive Dev Lab transport controls for live candidates: play, pause, restart, normalized scrub, frame stepping, playback speed and loop control.
+- Stage inspection tools including fullscreen, zoom/fit, background selection, grid, bounds, baseline and pivot overlays; sprite candidates can opt into crisp pixel-art rendering.
+- Data-driven animation discovery from `devlab-runtime.json`. Action names such as `idle`, `walk`, `run`, `attack`, `jump`, skills, emotes or project-specific clips are not hard-coded into MotionLoom.
+- Scalable Action Library support with project-defined groups/categories, tags, search, collapsible sections and filters for review-required, unreviewed, looping and one-shot actions.
+- Optional hash-bound `devlab-state-machine.json` contract with explicit states, legal transitions, multi-step review sequences and independent transition/sequence review coverage.
+- Portable `select-animation` transitions for sprite/clip runtimes and strict `runtime-trigger` transitions for iframe runtimes through `triggerTransition(request)`.
+- Transition history and review evidence for inspected actions, transitions, sequences and observed runtime state.
+
+## Hardened
+
+- Live runtime files, descriptors and state-machine bytes are bound into the browser-review candidate hash when declared; runtime-byte drift invalidates the candidate.
+- Path traversal, absolute paths, symlink escapes, duplicate animation ids, undeclared runtime files and mismatched candidate/runtime animation sets fail closed.
+- A declared live runtime that cannot load is shown as `LIVE RUNTIME UNAVAILABLE`; captured snapshots remain inspectable for diagnosis but approval is blocked.
+- `runtime-trigger` transitions are counted only after the runtime reports the declared target state. MotionLoom never silently downgrades an unsupported runtime trigger into a clip switch.
+- Search, grouping and filters affect presentation only. Hidden required actions or transitions still count as unreviewed.
+- `runtime-bridge.js` is included in the npm package allowlist so installed-package iframe/state-machine review does not depend on source-checkout-only files.
+
+## Verified behavior
+
+The Dev Lab CI harness covers deterministic snapshots, live sprite playback, iframe runtime bridging, a four-action interactive dogfood set, a twelve-action Action Library fixture, sprite state transitions, real iframe runtime-trigger transitions and browser-security smoke tests. The state/transition fixtures exercise flows such as `Idle -> Run -> Attack -> Hurt -> Idle` and verify that completing runtime coverage does not create a user approval decision.
+
+The protected release workflow reruns documentation/package validation, Skill Doctor, the full regression harness, isolated installed-package consumer smoke and release traceability before npm publication.
+
+## Trust boundary
+
+MotionLoom 2.6.0 does not turn runtime success into visual approval, production approval or PR authorization. Playback controls, action coverage, transition coverage, runtime state, hashes, snapshots, telemetry and automated sequence completion are evidence only. `approved` remains an explicit user decision bound to the exact browser-review candidate.
+
+AI-generated or otherwise non-authoritative source assets retain their declared provenance and authority tier. Dev Lab review does not promote `ai_generated` material to `artist_authored`, `production_eligible` or `production_approved`.
+
+The native macOS/iOS companion remains an unsigned source alpha. npm publication and GitHub Release creation remain explicit maintainer release actions through the protected GitHub Actions workflow.

package/docs/releases/npm-publish-from-workstation.md

@@ -1,6 +1,6 @@
 # Publish MotionLoom to npm from your workstation
 
-This guide publishes the prepared `motionloom@2.5.0` package from your own computer. The npm password, authenticator code and access token must stay on your computer; never paste them into chat, GitHub issues or repository files.
+This guide publishes the prepared `motionloom@2.5.1` package from your own computer. The npm password, authenticator code and access token must stay on your computer; never paste them into chat, GitHub issues or repository files.
 
 ## 1. Install prerequisites
 
@@ -48,7 +48,7 @@ npm pack --dry-run --json --ignore-scripts
 npm publish --dry-run --access public
 ```
 
-The dry-run should report `motionloom@2.5.0`, public access, and the current package file list. Do not hard-code a historical file count: inspect the JSON output and compare it with the checked-in package allowlist. The prepack hook removes generated Python bytecode before packaging. Do not publish if the dry-run shows private keys, `.env` files, `artifacts/`, `dev-lab/` or `__pycache__/` entries.
+The dry-run should report `motionloom@2.5.1`, public access, and the current package file list. Do not hard-code a historical file count: inspect the JSON output and compare it with the checked-in package allowlist. The prepack hook removes generated Python bytecode before packaging. Do not publish if the dry-run shows private keys, `.env` files, `artifacts/`, `dev-lab/` or `__pycache__/` entries.
