stillmade-sdk 0.1.3 → 0.1.5

package/.claude/settings.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/packages/block-cli/ready-gate.js\" --claude",
+            "timeout": 600
+          }
+        ]
+      }
+    ]
+  }
+}

package/.cursor/hooks.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "hooks": {
+    "stop": [
+      {
+        "command": "node packages/block-cli/ready-gate.js --cursor",
+        "timeout": 600
+      }
+    ]
+  }
+}

package/.gitignore

@@ -0,0 +1,2 @@
+.stillmade/ready-cache.json
+.stillmade/gate-state.json

package/.stillmade/sdk-baseline.json

@@ -0,0 +1,65 @@
+{
+ "version": 1,
+ "packages": {
+  "examples/asset-metadata.stillmade.json": "eb47dbde4d3d6857c829c223d56de9f76a3b1af5dffeff2f0ca433ba4678089b",
+  "examples/camera-recorder.stillmade.json": "6300bee739f4ebe1ca23ae43e3f412e9100a048df0df1f65db32eb0365658f27",
+  "examples/caption-from-text.stillmade.json": "3731a15b59043fbebee98416f2474800ef0154aa7873fb494934874ddcd2c705",
+  "examples/captions.stillmade-block": "b0fde32dddaf866f3e540018309aaa00ae56b0e74a53a498fbaf1553ce200bd6",
+  "examples/check-clip.stillmade.json": "cf83af5a3317cd714282939f6cd40cd0c459fb5af97e97e5148f1ca81b4b1b87",
+  "examples/clean-text.stillmade.json": "1d0ab95c652b201540fec45918651cdcffa7a70ea7909a17f8c1ad80345797e2",
+  "examples/comfy-invert.stillmade.json": "126bd3a8a88e14c08ae11c62a441ed099d83e16830e2062f936e14e56cb297eb",
+  "examples/comfy-text-to-image.stillmade.json": "957a616887115984c1888cf9c0eee2fe771dcbf041166ad112fb6c3feb7ad4dd",
+  "examples/custom-interface.stillmade.json": "e824f14f61b21d747a668faae55ad4f8afca9c2942a48436baefaa6925eb5a1b",
+  "examples/describe-image.stillmade.json": "1cf5985eaf7c27150815887c2f4550b3c5c716e9f2badda22ace606c082ac7cd",
+  "examples/docs-only-campfire-narrator.stillmade.json": "87c6a3b643b1ee007487e162aeced6f6302648f4c4a58b015e7df2ab9f2959be",
+  "examples/docs-only-custom-ui.stillmade.json": "4602fd6b9576d364e16b79d2f08b196a251a8e98cf3149576686a96680a5dfe6",
+  "examples/docs-only-gentle-trailer.stillmade.json": "ec081cc8aad654728dcd51257cb69603ec87fcc973ed2b1c5ea3d60a84c4c436",
+  "examples/docs-only-grayscale-original.stillmade.json": "9d04e6187d96ea49bdbdc20a257ccd25c2f3c20fa2359f1bf2de4664d32edf92",
+  "examples/docs-only-grayscale.stillmade.json": "c0453244cae4c7c07b632e420848e9a7f5de2bfc08b5b7350be917f81f4cfe48",
+  "examples/docs-only-image-studio.stillmade.json": "cbcaaa2ed1ff96c2f5310281afe5430215463381e48f36d7cc3b7fbf35f86f44",
+  "examples/docs-only-retained-versions.stillmade.json": "78b84f0e843887c2078ac3271d9c69ea779c31f94aee8d49f7465b8bbafef640",
+  "examples/docs-only-storybook-cover.stillmade.json": "7c94639d9bec5a673fe33f3c8c9b98e1119bea58a2fc8d0a7a98dabf73cc9a35",
+  "examples/export-timeline.stillmade-block": "7d3221dc3ec1491f420773edb0ad8612c650755111e1e8561510b68508976199",
+  "examples/foley-cue.stillmade.json": "5d274b5b646af166e0fc79e3b60004b4cce6ee82b58428dab542537794850df1",
+  "examples/generate-image.stillmade.json": "85c0b68f03535d30c1aacb857197135fc4384c0de50cc777ae02333b34e0d8e2",
+  "examples/generate-video.stillmade.json": "26c3d392ec8ee14ce805078eee4868cdcf53a6c885daa4135bd52fd9bf8caa4b",
+  "examples/grayscale.stillmade.json": "8c901790c25d2544f284a6a43341f72aa6b7e9211bef272b2e1d53c92b9e5faf",
+  "examples/import-media.stillmade-block": "e9642e203080f1a145bec81871525a670f98dd1c8763862f81ab876fb15a656b",
+  "examples/javascript-cloze-quiz": "b36a370c8b53250b9bb04783591661268ec674052bc13bf8cc8910fa27151f83",
+  "examples/javascript-invoice": "853f1464393563ac6e330f4d90cd97f6768d753cbd26b3191bb0838506530ffd",
+  "examples/microphone-recorder.stillmade.json": "ee6d420ab37ccffca42dcea737422e8fd13fe2ead65023740a2e7f7e50459141",
