diff --git a/.github/workflows/browser.yml b/.github/workflows/browser.yml
index e3f6d86..d960778 100644
--- a/.github/workflows/browser.yml
+++ b/.github/workflows/browser.yml
@@ -21,11 +21,11 @@ jobs:
matrix:
browser: [chromium, firefox, webkit]
steps:
- - uses: actions/checkout@v7
- - uses: pnpm/action-setup@v6
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
with:
run_install: false
- - uses: actions/setup-node@v7
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
cache: pnpm
@@ -33,7 +33,7 @@ jobs:
- run: pnpm exec playwright install --with-deps ${{ matrix.browser }}
- run: pnpm exec playwright test --project=${{ matrix.browser }}
- if: failure()
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: browser-evidence-${{ matrix.browser }}
path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd83cda..9acfc77 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,11 +29,11 @@ jobs:
- os: ubuntu-latest
node: 26
steps:
- - uses: actions/checkout@v7
- - uses: pnpm/action-setup@v6
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
with:
run_install: false
- - uses: actions/setup-node@v7
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ matrix.node }}
cache: pnpm
@@ -45,11 +45,11 @@ jobs:
name: Production dependency audit
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v7
- - uses: pnpm/action-setup@v6
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
with:
run_install: false
- - uses: actions/setup-node@v7
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
cache: pnpm
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 76edec5..ab17c3d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -16,8 +16,8 @@ jobs:
name: Analyze JavaScript and TypeScript
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v7
- - uses: github/codeql-action/init@v3
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
with:
languages: javascript-typescript
- - uses: github/codeql-action/analyze@v3
+ - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a06ebad..67fa2e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,13 +13,14 @@ jobs:
name: Verify and publish prerelease assets
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v7
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
- - uses: pnpm/action-setup@v6
+ persist-credentials: false
+ - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
with:
run_install: false
- - uses: actions/setup-node@v7
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
cache: pnpm
diff --git a/README.md b/README.md
index db86add..ff495b2 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,11 @@ pnpm add ./tabloom-0.3.0-alpha.2.tgz
Verify the adjacent `.sha256` asset before installing in a controlled delivery pipeline.
+For a complete Vite consumer using only public package exports, start with the
+[pinned WebLLM starter](examples/vite-webllm/README.md). Its page and
+SharedWorker share one configuration manifest and the repository package smoke
+builds it against a freshly packed TabLoom archive.
+
## Quick start
```ts
diff --git a/eslint.config.js b/eslint.config.js
index ec03a6b..1e4e057 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -44,6 +44,16 @@ export default tseslint.config(
],
},
},
+ {
+ files: ['examples/vite-webllm/**/*.ts'],
+ languageOptions: {
+ parserOptions: {
+ project: ['./tsconfig.starter-lint.json'],
+ projectService: false,
+ tsconfigRootDir: import.meta.dirname,
+ },
+ },
+ },
{
files: ['scripts/**/*.mjs'],
languageOptions: {
diff --git a/examples/vite-webllm/README.md b/examples/vite-webllm/README.md
new file mode 100644
index 0000000..0407f52
--- /dev/null
+++ b/examples/vite-webllm/README.md
@@ -0,0 +1,61 @@
+# TabLoom Vite + WebLLM starter
+
+This is a clean consumer of the released TabLoom package. The application and
+SharedWorker import only documented package exports; neither entry point reaches
+into the TabLoom source tree.
+
+## Pinned boundaries
+
+| Boundary | Pinned value | Change rule |
+| ---------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| TabLoom | Verified `0.3.0-alpha.2` GitHub release + lock SRI | Update `tabloomRelease`, lock, and all consumer gates |
+| WebLLM | `0.2.84` | Update the adapter identity and re-run a real-model gate |
+| Model | `SmolLM2-360M-Instruct-q4f16_1-MLC` at one HF commit | Update the commit and SRI values; expect a new download |
+| Runtime identity | Runtime, immutable artifact URLs, SRI, and policies | Never reuse a fingerprint after any behavior change |
+| Concurrency | One generation per owner | Keep at one for the current WebLLM adapter |
+
+`package.json` names the independently verified published TabLoom boundary; it
+is intentionally separate from the repository's next unreleased package
+version. The exact application policy lives in `src/runtime-config.ts`. Model
+weights are resolved at one immutable Hugging Face revision; the config,
+tokenizer, and WASM library additionally fail closed on SRI mismatch. Both the
+page and SharedWorker derive the same fingerprint from those artifact identities
+and the runtime policy, so incompatible deployments fail negotiation instead of
+silently sharing a runtime.
+
+## Run
+
+Requires Node.js 24+, pnpm 11.13.0, a WebGPU-capable browser, and HTTPS or a
+loopback development origin.
+
+```bash
+pnpm install --frozen-lockfile
+pnpm dev
+```
+
+Open `http://127.0.0.1:4173`. The first model load downloads provider assets and
+can take time. The adaptive policy prefers a SharedWorker where its lifecycle is
+portable; otherwise it selects the fenced page-owner path. In page-owner mode,
+open the sibling page before submitting a prompt.
+
+From the repository root, the opt-in live gate exercises the pinned URLs, SRI,
+owner handshake, streaming path, and one real generation in Chrome/WebGPU:
+
+```bash
+TABLOOM_WEBLLM_LIVE=1 pnpm test:live:starter
+```
+
+## Alpha contract
+
+- There is no automatic cloud fallback or provider routing.
+- Prompts stay in the selected local browser owner unless you add an external
+ adapter yourself.
+- A request may execute again after owner takeover; external side effects need
+ an application idempotency key.
+- Built-in telemetry excludes request and generated content, but application
+ logging remains your responsibility.
+- The checked-in model and provider pair is the verified boundary, not a claim
+ that every browser, GPU, model, or later provider version works.
+
+From the repository root, `pnpm package:smoke` packs TabLoom, installs that fresh
+archive into a temporary copy of this starter, and runs its production build.
diff --git a/examples/vite-webllm/index.html b/examples/vite-webllm/index.html
new file mode 100644
index 0000000..e45044f
--- /dev/null
+++ b/examples/vite-webllm/index.html
@@ -0,0 +1,77 @@
+
+
+
+
+
+
+
+ TabLoom WebLLM starter
+
+
+
+
+
Verified consumer starter
+
One local model runtime, shared across sibling pages.
+
+ This Vite app consumes only TabLoom's public package exports and keeps
+ the model, runtime identity, broker policy, and generation defaults in
+ one replaceable configuration module.
+