motionloom 2.6.0 → 2.6.1

package/AGENTS.md

@@ -12,6 +12,8 @@ motionloom discovery check --root . --json
 
 Then follow the lifecycle in `SKILL.md`. The repository may coordinate Lottie, dotLottie, Rive, GSAP and Framer Motion, but it does not replace those runtimes. Render evidence, provenance, semantic checks and browser review are separate states. **Do not infer user approval from a passing heuristic, signature, screenshot or quality gate.**
 
+For generated multi-frame animation assets, read [`references/multi-frame-asset-generation.md`](references/multi-frame-asset-generation.md) **before generating frame 2**. Apply it automatically without waiting for the user to ask: keep generated source frames isolated, lock canvas/scale/pivot/baseline from the accepted anchor frame, and pack sprite sheets/atlases only after the isolated frames pass. Before generating any later pose, create or load a `schemas/frame-generation-lock.schema.json` contract and run `motionloom frame-generation-lock validate`; compose each provider-facing frame instruction from that same lock with `motionloom frame-generation-lock compose`. After each generated frame, update the bound frame-geometry evidence and run `motionloom frame-set-preflight`. Six-frame-or-longer actions must never use one generated multi-pose sheet as their production source.
+
 For Dev Lab work, also read [`docs/CHECKLIST.md`](docs/CHECKLIST.md) and [`docs/DEV-LAB-RUNTIME.md`](docs/DEV-LAB-RUNTIME.md). A runnable animation candidate should expose the live runtime descriptor/controls defined there; 0/50/100 PNGs remain evidence/fallback and must not be presented as an interactive runtime when live playback is available.
 
 ## Source of truth

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable MotionLoom changes are documented here. The project follows semantic
 
 ## [Unreleased]
 
+## [2.6.1] - 2026-08-21
+
+### Added
+
+- Add a machine-readable `frame-generation-lock` contract that hash-binds the accepted identity/reference and locks canvas, alpha/color space, apparent size, pivot, footline, safe rectangle, transparent padding, camera/orientation and per-frame output identity before later frames are generated.
+- Add provider-neutral `motionloom frame-generation-lock validate|compose|compose-all` commands and public Agent routing so every pose instruction is deterministically rebuilt from the same lock instead of relying on repeated prose prompts.
+- Expose the strict generated `motionloom frame-set-preflight` command through the public CLI for post-generation alpha-bounds, scale, pivot/footline, guard-band, contamination and source-isolation checks.
+
+### Hardened
+
+- Default generated multi-frame source policy to one isolated PNG per frame; six-frame-or-longer actions must not use one generated pose sheet/contact sheet as production source material.
+- Fail closed on stale reference hashes, duplicate frame outputs, pose-sheet policy violations, path escape, shared/non-isolated sources, post-generation resize and measured apparent-size drift beyond tolerance.
+- Keep atlas packing as a later, separate gate: a clean atlas cannot repair inconsistent or contaminated source frames.
+
+### Verified
+
+- Dedicated Frame Generation Lock CI validates the public CLI, provider instruction composition and strict post-generation preflight.
+- Pull request #18 passed MotionLoom Quality, Security Analysis, Documentation and Package Hygiene, plus the dedicated Frame Generation Lock workflow before merge.
+
+### Boundary
+
+- Frame locks, generated prompts, SHA-256 bindings, preflight passes and atlas checks are deterministic evidence only. They never grant artist authorship, production eligibility, runtime approval, licence authority or user approval.
+
+See the [2.6.1 release note](docs/releases/2.6.1.md) for the generation/preflight contract and migration guidance.
+
 ## [2.6.0] - 2026-08-21
 
 ### Added
@@ -177,6 +202,7 @@ See the [2.0.0 release note](docs/releases/2.0.0.md).
 
 The 1.5.0–1.9.0 milestones established runtime evidence, browser review, Intelligence Core, semantic lint, continuity, telemetry and trust-boundary hardening. Their detailed notes are available in [`docs/releases/`](docs/releases/).
 
+[2.6.1]: docs/releases/2.6.1.md
 [2.6.0]: docs/releases/2.6.0.md
 [2.5.1]: docs/releases/2.5.1.md
 [2.5.0]: docs/releases/2.5.0.md

package/README.md

@@ -15,7 +15,7 @@ MotionLoom is an independent open-source Agent Skill for building UI motion, Lot
 
 > **MotionLoom is not an auto-approval layer.** A valid signature, a passing heuristic, or a successful render proves only the contract it checks. Visual quality, intent, accessibility and PR authorization remain reviewable human decisions.
 