+  "examples/module-action-items": "ba6026bddb7efbd5fc3ccbab994fab435917723e2668a395feb5c98f5a68b1d1",
+  "examples/module-audio-extract": "5afc1ef4a5d6594e312acdaf7e171307a56ad60a20ca28b7cfa25dfc579cc8ab",
+  "examples/module-brand-kit": "cff0dd8b86f8a63a2ff52f192be275fa77794d8e0a6546b0923f31cec4e0ddbd",
+  "examples/module-csv-summary": "0303ea851d3512def907b75f297f11279cc862db8069abed7f9069304155a3cd",
+  "examples/module-notion-to-airtable": "5bc6f3696618e94d3ede339a567bfaea1bd95e84df940f49b7075192502a18cf",
+  "examples/module-opencv": "6e809a597f3ea40877bcf0669b22b0a4e59fe0602a9bbcb77c90ea43bc670330",
+  "examples/module-pdf-shot-list": "b372674aae8ef3392cc679cbfca25a76afcbf2271d5577e4055d2097d8a9ff24",
+  "examples/module-silence-trimmer": "baeb12ae028122d1bd05312c6b0680c33f95c7ea8c176675678a1c4ff005fa86",
+  "examples/module-tempo": "d2b842114e12b50de57f46ff004d6213022120c8dd7908fb7cb3648cd0e1d29a",
+  "examples/module-word-stats": "d89eacc4395bb7eae69f25509454659798946178fdccc5748e383392c370927f",
+  "examples/narrate-script.stillmade.json": "ce88242a4ac699443a8e002856182da2e70dd71e52ba62a9142f0a8fa0c848da",
+  "examples/numbered-takes.stillmade.json": "e4eef4f065f0458ab43413b1a584f887203f5208e83556a7f99c5927383f5d99",
+  "examples/original-photo-editor": "12e88abd9cdeea6eba983699aa81fe8f29aca06bd8cb6d61dece9fb951dd702f",
+  "examples/original-photo-editor.stillmade-block": "32af42f5ac9ce2d27e731984511f71313f1e011ad88318440b91eed838f0c05f",
+  "examples/portable-regexp.stillmade-block": "538930eb4546ac2c0860025dbfc4717317e1d867e66b926c49ecd91dcf3b0666",
+  "examples/portable-regexp.stillmade.json": "fd769d584a6437e2a37c7e4101a031c0fef740afc76ef91f2337e2956fb08a1a",
+  "examples/quieter-clips.stillmade.json": "23b026b267e5da522cc6a3a6af51e166a64fcc1d5391e855704fe1e1f243401b",
+  "examples/research-topic.stillmade.json": "8cfed5313c073db959c2d468ce470bd47ec5e8de4b4ec2def13591b9bf2f723e",
+  "examples/saas-product-launch-reviewed-source.stillmade.json": "2ec264a160faba338f3924965f935ce92c3fdad1fb69719921d7561353b010ab",
+  "examples/saas-product-launch.stillmade.json": "aabec7d8680ef6687980296ab170bbb002c0dc81bc15edebdf9db9750e43eddb",
+  "examples/scene-shots.stillmade.json": "d10a0aebb42ff090035410dc92ab708ffaf50b579edac4aa2f2cf6150b3ef537",
+  "examples/score-a-scene.stillmade.json": "ecc05642d82d2507803389350c7ea574c4c3f761dd629289e0c1c8fa28713292",
+  "examples/screen-recorder.stillmade.json": "86a6c935253c3b06d727ded8295fb3f025ff2ceb4fdb9be72b2118516fbb62ce",
+  "examples/script-draft.stillmade.json": "6c62787353c361ed2e9e255eb03047093ebdc4d678cfeb8be97b8b36e27b4102",
+  "examples/shot-readiness.stillmade.json": "ed73fe9038afaed7c12435368e90001f0bd3cebd8f0e6fe06508c1bb80c8cb7e",
+  "examples/summarize-page.stillmade.json": "fe2956a76d99d5cb10de69b763649064991ac9ac00a8e216db852a725be3e65e",
+  "examples/text-workflow.stillmade.json": "0d53e7498fb47702055e206b75e0111bb1cdcca1b086931e4628e0a3c79e70dc",
+  "examples/thicken-lines.stillmade.json": "7948c6d686de61cd32234a00f12c22229d601360093f50966d50b4e8a4ee759c",
+  "examples/timeline-mixer.stillmade.json": "93220984a88ca553dcf7102ce82b23d16eadda07809a89222a8589506743b5f8",
+  "examples/timeline-polish.stillmade.json": "ababd22681cbd640a4e28469f428161fe739dfca007b87b7563c39c214597997",
+  "examples/transcribe-audio.stillmade.json": "75754c5389dd49ed5b3c784f5ee5b17926c02afbf0c94fb9c0d1fb8830f64c57",
+  "examples/view-react-chart": "a0e7ef5148e386b34e405187761d23f1739809c3d72c68c7c6b4e2193747218e",
+  "examples/word-count.stillmade.json": "6731ab355c4d5918e0b106481a0486303653a6bd19696e52bb21aaac38118d53"
+ }
+}

