Files
roboco/tests/unit/gateway/test_content_actions_video.py
T
e9d0e0bd48 feat(video): 0.19.0 video engine (Remotion) + preview auth + render persistence (#307)
* feat(video): Phase A — VideoEngine origination spine + held-source gates

New default-off engine skeleton: opens a UX/UI authoring task (source=video, assigned to a ux-dev, LOW complexity to clear the dev-needs-subtasks guard) and materializes a held CEO-approval draft (source=video_post). Excludes video_post from all three held-source skip sites; adds the video_draft marker, six config flags, and the feature-flag entries. Origination + gate behavior unit-tested.

* refactor(orchestrator): fold _dispatch_dev_work skip chain into a helper

The per-source if/continue chain grew past xenon's --max-absolute B when the video_post held source joined it. Extract _is_non_dev_dispatch_source (every held-CEO source plus the two Board exploration sources) so the dev loop's skip is one flat call. Behavior-identical.

* feat(video): Phase B — propose_video do-tool (metadata-only, team-gated)

UX/UI dev records a video's composition ref + per-platform captions onto the authoring task's video_draft marker. Team-gated at runtime via _caller_team (Role.DEVELOPER can't tell a ux-dev from a be-dev). Resolves the caller's ACTIVE task via get_active_task_for_agent, not an oldest-first scan that would clobber a second open video task. Metadata only, no render. Wired through do_server + route + schema; added to _DEV_DO.

* feat(video): Phase D — render loop + RemotionRenderer client

Orchestrator-async _video_render_loop renders a completed authoring task's merged composition to MP4 (vertical + square) via the remotion-renderer sidecar and materializes the held video_post draft. RemotionRenderer tars the read-clone's motion/ source, POSTs it, and saves the returned MP4 bytes to a TASK-scoped local path (no shared volume; a composition is reused across videos so a composition-scoped path would clobber an earlier draft). Render failures bounded-retry (read-clone catch-up window, transient sidecar) up to a cap, then terminal-fail. Client tested vs a mock transport; loop vs a mock renderer + real DB.

* feat(video): Phase C — release / spotlight / on-demand video triggers

Three entry points open a UX/UI video-authoring task via VideoEngine.open_video_task: (1) a published release drafts a companion video — best-effort in ReleaseProposalService.approve, never fails the publish; script from the CHANGELOG via the local model with a template fallback. (2) propose_feature_spotlight gains optional wants_video/video_script — best-effort, gated on video_on_spotlight, default-off leaves the spotlight flow byte-for-byte unchanged. (3) POST /video/request (CEO-only) for an on-demand brief, with clean disabled/not_opened responses. All gated on video_engine_enabled.

* fix(video): savepoint-isolate video-task inserts (F042 poisoned session)

The best-effort try/except around open_video_task (release-publish + spotlight hooks) swallowed the Python exception, but a DBAPI error at the insert flush left the shared session must-rollback — so the caller's next commit (release finalize / request boundary) threw PendingRollbackError: the release stuck 'pending' after actually publishing, or the spotlight draft + HTTP response were lost. Wrap both inserts (open_video_task, _originate_video_post) in a begin_nested savepoint (the repo's established F042 pattern) so a DB error rolls back only the insert. open_video_task returns None (every caller already handles it); _originate_video_post propagates to the render loop's handler. Regression test: an insert FK error returns None with the session left usable. Dormant while the flags were off; armed on the NAS.

* feat(video): Phase G — motion/ package + remotion-renderer sidecar + compose

In-repo Remotion v4 motion/ package (ReleaseAnnouncement composition; calculateMetadata returns 1080x1920 vertical / 1080x1080 square from inputProps.orientation) + a credential-free remotion-renderer sidecar: untar the POSTed motion/ source, bundle (LRU-cached per source sha), selectComposition + renderMedia h264, stream the MP4 bytes back — matching the RemotionRenderer client contract. docker/remotion.Dockerfile on Debian (Chrome apt deps, build-time Chrome pre-warm, ffmpeg bundled in @remotion/renderer). Wired into both compose files (roboco_default only, shm_size 1gb, /health check) + the release publish matrix. Verified via a real local render of both cuts; the Debian docker build is the CEO's to run.