-> **Release posture:** MotionLoom 2.6.0 upgrades Dev Lab into an interactive runtime review workbench with live playback controls, arbitrary project-defined Action Libraries and optional state/transition testing, while preserving deterministic snapshots and explicit human approval. The native macOS/iOS review app remains an unsigned source alpha under `apps/apple/`; the npm package remains the cross-platform Node/Python Skill and documentation surface. Verify npm/GitHub publication metadata separately; passing runtime evidence never implies user approval.
+> **Release posture:** MotionLoom 2.6.1 keeps the interactive Dev Lab from 2.6.0 and adds a proactive Frame Generation Lock for generated multi-frame animation assets. Agents now hash-bind one accepted identity/reference, compose one isolated provider instruction per frame from locked canvas/scale/pivot/footline geometry, and run measured frame-set preflight before atlas packing. The native macOS/iOS review app remains an unsigned source alpha under `apps/apple/`; the npm package remains the cross-platform Node/Python Skill and documentation surface. Generation, runtime and validation evidence never imply artist authorship or user approval. See the [2.6.1 release note](docs/releases/2.6.1.md).
 
 ## Why MotionLoom
 

package/SKILL.md

@@ -7,7 +7,7 @@ description: >-
   validate, review, or deliver animation inside an existing project.
 license: MIT
 metadata:
-  version: "2.6.0"
+  version: "2.6.1"
   target_frameworks: "lottie,dotlottie,rive,gsap,framer-motion,spine,threejs"
   verified_runtimes: "lottie-json,dotlottie-package,svg-cutout-rig,rive,gsap,framer-motion"
 ---
@@ -30,10 +30,10 @@ For Agent or CI composition, consume JSON and preserve the exit code. If the pro
 2. **Plan** — classify the animation, select a framework, and generate a context-bound `motion-spec.json` with timing, easing, loop, accessibility, performance and source authority.
 3. **Source** — resolve an authoritative asset from the project or `assets/library/`. Record attribution, license and checksum in the scene manifest's required `source_binding`; the binding's SHA-256 must match the bytes referenced by `manifest.file`. Do not promote an unknown or placeholder asset to production.
 3a. **Classify asset provenance** — create or load `asset-provenance.json` with `motionloom asset-provenance`. Treat Agent-created material as ingestible only when its origin, generator task, license, file hash and derivation chain are explicit. Use `code_authored` for an authored runtime scene such as GSAP or Framer Motion; it may be runtime-tested and marked `review_required`, but never self-promotes to production eligibility or approval. `ai_generated` may be runtime-tested but is never production-eligible; `ai_assisted` requires human sign-off; `artist_authored` and `production_approved` cannot be self-asserted by an Agent or quality gate. Use `check --mode runtime` for candidate ingest and `check --mode production` only for a full production gate.
-3b. **Compile asset consistency** — when a task contains multi-frame character actions, sprite sheets/atlases or layered maps, create the matching identity, action-set, frame-geometry, atlas and layered-map contracts from `schemas/`. Run `motionloom asset-consistency validate --kind <identity|action-set|frame-geometry|atlas|layered-map> --input <contract> --root <asset-root> --json`. The compiler measures actual PNG alpha bounds, pivot/footline/bbox drift, frame and atlas contamination, region overlap, parallax/z-order, tile seams and camera-safe bounds. A pass is deterministic contract evidence only; it never upgrades provenance, artist authority, production eligibility or human approval.
+3b. **Compile asset consistency and lock multi-frame generation** — when a task contains multi-frame character actions, sprite sheets/atlases or layered maps, create the matching identity, action-set, frame-geometry, atlas and layered-map contracts from `schemas/`. For Agent-generated frame sequences, read `references/multi-frame-asset-generation.md` before generating frame 2 and apply it automatically without waiting for the user to request consistency. Lock exact canvas, apparent scale, pivot, footline, safe rectangle, transparent guard band, camera/orientation and identity from the accepted anchor frame. Generate source frames as separate isolated images; actions with six or more frames must never use one generated contact sheet or multi-pose canvas as production source material. Validate every accepted frame incrementally with `python3 scripts/frame-set-preflight.py --input <frame-geometry.json> --root <asset-root> --json`; a shared source image, non-isolated source rect, scale drift beyond `bbox_drift_tolerance_px`, pivot/footline drift, guard-band violation, contamination or hash mismatch blocks continuation. Only after the isolated frames pass may the Agent pack a sprite sheet/atlas and run the normal atlas contract. For general consistency checks run `motionloom asset-consistency validate --kind <identity|action-set|frame-geometry|atlas|layered-map> --input <contract> --root <asset-root> --json`. The compiler measures actual PNG alpha bounds, pivot/footline/bbox drift, frame and atlas contamination, region overlap, parallax/z-order, tile seams and camera-safe bounds. A pass is deterministic contract evidence only; it never upgrades provenance, artist authority, production eligibility or human approval.
 3c. **Ingest generation artifacts** — before using output from an internal skill or external provider, bind it with a `generation-receipt`, `control-track` and `export-manifest`. Run `motionloom artifact-intake intake --root <project-root> --registry artifact-adapter-registry.json --receipt <receipt> --controls <controls> --export-manifest <export> --json`. For a single-character AI frame sequence, first run `motionloom build-ai-pilot`: it rejects painted checkerboards, all-opaque RGBA, insufficient measured padding and canvas-spanning detached residue. Visually inspect the isolated output too: edge-connected alpha removal cannot prove that disconnected opaque artifacts are absent. The core path makes no provider call and stores no secret; adapters are evidence descriptors. Use `--provider chatgpt` for user-provided ChatGPT bytes so the receipt records `openai.chatgpt` and `user-mediated`; never relabel them as `internal-imagegen`. Both adapters are scaffold-only metadata, not proof of runtime readiness, artist authority or approval.