package/AGENTS.md

@@ -1,8 +1,12 @@
 # Building StillMade Blocks in this folder
 
-This folder is the StillMade Block SDK. Read this file before writing code; it is the same contract StillMade's own AI and importers follow. Scaffold with `node packages/block-cli/cli.js create my-block javascript`, then iterate with `validate my-block` and `test my-block`, check admission with `pack my-block /tmp/my-block.stillmade-block --original`, and finish with `ready my-block`, the same readiness check StillMade runs before a release. `SDK.md` is the complete reference and `PASTE_TO_LLM.md` the detailed authoring guide.
+This folder is the StillMade Block SDK. Read this file before writing code; it is the same contract StillMade's own AI and importers follow. Scaffold with `node packages/block-cli/cli.js create my-block javascript`, then iterate with `validate my-block` and `test my-block`, check admission with `pack my-block /tmp/my-block.stillmade-block --original`, and finish with `ready my-block`, the same readiness check StillMade runs before an install or a release. `SDK.md` is the complete reference and `PASTE_TO_LLM.md` the detailed authoring guide.
 
-Contract `stillmade.block-builder@1.0.0`. Humans, coding agents, imported source, GitHub repositories and generated code all adapt to the Block platform; anything that becomes a StillMade Block obeys this contract.
+## Readiness gate
+
+Do not tell the user a Block is ready, done or working until `node packages/block-cli/cli.js gate .` passes after your last edit, and report the exact status it prints. In this folder Claude Code (`.claude/settings.json`) and Cursor (`.cursor/hooks.json`) run the gate when you finish a turn and send any failures back to you, but only in a session started in this folder: if you downloaded the SDK during the current session, run the gate yourself. Other agents must also run it themselves. If you cannot fix a failure, say plainly that the Block is not ready and list the failing checks.
+
+Contract `stillmade.block-builder@1.3.0`. Humans, coding agents, imported source, GitHub repositories and generated code all adapt to the Block platform; anything that becomes a StillMade Block obeys this contract.
 
 ## Source of truth
 
@@ -12,13 +16,27 @@ Treat the current SDK (`stillmade.block.json` manifest, `packages/block-sdk` con
 
 Before building, check what already exists (`find_existing_blocks` over MCP, or the Marketplace and your library) by the inputs, results and operations the goal needs. Use an installed or reviewed Block that already does it; remix a close one so its license, notices and creator credit stay attached; chain existing Blocks and build only the missing step. Never republish another creator's source without remix lineage: public copies are refused. Build a new Block when nothing fits or the person asks for their own version, and say which similar Blocks you considered.
 
+## One job per Step
+
+A Step is one job: the work between two moments where a person or the outside world must see the result. Start a new Step only at one of three points; everything else is a part of the neighboring Step.
+
+1. **A person works with the result**: reads, edits, picks or approves it (a workspace Block such as a script, a Canvas or an Editor, or an approval). That is why Chat, Bible, Canvas and Editor are four Steps.
+2. **Finding new things turns into handling each one**: the trigger (a schedule or an app event), the app read, its filter and "only new" are the first job; what is done with each item is the next job. A trigger is a setting of the first job, never a Step of its own.
+3. **The result leaves StillMade**: it is sent, posted, published, paid or written into another app. Consecutive writes to the same app, with the glue that shapes data for them, are one job.
+
+A part that only runs in the desktop app cannot share a Step with cloud parts. Before adding a Step, name which of the three reasons makes it separate; if none applies, make it a part of a neighbor. A Step nobody would ever open must not exist on its own. Prefer an app task's own filter (a Gmail query such as `has:attachment filename:png`) to an AI check, and use AI decide only for judgement.
+
+Inside one job, each capability stays its own part: a capability Block performs exactly one hosted operation and a connector one app task, so every part keeps its own permission, approval and credit rules, and StillMade groups the parts of one job into one Step (`groups` in the Project Type). Never invent a combined runtime. When one Block can do the whole job with documented primitives (a JavaScript Block doing several local transforms, a workspace owning its whole document), build it as one Block.
+
+Examples: "every new email with an image becomes a generated image" is two Steps, "Gmail · New emails with images" (When, fetch with an image filter, only new) and "Image from email" (AI write, Generate image); listing When, Fetch, Only new, AI decide, Continue only if, AI write and Generate image as seven Steps splits one job into its parts. "A new Meta lead goes to HubSpot" is three Steps: "Meta Ads · New leads", "Qualify lead" and "HubSpot · Add contact".
+
 ## Define the capability first
 
-Translate the request into an explicit capability contract before implementation: what the Block does; each input with its type, meaning and whether it is required (prefer optional settings with safe defaults over extra required questions); each output with its type and meaning; persistent state; project context it reads; permissions; UI; long-running behavior; expected failures; cancellation; determinism; and whether it needs hosted models, media, desktop tools or shared editing. Keep the public interface as small and general as possible and keep implementation details out of it.
+Translate the request into an explicit capability contract before implementation: what the Block does; each input with its type, meaning and whether it is required (prefer optional settings with safe defaults over extra required questions); each output with its type and meaning; persistent state; project context it reads; permissions; UI; long-running behavior; expected failures; cancellation; determinism; and whether it needs hosted models, media, desktop tools or shared editing. Keep the public interface as small and general as possible (few required inputs, one primary output) and keep implementation details out of it; small means a small interface, never a fragment of a job. A Block that generates images, video or speech declares only its prompt and output: every Step that runs it gets the host’s generation settings (model, quality, length and resolution, voice, speed, how many), saved with the Step, changed on its page or by Chat, and shown with their cost before each run.
 
 ## Blocks compose
 
-A Block is not a mini-app. Its outputs become other Blocks' inputs and its inputs come from other Blocks, project context or the user. Use the typed port system: shared StillMade types (`image`, `video`, `audio`, `asset`, `script`, `shot[]`, ...), a `semantic` meaning on every port, `required` and a short `description`. Mark exactly one primary input and one primary output so Project Type Steps connect automatically, and use `kind: "task"`: a `workspace` Block owns a project document and is never connected automatically. Inputs marked `context` read the project and cannot receive a connection from another Step. Output reusable StillMade values: media references (`{kind,assetId,versionId,url}`) and structured production values with `schemaVersion: 1`, preserving provenance, versions and relationships downstream Blocks need. Never make ordinary users wire JSON, copy IDs, understand internal paths or translate one Block's output into another: `createUniversalResolver()` (the same engine as the Project Type composer) resolves inputs from compatible upstream outputs, permitted project context and, for optional non-context inputs, `StillMade.requestFromUser`.
+A Block is one job: not a mini-app of many jobs and not a fragment of one. Its outputs become other Blocks' inputs and its inputs come from other Blocks, project context or the user. Use the typed port system: shared StillMade types (`image`, `video`, `audio`, `asset`, `script`, `shot[]`, ...), a `semantic` meaning on every port, `required` and a short `description`. Mark exactly one primary input and one primary output so Project Type Steps connect automatically, and use `kind: "task"`: a `workspace` Block owns a project document and is never connected automatically. Inputs marked `context` read the project and cannot receive a connection from another Step. Output reusable StillMade values: media references (`{kind,assetId,versionId,url}`) and structured production values with `schemaVersion: 1`, preserving provenance, versions and relationships downstream Blocks need. Never make ordinary users wire JSON, copy IDs, understand internal paths or translate one Block's output into another: `createUniversalResolver()` (the same engine as the Project Type composer) resolves inputs from compatible upstream outputs, permitted project context and, for optional non-context inputs, `StillMade.requestFromUser`.
 
