2 Commits

Include renames

Author	SHA1	Message	Date
Renn F	b0dcb03356	fix(marketing): release and spotlight drafts carry their source project ... draft_release_post / draft_release_video accept a project_id and the release-proposal approve hooks pass the proposal task's own project; the spotlight companion video forwards the spotlight draft's project into open_video_task — previously it always authored against the deployment-anchor project's motion/ tree regardless of which project the spotlight was about. Omitted project_id keeps the anchor-project fallback, so single-project deployments are unchanged.	2026-07-18 16:48:45 +02:00
3 people	e9d0e0bd48	feat(video): 0.19.0 video engine (Remotion) + preview auth + render persistence (#307) ... * feat(video): Phase A — VideoEngine origination spine + held-source gates New default-off engine skeleton: opens a UX/UI authoring task (source=video, assigned to a ux-dev, LOW complexity to clear the dev-needs-subtasks guard) and materializes a held CEO-approval draft (source=video_post). Excludes video_post from all three held-source skip sites; adds the video_draft marker, six config flags, and the feature-flag entries. Origination + gate behavior unit-tested. * refactor(orchestrator): fold _dispatch_dev_work skip chain into a helper The per-source if/continue chain grew past xenon's --max-absolute B when the video_post held source joined it. Extract _is_non_dev_dispatch_source (every held-CEO source plus the two Board exploration sources) so the dev loop's skip is one flat call. Behavior-identical. * feat(video): Phase B — propose_video do-tool (metadata-only, team-gated) UX/UI dev records a video's composition ref + per-platform captions onto the authoring task's video_draft marker. Team-gated at runtime via _caller_team (Role.DEVELOPER can't tell a ux-dev from a be-dev). Resolves the caller's ACTIVE task via get_active_task_for_agent, not an oldest-first scan that would clobber a second open video task. Metadata only, no render. Wired through do_server + route + schema; added to _DEV_DO. * feat(video): Phase D — render loop + RemotionRenderer client Orchestrator-async _video_render_loop renders a completed authoring task's merged composition to MP4 (vertical + square) via the remotion-renderer sidecar and materializes the held video_post draft. RemotionRenderer tars the read-clone's motion/ source, POSTs it, and saves the returned MP4 bytes to a TASK-scoped local path (no shared volume; a composition is reused across videos so a composition-scoped path would clobber an earlier draft). Render failures bounded-retry (read-clone catch-up window, transient sidecar) up to a cap, then terminal-fail. Client tested vs a mock transport; loop vs a mock renderer + real DB. * feat(video): Phase C — release / spotlight / on-demand video triggers Three entry points open a UX/UI video-authoring task via VideoEngine.open_video_task: (1) a published release drafts a companion video — best-effort in ReleaseProposalService.approve, never fails the publish; script from the CHANGELOG via the local model with a template fallback. (2) propose_feature_spotlight gains optional wants_video/video_script — best-effort, gated on video_on_spotlight, default-off leaves the spotlight flow byte-for-byte unchanged. (3) POST /video/request (CEO-only) for an on-demand brief, with clean disabled/not_opened responses. All gated on video_engine_enabled. * fix(video): savepoint-isolate video-task inserts (F042 poisoned session) The best-effort try/except around open_video_task (release-publish + spotlight hooks) swallowed the Python exception, but a DBAPI error at the insert flush left the shared session must-rollback — so the caller's next commit (release finalize / request boundary) threw PendingRollbackError: the release stuck 'pending' after actually publishing, or the spotlight draft + HTTP response were lost. Wrap both inserts (open_video_task, _originate_video_post) in a begin_nested savepoint (the repo's established F042 pattern) so a DB error rolls back only the insert. open_video_task returns None (every caller already handles it); _originate_video_post propagates to the render loop's handler. Regression test: an insert FK error returns None with the session left usable. Dormant while the flags were off; armed on the NAS. * feat(video): Phase G — motion/ package + remotion-renderer sidecar + compose In-repo Remotion v4 motion/ package (ReleaseAnnouncement composition; calculateMetadata returns 1080x1920 vertical / 1080x1080 square from inputProps.orientation) + a credential-free remotion-renderer sidecar: untar the POSTed motion/ source, bundle (LRU-cached per source sha), selectComposition + renderMedia h264, stream the MP4 bytes back — matching the RemotionRenderer client contract. docker/remotion.Dockerfile on Debian (Chrome apt deps, build-time