Bronto Layout v0.5.0-beta.1 — CSP-safe integration beta

Bronto Layout 0.5.0-beta.1 — GitHub integration beta

Status: experimental public GitHub prerelease for first-party integration and feedback. @ponchia/layout remains unpublished on the npm registry: this release contains an npm-compatible .tgz that you install from its attached file, NOT npm install @ponchia/layout@0.5.0-beta.1. No hosted service, account, collection of visitors' data, marketing launch or cross-project CSS change is part of this release.

What changed since 0.5.0-beta.0

• Fail closed for top-level HTTP documents enforcing Content-Security-Policy: sandbox without allow-scripts. An injected JavaScript geometry probe must not run in these documents; the CLI now returns an explicit machine-readable CSP_SANDBOX_UNINSPECTABLE error and exit 2 rather than timing out in Runtime.evaluate or falsely reporting a passing layout.
• Preserve the document's CSP, Chromium's process sandbox, app/browser isolation and all existing contracts. No script-disabled DOM/paint inspection has been added, and Content-Security-Policy-Report-Only is not treated as an enforced restriction. The detection covers confirmed top-level HTTP response headers, not all nested frames or meta policies.
• Real HTTP Chromium integration tests cover a normal page, an enforced sandbox, a sandbox with allowed scripts, and a Report-Only control. The zero-runtime-dependency tarball passes isolated offline npm consumer checks.

Install and verify

Download both release assets: ponchia-layout-0.5.0-beta.1.tgz and SHA256SUMS.txt. From their directory:

sha256sum -c SHA256SUMS.txt
npm install --ignore-scripts --no-audit --no-fund --prefix ./consumer ./ponchia-layout-0.5.0-beta.1.tgz
./consumer/node_modules/.bin/bronto-layout --version
./consumer/node_modules/.bin/bronto-layout doctor --verify-launch

Requires Node.js 22+ and a sandbox-capable Chrome/Chromium for browser checks. Choose a reviewed GitHub Action commit SHA rather than a moving branch when integrating CI. The corresponding source commit is 779709052378185bb4f7a0d1727fff7d7e91ac74; uses: Ponchia/bronto-layout@779709052378185bb4f7a0d1727fff7d7e91ac74 runs this source-based Action without an npm registry dependency.

Tarball SHA-256: f471a03498980d80ce304aa45a04e8b468736f51478822b7620ffc147a7b1de8.

Why this release exists

The first-party Spatial App source pilot (Ponchia/spatial-workspace PR #1538, still independently gated) checked two source-controlled HTML App documents at nine widths apiece: 72/72 Capacity Lab and 72/72 Pattern Studio contract evaluations. It also verified that a deliberate 12px alignment regression failed its approved rule while a generic audit recorded zero measured errors. Spatial's real report-view service returns a script-disabled HTML document under a sandbox CSP: v0.5.0-beta.0 timed out there, and this release now classifies that surface explicitly as unverified. The trial did not inspect a live Spatial canvas, authenticated frame, published App placement, SDK state, SVG pixels, or user-owned data; temporary fixtures and browser evidence stayed local.

BrontoUI's required website layout check, Sense6's supplemental multilingual/RTL checks, and the personal website's source-built local trial were also integrated in their own project repositories. The personal site's hosted Chrome trial is still manual-only because its private runner lacks the necessary sandbox-capable Chromium runtime dependencies. These are first-party regression and operational findings, not independently labeled detector precision/recall or general adoption.

Technical verification

• All five hosted PR jobs passed: Node 22 + Chromium (two shards), Node 24 + Chromium (two shards), and macOS portability. Main-branch qualification is a separate release gate.
• 233/233 browser-free tests, TypeScript build, ESLint, and the packaged offline consumer tests pass locally.
• Exact merged source 779709052378185bb4f7a0d1727fff7d7e91ac74 was repacked into 201 files, 273,075 bytes with zero third-party runtime dependencies, then installed into a fresh offline consumer where the CLI reported 0.5.0-beta.1, parsed an example contract, and exposed the pure TypeScript API.