 ## Use platform primitives
 
@@ -28,9 +46,13 @@ Prefer, in order: an SDK capability; a documented host capability (the hosted op
 
 Never make a Block look functional through hard-coded local paths, developer-machine dependencies, undocumented environment variables, admin or database access, hidden core modifications, direct database writes, fake or mocked production results, hand-prepared test assets that hide incompatibilities, credentials in code, or assumptions about one user's machine. The finished Block must work through the same interfaces available to any installed Block; `permissions.network`, `permissions.filesystem` and `permissions.secrets` must be empty arrays.
 
+## Name it briefly
+
+Give the Block a short, plain name of 40 characters or fewer that says what it does ("Captioned Clip", not "Captioned Business Clip Generator With Review"). The name appears in step bars, Project Type cards and pickers, so put the detail in the description instead. New releases with a longer name do not pass readiness.
+
 ## Interface
 
-If the capability needs UI, use the Block UI SDK: generated `manifest.ui` controls first; a sandboxed custom view (`view.html`/`view.css`/`view.js`) only when the core interaction genuinely needs one. Expose the capability, not the implementation: meaningful controls, sensible defaults, preview, direct manipulation, progress, clear errors and visible outputs. Do not show raw JSON, internal IDs, filesystem details, provider terminology or developer settings unless the Block is itself a developer tool. Follow the host appearance (Light, Dark and White) and the mobile layout contract: one interface for every screen size that fits a 320 CSS-pixel phone without horizontal scrolling.
+If the capability needs UI, use the Block UI SDK: generated `manifest.ui` controls first; a sandboxed custom view (`view.html`/`view.css`/`view.js`) only when the core interaction genuinely needs one. Expose the capability, not the implementation: meaningful controls, sensible defaults, preview, direct manipulation, progress, clear errors and visible outputs. Do not show raw JSON, internal IDs, filesystem details, provider terminology or developer settings unless the Block is itself a developer tool. When a person chooses among options they need to hear or see (voices, music, sounds, fonts, looks, colors, templates or images), let them preview each option before choosing: a sample to play or a thumbnail, from the Block's own files or the host's free samples, never a paid generation. Leave previews out only when the builder states there is nothing to preview. Choices StillMade owns, such as voices and models in the run review, already show their samples. Follow the host appearance (Light, Dark and White) and the mobile layout contract: one interface for every screen size that fits a 320 CSS-pixel phone without horizontal scrolling.
 
 ## Shared editing
 
@@ -66,11 +88,11 @@ StillMade runs the readiness check on every Block it admits: manifest and contra
 
 ## Project Types
 
-A Project Type is an ordered production workflow. Each Step's primary output must be a compatible input for the next Step, secondary values come from permitted project context, and every member Block obeys this contract. Install Blocks into a realistic Project Type: project chat must understand each Step, inputs must resolve intuitively, outputs and execution state must be visible, failures must be diagnosable, and the user must be able to continue through the workflow.
+A Project Type is an ordered production workflow. Each Step's primary output must be a compatible input for the next Step, secondary values come from permitted project context, and every member Block obeys this contract. Install Blocks into a realistic Project Type: project chat must understand each Step, inputs must resolve intuitively, outputs and execution state must be visible, failures must be diagnosable, and the user must be able to continue through the workflow. Group the parts of one job into one Step instead of listing helper parts as Steps; most automations are two to four Steps.
 
 ## Readiness report
 
-Finish with a Block Readiness Report: capability, contract (inputs, outputs, permissions, dependencies), platform APIs used, tests actually performed and their results, the composition test (upstream, Block, downstream), known limitations, unsupported requirements and any platform gap with its smallest general primitive. Choose exactly one status: PRODUCTION READY (every applicable check passed), READY WITH DOCUMENTED LIMITATIONS (works reliably within stated boundaries), BLOCKED BY PLATFORM CAPABILITY (needs a missing generic primitive) or FAILED. Never label a Block production ready to satisfy a request, and never claim a check ran when it did not.
+Finish with a Block Readiness Report: capability, contract (inputs, outputs, permissions, dependencies), platform APIs used, tests actually performed and their results, the composition test (upstream, Block, downstream), known limitations, unsupported requirements and any platform gap with its smallest general primitive. Report exactly one status, the one StillMade's readiness check returned (`ready` in the SDK CLI, `check_block_readiness` over MCP), never one you chose: PRODUCTION READY (every applicable check passed), READY WITH DOCUMENTED LIMITATIONS (works reliably within stated boundaries), BLOCKED BY PLATFORM CAPABILITY (needs a missing generic primitive) or FAILED. Never label a Block production ready to satisfy a request, and never claim a check ran when it did not.
 
 ## Definition of done
 

package/AGENT_CONTROL.md

@@ -106,7 +106,8 @@ Import `inspectAgentBlock`, `inspectAgentPorts`, `inspectAgentDocument`,
 presence paths; omitted children are explicit, and text/media contents stay out.
 `agentInputChoices(manifest, locked)` describes supported editable ports and UI
 choices. `parseAgentInput(manifest, {field, value}, {locked, busy, disabled})` checks
-types, numeric limits, choices and size before returning a copied value. This
+types, numeric limits, choices and size before returning a copied value. A script
+or brief input also accepts plain text, returned as `{schemaVersion:1, text}`. This
 helper does not grant permission, save a change, or authorize execution.
 