 
 ## 5. Publish the package
 
@@ -60,15 +60,15 @@ npm publish --access public
 
 Do not add `--provenance` unless the local npm client and its CI/provider integration explicitly support automatic npm provenance. Some workstation setups report `Automatic provenance generation not supported for provider: null`; in that case the package itself is still valid, and the supported fallback for this release is the command above without `--provenance`. Never retry by changing the version or by bypassing the package verification steps.
 
-The version `2.5.0` becomes immutable on npm after a successful publish. If npm reports that the version already exists, stop and verify the registry instead of trying to overwrite it.
+The version `2.5.1` becomes immutable on npm after a successful publish. If npm reports that the version already exists, stop and verify the registry instead of trying to overwrite it.
 
 ## 6. Verify the registry publication
 
-Run the following commands and confirm that they return `2.5.0` and a tarball URL:
+Run the following commands and confirm that they return `2.5.1` and a tarball URL:
 
 ```bash
 npm view motionloom version --registry=https://registry.npmjs.org/
-npm view motionloom@2.5.0 name version license dist.tarball dist.shasum --json \
+npm view motionloom@2.5.1 name version license dist.tarball dist.shasum --json \
   --registry=https://registry.npmjs.org/
 ```
 
@@ -78,7 +78,7 @@ Then test installation in a clean temporary directory:
 TMP_DIR="$(mktemp -d)"
 cd "$TMP_DIR"
 npm init --yes
-npm install motionloom@2.5.0
+npm install motionloom@2.5.1
 motionloom --help
 motionloom doctor
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "motionloom",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "type": "module",
   "packageManager": "pnpm@11.20.0",
   "description": "MotionLoom: project-aware animation Skill with Agent interoperability, graph, provenance, Motion IR, runtime telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, external evidence verification and Dev Lab review.",
@@ -33,6 +33,12 @@
     "schemas/asset-provenance.schema.json",
     "examples/agent-consumer/ai-generated-pilot-provenance.json",
     "project-context.example.json",
+    "requirements.txt",
+    "dev-lab/public/index.html",
+    "dev-lab/public/devlab.js",
+    "dev-lab/public/action-library.js",
+    "dev-lab/public/runtime-bridge.js",
+    "tests/runtime-harness",
     "tests/evals",
     "tests/scripts/run_tests.py",
     "tests/scripts/test_attestation.py",
@@ -124,7 +130,7 @@
   },
   "scripts": {
     "prepack": "node scripts/prepack-clean.mjs",
-    "test": "node bin/motionloom.mjs test",
+    "test": "python3 tests/scripts/run_tests.py",
     "validate": "npm run quality:attestation",
     "doctor": "node bin/motionloom.mjs doctor --json",
     "init": "node bin/motionloom.mjs init",
@@ -147,7 +153,8 @@
     "intelligence:p1": "node bin/motionloom.mjs intelligence",
     "quality:p1": "node bin/motionloom.mjs quality-gate --require-intelligence --require-p1 --require-benchmark",
     "eval:intelligence": "node bin/motionloom.mjs eval-intelligence",
-    "audit:deep": "node bin/motionloom.mjs deep-audit --iterations 5000 --seed 20260813 --report docs/audits/data/deep-stress-latest.json",
+    "audit:deep": "python3 tests/scripts/deep-stress.py --iterations 5000 --seed 20260813 --report docs/audits/data/deep-stress-latest.json",
+    "package:smoke": "node scripts/package-consumer-smoke.mjs",
     "memory:init": "node bin/motionloom.mjs memory init --project-root .",
     "memory:bootstrap": "node bin/motionloom.mjs analyze . --init-memory",
     "memory:recover": "node bin/motionloom.mjs memory recover --project-root .",
@@ -191,9 +198,10 @@
     "react": "^19.2.8",
     "react-dom": "^19.2.8"
   },
-  "devDependencies": {
+  "optionalDependencies": {
     "playwright": "^1.62.1",
     "vite": "^8.2.1"
   },
+  "devDependencies": {},
   "license": "MIT"
 }

package/requirements.txt

@@ -0,0 +1 @@
+cryptography>=42.0,<47.0

package/rig-adapter-registry.json

@@ -16,7 +16,7 @@
       "target": "rive",
       "framework": "rive",
       "status": "project_integrated",
-      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d"}],
       "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
     },
     {
@@ -24,7 +24,7 @@
       "target": "gsap",
       "framework": "gsap",
       "status": "project_integrated",
-      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d"}],
       "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
     },
     {
@@ -32,7 +32,7 @@
       "target": "framer-motion",
       "framework": "framer-motion",
       "status": "project_integrated",
-      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "711a64c07b4d82f646d066c7b0d91deaefc5c9c0fb701358706bf31d558b4d89"}],
+      "evidence": [{"path": "scripts/runtime-adapters.mjs", "sha256": "6f135e75e700a7bb105903db59445fcd3577669b595082a2b542db639f5fe56d"}],
       "limitations": ["Runtime harness evidence must be captured for the concrete scene and source bytes."]
