Skill Launch Video Factory

- OPVS copy of the 44-file Di-Atomic 0.5.10 bundle. House record unchanged.
- F: key-free OPVS plan, approved upload/import, clean bundle handoff to LLM14, live readback, and independent draft sync PR. Di-Atomic publishing retained.
- Sprite cast/request/cut route with provenance, geometry/scale checks and visual match sheet; E builder unchanged.
- Signed dry run: LLM14, stage 3. No vendor DAS2-97 fixes in this release.

Marketplace listing update: added the launch explainer film (`media.demo_video_url`). No code, schema, copy or guidance changes; hero and screenshots unchanged from 0.5.9.

Step D refuses music that is near-silent under the first spoken word (DAS2-73 persona-builder, DAS2-74
explainer-illustrations: the same house track rises from -116 dB to -25 dB over its first 1.1 s; with the first
sentence at 0.04-0.06 s the Editor's ducking check read 3.4 / 8.3 dB "pump" on sentence 1 only, every other
sentence 0.1-1.8 dB; the same bed started 1.1 s later passed every finish check, pump 1.64).
- verify-d-content measures the bed under the first word against its own median (100 ms windows); more than
  20 dB below = "YOUR FILE audio-plan.json", naming the second where the bed is audible. A D approved before
  0.5.9 keeps its music (the rule checks only a D not yet approved), so running films can adopt.
- Calibration on 25 real film beds: a simple loudness rule cannot predict the Editor's pump result (github-reader
  passed with more near-silence than explainer-illustrations), so the rule is the strict, cheap one: audible
  at the first word. Real controls: explainer bed r3 (failed E) FAIL, its r4 and persona's re-prepared bed PASS.
- Tests: synthetic rising bed FAIL / steady and late-word PASS; D gate test fails on 0.5.8, passes on 0.5.9.

Step E motion check on long films (DAS2-76 linkedin-researcher 78.4 s, DAS2-77 github-reader 84.0 s): the
HyperFrames check samples 300 evenly spaced times and seeks each to the frame at or before it. Past 14.95 s the
spacing is D/299 (0.26-0.28 s), so the fixed r0+0.25 s deadline and 0.18 s staggered "before" orders could not
be seen and failed (motion_appears_late, motion_out_of_order) on a correct picture.
- e_build's motion sidecar now uses the sampler's own grid and frame floor: each deadline is the first sample
  whose frame shows the element fully revealed; an order is asserted only when a sample shows one element and
  not yet the other; anything on screen shorter than the spacing is listed as unobservable (the frame sheet
  still shows it). Short films keep their old deadlines.
- Proof: the real `hyperframes check` (0.9.15) on copies of both films: FAIL as built by 0.5.6/0.5.7,
  ok:true with the 0.5.8 sidecar. Tests from the real numbers.

Step B starts with why (Martin, 2026-11-09, films DAS2-70..79/93: "they are picking a detail from the skill
and this is wrong"). A launch film sells a change of WHO does the job: today the buyer does it themselves or
pays someone; now an agent with this skill does it.
- angle.json needs big_picture {job, why, today {yourself, hire}, agent, problem}; every option needs a
  one-line why; options tell that story in an everyday scenario and never pick one feature/recipe/check.
  The B gate refuses an angle without it; the B brief and handoff line show the problem first.
- Step C narration follows the same golden circle (hook = why; pain = do it yourself / pay someone;
  usual_failure = what that costs; difference = the agent with this skill; verified_result = what you get).
  narrative_order keys are unchanged, so no schema migration.
- Tests: an angle without big_picture, without today.hire, or an option without why is refused (both new
  tests FAIL on the 0.5.6 controller, PASS on 0.5.7).
- Step D (DAS2-74 explainer-illustrations: Codex stopped on "music choice absent from its actual mix
  carrier" because the carrier shape was not written down): prepare.md 7 now spells out the carriers
  (music.files; effects.files = room + cue files) and that motion-plan elements list every scene-plan beat
  asset. Both refusals now name the exact field and the missing ids. Proven on a copy of the real film: the
  two data fixes take it to "needs approvals/D.json" with no runtime change.
- Step E (DAS2-71 video-editor, scene S02): a tray box held five item boxes; the tray was listed first, the
  peer gives shared pixels to the earlier element, so four items came out empty and E stopped. e_build now
  cuts nested elements first (front_first: deepest box first, plan order otherwise). Proof on the real S02
  canvas: 6 of 6 layers non-empty, recomposition mean |diff| 0.21 levels; test with a tray, nested note and
  an unrelated hand.
- Films initialized before 0.5.7 keep their approved angle: init now writes production.json
  angle_rule=start-with-why and only then does B require big_picture (so running films can adopt 0.5.7).