 Trusted native modules can use `defineNativeAgentAdapter` and

package/BROWSER_APPLICATIONS.md

@@ -35,6 +35,32 @@ automatic permission. Arbitrary development servers, native Node modules,
 service workers, threaded WASM and full-stack backends need distinct profiles
 and verified host capabilities. Existing SDK restrictions are not removed.
 
+The separately identified `desktop-browser-application/2` bundle may declare
+`features: {wasm:false, srcdocFrames:true}`. A trusted stage and runtime use this
+exact declaration to enable at most eight simultaneous direct `about:srcdoc`
+frames (32 over the page lifetime), with inline script needed for a preview
+document. Other frame URLs, nested frames, popups and local web workers remain
+denied. The trusted controller bootstrap runs only in the top document. This
+profile does not authorize ambient network requests or installation; exact
+source review, isolated execution and output review still apply. An authoring
+model can request it, but it cannot enable it by changing a prompt or manifest.
+
+`desktop-browser-application/3` adds `localWorkers:true` (and an explicit
+`srcdocFrames` boolean). It permits only dedicated workers whose script URL
+exactly names a bundled JavaScript asset on the application asset server. The
+target policy binds each worker to the exact parent page and browser context,
+requires a paused attachment, installs recursive target monitoring before
+resume, limits active and lifetime workers, and fails the session on an unknown
+target or unconfirmed detach. The host-controlled CSP permits same-origin
+workers and same-origin connections; the asset server serves only verified
+bundled files. The isolated job's private network namespace remains required.
+Chrome does not expose `Fetch.enable` on worker CDP sessions, so worker egress
+is enforced by the host CSP, exact local asset server and private network
+boundary, not by a worker-session Fetch interceptor. Blob, remote, shared and
+service workers remain denied. A local Chromium probe exercises the target
+policy and asset server, including a denied second loopback origin. A
+provisioned StillMade worker run and application-level review remain required.
+
 Inspect compiled dependencies as well as asset extensions. For example, a
 checked-in editor bundle may contain base64 WebAssembly or dynamically create
 workers without shipping any `.wasm` file. The current asset/declaration check
@@ -42,7 +68,8 @@ does not prove those paths are absent. Admission must record which paths are
 needed, and the selected runtime must enforce its CSP, target and resource
 policy when code executes. A dead or explicitly unavailable feature is different
 from a verified fallback. The current development Linux worker rejects declared
-WASM and blocks worker creation; it does not establish general WASM support.
+WASM; the new worker profile has not been provisioned or admitted for an
+installed Block.
 
 ## Adapter lifecycle and completion
 
@@ -52,6 +79,47 @@ original application APIs and controls. Keep autosave separate from explicit
 completion; mounting a UI or retaining the original input is not evidence of
 the requested transformation.
 
+For compiled applications, inspect where the original UI owns its live state.
+If that state is private to a bundled module, a bounded source edit may expose
+a data-only bridge for the Block-owned adapter. The edit must target an exact
+inspected pinned file and be rebuilt under the sealed source identity. The
+adapter should seed inputs and restore checkpoints through the original state
+path, then export the state changed by real UI actions. A global store bridge
+is not itself host storage or permission authority. Include binary project
+files or fail explicitly; silently dropping them makes saved state and export
+incomplete. Declare structured output meaning and schema so Revolver can
+distinguish a website-source project from arbitrary JSON. Browser-downloaded
+ZIP bytes are not a connected artifact until a trusted host materializer owns
+and validates them; a JSON/base64 field must not be presented as a ZIP.
+
+The candidate reviewer can perturb a primary `plain_text` input, or insert a
+valid HTML comment into a primary `html_document` input, in a fresh isolated
+session. It compares only declared text or schema-bearing structured output
+ports for the same export operation. A fixed JSON project now fails this check
+even when its original UI and save/reopen path appear to work. An arbitrary
+custom text format does not receive a guessed mutation. This diagnostic checks
+that output responds to changed input; it does not establish that the result
+has the correct application-specific meaning.
+
+When a Block receives an upstream value and also stores user edits, checkpoint
+both the editable document and the upstream value that seeded it. Reopen edits
+only when the mounted upstream value still matches; otherwise apply the new
+upstream value and rerun the original application's render path. A model must
+not treat the application's `localStorage` as the host's project or placement
+state. If rendering is debounced or asynchronous, `mount` must wait for the
+new result (or a real error) before acknowledging success, and `execute` must
+read the completed original result rather than an old preview. Runtime review
+should vary the input after a saved edit to catch stale-result replay.
+
+Exercise original export buttons under the exact runtime CSP as well as the
+declared adapter operations. Displaying SVG is weaker evidence than exporting
+PNG: embedded XHTML `foreignObject` labels can taint the canvas when that SVG
+is rasterized. An adapter may repair the original action with a bounded,
+reviewed conversion, but must compare the visible result and downloaded bytes.
+An operation that succeeds while the corresponding original control fails does
+not establish a preserved application interface. Clipboard actions require a
+separate approved capability and behavioral review.
+
 `prepareBrowserApplicationMount` binds a mount request to the exact package,
 bundle, input and state revision. A mount acknowledgement carries no outputs and
 cannot pass execution validation.
@@ -64,21 +132,70 @@ current permission/state checks. `validateBrowserApplicationExecutionResult`
 and the saved-record validator check those bindings; their result explicitly
 keeps `independentlyVerified:false`. Arbitrary callers can fabricate JSON, so
 these pure helpers do not authenticate evidence or authorize adoption.
+An application package must declare at least one typed output, and each
+completed operation must actually return at least one declared output even if
+the port is optional. A nonempty value can still be semantically wrong; review
+must compare representative saved and exported results with the original app.
 