* chore(video): D-hardening — video_post source_task_id + render-loop docstring

Add a source_task_id back-reference to the video_post held-draft marker (traceability from a draft to its authoring task; also makes the render loop's two-key idempotency check wireable later). Fix the render-loop test's stale docstring ('never retried' -> bounded-retry). Both from the Phase D critic's non-blocking follow-ups.

* feat(video): Phase E1 — VideoPostService + heartbeat mutex (approve->post)

CEO-approve->post service: heartbeat-renewed Redis mutex (fail-closed, grace=ttl-2*heartbeat), re-read-in-lock double-post guard, per-platform durable commits (asyncio.shield-ed, settle-before-rollback on lock-loss), all writes inside the lock (captions validated pre-lock, applied in-lock — no stale whole-column clobber), idempotent, per-platform retry-skip. Poster interfaces (X/TikTok, mocked here). Reject + list-held-drafts. Survived 3 adversarial rounds; residual = a crash in the poster->commit window (CEO-gated low-freq, documented).

* fix(video): G-hardening — renderer leaks + Share Tech Mono brand font

Sidecar: give bundle() an explicit outDir tracked + deleted on LRU eviction (was leaking ~19MB remotion-webpack-bundle-* per source); res.on('close') cleanup so an aborted/retried download no longer leaks its remotion-out-* MP4 dir. Fonts: vendor Share Tech Mono (roboco-website brand font) as the display face (self-hosted woff2, 400-weight, headline fontWeight 700->400 to avoid faux-bold) + self-hosted Inter body — no gstatic fetch at render time (lsof-verified). Extras: composition_id whitelist (400) + Multer error middleware (400/413).

* feat(video): Phase E2 — X v2 + TikTok posters, tiktok_credentials, routes

LiveXVideoPoster (X v2 chunked media upload: init/append/finalize/STATUS-poll -> tweet w/ media_ids, OAuth1 signer reused). LiveTikTokPoster (OAuth2 inbox: init -> chunked PUT with asymmetric final chunk -> status-fetch; 401 -> refresh_token grant, rotated token persisted). tiktok_credentials Fernet singleton + migration 062 (single head). Routes: CEO approve/reject + list held drafts + write-only tiktok creds, wiring real posters into VideoPostService. Residual: a lock-loss right after a token-refresh flush can discard the rotated token (same rare CEO-gated class as the documented post->commit window).

* feat(video): Phase F — panel video-post queue + TikTok creds card + flags

video-post-queue.tsx: <video> MP4 preview with 9:16/1:1 cut switch, per-platform editable captions (280/2200 counters, over-limit disables approve), approve/reject, Request-a-video dialog. tiktok-credentials-card.tsx (4 write-only OAuth2 fields). feature-flags-card inlines TikTokCredentialsForm under video_engine_enabled. Mounted in command-center. tsc/eslint clean, 273 panel tests green. NOTE: needs the GET /video/posts/{id}/media route + mp4_paths on VideoPostResponse (folded into H) for the preview source.

* feat(video): Phase H — media route + e2e smoke + NAS arming + docs

GET /video/posts/{id}/media?cut= (CEO-gated FileResponse of the rendered MP4; closes the panel preview gap) + mp4_paths on VideoPostResponse. e2e smoke tests/e2e_smoke/test_video_pipeline.py (full flow, sidecar+X/TikTok mocked; asserts dispatcher skips, render-loop materialize, propose_video team-gate, approve idempotency). NAS arming: docker-compose.yml/.yaml ROBOCO_VIDEO_ENGINE_ENABLED/ON_RELEASE/ON_SPOTLIGHT default-on (.yaml resynced to .yml); registry stays off. CLAUDE.md video-engine section + CHANGELOG. Fixed 2 pre-existing route-test pollution leaks. Full suite 11763 passed.

