feat: ship fenced multi-tab inference broker alpha

.gitattributes

@@ -0,0 +1,7 @@
+* text=auto eol=lf
+
+*.gif binary
+*.ico binary
+*.jpg binary
+*.png binary
+*.webp binary

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,24 @@
+name: Bug report
+description: Report reproducible broker behavior without private inference content.
+title: 'bug: '
+labels: [bug]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: TabLoom version
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+      description: Use synthetic inputs and safe event metadata only.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## Objective
+
+Describe the user or operator outcome.
+
+## Contract impact
+
+- Requirement IDs:
+- Protocol or configuration change:
+- Privacy or security change:
+
+## Evidence
+
+- [ ] Format, lint, and type checks
+- [ ] Unit tests and coverage
+- [ ] Library and demo builds
+- [ ] Package checks and clean-consumer smoke
+- [ ] Browser coordination tests
+- [ ] Dependency audit
+- [ ] Visual verification when the demo changes
+
+## Residual risk
+
+Document any unverified provider, browser, or failure mode.

.github/workflows/browser.yml

@@ -0,0 +1,42 @@
+name: Browser conformance
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: browser-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  browser:
+    name: Browser (${{ matrix.browser }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [chromium, firefox, webkit]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec playwright install --with-deps ${{ matrix.browser }}
+      - run: pnpm exec playwright test --project=${{ matrix.browser }}
+      - if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: browser-evidence-${{ matrix.browser }}
+          path: |
+            playwright-report
+            test-results
+          if-no-files-found: ignore

.github/workflows/ci.yml

@@ -0,0 +1,57 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Quality (${{ matrix.os }}, Node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            node: 24
+          - os: macos-latest
+            node: 24
+          - os: windows-latest
+            node: 24
+          - os: ubuntu-latest
+            node: 26
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check
+      - run: pnpm package:smoke
+
+  dependency-audit:
+    name: Production dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run audit

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '23 3 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v3

.github/workflows/release.yml

@@ -0,0 +1,45 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  prerelease:
+    name: Verify and publish prerelease assets
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check
+      - run: pnpm package:smoke
+      - run: pnpm run audit
+      - run: pnpm exec playwright install --with-deps chromium firefox webkit
+      - run: pnpm test:browser
+      - name: Build archive and checksum
+        shell: bash
+        run: |
+          mkdir release
+          pnpm pack --pack-destination release --silent
+          version="${GITHUB_REF_NAME#v}"
+          archive="$(find release -maxdepth 1 -type f -name '*.tgz' -print -quit)"
+          mv "$archive" "release/tabloom-${version}.tgz"
+          cd release
+          sha256sum "tabloom-${version}.tgz" > "tabloom-${version}.tgz.sha256"
+      - name: Create GitHub prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" release/* --verify-tag --prerelease --generate-notes

.gitignore

@@ -0,0 +1,10 @@
+node_modules/
+dist/
+dist-demo/
+coverage/
+playwright-report/
+test-results/
+.artifacts/
+*.tgz
+.DS_Store
+*.log

.npmrc

@@ -0,0 +1,3 @@
+engine-strict=true
+prefer-frozen-lockfile=true
+strict-peer-dependencies=true

.prettierignore

@@ -0,0 +1,6 @@
+dist
+dist-demo
+coverage
+playwright-report
+test-results
+pnpm-lock.yaml

.prettierrc.json

@@ -0,0 +1,5 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "all"
+}

AGENTS.md

@@ -0,0 +1,8 @@
+# Repository working agreement
+
+- Use `Antonio Antenore <ant_ant95@hotmail.it>` for every local commit.
+- Keep `main` releasable and deliver reviewed work through a short-lived branch.
+- Prefer typed configuration, explicit ports, and provider-neutral domain code.
+- Do not claim live GPU or model evidence when a deterministic adapter produced the result.
+- Keep prompt payloads out of telemetry, diagnostics, screenshots, and fixtures.
+- Run the full quality gate before publication and verify the published state from a fresh clone.

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes are documented here.
+
+## [0.1.0-alpha.1] - 2026-07-17
+
+### Added
+
+- Fenced same-origin owner election using Web Locks and persistent epochs.
+- Versioned BroadcastChannel protocol with runtime envelope validation.
+- Provider-neutral streaming sessions with cancellation, timeout, bounded admission, and typed failures.
+- Automatic pending-request redispatch after takeover with stale-attempt rejection and one accepted client terminal.
+- Deterministic adapter for repeatable coordination evidence.
+- Visual three-page broker lab with topology, controls, safe event lineage, and responsive layouts.
+- Unit, coverage, package, and Playwright gates across Chromium, Firefox, and WebKit.
+- CI, dependency audit, CodeQL, prerelease archive, and checksum automation.