 3d. **Build the runtime candidate and rig proof** — bind the intake bundle to identity/action/frame contracts with `motionloom runtime-candidate validate --root <project-root> --input <runtime-candidate.json> --json`, then validate the declared skeleton, sockets, actions, events, export target and runtime adapter with `motionloom rig-compatibility validate --root <project-root> --registry rig-adapter-registry.json --input <rig-contract.json> --json`. A passing candidate is `runtime_test_ready` and remains review-required; it cannot stand in for a production rig, human review or `production_approved`.
-4. **Generate** — use the matching template or rig implementation. For body animation, preserve named anatomy, pivot and parent-first hierarchy.
+4. **Generate** — use the matching template or rig implementation. For body animation, preserve named anatomy, pivot and parent-first hierarchy. For generated frame sequences, do not batch the whole action blindly: preserve the locked anchor geometry and accept each frame only after the multi-frame preflight passes; regenerate only the failing frame rather than resizing accepted frames to match it.
 5. **Render** — run the platform-neutral Node entrypoint for scene output, or `node scripts/runtime-adapters.mjs` for the verified Rive/GSAP/Framer Motion adapter matrix. Acceptance requires runtime evidence at 0/50/100%, not a static placeholder. Keep the render metadata beside the snapshots.
 6. **Bind Intelligence Core** — build a framework-neutral `motion-ir.json`, `project-graph.json`, `provenance.json`, `replay-bundle.json`, `semantic-lint-report.json` and `semantic-lint-benchmark.json` with `python3 scripts/intelligence.py`. Select only a capability registry entry whose status is `verified`, whose evidence is fresh and whose compatibility matches the target environment. A confidence score or benchmark result can prioritize investigation; neither can replace deterministic or human acceptance.
 6a. **Harden the trust boundary** — keep artifact and task bundles inside the repository/task root, reject symlinked evidence, bind replay to its exact `task_dir`, `task_id` and scene, select one deterministic report bundle per scene, and require browser candidate/review identity and expiry checks before readiness. The Dev Lab must reject cross-origin or identity-mismatched artifact bases. In strict runtime-observability runs, capture `runtime-telemetry.json` and a read-only `evidence-verifier-report.json`; verifier output must preserve `approval: false`. These checks expose risk and prevent evidence mixing, but do not turn heuristics or evidence integrity into approval.
@@ -68,6 +68,7 @@ Only user-confirmed decisions and outcomes may become durable remediation memory
 - Read `references/reporting-contract.md` when creating task, execution, issue or handoff artifacts.
 - Read `references/runtime-capability.md` before claiming a framework is production-verified.
 - Read `docs/FRAMEWORK-SELECTION.md` and `docs/CATEGORIES.md` when selecting a runtime.
+- Read `references/multi-frame-asset-generation.md` before creating the second generated frame of any multi-frame action; this is an automatic source-generation rule, not an optional user preference.
 - Read `docs/CHECKLIST.md` before marking a scene ready for review.
 - Read `docs/DEV-LAB-RUNTIME.md` before declaring live actions, playback controls, Action Library metadata or state/transition review flows.
 - Read `src/rig/README.md` for character body hierarchy and pose rules.
@@ -91,6 +92,7 @@ Only user-confirmed decisions and outcomes may become durable remediation memory
 - Asset provenance is tiered: `code_authored` is runtime-only and may be `review_required`; `ai_generated` is `runtime_ready` but not `production_eligible`; `ai_assisted` becomes eligible only after human sign-off; `ai_assisted_human_reviewed` remains review-bound; `artist_authored` requires a verified human/artist record and full gate; `unknown` is `blocked`.
 - `production_approved` is a human decision only. An Agent, generator metadata, signed attestation or quality gate may preserve or verify a decision but may never mint it; `approval` remains `false` in machine-generated evidence.
 - Asset provenance binds each declared file to a SHA-256, license/source metadata, generator or derivation chain, runtime evidence and, where applicable, human review. Production checks fail closed on unknown origin, self-asserted artist authority, missing evidence or hash drift.
+- Generated multi-frame source assets are isolated-frame-first. Lock canvas/apparent scale/pivot/footline/safe-rect geometry before frame 2, validate every accepted frame incrementally, and pack atlases only after preflight. Six-frame-or-longer generated actions must not use a single multi-pose source sheet. Deterministic source-geometry failures are blockers and must not be weakened into approval-friendly tolerances.
 - Asset consistency is artifact-first and fail-closed: declared frame geometry, hashes, atlas regions and layered-map bounds must agree with measured runtime/source files. Heuristic warnings remain visible and may become blocking under `--strict`; no consistency result is an approval decision.
 - Artifact Intake is provider-neutral and hash-bound: receipt, control track, export manifest, provenance reference and adapter registry evidence must agree with the actual output bytes. Provider metadata, a prompt, a skill name, a model identifier or an adapter status cannot mint artist authority, production eligibility, runtime proof or approval.
 - A runtime candidate may become `runtime_test_ready` only when its intake and referenced consistency contracts pass. Rig compatibility must bind a supported adapter, skeleton/socket/action/event requirements and runtime evidence; `static-validated` and `scaffold` remain non-production states.
@@ -124,6 +126,11 @@ node scripts/to-dotlottie.mjs --scene-dir src/output/<scene> --output src/output
 motionloom memory init --project-root <project-path>
 motionloom memory recover --project-root <project-path> --json
 