* fix(video): auth-carrying preview, media route confinement, VideoPost type drift

Three fixes along the video preview path:

1. panel video preview auth: the <video> element was pointed straight at
   GET /video/posts/{id}/media, but a native <video src> GET carries none
   of axios's X-Agent-ID/X-Agent-Role headers — so in the default
   header-trust deployment the request 401s. Fetch the cut via
   videoApi.getMediaBlob (axios, responseType: blob) and drive <video>
   off a URL.createObjectURL result instead. The object URL is revoked
   on cut-change (the previous cut's URL) and on unmount, so neither
   cut switches nor row teardown leak blob URLs.

2. backend media route confinement: GET /video/posts/{id}/media now
   resolves mp4_path and refuses it with 404 when it falls outside
   settings.video_output_dir. Defense-in-depth against any future
   writer of mp4_paths serving files from arbitrary disk locations.

3. panel VideoPost type/comment drift: added mp4_paths to the
   VideoPost interface (the committed VideoPostResponse already
   carries it), and corrected the stale comment on videoMediaUrl
   that claimed no route served the rendered bytes — the route has
   existed since the media endpoint landed; the comment now describes
   why getMediaBlob exists instead of a direct <video src>.

* Persist rendered videos to data in physical storage.

* ++

* docs(video): 0.18.0 CHANGELOG entry + RAG + map reference for video engine

- Move the video engine bullet from [Unreleased] into [0.18.0] and note
  the ROBOCO_VIDEO_OUTPUT_DIR bind-mount persistence.
- Add docs/rag/architecture/video-engine.md (mirrors x-engine.md shape:
  enable/disable, three triggers, render loop + sidecar, CEO gate, media
  route confinement, credentials).
- Reference the video render loop in docs/map/orchestrator.md's engine list.

* chore(video): re-bump to 0.19.0 + sync registry compose defaults

Version was wrongly bumped to 0.18.0; 0.18.0 is an already-released
section. Restore its 2026-07-04 date and move the video-engine CHANGELOG
bullet into a new [0.19.0] - 2026-07-05 section above it. Bump
pyproject.toml, roboco/__init__.py, roboco/config.py (app_version),
panel/package.json, and the motion/README inputProps example to 0.19.0.

docker-compose.registry.yml: add ROBOCO_VIDEO_ENGINE_ENABLED /
_VIDEO_ON_RELEASE / _VIDEO_ON_SPOTLIGHT defaulted false (NAS arms them
true), and comment out the video-renders bind mount with a short note
so the public registry image ships video off by default. Structural
sync with docker-compose.yml maintained.

* fix(video): rate-limit /render + reflow motion/README

CodeQL flagged js/missing-rate-limiting on the renderer /render route.
The sidecar is container-network-only with one trusted caller (the
orchestrator, which renders cuts serially), so this limiter is a
retry-storm ceiling (30/min, well above legit render rate), not the
primary control. Also reflows motion/README.md hard-wrapped prose that
failed the markdown quality gate.

* fix(build): finish pnpm 11 migration + regen verb tables

The panel Docker image build failed on `pnpm install --frozen-lockfile`:
node:22-alpine's corepack resolved to its bundled pnpm 11, but
panel/package.json pinned packageManager to pnpm@10.25.0, and pnpm 11
refuses to run against that pin. The Dockerfiles were already written for
pnpm 11 (comments, CI=true, strictDepBuilds); the package.json pin was the
stale outlier. Finish the migration instead of working around it:

- panel/package.json: packageManager pnpm@10.25.0 -> pnpm@11.10.0; drop the
  `pnpm` field (pnpm 11 ignores it — build approval lives in
  panel/pnpm-workspace.yaml's allowBuilds). Lockfile unchanged (pnpm 11
  accepts it as-is); frozen-lockfile verified.
- remotion-renderer/package.json: pin packageManager pnpm@11.10.0 for
  determinism (was relying on corepack's implicit default); engines.node
  >=22.13 (pnpm 11 requirement).
- docker/panel.Dockerfile + docker/remotion.Dockerfile: `corepack prepare
  pnpm@11.10.0 --activate` so the build uses the pinned version explicitly
  instead of trusting corepack's bundled default (which a future
  node:22-alpine could change).
- .github/workflows/panel-ci.yml: Node 20 -> 22 (pnpm 11 requires
  Node >=22.13; Node 20 fails the engines check).