 `runBrowserApplication` requires an explicitly supplied trusted executor. It
 never falls back to evaluating source in the host or treating a mounted page as
 success. Cancellation and timeout signal the executor; actual process/resource
 termination is the executor's responsibility and needs independent verification.
 
+### Media output candidates
+
+An adapter exporting an `image` port returns actual PNG bytes as
+`{encoding:"base64",mimeType:"image/png",data:"..."}`. It must never return an
+`assetId`, `versionId`, URL or receipt of its own. The worker checks the shape
+and keeps the result an **untrusted candidate**. The host-side
+`materializeBrowserApplicationOutputs` boundary decodes and checks the image,
+writes it through trusted storage, reads back the exact bytes, checks the current
+execution revision again, and only then creates the typed image reference that
+Revolver can carry. Other media types still require materializers. The local
+worker, browser-control pipe and guest output envelope now each accept a
+bounded 4 MiB PNG after base64 encoding inside an 8 MiB frame; the session
+traffic cap is 32 MiB. Inputs and saved state retain their smaller limits.
+Large candidate transport was checked offline across those layers, while
+miniPaint's real PNG was separately decoded and materialized. A durable S3
+output adapter exists but is not wired into installed production execution.
+Installed image executions now reserve an 8 MiB aggregate maximum in the
+server-owned ledger before dispatch, under the account-wide lock. The
+reservation is compared with the account's storage-plan allotment and remains
+charged if dispatch becomes uncertain. A reservation proven never dispatched
+can be closed without consuming capacity. A completed run records verified
+stored bytes. This ledger measures application outputs separately from other
+project media; output deletion and plan-wide reconciliation still need the
+production lifecycle before enabling installed image exports.
+The desktop session now accepts a host-only `store.materializeOutputs` callback
+between isolated execution and completion. It rejects guest-minted image asset
+IDs before that callback, supplies the exact request and current authority
+binding, rechecks access afterward, and accepts only a valid typed result.
+The manager forwards this callback from trusted main-process composition; a
+real PNG was tested through decode, write, readback and receipt validation,
+including revocation after storage read. The installed HTTP host does not yet
+supply a media store, so this is a supported host boundary, not a production
+image export claim. Candidate review also lacks that store today.
+
 ## Guest registration
 
-`installBrowserApplicationGuest({target,operations,messageBytes})` is the
+`installBrowserApplicationGuest({target,operations,messageBytes,outputBytes})` is the
 framework-neutral lifecycle dispatcher for a trusted bootstrap. It installs only
 `target.stillmadeApplication.register(adapter)` and returns a separate controller
-to that bootstrap. It does not install a runtime or grant host access.
+to that bootstrap. The host may select a larger output-only envelope up to
+8 MiB; the ordinary message limit still applies to inputs and saved state.
+It does not install a runtime or grant host access.
 
 The Block-owned adapter registers exactly these four methods once:
 
+For a new application with several export choices, each bundle operation maps
+to the output ports it actually produces, for example
+`{id:"png.export",kind:"export",outputs:["png"]}`. Ports absent from some
+operations must declare `required:false` in the shared manifest. The host
+requires every mapped operation to return exactly its listed ports before
+materializing media or committing a completion. Older bundles with only
+`{id,kind}` retain their original contract; the new mapping is additive and
+does not change published package bytes.
+
 | Method | Adapter result |
 | --- | --- |
 | `mount({inputs,state,signal})` | Restore the original UI and return exactly `{mounted:true}`. |
@@ -122,6 +239,14 @@ Method Draw is being used to study the first complete static editor route.
 Its remote fonts, global localStorage and SVG import behavior require explicit
 adaptation; an original-page baseline is not a completed Block integration.
 
+The worker now has a separate **candidate-review** stage identity for an
+unlisted, digest-verified browser package. Its driver and unit entry are selected
+by trusted code, while the installed supervisor and runner retain the exact
+reviewed-source registry. This is the source boundary needed to test generated
+adapters without editing a per-repository allowlist. A root-owned review
+supervisor, complete behavior gate, and admission-to-install handoff are still
+missing; staging a candidate does not run or install it.
+
 ## Reproduce the reviewed package outside the repository
 