+# Generated multi-frame source preflight: isolated canvases, scale/pivot/footline and guard-band checks.
+python3 scripts/frame-set-preflight.py \
+  --input src/output/<scene>/hero-walk-frame-geometry.json \
+  --root src/output/<scene> --json
+
 # Measure multi-frame, atlas or layered-map consistency from real artifacts.
 motionloom asset-consistency validate --kind frame-geometry \
   --input src/output/<scene>/hero-walk-frame-geometry.json \

package/agent-card.json

@@ -1,7 +1,7 @@
 {
   "card_version": "1.0",
   "name": "motionloom",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "Project-aware animation production with durable Project Memory, provider-neutral Artifact Intake, hash-bound control-to-runtime candidates, tiered asset provenance, framework-neutral motion IR, rig compatibility, runtime verification and telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, interactive Dev Lab review, trust-boundary hardening and deterministic Agent handoff.",
   "capabilities": [
     "project.setup",
@@ -28,6 +28,9 @@
     "asset.provenance.validate",
     "asset.provenance.report",
     "asset.provenance.production-gate",
+    "asset.frame-generation-lock.validate",
+    "asset.frame-generation-lock.compose",
+    "asset.frame-set-preflight",
     "asset.consistency.validate",
     "asset.consistency.frame-geometry",
     "asset.consistency.atlas",
@@ -94,7 +97,8 @@
     "control-track",
     "export-manifest",
     "runtime-candidate",
-    "rig-compatibility-contract"
+    "rig-compatibility-contract",
+    "frame-generation-lock"
   ],
   "output_artifacts": [
     "agent-discovery-report",
@@ -134,11 +138,23 @@
     "project-memory",
     "continuity-report",
     "fix-plan",
-    "pr-patch"
+    "pr-patch",
+    "frame-generation-instruction",
+    "generated-frame-set-preflight-report"
   ],
   "runtime_capabilities": {
-    "verified": ["lottie-json", "dotlottie-package", "svg-cutout-rig", "rive", "gsap", "framer-motion"],
-    "scaffold_only": ["spine", "threejs"]
+    "verified": [
+      "lottie-json",
+      "dotlottie-package",
+      "svg-cutout-rig",
+      "rive",
+      "gsap",
+      "framer-motion"
+    ],
+    "scaffold_only": [
+      "spine",
+      "threejs"
+    ]
   },
   "side_effects": {
     "read_files": "allowed",
@@ -155,24 +171,46 @@
       "url": "https://github.com/LottieFiles/dotlottie-web/blob/main/SKILL.md",
       "role": "official-runtime-reference",
       "trust": "official",
-      "use_for": ["dotLottie runtime API", "worker rendering", "state machines", "slots"],
-      "not_for": ["project planning", "provenance", "PR acceptance"]
+      "use_for": [
+        "dotLottie runtime API",
+        "worker rendering",
+        "state machines",
+        "slots"
+      ],
+      "not_for": [
+        "project planning",
+        "provenance",
+        "PR acceptance"
+      ]
     },
     {
       "id": "text-to-lottie",
       "url": "https://github.com/diffusionstudio/lottie",
       "role": "optional-scaffold",
       "trust": "community-open-source",
-      "use_for": ["scene setup", "live preview patterns", "prompt conventions"],
-      "not_for": ["runtime truth", "context binding"]
+      "use_for": [
+        "scene setup",
+        "live preview patterns",
+        "prompt conventions"
+      ],
+      "not_for": [
+        "runtime truth",
+        "context binding"
+      ]
     },
     {
       "id": "animation-design",
       "url": "https://github.com/b1rdmania/claude-lottie-skill/blob/main/SKILL.md",
       "role": "optional-asset-discovery",
       "trust": "community-open-source",
-      "use_for": ["brand-aware Lottie/Rive search", "series coherence"],
-      "not_for": ["license authority", "runtime verification"]
+      "use_for": [
+        "brand-aware Lottie/Rive search",
+        "series coherence"
+      ],
+      "not_for": [
+        "license authority",
+        "runtime verification"
+      ]
     }
   ],
   "entrypoints": {
@@ -234,10 +272,21 @@
     "remediation_summary": "motionloom remediation-learning summary --history artifacts/remediation-history.jsonl --output artifacts/remediation-summary.json --json",
     "browser_review_prepare": "python3 scripts/review-hook.py prepare --task-dir artifacts/<task-id> --lab-url <internal-lab-url>",
     "browser_review_validate": "python3 scripts/review-hook.py validate --task-dir artifacts/<task-id>",
-    "pr_prepare": "node scripts/pr.mjs <scene>"
+    "pr_prepare": "node scripts/pr.mjs <scene>",
+    "frame_generation_lock_validate": "motionloom frame-generation-lock validate --input <frame-generation-lock.json> --root <asset-root> --json",
+    "frame_generation_lock_compose": "motionloom frame-generation-lock compose --input <frame-generation-lock.json> --frame-id <frame-id> --root <asset-root> --json",
+    "frame_set_preflight": "motionloom frame-set-preflight --input <frame-geometry.json> --root <asset-root> --json"
   },
   "report_contract": {
-    "required_sections": ["completed", "verified", "not_completed", "problems", "structure_review", "next_agent", "browser_review"],
+    "required_sections": [
+      "completed",
+      "verified",
+      "not_completed",
+      "problems",
+      "structure_review",
+      "next_agent",
+      "browser_review"
+    ],
     "artifact_root": "artifacts/<task-id>/"
   }
 }