Also regenerate agents/prompts/_generated/{developer,head_marketing,verbs}.md
— the video engine added propose_video and extended propose_feature_spotlight
(wants_video, video_script) but the verb tables weren't refreshed, failing
the foundation-check quality gate.

* chore(build): approve esbuild build script in remotion pnpm-workspace.yaml

pnpm 11 generated this file with a placeholder ('set this to true or false')
during install; resolve it to true so local dev of the renderer doesn't
re-prompt. esbuild's postinstall only verifies the prebuilt platform binary
(@esbuild/<platform> is installed as an optional dep), so approving it is
safe and silences the ERR_PNPM_IGNORED_BUILDS warning.

* fix(build): copy pnpm-workspace.yaml into panel + remotion images

pnpm 11 hard-errors with [ERR_PNPM_IGNORED_BUILDS] (exit 1) when a
dependency ships a postinstall script that isn't approved in
allowBuilds. Both Dockerfiles copied only package.json + pnpm-lock.yaml,
so the build-approval map in pnpm-workspace.yaml never made it into the
image — the remotion image build died on esbuild@0.28.1's postinstall.

Copy pnpm-workspace.yaml alongside the manifests in both images. In
panel, this also drops the --config.strictDepBuilds=false workaround:
with sharp and unrs-resolver now approved, their postinstalls run and
install the platform-specific binaries (previously skipped, leaving
sharp without its @img/sharp-* binary at runtime).

Verified locally: remotion + panel `pnpm install --frozen-lockfile`
exit 0 with the workspace file present; both exit 1 without it.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
2026-07-05 13:37:17 +02:00