 The downloadable SDK zip includes `packages/block-sdk/browser-application.js`

package/GITHUB_APPLICATIONS.md

@@ -17,8 +17,98 @@ The in-app full-application inspection pins source and retains an inventory of
 code, binary assets, dependency manifests, lockfiles, symlinks and submodules.
 It returns `not-built`, including unfinished feature and runtime checks. A complete
 file inventory is neither a complete dependency checkout nor a successful build.
-Inspection uses public unauthenticated GitHub APIs; it does not authorize private
+Inspection first uses public unauthenticated GitHub APIs; it does not authorize private
 repository access, install dependencies, execute scripts or charge model credits.
+An exact commit's complete, verified public tree and Git-blob-checked source
+bytes may be reused from a 15-minute, 24 MiB process-local cache across the
+inspection, build and source-recheck phases. Branch/HEAD resolution, partial
+trees, failed reads and unverified bytes are not cached. Source review reports
+`pinned-cache` when it uses that evidence instead of claiming a fresh API read.
+The cache avoids repeated anonymous requests for one pin; a cold repository
+still depends on GitHub availability and its rate limit, and another server
+process has its own cache. It is not a substitute for an authenticated or
+archive-backed source acquisition route at larger scale.
+When the public REST API is rate-limited, the application import can instead
+resolve the public branch or tag through bounded Git protocol v2 HTTP and inspect a
+GitHub codeload archive at the resulting commit. The host checks the archive's
+commit marker, tar structure and paths, computes Git blob identities from
+actual bytes, rejects sensitive or oversized selected files, and labels this
+evidence `pinned-github-archive`. A named ref uses two bounded Git HTTP requests
+before the archive request; an exact commit needs only the archive request.
+This fallback is capped at 12 MB compressed and 40 MB expanded, requires no
+Git executable on the server, and refuses repositories with
+submodules because the archive omits their Git identities. Larger archives
+must use the Git tree route or a future bounded acquisition worker. Archive
+inspection is source evidence only; it does not approve execution or install.
+The REST and fallback phases use the same caller-owned HTTP transport when one
+is provided. Reported request use includes both phases. Reported byte use
+includes REST and archive bodies; the two Git-ref responses have separate
+64 KiB limits and are not included in that aggregate byte figure.
+For a complete Git tree containing submodules, inspection reads the pinned
+`.gitmodules` blob, accepts only canonical or relative GitHub repositories,
+and follows each exact Gitlink commit (including nested modules) within one
+48-request, 32 MB metadata and 24-placement bound. It reports each dependency
+commit separately. This verifies dependency identities and file inventories;
+the isolated builder must still acquire and hash the actual dependency bytes
+before running their code. Missing mappings, outside hosts, incomplete trees
+and exhausted bounds fail with a specific source-graph reason.
+The larger isolated-build acquisition profile can verify a complete archive
+against that Git tree, including ordinary files and symlink identities. GitHub
+codeload can omit files under `export-ignore` or transform exported text; those
+paths must be restored from exact-commit raw transport and independently
+rehashed to their pinned Git blobs. The raw route is limited to 64 files and
+8 MB, denies sensitive paths, uses no credentials or redirects, and cannot
+grant execution. All archive and recovered bytes are checked before a trusted
+staging callback receives any file. This profile has not yet been connected
+to a complete native build or installation workflow.
+The inspection `readable` flag controls what the LLM can request as source
+text. It is not a build-file filter. A separately checked `stageable` flag
+allows oversized but bounded files and inert symlink-target blobs into the
+private build-source quarantine; sensitive paths remain excluded. Symlink
+targets are stored as bytes, not followed or created as active filesystem
+links. A later materializer must validate every link target before use.
+The isolated-worker source-closure orchestrator groups identical pinned
+repositories across submodule placements, rechecks each exact commit, and
+hands verified bytes to a trusted quarantined staging callback under one
+request, network-byte, file, staged-byte and deadline budget. Its receipt is
+`execution:not-run` and `installable:false`; a partial stage has no activation
+authority. The connected private staging writer uses content-addressed inert
+blobs and rereads each file before sealing it. A complete closure produces a
+read-only manifest bound to a host-retained digest; reopening the quarantine
+audits every blob against its Git identity. Partial stages cannot be sealed.
+The inert tree planner checks file/directory namespace collisions and resolves
+symlink targets only within the exact staged closure, without expanding source
+paths on the host filesystem. A bounded transfer format then packs each
+audited Git blob once and binds its canonical namespace, modes, link targets,
+source digest and sealed-manifest digest into a SHA-256 bundle. The Linux
+materializer independently verifies the bundle and Git hashes, creates files
+through private directory descriptors, creates links only after file writes,
+and audits the final tree. A synthetic tree with an executable and links ran
+in the isolated VM; a changed bundle was rejected before staging. Natron's
+allowed exact closure also materialized there: 6,445 files and 654 directories.
+This development path is not yet a trusted install or execution admission:
+the stage owner can still change its read-only modes, and build recipes,
+dependencies, GUI sessions and result contracts need separate host control.
+For an npm browser candidate, inspection also reads the pinned `package.json` and
+`package-lock.json` through the same bounded source verifier. It checks that root
+dependency declarations agree and distinguishes integrity-pinned npm tarballs,
+exact-commit GitHub dependencies and unresolved sources. This is a build plan,
+not dependency acquisition or build admission. The pinned miniPaint case has
+517 npm tarballs and one exact-commit GitHub dependency; an isolated builder
+must acquire and verify both kinds before executing its Webpack build.
+Before rebuilding, the importer checks whether the pinned repository already
+contains an HTML entry referencing a checked-in local browser bundle. It selects
+the referenced scripts/styles and bounded local media resources, then verifies
+every selected byte against the Git tree. This can preserve a real original UI
+without executing a package script. It is still only a candidate: dynamic
+resource requests, operations, state and output must pass isolated review.
+miniPaint's checked-in bundle passed a separate local browser probe with a real
+brush stroke, changed PNG bytes and exact document restore in a second page.
+That probe is not an installed Block or a host-enforced multiplayer result.
+The local acquisition module also re-read miniPaint's exact pinned lockfile and
+verified all 518 dependencies (about 18.2 MB) against registry SHA-512 or Git
+blob identities. Those bytes were discarded after the probe. A managed stage,
+isolated framework rebuild and reviewed execution admission are still missing.
 
 Use the exported `defineRepositoryApplication` contract to record the requested
 scope, interface, versioned route and source-backed feature ledger. Use
@@ -28,6 +118,80 @@ verification. The assessor always reports `executionPerformed:false` and
 `independentlyVerified:false`. A model cannot certify its own integration by
 filling in that object.
 