Chrome pre-warm, ffmpeg bundled in @remotion/renderer). Wired into both compose files (roboco_default only, shm_size 1gb, /health check) + the release publish matrix. Verified via a real local render of both cuts; the Debian docker build is the CEO's to run. * chore(video): D-hardening — video_post source_task_id + render-loop docstring Add a source_task_id back-reference to the video_post held-draft marker (traceability from a draft to its authoring task; also makes the render loop's two-key idempotency check wireable later). Fix the render-loop test's stale docstring ('never retried' -> bounded-retry). Both from the Phase D critic's non-blocking follow-ups. * feat(video): Phase E1 — VideoPostService + heartbeat mutex (approve->post) CEO-approve->post service: heartbeat-renewed Redis mutex (fail-closed, grace=ttl-2*heartbeat), re-read-in-lock double-post guard, per-platform durable commits (asyncio.shield-ed, settle-before-rollback on lock-loss), all writes inside the lock (captions validated pre-lock, applied in-lock — no stale whole-column clobber), idempotent, per-platform retry-skip. Poster interfaces (X/TikTok, mocked here). Reject + list-held-drafts. Survived 3 adversarial rounds; residual = a crash in the poster->commit window (CEO-gated low-freq, documented). * fix(video): G-hardening — renderer leaks + Share Tech Mono brand font Sidecar: give bundle() an explicit outDir tracked + deleted on LRU eviction (was leaking ~19MB remotion-webpack-bundle-* per source); res.on('close') cleanup so an aborted/retried download no longer leaks its remotion-out-* MP4 dir. Fonts: vendor Share Tech Mono (roboco-website brand font) as the display face (self-hosted woff2, 400-weight, headline fontWeight 700->400 to avoid faux-bold) + self-hosted Inter body — no gstatic fetch at render time (lsof-verified). Extras: composition_id whitelist (400) + Multer error middleware (400/413). * feat(video): Phase E2 — X v2 + TikTok posters, tiktok_credentials, routes LiveXVideoPoster (X v2 chunked media upload: init/append/finalize/STATUS-poll -> tweet w/ media_ids, OAuth1 signer reused). LiveTikTokPoster (OAuth2 inbox: init -> chunked PUT with asymmetric final chunk -> status-fetch; 401 -> refresh_token grant, rotated token persisted). tiktok_credentials Fernet singleton + migration 062 (single head). Routes: CEO approve/reject + list held drafts + write-only tiktok creds, wiring real posters into VideoPostService. Residual: a lock-loss right after a token-refresh flush can discard the rotated token (same rare CEO-gated class as the documented post->commit window). * feat(video): Phase F — panel video-post queue + TikTok creds card + flags video-post-queue.tsx: <video> MP4 preview with 9:16/1:1 cut switch, per-platform editable captions (280/2200 counters, over-limit disables approve), approve/reject, Request-a-video dialog. tiktok-credentials-card.tsx (4 write-only OAuth2 fields). feature-flags-card inlines TikTokCredentialsForm under video_engine_enabled. Mounted in command-center. tsc/eslint clean, 273 panel tests green. NOTE: needs the GET /video/posts/{id}/media route + mp4_paths on VideoPostResponse (folded into H) for the preview source. * feat(video): Phase H — media route + e2e smoke + NAS arming + docs GET /video/posts/{id}/media?cut= (CEO-gated FileResponse of the rendered MP4; closes the panel preview gap) + mp4_paths on VideoPostResponse. e2e smoke tests/e2e_smoke/test_video_pipeline.py (full flow, sidecar+X/TikTok mocked; asserts dispatcher skips, render-loop materialize, propose_video team-gate, approve idempotency). NAS arming: docker-compose.yml/.yaml ROBOCO_VIDEO_ENGINE_ENABLED/ON_RELEASE/ON_SPOTLIGHT default-on (.yaml resynced to .yml); registry stays off. CLAUDE.md video-engine section + CHANGELOG. Fixed 2 pre-existing route-test pollution leaks. Full suite 11763 passed. * fix(video): auth-carrying preview, media route confinement, VideoPost type drift Three fixes along the video preview path: 1. panel video preview auth: the <video> element was pointed straight at GET /video/posts/{id}/media, but a native <video src> GET carries none of axios's X-Agent-ID/X-Agent-Role headers — so in the default header-trust deployment the request 401s. Fetch the cut via videoApi.getMediaBlob (axios, responseType: blob) and drive <video> off a URL.createObjectURL result instead. The object URL is revoked on cut-change (the previous cut's URL) and on unmount, so neither cut switches nor row teardown leak blob URLs. 2. backend media route confinement: GET /video/posts/{id}/media now resolves mp4_path and refuses it with 404 when it falls outside settings.video_output_dir. Defense-in-depth against any future writer of mp4_paths serving files from arbitrary disk locations. 