package/agent-surfaces.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.0",
   "name": "motionloom",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "canonical": {
     "skill": "SKILL.md",
     "agent_card": "agent-card.json",
@@ -14,7 +14,12 @@
       "path": ".agents/skills/motionloom/SKILL.md",
       "canonical": "SKILL.md",
       "load_mode": "alias",
-      "agents": ["codex", "claude-code", "cursor", "opencode"]
+      "agents": [
+        "codex",
+        "claude-code",
+        "cursor",
+        "opencode"
+      ]
     },
     {
       "id": "claude-code",
@@ -22,7 +27,9 @@
       "path": ".claude/skills/motionloom.md",
       "canonical": "SKILL.md",
       "load_mode": "alias",
-      "agents": ["claude-code"]
+      "agents": [
+        "claude-code"
+      ]
     },
     {
       "id": "codex",
@@ -30,7 +37,9 @@
       "path": ".codex/skills/motionloom.md",
       "canonical": "SKILL.md",
       "load_mode": "alias",
-      "agents": ["codex"]
+      "agents": [
+        "codex"
+      ]
     },
     {
       "id": "repository-agent-guide",
@@ -38,7 +47,12 @@
       "path": "AGENTS.md",
       "canonical": "SKILL.md",
       "load_mode": "router",
-      "agents": ["codex", "claude-code", "cursor", "opencode"]
+      "agents": [
+        "codex",
+        "claude-code",
+        "cursor",
+        "opencode"
+      ]
     }
   ],
   "installations": [
@@ -72,10 +86,19 @@
     }
   ],
   "compatibility": {
-    "operating_systems": ["ubuntu", "macos", "windows"],
+    "operating_systems": [
+      "ubuntu",
+      "macos",
+      "windows"
+    ],
     "node": ">=18",
     "python": ">=3.11",
-    "agents": ["codex", "claude-code", "cursor", "opencode"]
+    "agents": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "opencode"
+    ]
   },
   "rules": {
     "canonical_instruction_source": "SKILL.md",

