Add a verified Vite and WebLLM consumer starter

.github/workflows/browser.yml

@@ -21,19 +21,19 @@ jobs:
       matrix:
         browser: [chromium, firefox, webkit]
     steps:
-      - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           run_install: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm exec playwright install --with-deps ${{ matrix.browser }}
       - run: pnpm exec playwright test --project=${{ matrix.browser }}
       - if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: browser-evidence-${{ matrix.browser }}
           path: |

.github/workflows/ci.yml

@@ -29,11 +29,11 @@ jobs:
           - os: ubuntu-latest
             node: 26
     steps:
-      - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           run_install: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
@@ -45,11 +45,11 @@ jobs:
     name: Production dependency audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           run_install: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm

.github/workflows/codeql.yml

@@ -16,8 +16,8 @@ jobs:
     name: Analyze JavaScript and TypeScript
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           languages: javascript-typescript
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1

.github/workflows/release.yml

@@ -13,13 +13,14 @@ jobs:
     name: Verify and publish prerelease assets
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v6
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           run_install: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm

README.md

@@ -52,6 +52,11 @@ pnpm add ./tabloom-0.3.0-alpha.2.tgz
 
 Verify the adjacent `.sha256` asset before installing in a controlled delivery pipeline.
 
+For a complete Vite consumer using only public package exports, start with the
+[pinned WebLLM starter](examples/vite-webllm/README.md). Its page and
+SharedWorker share one configuration manifest and the repository package smoke
+builds it against a freshly packed TabLoom archive.
+
 ## Quick start
 
 ```ts

eslint.config.js

@@ -44,6 +44,16 @@ export default tseslint.config(
       ],
     },
   },
+  {
+    files: ['examples/vite-webllm/**/*.ts'],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.starter-lint.json'],
+        projectService: false,
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+  },
   {
     files: ['scripts/**/*.mjs'],
     languageOptions: {

examples/vite-webllm/README.md

@@ -0,0 +1,61 @@
+# TabLoom Vite + WebLLM starter
+
+This is a clean consumer of the released TabLoom package. The application and
+SharedWorker import only documented package exports; neither entry point reaches
+into the TabLoom source tree.
+
+## Pinned boundaries
+
+| Boundary         | Pinned value                                         | Change rule                                              |
+| ---------------- | ---------------------------------------------------- | -------------------------------------------------------- |
+| TabLoom          | Verified `0.3.0-alpha.2` GitHub release + lock SRI   | Update `tabloomRelease`, lock, and all consumer gates    |
+| WebLLM           | `0.2.84`                                             | Update the adapter identity and re-run a real-model gate |
+| Model            | `SmolLM2-360M-Instruct-q4f16_1-MLC` at one HF commit | Update the commit and SRI values; expect a new download  |
+| Runtime identity | Runtime, immutable artifact URLs, SRI, and policies  | Never reuse a fingerprint after any behavior change      |
+| Concurrency      | One generation per owner                             | Keep at one for the current WebLLM adapter               |
+
+`package.json` names the independently verified published TabLoom boundary; it
+is intentionally separate from the repository's next unreleased package
+version. The exact application policy lives in `src/runtime-config.ts`. Model
+weights are resolved at one immutable Hugging Face revision; the config,
+tokenizer, and WASM library additionally fail closed on SRI mismatch. Both the
+page and SharedWorker derive the same fingerprint from those artifact identities
+and the runtime policy, so incompatible deployments fail negotiation instead of
+silently sharing a runtime.
+
+## Run
+
+Requires Node.js 24+, pnpm 11.13.0, a WebGPU-capable browser, and HTTPS or a
+loopback development origin.
+
+```bash
+pnpm install --frozen-lockfile
+pnpm dev
+```
+
+Open `http://127.0.0.1:4173`. The first model load downloads provider assets and