From film DAS2-95 (changelog-writer 0.2.0): its live package.yaml has no media: block, so execute stopped with
CANNOT after the upload and PeerTube import, at the step that adds demo_video_url.
- final_manifest_text adds `media:` holding only the link when the package has none (several media: lines stay
  CANNOT); verify F treats a media block that holds only the link as the link.
- The plan now tries the link insertion on the candidate BEFORE the approval request, so this class of stop
  cannot happen after an upload again.
- Proof on the real DAS2-95 files: candidate + the real PeerTube link changes package.yaml by the link only, and
  publish.sh --carry-live --dry-run on that final bundle PASSES. Of the 21 queue skills only changelog-writer
  lacks the block. Test: block added, ambiguous blocks still CANNOT.

Step F repairs an OLD live bundle in the same patch, and checks the vendor's own publish gate before asking
(DAS2-90 podcast: upload, PeerTube import and final bundle passed, then publish.sh refused the 0.1.3 base:
a workbench source/ folder and a verify-coordination.mjs whose shared helper was never vendored).
- The plan applies the repairs patch_delta already allowed, plus vendoring: drop cache/workbench files (root
  source/, tests/, BRIEF/PLAYBOOK notes); beta skills[] visibility -> public; marketing.author from the vendor
  route's vendor-author.json when absent; a verify-coordination.mjs importing a helper that is not beside it gets
  the vendor's helper beside it and the vendor's canonical wrapper (vendor-scripts.mjs semantics). Every repair is
  listed in the plan the person approves; the vendor files are copied into publish/vendor/ and pinned by hash.
- Before the approval request, the plan runs `publish.sh <candidate> --carry-live --dry-run` (sends nothing) and
  stops on its refusal. Measured on the 5 live bundles that fail today's packaging rules: podcast, community,
  distribution-launcher, url-utils, changelog-writer all PASS the real dry run after the repairs (changelog-writer
  loses only BRIEF.md + tests/; its 7 content folders are carried unchanged).
- Re-plan after a refused publish: when an execute uploaded and imported but never published, a new plan (after
  recover F) reuses that upload + PeerTube video, archives the old run under publish/superseded/<time>/, and says
  so in the plan; verify F accepts the earlier upload time only for the upload the approved plan names, with the
  same bytes. A publish that may have been sent still blocks any re-plan.
- Tests: 7 new in test_f_run.py (gate refusal; re-plan reuse -> one upload, one import, verify F PASS, and a
  wrong upload time FAILs it; in-flight publish refuses a re-plan; manifest repairs on community- and
  changelog-writer-shaped texts; vendoring accepted byte-identical and refused when the helper differs).
- Also from 0.5.4: the next-chat line names the film card.

The next-chat line printed by init, advance and approval-request names the film card first (Martin: every spawn
prompt carries the card id): `Use the skill-launch-video-factory skill on card DAS2-89: film <folder>, step D.`
It reads card_ref from production.json; a film without one keeps the old line. test_flow_v4 checks the new line.

From film DAS2-92 (distribution-launcher 0.3.2, the first film with music through the automatic step E):
- Step E's ducking check measured the UNPREPARED edit plan (raw music at -23.22 LUFS, no house volumes) after
  finish.mjs had passed the same check on the plan it actually mixed (prepared music -25 LUFS, music_volume 0.55,
  duck_db -8: balance 8.00 dB, depth 8.01 dB). E could never pass with music. flow_v4 now runs verify-ducking on
  renders/finish-plan.json, only when it is provably the plan that made these finals from this edit plan (edit-plan
  <= finish-plan <= captioned.mp4 in time; same length, voice, picture and caption words; the finish report names the
  approved music as the source of its prepared bed). Otherwise it measures edit-plan.json exactly as before.
- Step D refuses a pronunciation.json naming both "aliases" and "entries" (the chalkboard delivery check refuses it at
  the END of E; DAS2-92 wrote {"entries": [], "aliases": []}).
- Proof on a copy of the real DAS2-92 film: the 0.5.2 controller FAILs the E check; the 0.5.3 controller passes ducking,
  and with the pronunciation file corrected the full E check PASSes. Tests: the binding (control + 4 broken cases:
  newer edit plan, other words, other music, a plan made for another folder) and the D rule (control + DAS2-92's file).