package/bin/motionloom.mjs

@@ -40,6 +40,8 @@ const PYTHON_COMMANDS = {
   "remediation-learning": "scripts/remediation-learning.py",
   "asset-provenance": "scripts/asset-provenance.py",
   "asset-consistency": "scripts/asset-consistency.py",
+  "frame-generation-lock": "scripts/frame-generation-lock.py",
+  "frame-set-preflight": "scripts/frame-set-preflight.py",
   "artifact-intake": "scripts/artifact-intake.py",
   "runtime-candidate": "scripts/runtime-candidate.py",
   "rig-compatibility": "scripts/rig-compatibility.py",
@@ -92,6 +94,8 @@ Use when an animation task needs it:
   remediation-learning   Record or summarize user-confirmed remediation and benchmark history
   asset-provenance       Validate, classify or report asset origin and production readiness
   asset-consistency      Validate frame geometry, atlas contamination and layered-map contracts
+  frame-generation-lock  Validate or compose locked per-frame generation instructions
+  frame-set-preflight    Fail closed on shared canvases, scale drift and frame contamination
   artifact-intake        Bind generation controls, provenance, adapter metadata and exported bytes
   runtime-candidate      Bind intake exports to consistency contracts before runtime testing
   rig-compatibility      Validate rig bones, sockets, actions, events and runtime adapter evidence
@@ -114,6 +118,8 @@ Cross-platform examples:
   motionloom remediation-learning summary --history artifacts/remediation-history.jsonl --json
   motionloom asset-provenance check --input <asset-provenance.json> --root <scene-dir> --mode runtime --json
   motionloom asset-consistency validate --kind frame-geometry --input <frame-geometry.json> --root <scene-dir> --json
+  motionloom frame-generation-lock compose --input <frame-generation-lock.json> --root <asset-root> --frame-id walk.00 --json
+  motionloom frame-set-preflight --input <frame-geometry.json> --root <asset-root> --json
   motionloom artifact-intake intake --root <asset-dir> --registry artifact-adapter-registry.json \\
     --receipt <generation-receipt.json> --controls <control-track.json> --export-manifest <export-manifest.json> --json
   motionloom alpha-isolate <opaque.png> <isolated.png> --report <alpha-report.json>

package/docs/STATUS.md

@@ -4,7 +4,7 @@
 
 ## Current release posture
 
-MotionLoom's repository source and package manifest carry **2.6.0 release metadata**. The publication state of the npm registry and GitHub Release/tag must be verified against the latest release workflow rather than inferred from this document. The repository has a cross-platform CLI, one-command project onboarding, durable Project Memory, Agent interoperability surfaces, artifact-first handoff, runtime evidence, Visual Truth, Remediation Learning, signed attestation, AI-first asset provenance, a truthful code-authored runtime lane and an interactive browser-based Dev Lab review workbench. Dev Lab now supports hash-bound live playback, arbitrary project-defined action libraries, and optional state/transition review flows in addition to deterministic snapshot evidence. The protected manual release workflow verifies package/changelog/release-note alignment before publication.
+MotionLoom's repository source and package manifest carry **2.6.1 release metadata**. The publication state of the npm registry and GitHub Release/tag must be verified against the latest release workflow rather than inferred from this document. The repository has a cross-platform CLI, one-command project onboarding, durable Project Memory, Agent interoperability surfaces, artifact-first handoff, runtime evidence, Visual Truth, Remediation Learning, signed attestation, AI-first asset provenance, a truthful code-authored runtime lane and an interactive browser-based Dev Lab review workbench. Dev Lab supports hash-bound live playback, arbitrary project-defined action libraries and optional state/transition review flows; generated frame sequences additionally use a machine-readable Frame Generation Lock plus fail-closed measured preflight so isolated source geometry is controlled before and after generation. The protected manual release workflow verifies package/changelog/release-note alignment before publication.
 
 The repository is **engineering-ready for continued integration work**, not a universal production certification for every animation framework or every host project. CI status must be read from the latest GitHub Actions run, not inferred from historical audit prose.
 
@@ -30,4 +30,4 @@ Use the following order when sources disagree:
 
 ## Known next work
 
-The bounded analyzer has been exercised against a labeled external corpus; see the [dated evidence note](audits/external-project-corpus-2026-08-13.md). The 2.5.x publication chain established npm/GitHub release provenance, and 2.6.0 adds a substantially richer Dev Lab review surface without weakening the human approval boundary. The highest-value next evidence work is consumer-project review of real action sets and transitions, followed by paired product evaluation across more real projects and repeating the same provenance verification for each new release. Missing external projects are reported as `insufficient_evidence`, never as a pass. None of these items should weaken the user-review gate or convert runtime success or heuristic warnings into approval.
+The bounded analyzer has been exercised against a labeled external corpus; see the [dated evidence note](audits/external-project-corpus-2026-08-13.md). The 2.5.x publication chain established npm/GitHub release provenance, 2.6.0 added the richer Dev Lab review surface, and 2.6.1 adds proactive machine-readable frame-generation geometry control without weakening the human approval boundary. The highest-value next evidence work is consumer-project review of real action sets, transitions and generated frame sequences, followed by paired product evaluation across more real projects and repeating the same provenance verification for each new release. Missing external projects are reported as `insufficient_evidence`, never as a pass. None of these items should weaken the user-review gate or convert runtime success or heuristic warnings into approval.