+can take time. The adaptive policy prefers a SharedWorker where its lifecycle is
+portable; otherwise it selects the fenced page-owner path. In page-owner mode,
+open the sibling page before submitting a prompt.
+
+From the repository root, the opt-in live gate exercises the pinned URLs, SRI,
+owner handshake, streaming path, and one real generation in Chrome/WebGPU:
+
+```bash
+TABLOOM_WEBLLM_LIVE=1 pnpm test:live:starter
+```
+
+## Alpha contract
+
+- There is no automatic cloud fallback or provider routing.
+- Prompts stay in the selected local browser owner unless you add an external
+  adapter yourself.
+- A request may execute again after owner takeover; external side effects need
+  an application idempotency key.
+- Built-in telemetry excludes request and generated content, but application
+  logging remains your responsibility.
+- The checked-in model and provider pair is the verified boundary, not a claim
+  that every browser, GPU, model, or later provider version works.
+
+From the repository root, `pnpm package:smoke` packs TabLoom, installs that fresh
+archive into a temporary copy of this starter, and runs its production build.

examples/vite-webllm/index.html

@@ -0,0 +1,77 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta
+      name="description"
+      content="A clean Vite consumer for TabLoom and a pinned WebLLM runtime."
+    />
+    <link rel="icon" href="data:," />
+    <title>TabLoom WebLLM starter</title>
+  </head>
+  <body>
+    <main>
+      <header>
+        <p class="eyebrow">Verified consumer starter</p>
+        <h1>One local model runtime, shared across sibling pages.</h1>
+        <p class="lede">
+          This Vite app consumes only TabLoom's public package exports and keeps
+          the model, runtime identity, broker policy, and generation defaults in
+          one replaceable configuration module.
+        </p>
+      </header>
+
+      <section class="runtime" aria-label="Runtime status">
+        <dl>
+          <div>
+            <dt>Model</dt>
+            <dd data-field="model">not loaded</dd>
+          </div>
+          <div>
+            <dt>Topology</dt>
+            <dd data-field="topology">starting</dd>
+          </div>
+          <div>
+            <dt>Role</dt>
+            <dd data-field="role">starting</dd>
+          </div>
+          <div>
+            <dt>Readiness</dt>
+            <dd data-field="readiness">starting</dd>
+          </div>
+          <div>
+            <dt>Epoch</dt>
+            <dd data-field="epoch">0</dd>
+          </div>
+        </dl>
+        <p class="status" data-field="status" aria-live="polite">
+          Checking browser capabilities.
+        </p>
+      </section>
+
+      <section class="prompt-card" aria-label="Local inference prompt">
+        <form data-field="form">
+          <label for="prompt">Prompt</label>
+          <textarea id="prompt" data-field="prompt" rows="5">
+Explain why fenced ownership matters in one concise paragraph.</textarea>
+          <div class="actions">
+            <button data-field="submit" type="submit" disabled>
+              Run locally
+            </button>
+            <button data-field="peer" type="button" class="secondary">
+              Open sibling page
+            </button>
+          </div>
+        </form>
+        <pre data-field="output" aria-live="polite">Waiting for a request.</pre>
+      </section>
+
+      <footer>
+        Alpha boundary: WebGPU, the pinned provider runtime, and the configured
+        model are required. Automatic cloud fallback is intentionally absent.
+      </footer>
+    </main>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

examples/vite-webllm/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "tabloom-vite-webllm-starter",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "packageManager": "pnpm@11.13.0",
+  "tabloomRelease": {
+    "version": "0.3.0-alpha.2",
+    "integrity": "sha512-E9LQMl+dovCjAksjA6jrmfFemviu6uT45IwjUK2dcsvnINiUPPiZUzXHd8pwbTHQhPeIft0SrnFcdTFNdxL3hg==",
+    "webLlmVersion": "0.2.84"
+  },
+  "scripts": {
+    "build": "tsc --noEmit && vite build",
+    "dev": "vite",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@aantenore/tabloom": "https://github.com/aantenore/tabloom/releases/download/v0.3.0-alpha.2/tabloom-0.3.0-alpha.2.tgz",
+    "@mlc-ai/web-llm": "0.2.84"
+  },
+  "devDependencies": {
+    "typescript": "6.0.3",
+    "vite": "8.1.5"
+  }
+}