+For a generated browser application, put the exact GitHub repository URL,
+40-character commit and application folder in
+`manifest.provenance.githubSource`. The SDK checks its shape and the source
+reviewer independently matches it to the pinned Git tree and every bundled
+original asset. This field travels with the versioned package; it is source
+identity, not permission, a license decision or evidence that the adapter ran.
+Older uninstalled candidates without the embedded pin can still undergo
+source review, but must not be promoted to production solely from that legacy
+shape.
+
+For a framework application built from pinned source, the unreviewed candidate
+also carries `manifest.provenance.browserBuild`: the verified source-closure
+digest, build-script digest, output directory and digest of every original
+compiled file. A model may author the lifecycle adapter, but cannot supply the
+build result or certify it. A trusted host must independently rederive the
+Git source closure, verify the exact isolated build and reconstruct the full
+application bundle before running the ordinary interface, state and output
+review. The current SDK handoff and internal verifier implement these checks;
+the production build supervisor and review issuer are not yet connected to the
+GitHub button. A build or source receipt alone does not make a Block installable.
+An internal npm job now composes the sealed source bundle, Linux materializer,
+integrity-pinned registry and exact-commit GitHub package stages, and the
+network-denied build runner. It checks each identity again between stages and
+returns compiled bytes with no installation authority. The Linux npm profile
+now caps selected packages at 768, verified expanded package bytes at 256 MiB,
+and package files at 18,000. It caps compiled files at 16 MiB total, each
+file at 8 MiB, and the encoded build report at 24 MiB, with a root `dist`,
+`build` or `out` entry. It
+omits a lockfile package only when that package is explicitly optional and
+incompatible with the worker's OS, CPU or libc; the root launcher rechecks
+that selection against the pinned lock before execution. It has not run
+miniPaint's build, and still needs the durable supervisor lease and cleanup
+needed for a production
+button. The stage-order tests are offline; no real framework repository has
+passed this composed job. The worker also exposes a trusted rebuild callback
+for the compiled-candidate source verifier; the caller must run it under the
+same host-owned supervisor rather than accepting a browser-supplied report.
+
+A successful framework build does not prove that all runtime assets are local.
+For example, CanvasCode compiled from its pinned source but loaded Monaco from
+a CDN; the isolated network-denied browser showed its preview while the editor
+remained unavailable. Manually bundling the already pinned Monaco dependency
+restored the editor and real ZIP export in an offline development VM. The
+internal compiled-authoring path can now ask a model for complete replacements
+or unique exact-text edits of inspected source files, each bound to its
+original Git SHA-256. The host derives full replacement bytes for an edit. A root-owned
+stage checks and seals replacement bytes separately from the immutable Git
+source; the network-denied build applies them in scratch space. Patch identity
+must match in the compiled candidate and an independent rebuild. Package
+manifests and lockfiles cannot be patched in this profile. The root-owned patch
+stage, service connection, automatic runtime-failure repair and full behavior
+review remain unverified. A model-suggested CDN exception is not equivalent to
+localizing and verifying those assets.
+CanvasCode also requires a `srcDoc` preview frame and local Monaco language
+workers. The original browser-application profile declares only single-thread
+WASM; its CSP and target guard deny frames and workers. A successful ordinary
+Chromium smoke therefore cannot establish host-runtime compatibility.
+
+The new browser-application v2 source profile now supports a declared, bounded
+direct `srcdoc` frame. The compiled authorer can request that feature, and
+independent source verification reconstructs the exact profile from the pinned
+build. A local Chromium probe confirmed that the v2 CSP runs an inline preview
+script, reports the expected direct child frame, and keeps the top-only trusted
+bootstrap out of the child. The existing v1 CSP and frame guard remain closed.
+This is development-browser evidence, not a provisioned StillMade worker run.
+CanvasCode also needs local Monaco language workers. Browser application v3
+now declares exact bundled dedicated worker scripts, and the trusted target
+policy admits them only when paused under the original page and context. A
+local Chrome probe ran a worker through that policy and the hashed asset
+server, while CSP denied a second loopback origin. The original v1 and v2
+profiles still deny workers. This is not a provisioned StillMade worker test,
+CanvasCode's own worker behavior has not passed runtime review, and its full
+application import remains uninstalled.
+
 ## Choose an actual runtime
 
 | Source | Current boundary |
@@ -45,6 +209,18 @@ adapter. The exact reviewed Method Draw source has a private desktop install,
 editing and SVG export path. Other applications require separate source,
 runtime and result review; package validation alone is insufficient.
 
+The separate Natron ARM64 development build (repository evidence `artifacts/repository-acceptance/natron-native-gui-dev-build-2026-09-29.json`)
+shows that a Qt5/PySide2 native GUI can compile and open in a local VM after
+architecture and Python-home adaptation. Its source tree is not yet the
+complete sealed Git closure, and its OCIO configs and OpenFX plugins are
+missing. This is runtime feasibility evidence, not approval to install a
+GitHub-authored Block or a replacement for the full application.
+The later exact-source-to-GUI check (repository evidence `artifacts/repository-acceptance/natron-exact-tree-to-gui-2026-09-29.json`)
+replaced that archive input with the verified allowed Git closure and compiled
+a separate copy carrying only the recorded ARM64 patch. The GUI opened; the
+same binary also saved and reopened a native `.ntp` project. The missing
+plugins, color config and host-enforced Block contracts remain.
+
 ## Keep the original appearance
 
 For an eligible restricted view, place this option in `src/view.json`:
@@ -77,6 +253,13 @@ contract and the complete runtime message limits. Large or referenced media
 still needs the host's authenticated asset resolution and materialization path;
 a guest-local data/blob URL is not a durable shared asset.
 
+For browser applications with several export actions, declare which output
+ports each action produces. An SVG export can map to `svg` and a PNG export to
+`png`; mark each shared-manifest port `required:false` when another action
+does not return it. The host checks the exact action-to-port mapping before
+publishing output or storing media. A generated adapter's declaration alone
+does not prove either export works.
+
 Map existing app behavior to SDK input, shared-document and output interfaces.
 Do not recreate the application's logic in the shared host or add a special
 Block-ID branch. Persist editable state through declared host services and keep