package/docs/releases/2.6.1.md

@@ -0,0 +1,57 @@
+# MotionLoom 2.6.1
+
+MotionLoom 2.6.1 closes the generated multi-frame consistency gap discovered during real Codex animation work. The release makes frame consistency proactive: the Agent binds one accepted identity/reference into a machine-readable Frame Generation Lock before producing later poses, then validates the real PNG bytes after every generated frame before any atlas is packed.
+
+## What changed
+
+### Frame Generation Lock before generation
+
+Generated frame sequences now have a provider-neutral contract in `schemas/frame-generation-lock.schema.json`. The lock records and verifies:
+
+- accepted identity/reference path and SHA-256;
+- exact canvas dimensions, alpha mode and color space;
+- camera/orientation and apparent character scale;
+- pivot and baseline/footline;
+- safe rectangle, transparent padding and geometry tolerances;
+- ordered frame ids, pose intent and one unique isolated output path per frame.
+
+Agents use `motionloom frame-generation-lock validate` before generation and `motionloom frame-generation-lock compose` (or `compose-all`) to build each provider-facing pose instruction from the same lock. This removes dependence on an Agent remembering or rewriting the geometry prose consistently across frame 2, frame 6 or frame 20.
+
+### Strict preflight after each generated frame
+
+`motionloom frame-set-preflight` is now a public CLI command. It re-measures actual PNG bytes and blocks shared/non-isolated source canvases, stale hashes, contamination, guard-band violations, pivot/footline drift and apparent-size drift beyond the declared tolerance.
+
+The default source policy is deliberately strict: generate one isolated source PNG per frame, validate it, and only then continue. For long actions (including six or more frames), a generated contact sheet or multi-pose sheet must not be cropped into production source frames. Atlas/sprite-sheet packing happens only after all isolated source frames pass.
+
+## Agent behavior
+
+`AGENTS.md` and the canonical Skill route Codex and other compatible Agents through this workflow automatically. The user does not need to remember to ask for equal scale, separate frames, padding, baseline consistency or pose-sheet avoidance.
+
+If one frame fails, the Agent regenerates or repairs that frame under the same lock. It must not silently resize previously accepted frames or weaken tolerances merely to make the set pass.
+
+## Verification
+
+PR #18 passed:
+
+- the dedicated Frame Generation Lock workflow;
+- MotionLoom Quality (including engine tests and cross-platform package checks);
+- Security Analysis / CodeQL;
+- Documentation and Package Hygiene.
+
+The dedicated regression suite covers stale reference hashes, duplicate outputs, pose-sheet policy, path escape, post-generation resize, public CLI composition and strict preflight.
+
+## Trust boundary
+
+This release improves source consistency and evidence quality; it does not change authority. A generator prompt, reference hash, frame lock, preflight pass, atlas pass, runtime render or signed evidence record does **not** create artist authorship, licence authority, production eligibility, production approval or user approval. Human review remains a separate bounded decision.
+
+## Updating a project
+
+After `motionloom@2.6.1` is published, update the project-local development dependency and refresh the managed Agent surface:
+
+```bash
+npm install --save-dev motionloom@2.6.1
+npx --no-install motionloom repair --yes
+npx --no-install motionloom status --json
+```
+
+For a generated multi-frame task, the Agent should then use the Frame Generation Lock before later frames and `frame-set-preflight` after each accepted frame.