     }
   ]

package/schemas/browser-review-candidate.schema.json

@@ -15,6 +15,43 @@
     "source_sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"},
     "runtime": {"type": "string"},
     "checkpoints": {"type": "array", "items": {"type": "integer", "enum": [0, 50, 100]}},
+    "runtime_review": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["live", "mode", "checkpoints"],
+          "properties": {
+            "live": {"const": false},
+            "mode": {"const": "captured-evidence"},
+            "checkpoints": {"type": "array", "items": {"type": "integer", "enum": [0, 50, 100]}}
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["live", "mode", "descriptor", "bundle_sha256", "animations", "review_policy"],
+          "properties": {
+            "live": {"const": true},
+            "mode": {"enum": ["sprite-sequence", "iframe"]},
+            "descriptor": {"const": "devlab-runtime.json"},
+            "bundle_sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"},
+            "animations": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"}
+            },
+            "review_policy": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["require_all_animations"],
+              "properties": {"require_all_animations": {"type": "boolean"}}
+            }
+          }
+        }
+      ]
+    },
     "review_artifact": {"type": "string"},
     "requires_user_approval": {"type": "boolean"},
     "prepared_at": {"type": "string", "format": "date-time"},

package/schemas/devlab-runtime.schema.json

@@ -0,0 +1,140 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://motionloom.dev/schemas/devlab-runtime.schema.json",
+  "title": "MotionLoom Dev Lab live runtime descriptor",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "mode", "files", "animations", "default_animation", "controls", "review_policy"],
+  "properties": {
+    "schema_version": { "const": "1.0" },
+    "mode": { "enum": ["sprite-sequence", "iframe"] },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/relativePath" }
+    },
+    "entrypoint": { "$ref": "#/$defs/relativePath" },
+    "default_animation": { "$ref": "#/$defs/animationId" },
+    "groups": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/group" }
+    },
+    "animations": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/animation" }
+    },
+    "controls": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["play", "pause", "restart", "seek", "step", "speed", "loop"],
+      "properties": {
+        "play": { "type": "boolean" },
+        "pause": { "type": "boolean" },
+        "restart": { "type": "boolean" },
+        "seek": { "type": "boolean" },
+        "step": { "type": "boolean" },
+        "speed": { "type": "boolean" },
+        "loop": { "type": "boolean" }
+      }
+    },
+    "viewport": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "canvas_width": { "type": "number", "exclusiveMinimum": 0 },
+        "canvas_height": { "type": "number", "exclusiveMinimum": 0 },
+        "pixel_art": { "type": "boolean" },
+        "baseline_y": { "type": "number" },
+        "pivot": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["x", "y"],
+          "properties": {
+            "x": { "type": "number" },
+            "y": { "type": "number" }
+          }
+        },
+        "background": { "enum": ["checker", "dark", "light", "transparent", "project"] }
+      }
+    },
+    "review_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["require_all_animations"],
+      "properties": {
+        "require_all_animations": { "type": "boolean" }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "mode": { "const": "iframe" } } },
+      "then": { "required": ["entrypoint"] }
+    },
+    {
+      "if": { "properties": { "mode": { "const": "sprite-sequence" } } },
+      "then": {
+        "properties": {
+          "animations": {
+            "items": {
+              "required": ["id", "fps", "frames", "loop"]
+            }
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "animationId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"
+    },
+    "groupId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+"
+    },
+    "group": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id"],
+      "properties": {
+        "id": { "$ref": "#/$defs/groupId" },
+        "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+        "order": { "type": "integer", "minimum": -10000, "maximum": 10000 }
+      }
+    },