Step E mounts approved sound effects. In 0.5.1, step D could approve a room bed and cues but e_build stopped
with "build E by hand", which the film brief forbids: film DAS2-90 (podcast 0.1.3) was stuck there.
- Step D states the effects exactly: ONE ambience (room-bed) file, prepared cue files, and
  `effects.cues: [{path, at}]` (the second each cue file starts). verify-d-content refuses selected effects
  without cue times, so the gap shows at D, not at E.
- e_build builds `audio/effects-stem.wav` (film length; room prepared to the house preset -44 LUFS,
  1 s in / 2 s out, looped if short, used as-is if already there; cues placed at their seconds, mixed
  without normalisation), mounts it as the picture's one audio track with the video stream copied, and
  writes `mute: false`, so finish.mjs mixes it at the house effects level. Stem and mount are reused while
  their inputs are unchanged; a new (silent) render is mounted again.
- CANNOT, each broken once in tests: two room files, effects without cue times, a cue path not approved,
  a negative or boolean time, a cue after the film end, a cue longer than 2 s (unprepared library file),
  a cue peaking above -12 dBFS.
- Tests: 8 new in tests/test_e_build.py on a copy of the sales-pipeline film with SYNTHETIC audio made by
  ffmpeg (pink-noise room, sine cue; no library file read). The control proves the stem length, the room
  at -44 LUFS, the cue audible at its second, one audio + one video stream in the picture, and the
  controller's own E checks (mute policy, "selected SFX absent from picture audio route") passing.
  Render and finish stay mocked in these tests, as before; no real film has run on 0.5.2.
- Music tail (from film DAS2-95, changelog-writer 0.2.0): with music selected, step D now requires the film to end
  >= 2.0 s after the last measured word. The Editor's ducking check needs music heard without speech; a
  continuous narration with a 0.21 s tail gave 3 pause windows and FAILED E after the full render and finish.
  2.0 s is the measured passing value (podcast-0.1.3: ducking depth 8 dB, balance 7.99 dB). Every earlier film
  with music had 1.27-2.52 s. Test: control at the real tail passes, one step over refuses.
- Step F uploads a compressed copy, never the master (Martin, 2026-11-09: "why fill SpiderMedia with such large
  files? it's a 1 min video"; a 74 MB master was refused with HTTP 413 on DAS2-88). `f_run.py plan` writes
  renders/captioned-upload.mp4 (H.264 CRF 20, audio copied, faststart) + publish/upload-copy.json proving it is
  the same film: size/rate equal, length within 1 frame, identical audio packets, SSIM >= 0.99, smaller. The
  plan names copy + master, so the F yes covers the uploaded bytes; verify F accepts only a recorded copy of
  the captioned final. CRF 20 on 4 real finals: 28-74 MB -> 8-22 MB, SSIM 0.9914-0.9989 (CRF 23 gave 0.987 on
  two). Tests on 2 real films: control plan+execute+verify F pass; SSIM floor broken once refuses; a tampered
  copy record fails approval-request; a second plan reuses the copy.
- Films started on 0.5.1 keep 0.5.1 (their runtime files are pinned by hash).

New films pin HyperFrames 0.9.15 (was 0.8.212). Existing films keep their pin. Measured on a copy of the
finished smartlead film: 0.9.15 renders a picture pixel-identical to 0.8.212 on all 2460 frames, in 17 s
against 18 s, and its `check --json` gives the same contract and the same findings. Details:
`tests/HYPERFRAMES-0.9-NOTES.md`.
- Step F, from the three 0.5.0 test films (DAS2-58..60, 2026-11-05): (1) the embed playback check awaited
  `video.play()` before PeerTube attached the stream; it never settled and timed out at 180 s on a film that
  plays. It now clicks the player's own play button (5/5 plays in about 5 s) and records `started_by`.
  (2) f_run calls publish.sh with `--carry-live` (skill-factory 0.1.21), so a patch of an old live bundle whose
  root predates the clean-copy rule is no longer refused. Tests 13/13; each fix broken once is caught.
- SKILL.md and produce.md name video-editor's finish script as the peer path `$EDITOR_FINISH` (finish.mjs in
  the scripts folder of the `--editor-dir` skill), not a `scripts/` path inside this bundle. OPVS
  test_skill_guide_reachable failed on the old line; the guide now names 4 scripts, all shipped.
- SKILL.md: the init line names `--hyperframes-version 0.9.15`; one line says this skill leads a launch
  film and the HyperFrames skills are reference for the tool, not a second workflow.
- produce.md: the motion sidecar is still required on 0.9.15 (measured); `upgrade --project` does not move
  a film; 0.9.15's own per-account render lock does not replace render-picture.sh's machine-wide one.
- flow_v4.py: comment only, on where 0.8.x and 0.9.x read the browser cache. No code change; the exact
  pin checks in factory.py and e_build.py are unchanged.
- Tests: synthetic fixtures pin 0.9.15; the legacy initializer test stays on 0.8.212; two new self-tests: a
  0.8.212 film still passes on 0.8.212 and is refused when the installed tool is 0.9.15 (fails with the
  version check removed, on purpose).