package/examples/agent-consumer/frame-generation-lock/hero-walk-lock.json

@@ -0,0 +1,84 @@
+{
+  "schema_version": "0.1",
+  "lock_id": "hero-walk-v1",
+  "asset_identity": "character/hero-male",
+  "action_id": "walk",
+  "reference": {
+    "image": "asset-consistency/assets/hero-frame-00.png",
+    "sha256": "75ce90653a01a23bcfab1aef83647d6364d3edbf6e4a44b84c635338c12b9248",
+    "role": "accepted_frame_anchor"
+  },
+  "canvas": {
+    "width": 8,
+    "height": 8,
+    "color_space": "srgb",
+    "alpha_mode": "straight"
+  },
+  "geometry": {
+    "center_x": 4,
+    "pivot": { "x": 4, "y": 7, "space": "pixels" },
+    "footline_px": 6,
+    "safe_rect": { "x": 1, "y": 0, "width": 6, "height": 7 },
+    "min_padding_px": 1,
+    "target_alpha_bbox": { "width": 4, "height": 5 },
+    "tolerances": {
+      "pivot_px": 0.01,
+      "footline_px": 0.01,
+      "bbox_width_px": 0,
+      "bbox_height_px": 0
+    }
+  },
+  "appearance": {
+    "preserve": [
+      "same character identity and silhouette",
+      "same camera and left-to-right orientation",
+      "same palette, outline weight and apparent scale"
+    ],
+    "forbid": [
+      "second character or neighboring pose",
+      "background, shadow, text, prop or crop",
+      "camera change, mirror, recolor or post-generation resize"
+    ],
+    "pixel_art": {
+      "enabled": true,
+      "nearest_neighbor_only": true
+    }
+  },
+  "source_policy": {
+    "isolated_frames": true,
+    "max_frames_per_image": 1,
+    "allow_pose_sheet": false,
+    "allow_post_resize": false,
+    "reuse_reference": true
+  },
+  "frames": [
+    {
+      "frame_id": "walk.00",
+      "pose": "Contact-right: right foot forward on the shared footline, left leg trailing, natural counter-swing.",
+      "output": "frame-generation-lock/generated/hero-walk-00.png"
+    },
+    {
+      "frame_id": "walk.01",
+      "pose": "Passing: one leg passes beneath the upright body with compact stride and natural counter-swing.",
+      "output": "frame-generation-lock/generated/hero-walk-01.png"
+    },
+    {
+      "frame_id": "walk.02",
+      "pose": "Contact-left: left foot forward on the shared footline, right leg trailing, natural counter-swing.",
+      "output": "frame-generation-lock/generated/hero-walk-02.png"
+    },
+    {
+      "frame_id": "walk.03",
+      "pose": "Passing complement: opposite leg passes beneath the upright body; preserve the same body scale and baseline.",
+      "output": "frame-generation-lock/generated/hero-walk-03.png"
+    }
+  ],
+  "postflight": {
+    "frame_geometry": "asset-consistency/hero-walk-frame-geometry.json"
+  },
+  "trust": {
+    "authority": "ai_generated",
+    "review_only": true,
+    "approval": false
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "motionloom",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "type": "module",
   "packageManager": "pnpm@11.20.0",
   "description": "MotionLoom: project-aware animation Skill with Agent interoperability, graph, provenance, Motion IR, runtime telemetry, Visual Truth, Remediation Learning, DSSE-compatible signed attestation, external evidence verification and Dev Lab review.",
@@ -76,11 +76,11 @@
     "scripts/rive-package-gate.py",
     "schemas/rive-package-manifest.schema.json",
     "examples/agent-consumer/rive-package-gate",
-    "tests/scripts/test_rive_package_gate.py"
-    ,"scripts/build-ai-pilot.py"
-    ,"scripts/isolate-alpha-background.py"
-    ,"tests/scripts/test_ai_pilot_builder.py"
-    ,"tests/scripts/test_alpha_isolation.py"
+    "tests/scripts/test_rive_package_gate.py",
+    "scripts/build-ai-pilot.py",
+    "scripts/isolate-alpha-background.py",
+    "tests/scripts/test_ai_pilot_builder.py",
+    "tests/scripts/test_alpha_isolation.py"
   ],
   "keywords": [
     "animation",
@@ -184,9 +184,9 @@
     "artifact:intake": "node bin/motionloom.mjs artifact-intake intake --root . --registry artifact-adapter-registry.json --receipt examples/agent-consumer/artifact-intake/hero-motion-receipt.json --controls examples/agent-consumer/artifact-intake/hero-motion-controls.json --export-manifest examples/agent-consumer/artifact-intake/hero-motion-export.json --json",
     "runtime:candidate": "node bin/motionloom.mjs runtime-candidate validate --root . --input examples/agent-consumer/runtime-candidate/hero-walk-candidate.json --json",
     "rig:compatibility": "node bin/motionloom.mjs rig-compatibility validate --root . --registry rig-adapter-registry.json --input examples/agent-consumer/rig-compatibility/hero-walk-fixture-rig.json --json",
-    "rive:gate": "node bin/motionloom.mjs rive-package-gate --help"
-    ,"pilot:build": "node bin/motionloom.mjs pilot-build --help"
-    ,"alpha:isolate": "node bin/motionloom.mjs alpha-isolate --help"
+    "rive:gate": "node bin/motionloom.mjs rive-package-gate --help",
+    "pilot:build": "node bin/motionloom.mjs pilot-build --help",
+    "alpha:isolate": "node bin/motionloom.mjs alpha-isolate --help"
   },
   "dependencies": {
     "@lottiefiles/dotlottie-web": "^0.79.0",