3. panel VideoPost type/comment drift: added mp4_paths to the VideoPost interface (the committed VideoPostResponse already carries it), and corrected the stale comment on videoMediaUrl that claimed no route served the rendered bytes — the route has existed since the media endpoint landed; the comment now describes why getMediaBlob exists instead of a direct <video src>. * Persist rendered videos to data in physical storage. * ++ * docs(video): 0.18.0 CHANGELOG entry + RAG + map reference for video engine - Move the video engine bullet from [Unreleased] into [0.18.0] and note the ROBOCO_VIDEO_OUTPUT_DIR bind-mount persistence. - Add docs/rag/architecture/video-engine.md (mirrors x-engine.md shape: enable/disable, three triggers, render loop + sidecar, CEO gate, media route confinement, credentials). - Reference the video render loop in docs/map/orchestrator.md's engine list. * chore(video): re-bump to 0.19.0 + sync registry compose defaults Version was wrongly bumped to 0.18.0; 0.18.0 is an already-released section. Restore its 2026-07-04 date and move the video-engine CHANGELOG bullet into a new [0.19.0] - 2026-07-05 section above it. Bump pyproject.toml, roboco/__init__.py, roboco/config.py (app_version), panel/package.json, and the motion/README inputProps example to 0.19.0. docker-compose.registry.yml: add ROBOCO_VIDEO_ENGINE_ENABLED / _VIDEO_ON_RELEASE / _VIDEO_ON_SPOTLIGHT defaulted false (NAS arms them true), and comment out the video-renders bind mount with a short note so the public registry image ships video off by default. Structural sync with docker-compose.yml maintained. * fix(video): rate-limit /render + reflow motion/README CodeQL flagged js/missing-rate-limiting on the renderer /render route. The sidecar is container-network-only with one trusted caller (the orchestrator, which renders cuts serially), so this limiter is a retry-storm ceiling (30/min, well above legit render rate), not the primary control. Also reflows motion/README.md hard-wrapped prose that failed the markdown quality gate. * fix(build): finish pnpm 11 migration + regen verb tables The panel Docker image build failed on `pnpm install --frozen-lockfile`: node:22-alpine's corepack resolved to its bundled pnpm 11, but panel/package.json pinned packageManager to pnpm@10.25.0, and pnpm 11 refuses to run against that pin. The Dockerfiles were already written for pnpm 11 (comments, CI=true, strictDepBuilds); the package.json pin was the stale outlier. Finish the migration instead of working around it: - panel/package.json: packageManager pnpm@10.25.0 -> pnpm@11.10.0; drop the `pnpm` field (pnpm 11 ignores it — build approval lives in panel/pnpm-workspace.yaml's allowBuilds). Lockfile unchanged (pnpm 11 accepts it as-is); frozen-lockfile verified. - remotion-renderer/package.json: pin packageManager pnpm@11.10.0 for determinism (was relying on corepack's implicit default); engines.node >=22.13 (pnpm 11 requirement). - docker/panel.Dockerfile + docker/remotion.Dockerfile: `corepack prepare pnpm@11.10.0 --activate` so the build uses the pinned version explicitly instead of trusting corepack's bundled default (which a future node:22-alpine could change). - .github/workflows/panel-ci.yml: Node 20 -> 22 (pnpm 11 requires Node >=22.13; Node 20 fails the engines check). Also regenerate agents/prompts/_generated/{developer,head_marketing,verbs}.md — the video engine added propose_video and extended propose_feature_spotlight (wants_video, video_script) but the verb tables weren't refreshed, failing the foundation-check quality gate. * chore(build): approve esbuild build script in remotion pnpm-workspace.yaml pnpm 11 generated this file with a placeholder ('set this to true or false') during install; resolve it to true so local dev of the renderer doesn't re-prompt. esbuild's postinstall only verifies the prebuilt platform binary (@esbuild/<platform> is installed as an optional dep), so approving it is safe and silences the ERR_PNPM_IGNORED_BUILDS warning. * fix(build): copy pnpm-workspace.yaml into panel + remotion images pnpm 11 hard-errors with [ERR_PNPM_IGNORED_BUILDS] (exit 1) when a dependency ships a postinstall script that isn't approved in allowBuilds. Both Dockerfiles copied only package.json + pnpm-lock.yaml, so the build-approval map in pnpm-workspace.yaml never made it into the image — the remotion image build died on esbuild@0.28.1's postinstall. Copy pnpm-workspace.yaml alongside the manifests in both images. In panel, this also drops the --config.strictDepBuilds=false workaround: with sharp and unrs-resolver now approved, their postinstalls run and install the platform-specific binaries (previously skipped, leaving sharp without its @img/sharp-* binary at runtime). Verified locally: remotion + panel `pnpm install --frozen-lockfile` exit 0 with the workspace file present; both exit 1 without it. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-05 13:37:17 +02:00