Boundaries and follow-up

Bronto Layout remains a Chromium-family DOM-geometry tool, not a pixel-perfect browser renderer or automatic design judge. Cross-origin iframe interiors, closed shadow roots, canvas/WebGL painting, unobserved widths/states, and script-disabled CSP documents remain outside validated geometry coverage. Contracts represent reviewed design intention; heuristic review leads do not become strict failures by themselves. Keep private page URLs, DOM evidence and screenshots private; do not weaken sandboxing to gain inspection access. Independent first-use studies and human review of both missed problems and false positives are still pending. Promotional posts are intentionally deferred.

Bronto Layout v0.5.0-beta.0 — source-first integration beta

Bronto Layout 0.5.0-beta.0 — GitHub source beta

This is an experimental, first-party integration beta, not a general-availability product. Bronto Layout checks explicit semantic layout relationships across viewport widths and recorded application states. Its zero-contract audit surfaces a limited set of measured browser observations and nonblocking review leads. It cannot independently determine whether a design is good, beautiful or accessible.

Get started

• Source and documentation: Bronto Layout repository · Beta integration guide · First-party trial worksheet
• Standalone package artifact: ponchia-layout-0.5.0-beta.0.tgz attached to this GitHub release; verify it with SHA256SUMS.txt before use. It is an npm-compatible package file that can be installed from a local path with Node.js 22+ and your own Chrome/Chromium installation.
• GitHub Action: pin uses: Ponchia/bronto-layout@76d252304ab6fd8f1698fd0136b32091cb19f284 in a consuming project. It builds the reviewed source, verifies sandboxed Chrome, runs a reviewed check or an audit and leaves local JSON evidence without automatically uploading potentially private page data.
• Package name: @ponchia/layout; executable name: bronto-layout.

Important registry distinction: This release is on GitHub only. @ponchia/layout is not published to the npm registry. Do not use npm install @ponchia/layout@0.5.0-beta.0 or assume registry availability. npm publisher authentication and a separate verified beta dist-tag are still pending.

Beta changes

• Added optional --interior-probes 0..8 for explicit contract checks, scans and comparisons, so narrow responsive failures can be detected even when the original coarse endpoints pass. --refine can locate observed transitions; it never proves the widths or states that weren't sampled.
• Reports now disclose the interior widths and largest remaining unsampled integer-width gap inside the requested range, helping agents and developers assess coverage without false certainty.
• Finite batch check jobs can use schema-validated interiorProbes, refine, and failOnSkip with no arbitrary JavaScript or inferred contract approvals.
• Added a reusable, source-based GitHub Action with a sandboxed Chrome preflight, compact local JSON report and no automatic uploads. CI includes healthy and deliberately broken page controls.
• Added a practical owned-project/agent integration guide and a blank privacy-conscious field-trial log; promotion is intentionally deferred.

Tested scope

• Successful hosted PR CI: Node.js 22 and 24 Chromium matrices and hosted macOS checks; reusable Action positive and negative controls included.
• Locally: TypeScript build, lint, 229/229 browser-free tests, targeted real Chromium tests, portable-core coverage gates and a 33-case controlled synthetic browser benchmark passed.
• The tarball contains 200 files (~271 KB), has zero third-party runtime dependencies, and was tested in separate offline npm consumers with lifecycle scripts both enabled and disabled.
• Package SHA-256: 0755daff80a961d1006d118940daaa075c2a0eb6cd97376bb63b8d32d9979e5c.
• Release source: merged main commit 76d252304ab6fd8f1698fd0136b32091cb19f284 (same source tree as all-green PR head).

Limits and appropriate use

Browser automation is Chromium-family only. Closed Shadow DOM, inaccessible cross-origin frame contents, canvas/WebGL pixel paint, invisible application states, and widths not explicitly sampled are not certified. Automatic clipping/spacing/overlap leads are review-only, not an objective verdict about design intent. Screenshot integrity is not a substitute for independent evaluation. The benchmark cases are controlled examples, not real-world detector precision/recall. No independent external developer validation has yet been collected.

Reports, screenshot evidence and URLs may contain sensitive content. Keep them private by default. Keep Chromium sandboxing enabled for untrusted sites. Use human-approved contracts, verify measured failures against the actual design, and record first-party trial outcomes before adding further heuristics or promoting the project.