Prepare Renderoni 0.9 beta

.github/workflows/ci.yml

@@ -6,9 +6,22 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  test:
-    runs-on: ubuntu-latest
+  # Types, tests and gameplay determinism on every supported OS.
+  # The literal golden hash is only asserted on the pinned matrix
+  # (Node 22 / Linux / x64). The other runners assert deterministic gameplay
+  # outcomes and run-to-run equality instead.
+  verify:
+    name: Verify (Node 22, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
       - uses: actions/checkout@v4
@@ -22,11 +35,82 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Report determinism platform
+        run: node scripts/report-determinism-platform.mjs
+
       - name: Typecheck
         run: npm run typecheck
 
-      - name: Build
-        run: npm run build
+      - name: Determinism gate (golden hash pinned on Linux x64 only)
+        run: npm run gate:determinism
+        env:
+          # Fails the Linux x64 job if platform detection ever stops enforcing
+          # the pinned digest, instead of silently downgrading to shape checks.
+          RENDERONI_REQUIRE_EXACT_HASH: ${{ (runner.os == 'Linux' && runner.arch == 'X64') && '1' || '0' }}
 
-      - name: Run 6 MVP Validation Gates & Archetypes
+      - name: Test suite
         run: npm test
+
+      # The full beta gate remains on Ubuntu because its consumer installs and
+      # browser bundle checks are expensive. Exercise every script that invokes
+      # npm/npx directly on Windows so .cmd launching stays covered in CI.
+      - name: Windows portable release scripts
+        if: runner.os == 'Windows'
+        run: npm run build && npm run test:readme-examples && npm run gate:package && npm run gate:release
+
+  # The aggregate release gate: determinism, MCP, lifecycle, tests, build,
+  # README examples, packed consumers, console build and load budgets.
+  beta-gate:
+    name: Beta release gate
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run 0.9 beta gate (never publishes)
+        run: npm run gate:beta
+        env:
+          RENDERONI_REQUIRE_EXACT_HASH: '1'
+
+      - name: Upload console build
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-web
+          path: dist-web
+          retention-days: 7
+          if-no-files-found: ignore
+
+  security:
+    name: Security & release contract
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit production dependencies
+        run: npm run gate:security
+
+      - name: Build package
+        run: npm run build
+
+      - name: Release contract dry run (no publish)
+        run: npm run gate:release

.github/workflows/publish.yml

@@ -31,7 +31,39 @@ jobs:
       - name: Build packages
         run: npm run build
 
+      - name: Verify release contract (dry run, publishes nothing)
+        run: npm run gate:release
+
+      - name: Audit production dependencies
+        run: npm run gate:security
+
+      - name: Determine npm dist-tag
+        id: npm-tag
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if [[ "$VERSION" == *-* ]]; then
+            echo "Publishing prerelease $VERSION under the 'beta' dist-tag (never 'latest')."
+            echo "tag=beta" >> "$GITHUB_OUTPUT"
+          else
+            echo "Publishing stable $VERSION under the 'latest' dist-tag."
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Confirm the resolved dist-tag matches the package version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          RESOLVED=$(node -e "import('./scripts/check-release-contract.mjs').then((m) => console.log(m.resolveDistTag(require('./package.json').version)))")
+          if [[ "${{ steps.npm-tag.outputs.tag }}" != "$RESOLVED" ]]; then
+            echo "Workflow resolved '${{ steps.npm-tag.outputs.tag }}' but the release contract resolved '$RESOLVED' for $VERSION." >&2
+            exit 1
+          fi
+          if [[ "$VERSION" == *-* && "$RESOLVED" != "beta" ]]; then
+            echo "Refusing to publish prerelease $VERSION under '$RESOLVED'." >&2
+            exit 1
+          fi
+          echo "$VERSION will be published under the '$RESOLVED' dist-tag."
+
       - name: Publish to npm
-        run: npm publish --access public --provenance
+        run: npm publish --access public --provenance --tag ${{ steps.npm-tag.outputs.tag }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

AGENTS.md

@@ -11,7 +11,7 @@ Renderoni is structured in 4 strict hierarchical layers:
   - **Rule 1**: NEVER call `Math.random()`, `Date.now()`, `performance.now()`, or `requestAnimationFrame()` inside simulation logic or entity updates. Always use `engine.prng` and `engine.clock.tick`.
   - **Rule 2**: NEVER bypass the dual-buffer transform pipeline. Write physics transforms into canonical buffer slots, never directly into render scene graphs.
 - **L1: Batteries & Subsystems (`src/presets/`, `src/animation/`, `src/audio/`, `src/vfx/`, `src/ui/`, `src/scene/`)**: High-level declarative presets (`body`, `sensor`, `light`, `kccPlayer`, `dynamicPlayer`, `proceduralModel`) and compact scene inventories for prompt → img2threejs factories.
-- **L2: Agent Tooling & MCP (`src/mcp/`, `src/testing/`)**: Stdio/SSE Model Context Protocol server, custom Vitest matchers, and headless CLI verification.
+- **L2: Agent Tooling & MCP (`src/mcp/`, `src/testing/`)**: Stdio Model Context Protocol server, custom Vitest matchers, and headless CLI verification.
 - **L3: Web Application & Demos (`src/demo/`, `index.html`)**: Interactive playground and multi-archetype web showcases.
 
 ---

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to Renderoni are documented in this file.
+
+## 0.9.0-beta.1
+
+- First installable beta package with explicit ESM subpath exports.
+- Three.js and `@dimforge/rapier3d-compat` are required peer dependencies.
+- Added stable `renderoni/input` and `RenderoniEngine` from `renderoni/core`.
+- Split framework-free assertion checks (`renderoni/testing`) from Vitest matchers
+  (`renderoni/testing/matchers`). Vitest is optional unless matchers are imported.
+- `renderoni/assets`, `renderoni/replays`, and `renderoni/network` are not public
+  package APIs in this beta.
+
+## Beta compatibility
+
+The 0.9 beta API may change before 1.0. Pin a beta version or use the `beta`
+dist-tag; do not rely on unpublished source paths.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Esteban Leandro Marín
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.