+    "animation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "loop"],
+      "properties": {
+        "id": { "$ref": "#/$defs/animationId" },
+        "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+        "group": { "$ref": "#/$defs/groupId" },
+        "tags": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1, "maxLength": 64 }
+        },
+        "fps": { "type": "number", "exclusiveMinimum": 0 },
+        "frames": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/relativePath" }
+        },
+        "loop": { "type": "boolean" },
+        "duration_s": { "type": "number", "exclusiveMinimum": 0 },
+        "review_required": { "type": "boolean", "default": true },
+        "events": { "type": "array", "items": { "type": "string" } }
+      }
+    }
+  }
+}

package/schemas/devlab-state-machine.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://motionloom.dev/schemas/devlab-state-machine.schema.json",
+  "title": "MotionLoom Dev Lab state/transition review contract",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "initial_state", "states", "transitions", "review_policy"],
+  "properties": {
+    "schema_version": { "const": "1.0" },
+    "initial_state": { "$ref": "#/$defs/id" },
+    "states": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "items": { "$ref": "#/$defs/state" }
+    },
+    "transitions": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 512,
+      "items": { "$ref": "#/$defs/transition" }
+    },
+    "sequences": {
+      "type": "array",
+      "maxItems": 64,
+      "items": { "$ref": "#/$defs/sequence" }
+    },
+    "review_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["require_all_transitions", "require_all_sequences"],
+      "properties": {
+        "require_all_transitions": { "type": "boolean" },
+        "require_all_sequences": { "type": "boolean" }
+      }
+    }
+  },
+  "$defs": {
+    "id": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"
+    },
+    "state": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "animation"],
+      "properties": {
+        "id": { "$ref": "#/$defs/id" },
+        "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+        "animation": { "$ref": "#/$defs/id" },
+        "description": { "type": "string", "maxLength": 500 }
+      }
+    },
+    "transition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "from", "to", "mode"],
+      "properties": {
+        "id": { "$ref": "#/$defs/id" },
+        "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+        "from": {
+          "oneOf": [
+            { "$ref": "#/$defs/id" },
+            { "const": "*" }
+          ]
+        },
+        "to": { "$ref": "#/$defs/id" },
+        "trigger": { "type": "string", "minLength": 1, "maxLength": 120 },
+        "mode": { "enum": ["select-animation", "runtime-trigger"] },
+        "auto_play": { "type": "boolean", "default": true },
+        "review_required": { "type": "boolean", "default": true },
+        "wait_ms": { "type": "integer", "minimum": 0, "maximum": 10000 },
+        "payload": { "type": "object" }
+      }
+    },
+    "sequenceStep": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["transition"],
+      "properties": {
+        "transition": { "$ref": "#/$defs/id" },
+        "wait_ms": { "type": "integer", "minimum": 0, "maximum": 10000 }
+      }
+    },
+    "sequence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "steps"],
+      "properties": {
+        "id": { "$ref": "#/$defs/id" },
+        "label": { "type": "string", "minLength": 1, "maxLength": 120 },
+        "description": { "type": "string", "maxLength": 500 },
+        "review_required": { "type": "boolean", "default": false },
+        "steps": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": { "$ref": "#/$defs/sequenceStep" }
+        }
+      }
+    }
+  }
+}

package/scripts/capture-runtime-telemetry.py

@@ -47,9 +47,15 @@ def main() -> int:
         print("capture-runtime-telemetry: --max-age-days must be non-negative", file=sys.stderr)
         return 2
 
-    root = Path(__file__).resolve().parents[1]
+    package_root = Path(__file__).resolve().parents[1]
+    root = Path(os.environ.get("MOTIONLOOM_PROJECT_ROOT") or Path.cwd()).expanduser().resolve()
     task_dir = Path(args.task_dir).expanduser()
     task_dir = task_dir.resolve() if task_dir.is_absolute() else (root / task_dir).resolve()
+    try:
+        task_dir.relative_to(root)
+    except ValueError:
+        print("capture-runtime-telemetry: task directory must remain inside the project root", file=sys.stderr)
+        return 2
     scene_dir = (root / "src" / "output" / args.scene).resolve()
     manifest_path = scene_dir / "manifest.json"
     task_path = task_dir / "task.json"
@@ -74,10 +80,6 @@ def main() -> int:
         return 2
 
     output_dir = task_dir / "runtime-adapters"
-    if output_dir.exists():
-        shutil.rmtree(output_dir)
-    output_dir.mkdir(parents=True, exist_ok=True)
-
     env = os.environ.copy()
     env.update(
         {
@@ -87,17 +89,23 @@ def main() -> int:
             "RUNTIME_SOURCE_PATH": str(source_path),
             "RUNTIME_MANIFEST_PATH": str(manifest_path),
             "RUNTIME_MOTION_IR_PATH": str(task_dir / "motion-ir.json"),
+            "MOTIONLOOM_RUNTIME_OUTPUT_ROOT": str(root),
         }
     )
-    npm = "npm.cmd" if os.name == "nt" else "npm"
-    runtime = subprocess.run([npm, "run", "runtime:test"], cwd=root, env=env, check=False)
+    node = shutil.which("node") or ("node.exe" if os.name == "nt" else "node")
+    runtime = subprocess.run(
+        [node, str(package_root / "scripts" / "runtime-adapters.mjs")],
+        cwd=root,
+        env=env,
+        check=False,
+    )
     if runtime.returncode != 0:
         return runtime.returncode
 
     verifier = subprocess.run(
         [
             sys.executable,
-            str(root / "scripts" / "evidence-verifier.py"),
+            str(package_root / "scripts" / "evidence-verifier.py"),
             "--scene-dir",
             str(scene_dir),
             "--task-dir",

package/scripts/devlab.py

@@ -87,17 +87,9 @@ def prepare_scene(root: Path, lab: Path, scene: str, task_dir: Path | None) -> t
     return destination, task_destination, task_id
 
 
-def pnpm_executable() -> str:
-    candidate = "pnpm.cmd" if os.name == "nt" else "pnpm"
-    return shutil.which(candidate) or candidate
-
-
 def serve(lab: Path, port: int) -> int:
     if not (lab / "public").is_dir():
         fail(f"Dev Lab public directory not found: {lab / 'public'}")
-    if not (lab / "node_modules").is_dir():
-        print("== installing Dev Lab dependencies (first run) ==")
-        subprocess.run([pnpm_executable(), "install", "--silent"], cwd=lab, check=True)
     print(f"== Dev Lab ready: http://localhost:{port}/ ==")
     return subprocess.run([sys.executable, "-m", "http.server", str(port), "--directory", str(lab / "public")], check=False).returncode
 
@@ -110,8 +102,9 @@ def main() -> int:
     parser.add_argument("--port", type=int, default=int(os.environ.get("PORT", "3300")))
     parser.add_argument("--prepare-only", action="store_true")
     args = parser.parse_args()
-    root = Path(__file__).resolve().parents[1]
-    lab = Path(args.lab_dir or os.environ.get("MOTIONLOOM_DEV_LAB") or root / "dev-lab").expanduser().resolve()
+    package_root = Path(__file__).resolve().parents[1]
+    root = Path(os.environ.get("MOTIONLOOM_PROJECT_ROOT") or Path.cwd()).expanduser().resolve()
+    lab = Path(args.lab_dir or os.environ.get("MOTIONLOOM_DEV_LAB") or package_root / "dev-lab").expanduser().resolve()
     task_dir = Path(args.task_dir).expanduser().resolve() if args.task_dir else None
     destination, task_destination, task_id = prepare_scene(root, lab, args.scene, task_dir)
     print(f"== Dev Lab scene prepared: {destination} ==")

package/scripts/docs-audit.py

@@ -93,9 +93,21 @@ if "--require-asset-provenance" not in (workflow_dir / "quality.yml").read_text(
         errors.append(f"{workflow.relative_to(ROOT)}: secrets referenced in pull_request workflow")
 
 release = (workflow_dir / "release.yml").read_text(encoding="utf-8")
-for required in ["workflow_dispatch:", "environment: npm-release", "id-token: write", "release_version:", "scripts/release-verify.py"]:
+for required in [
+    "workflow_dispatch:",
+    "environment: npm-release",
+    "id-token: write",
+    "release_version:",
+    "scripts/release-verify.py",
+    'node-version: "24"',
+    "npm@11.19.0",
+    'npm publish --access public --tag "$NPM_TAG"',
+]:
     if required not in release:
         errors.append(f"release.yml: missing release safety control {required}")
+for forbidden in ["NODE_AUTH_TOKEN", "secrets.NPM_TOKEN", "--provenance"]:
+    if forbidden in release:
+        errors.append(f"release.yml: token-based or redundant trusted-publishing control remains: {forbidden}")
 
 devlab = (workflow_dir / "devlab.yml").read_text(encoding="utf-8")
 for required in [