Steps E and F run from ready commands, so the chat judges and asks instead of working the tool out by
hand. Measured on the 0.4.3 films: E and F each took ~72 model calls and ~9-10 M tokens, mostly reading
this tool's own scripts and other films' folders, then hand-writing JSON.
- `scripts/e_build.py`: writes every E file from the approved D outputs (elements cut from the scene
  boxes or drawn files the chat makes, element sheet, HyperFrames project, edit plan, delivery), renders
  through render-picture.sh, one finish.mjs pass, frame sheet, runs the E checks. Stops with NEEDS when
  the chat must choose boxes, draw an element or write its frame review; re-runs continue. 16 tests,
  known-good control: a real film rewound to D rebuilt and passed the real E checks.
- `scripts/f_run.py plan` writes the exact publish plan and sends nothing; `execute`, only after the
  approval of that exact plan, does permit, upload, import, wait, final bundle, publish, readback and
  receipts in one run. A journal never repeats a send that started without a recorded result. 12 tests,
  known-good controls on two films published with 0.4.3; every guard broken once on purpose.
- Brief: names the two commands and forbids reading the tool's scripts or other films; the Shell line
  is short (it copied the whole PATH and pushed the brief past its size limit, cutting the Board line).
- Both commands are pinned runtime files for new films.

Fixes the step report, found on the first three 0.4.3 films (cro-actions, cro-optimizer, smartlead).
- Step B was CANNOT on all three: Antigravity's own error notices (step 17) broke the token pairing. A stop
  notice ("There was a network issue", "not logged into Antigravity") pairs with a token row only when
  that row is empty; an automatic retry ("API error (attempt 2)") has none. Counted as runtime errors.
- Time the chat sat stopped after such an error is waiting, not working; a call that hung and then
  failed is reported apart as "hung" (one hung 101 minutes).
- Time idle on a background command (render, upload, picture job; Antigravity's "[Message] ... Command
  exited" notice) is shown inside the working time.
- SKILL.md: the PATH line is the first command of every chat, before any preflight or mail check (the
  one 'command not found' left per film came from step A's first command).
- Self-test 26/26; two break-on-purpose controls caught.

Fixes the faults the step reports found in all three 0.4.x films (8-11 'command not found', 3-5 board
'unconfirmed', wrong opvs flags, one crash per film), plus Martin's player rule.
- Every tool the controller runs gets a PATH with /opt/homebrew/bin, /usr/local/bin, ~/.local/bin and nvm node first; the brief prints the same PATH line for the chat. The board error now says why (it hid 'opvs not found').
- The brief names the board command (step-status) and says which opvs flags do not exist; step E warns off running Chalkboard's verify-delivery on delivery.json directly (it crashed once).
- B summary names the option the person chose (approvals/B.json selected_option), not the recommendation.
- PeerTube listing link is always the minimal embed `/videos/embed/<id>?title=0&warningTitle=0&peertubeLink=0&p2p=0`; F refuses any other form, before the approval request and after publish. Thumbnail = scene 1 needs a SpiderIQ route (request written).
- Step report: an error shows the line that did the work, not the PATH export.

- Step report at every handoff: `scripts/step_report.py` reads the step's own chat record on the Mac (Antigravity, Codex, Claude Code) and writes `.factory/reports/<step>.json` plus one line on the card: turns, model calls, tokens (new / cached / output / thinking), minutes working vs waiting for the person, failed commands by kind, SKILL DEFECT notes. A chat shared by several steps is cut at the steps' completion times. The last step prints the film total and recurring failures. Never blocks a handoff; CANNOT when it cannot read. Self-test 21/21; checked on 3 real films (step A of cro-audit: 1,896,302 tokens counted, the same total counted independently).

- F: a root entry the signed live bundle already ships byte for byte (and NOTICE.md, upstream licence text) no longer fails packaging. cro-audit 0.2.0 ships an MIT NOTICE.md: 0.4.0 refused keeping it and refused dropping it, so its film could not reach the F approval request (DAS2-52). Test with two break-on-purpose controls.

