Update public inference release, runtime contracts and documentation

.dockerignore

@@ -1,8 +1,26 @@
 .git
 .github
+.codex
+.codex/
+.claude/
+.agents/
+.cursor/
+.vscode/
+.idea/
+.env*
+.envrc
+**/.env*
+**/.envrc
+**/.direnv/
+credentials/*.secret
+**/credentials/*.secret
+token
+*.token
+**/*.token
 .mypy_cache
 .pytest_cache
 .ruff_cache
+.runtime/
 __pycache__/
 *.py[cod]
 *.egg-info/
@@ -17,6 +35,9 @@ runs/
 tmp/
 inspatio_world_output/
 worldfoundry_outputs/
+*.log
+*.out
+*.err
 
 node_modules/
 docs/fumadocs/.next/
@@ -32,3 +53,46 @@ docs/fumadocs/node_modules/
 *.tar.gz
 *.tgz
 *.zip
+
+worldfoundry/training
+worldfoundry/cli/training.py
+worldfoundry/cli/training_commands
+scripts/training
+configs/training
+configs/post_training
+test
+tests
+test_stream
+
+testcase
+worldfoundry/data/test_cases
+**/tmp
+**/test_*.py
+**/*_test.py
+
+# Include the public test sources for development/test containers.
+!tests/
+!tests/**/
+!tests/**/*.py
+!tests/**/*.md
+!tests/**/*.sh
+!tests/**/*.yaml
+!tests/**/*.yml
+!tests/**/*.json
+!tests/**/*.jsonl
+tests/**/__pycache__/
+tests/**/.pytest_cache/
+tests/**/.mypy_cache/
+tests/**/.ruff_cache/
+tests/**/tmp/
+tests/**/temp/
+tests/**/logs/
+tests/**/outputs/
+tests/**/.env*
+tests/**/*.py[cod]
+tests/**/*.log
+tests/**/*.ckpt
+tests/**/*.pt
+tests/**/*.pth
+tests/**/*.safetensors
+tests/**/*.mp4

.gitattributes

@@ -6,8 +6,9 @@
 *.bin filter=lfs diff=lfs merge=lfs -text
 *.mp4 filter=lfs diff=lfs merge=lfs -text
 docs/fumadocs/public/home-demos/*.mp4 -filter -diff -merge -text
-docs/fumadocs/public/readme-demos/*.mp4 -filter -diff -merge -text
-docs/fumadocs/public/cover_4x4_hero.mp4 -filter -diff -merge -text
+worldfoundry/data/test_cases/**/*.mp4 -filter -diff -merge -text
 *.mov filter=lfs diff=lfs merge=lfs -text
 *.pt filter=lfs diff=lfs merge=lfs -text
 *.pth filter=lfs diff=lfs merge=lfs -text
+# Retained license texts preserve upstream whitespace byte for byte.
+THIRD-PARTY-NOTICES -text whitespace=-blank-at-eol

.github/CODEOWNERS

@@ -0,0 +1,13 @@
+# Review coverage for high-impact infrastructure and generated-data surfaces.
+# GitHub ignores owners that do not have write access to this repository.
+
+.github/workflows/ @dhsaikhgdius
+.github/dependabot.yml @dhsaikhgdius
+.github/CODEOWNERS @dhsaikhgdius
+
+docs/ @dhsaikhgdius
+scripts/docs/ @dhsaikhgdius
+worldfoundry/data/ @dhsaikhgdius
+pyproject.toml @dhsaikhgdius
+requirements/ @dhsaikhgdius
+docker/ @dhsaikhgdius

.github/workflows/ci.yml

@@ -5,13 +5,216 @@ on:
   push:
     branches:
       - main
+      - 'release/**'
   workflow_dispatch:
+    inputs:
+      source_revision:
+        description: Exact candidate commit for trusted inference evidence
+        required: false
+        type: string
+      base_revision:
+        description: Exact comparison commit
+        required: false
+        type: string
+      evidence_json:
+        description: Compact numerical evidence from a trusted model host
+        required: false
+        type: string
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
+  geometry-impact:
+    name: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' && 'evidence-dispatch-idle-geometry-impact' || 'geometry-impact' }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.evidence_json == '' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout with diff history
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Plan affected 3D, video and world-model replays without weights or GPU
+        env:
+          IMPACT_BASE_SHA: ${{ inputs.base_revision || github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ -n "$IMPACT_BASE_SHA" ] && [ "$IMPACT_BASE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            python tests/manual/geometry_regression_impact.py --base "$IMPACT_BASE_SHA" --output tmp/geometry-impact.json
+          else
+            python tests/manual/geometry_regression_impact.py --changed-file worldfoundry/core/__init__.py --output tmp/geometry-impact.json
+          fi
+      - name: Publish required replay plan, including uncovered changes
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: geometry-impact
+          path: tmp/geometry-impact.json
+          if-no-files-found: error
+      - name: Install declaration reader
+        if: always()
+        run: python -m pip install "PyYAML>=6"
+      - name: Reject new, regressed or affected uncovered native variants
+        if: always()
+        env:
+          IMPACT_BASE_SHA: ${{ inputs.base_revision || github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          if [ -n "$IMPACT_BASE_SHA" ] && [ "$IMPACT_BASE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            python tests/manual/inference_regression_coverage.py --base "$IMPACT_BASE_SHA" --output tmp/inference-coverage.json
+          else
+            python tests/manual/inference_regression_coverage.py --output tmp/inference-coverage.json
+          fi
+      - name: Publish coverage definitions and gaps
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: inference-coverage
+          path: tmp/inference-coverage.json
+          if-no-files-found: error
+
+  inference-replay:
+    name: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' && 'evidence-dispatch-idle-inference-replay' || 'inference-replay' }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.evidence_json == '' }}
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      INFERENCE_EVIDENCE_CONTROL_REF: ${{ vars.INFERENCE_EVIDENCE_CONTROL_REF }}
+      INFERENCE_EVIDENCE_WORKFLOW_PATH: ${{ vars.INFERENCE_EVIDENCE_WORKFLOW_PATH }}
+      INFERENCE_REFERENCE_INDEX_SHA256: ${{ vars.INFERENCE_REFERENCE_INDEX_SHA256 }}
+      IMPACT_BASE_SHA: ${{ inputs.base_revision || github.event.pull_request.base.sha || github.event.before }}
+    steps:
+      - name: Checkout exact candidate with comparison history
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Compute committed inference impact
+        run: |
+          test -n "$IMPACT_BASE_SHA"
+          test "$IMPACT_BASE_SHA" != "0000000000000000000000000000000000000000"
+          python tests/manual/geometry_regression_impact.py --base "$IMPACT_BASE_SHA" --output tmp/geometry-impact.json
+      - name: Require successful official evidence for this exact commit
+        run: python tests/manual/inference_actions_evidence.py verify-actions --plan tmp/geometry-impact.json --output tmp/inference-evidence.json
+      - name: Publish replay gate result
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: inference-evidence-verification
+          path: tmp/inference-evidence.json
+          if-no-files-found: error
+
+  attest-inference-evidence:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' }}
+    runs-on: ubuntu-latest
+    env:
+      INFERENCE_EVIDENCE_CONTROL_REF: ${{ vars.INFERENCE_EVIDENCE_CONTROL_REF }}
+      INFERENCE_EVIDENCE_WORKFLOW_PATH: ${{ vars.INFERENCE_EVIDENCE_WORKFLOW_PATH }}
+      INFERENCE_REFERENCE_INDEX_SHA256: ${{ vars.INFERENCE_REFERENCE_INDEX_SHA256 }}
+      INFERENCE_REPORT_JSON: ${{ inputs.evidence_json }}
+      CANDIDATE_REVISION: ${{ inputs.source_revision }}
+      BASE_REVISION: ${{ inputs.base_revision }}
+    steps:
+      - name: Checkout trusted control workflow source
+        uses: actions/checkout@v5
+        with:
+          path: control
+          persist-credentials: false
+      - name: Checkout candidate for immutable source verification
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.source_revision }}
+          path: candidate
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Verify numerical bundle and control provenance
+        run: |
+          python control/tests/manual/inference_actions_evidence.py attest \
+            --base "$BASE_REVISION" --head "$CANDIDATE_REVISION" \
+            --control-revision "$GITHUB_SHA" --actual-control-ref "$GITHUB_REF_NAME" \
+            --run-id "$GITHUB_RUN_ID" --source-root candidate --output tmp/receipt.json
+      - name: Publish trusted inference receipt
+        uses: actions/upload-artifact@v4
+        with:
+          name: trusted-inference-evidence
+          path: tmp/receipt.json
+          if-no-files-found: error
+          retention-days: 90
+
+  cpu-tests:
+    name: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' && 'evidence-dispatch-idle-cpu-tests' || 'cpu-tests' }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.evidence_json == '' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install CPU test dependencies
+        run: python -m pip install -e ".[test]"
+      - name: Run public CPU inference and packaging tests
+        run: make test
+      - name: Validate documented commands and catalog claims without weights
+        run: make test-docs-contracts
+      - name: Publish complete CPU selection and results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: public-cpu-contracts
+          path: |
+            tmp/public-cpu-selection.json
+            tmp/public-cpu-contracts.xml
+            tmp/docs-contract-selection.json
+            tmp/docs-contracts.xml
+          if-no-files-found: error
+
+  inference-tensors:
+    name: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' && 'evidence-dispatch-idle-inference-tensors' || 'inference-tensors' }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.evidence_json == '' }}
+    runs-on: ubuntu-latest
+    env:
+      CUDA_VISIBLE_DEVICES: ""
+      PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install CPU Torch and tensor test dependencies
+        run: |
+          python -m pip install "torch==2.9.0+cpu" --index-url https://download.pytorch.org/whl/cpu
+          python -m pip install -e ".[test]" \
+            "safetensors>=0.4" "einops>=0.7,<0.9" "omegaconf>=2.3,<3" "triton==3.5.0" \
+            "transformers>=4.57,<4.58" ftfy regex opencv-python-headless "aiohttp>=3.10,<4" scikit-image
+      - name: Run inference tensors and streaming contracts without model weights
+        run: make test-infer-tensors
+      - name: Publish inference contract results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: inference-cpu-contracts
+          path: |
+            tmp/inference-cpu-selection.json
+            tmp/inference-cpu-contracts.xml
+          if-no-files-found: error
+
   public-surface:
+    name: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' && 'evidence-dispatch-idle-public-surface' || 'public-surface' }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.evidence_json == '' }}
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -40,7 +243,10 @@ jobs:
       - name: Install quality gate dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install PyYAML
+          python -m pip install PyYAML "ruff==0.12.7"
+
+      - name: Check generated docs
+        run: make docs-check
 