- One fresh chat per step: `factory-v4.py brief` prints a short start brief from the film folder; each step ends with the one line for the next chat. All "same chat" instructions removed. Images are checked through one contact sheet per check (new `contact-sheet`).
- E: `scripts/render-picture.sh` renders one film at a time on the machine with 10 workers and the real user's HyperFrames cache; Video Editor's one-run `finish.mjs` replaces hand-tuned compose passes; the full delivery check runs inside the E approval request; no ducking check on a no-music plan; the HyperFrames preview cache is ignored.
- F: packaging checked before the approval request, with the repairs packaging needs (visibility, author, cache removal); upload and URL after the yes; direct MP4 and PeerTube URLs each have their own rule; buyer page without a buyer login is recorded as not measured; relative card paths; upload-batch route for large films; hosted-video import recipe. Peer floors: Video Editor >=0.2.0, Chalkboard Explainer >=0.1.2. No real film has run on 0.4.0.

- Add independent schema 4 A–F production with angle/story, style sample, Content, final film and separate Publish approval. Preserve all legacy runtime bytes.
- Make elements from approved scene art during Video; check mounted hashes, layer files, render freshness, blur and current decoded frames before final review. Add explicit visible recovery and one-request timestamped voice helper with a designated external key file.
- Verify exact upload plans and actual live-based film-patch bundles; preserve listing fields and require real playback, human final review and buyer evidence. No real film has run on 0.3.0.

# 0.2.0

- Track six visible film steps on AgentBoard; retain all detailed gates internally.
- Continue the same chat through verified handoffs, pausing for genuine approvals or unresolved failures.
- Add six step verifiers, exact handoff/readback and safe retry; preserve legacy project contracts.
- Pin the coordinator, require rough-cut evidence, refuse populated-card initialization and silent
  reopen of closed steps. Keep generated-media persistence and optional destination authorization.
- Tested synthetic controls and one disposable live board round trip; no real film on 0.2.0 yet.

# Changelog

- Remove the stray compiled Python cache file included in 0.1.6. No change in behaviour.

- Add the measured quiet-mix reference and a bounded ElevenLabs effects helper; source or generate cues without private project files.
- New projects use schema 2 with independent sound choices, scoped approvals and an actual style sample approved before scene generation.
- Accept only replay-proven gain/latency-compensated limiter derivatives of the approved voice; preserve sample timing.
- Serialize media/card updates, preserve historical links, and add explicit continuation/activity states and communication-gap diagnostics.
- Bind workflow_support.py alongside the changed controller; no automatic migration of projects already running.
- Reconcile the shipping workflow with the human entry point and remove private production identifiers from buyer files.

- Add one concept hero and three explanatory panels for the public marketplace card.
- Add buyer-facing long description and feature copy.
- Workflow, controller, peer floors and upload implementation unchanged from 0.1.4.

- Expose the factory at beta/public with Video Editor >=0.1.2.
- Read the media bucket from the first authorized upload; keep workspace/login examples portable.
- Refresh the two-workflow handbook and remove private identifiers, local paths and unavailable internal report links.
- Recheck the media command recipes and upload/readback controls before release.

- Register all generated images/audio/video and revisions in one media index throughout both workflows.
- Use SpiderMedia's authorized upload/readback routes; retain separate master/hosted-copy hashes.
- Persist the full media list and every actual URL on the production AgentBoard card using a separate merge/readback, preserving history and unrelated fields.
- Correct the claim that factory checkpoint alone saves hosted-media URLs. Controller/upload code unchanged.
- references/workflow.md: the human entry point and session prompts now ship in the package.

- references/spidermedia.md: how the propagate stage hosts images, audio and film on SpiderMedia and
  makes the PeerTube copy. Every door run live; audio has its own door, `upload_local_file` refuses it.
- scripts/spidermedia.py: audio upload through the OPVS proxy, hosted-bytes read-back, PeerTube import
  and status. Controller and peer code unchanged.

- Clarify authorized continuation, actual stage-run identities and the two-workflow boundary.
- Require visual storyboards, asset/camera feasibility proof and scene/seam motion review.
- Document sound revision/revalidation, short-word caption audition and approved-audio preservation.
- Distinguish current decisions, historical evidence, preview types and checkpoint/status health.
- Clarify technical checks versus creative acceptance and peer release requirements.
- Keep controller/peer code and finished production bytes unchanged; new editorial requirements are not new automated checks.

- Add two-workflow stage controller with resume/reopen, project lock, input fingerprints and approvals.
- Gate source claims, measured narration/caption coverage, directed speech beats and scene/element coverage.
- Execute actual Chalkboard, HyperFrames and Editor checks; freeze tool/artifact evidence at handoff.
- Separate approved preparation kit, private ship and exact-scope distribution verification.
- Add synthetic positive/negative controller tests and real historical-media integration checks.