       - name: Run lightweight quality gates
         run: make lint
@@ -51,5 +257,47 @@ jobs:
       - name: Run CLI check
         run: make cli-check
 
-      - name: Run documented CLI checks
-        run: make docs-check
+      - name: Run documented CLI entrypoint checks
+        run: make cli-entrypoint-check
+
+
+  packaging-license-gate:
+    name: ${{ github.event_name == 'workflow_dispatch' && inputs.evidence_json != '' && 'evidence-dispatch-idle-packaging-license-gate' || 'packaging-license-gate' }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.evidence_json == '' }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+
+    steps:
+      - name: Checkout clean source tree
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install wheel build and audit tooling
+        run: python -m pip install --upgrade build "setuptools>=77" "setuptools-scm[toml]" wheel
+
+      - name: Build and audit clean distributions
+        run: |
+          test -z "$(git status --porcelain)"
+          test ! -e build
+          audit_dir="$(mktemp -d)"
+          python -m build --outdir "$audit_dir"
+          set -- "$audit_dir"/*.whl
+          test "$#" -eq 1
+          test -f "$1"
+          wheel_path="$1"
+          set -- "$audit_dir"/*.tar.gz
+          test "$#" -eq 1
+          test -f "$1"
+          make packaging-check WHEEL="$wheel_path" SDIST="$1"
+          python -m pip install "${wheel_path}[test]"
+          source_dir="$audit_dir/source"
+          mkdir "$source_dir"
+          tar -xzf "$1" -C "$source_dir"
+          cd "$source_dir"/*
+          make test