289 lines
9.7 KiB
Python

"""roboco.services.gateway.content_actions.propose_video — team-gated,
metadata-only video-authoring draft (no render)."""
from __future__ import annotations
from typing import Any
from unittest.mock import AsyncMock, MagicMock
from uuid import uuid4
import pytest
from roboco.foundation.policy.content import markers
from roboco.services.gateway.content_actions import ContentActions, ContentActionsDeps
class _FakeTask:
"""Minimal stand-in for the ORM TaskTable row — carries just what
``propose_video`` touches."""
def __init__(
self,
*,
assigned_to: Any,
source: str = "video",
task_id: Any = None,
draft: dict[str, Any] | None = None,
) -> None:
self.id = task_id or uuid4()
self.assigned_to = assigned_to
self.source = source
self.orchestration_markers = {"video_draft": draft} if draft else None
def _actions(role: str, team: str | None) -> ContentActions:
task = MagicMock()
agent = MagicMock()
agent.role = role
agent.team = team
task.agent_for = AsyncMock(return_value=agent)
task.session = MagicMock()
task.session.flush = AsyncMock()
deps = ContentActionsDeps(
task=task,
git=MagicMock(),
a2a=MagicMock(),
journal=MagicMock(),
workspace=MagicMock(),
notifications=MagicMock(),
)
return ContentActions(deps)
def _valid_kwargs(**overrides: Any) -> dict[str, Any]:
kwargs: dict[str, Any] = {
"composition_id": "release-announcement-v1",
"x_caption": "We just shipped v1.0.0! Check out the new release.",
"tiktok_caption": "New release just dropped — here's what's inside.",
"platforms": ["x", "tiktok"],
}
kwargs.update(overrides)
return kwargs
def _mock_active_task(
monkeypatch: pytest.MonkeyPatch, task: _FakeTask | None
) -> MagicMock:
"""Stub the caller's currently-active task — the resolver propose_video uses
(``get_active_task_for_agent``), NOT an oldest-first scan over every open
video task."""
task_svc = MagicMock()
task_svc.get_active_task_for_agent = AsyncMock(return_value=task)
monkeypatch.setattr("roboco.services.task.get_task_service", lambda _s: task_svc)
return task_svc
# --------------------------------------------------------------------------- #
# team gate
# --------------------------------------------------------------------------- #
@pytest.mark.asyncio
async def test_propose_video_forbidden_for_backend_dev() -> None:
env = await _actions("developer", "backend").propose_video(
agent_id=uuid4(), **_valid_kwargs()
)
assert env.error == "not_authorized"
@pytest.mark.asyncio
async def test_propose_video_forbidden_for_frontend_dev() -> None:
env = await _actions("developer", "frontend").propose_video(
agent_id=uuid4(), **_valid_kwargs()
)
assert env.error == "not_authorized"
@pytest.mark.asyncio
async def test_propose_video_forbidden_with_no_team() -> None:
env = await _actions("developer", None).propose_video(
agent_id=uuid4(), **_valid_kwargs()
)
assert env.error == "not_authorized"
# --------------------------------------------------------------------------- #
# field validation
# --------------------------------------------------------------------------- #
@pytest.mark.asyncio
async def test_propose_video_rejects_empty_composition_id() -> None:
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs(composition_id="")
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_rejects_over_280_x_caption() -> None:
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs(x_caption="z" * 281)
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_rejects_over_2200_tiktok_caption() -> None:
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs(tiktok_caption="z" * 2201)
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_rejects_empty_platforms() -> None:
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs(platforms=[])
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_rejects_unknown_platform() -> None:
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs(platforms=["instagram"])
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_rejects_partially_unknown_platform() -> None:
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs(platforms=["x", "instagram"])
)
assert env.error == "invalid_state"
# --------------------------------------------------------------------------- #
# authoring-task resolution — the caller's ACTIVE task, not an oldest-first scan
# --------------------------------------------------------------------------- #
@pytest.mark.asyncio
async def test_propose_video_no_active_task_is_invalid_state(
monkeypatch: pytest.MonkeyPatch,
) -> None:
_mock_active_task(monkeypatch, None)
env = await _actions("developer", "ux_ui").propose_video(
agent_id=uuid4(), **_valid_kwargs()
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_rejects_when_active_task_not_video(
monkeypatch: pytest.MonkeyPatch,
) -> None:
"""The dev's currently-active task is an ordinary code task, not a video
authoring task — refuse rather than write video metadata onto unrelated
work."""
agent_id = uuid4()
other = _FakeTask(assigned_to=agent_id, source="chore")
_mock_active_task(monkeypatch, other)
env = await _actions("developer", "ux_ui").propose_video(
agent_id=agent_id, **_valid_kwargs()
)
assert env.error == "invalid_state"
assert markers.get_video_draft(other) is None
@pytest.mark.asyncio
async def test_propose_video_rejects_when_active_task_is_held_post(
monkeypatch: pytest.MonkeyPatch,
) -> None:
"""A held video_post draft is never a dev's authoring task (Secretary-owned,
source video_post) — refused by the source check."""
agent_id = uuid4()
held = _FakeTask(assigned_to=agent_id, source="video_post")
_mock_active_task(monkeypatch, held)
env = await _actions("developer", "ux_ui").propose_video(
agent_id=agent_id, **_valid_kwargs()
)
assert env.error == "invalid_state"
@pytest.mark.asyncio
async def test_propose_video_targets_active_task_not_an_older_one(
monkeypatch: pytest.MonkeyPatch,
) -> None:
"""Regression: a UX/UI dev routinely holds more than one open video task
(finish A -> submit to QA -> claim B). propose_video must write to the task
the dev is ACTIVELY working on (via get_active_task_for_agent), never
silently onto an older open one — which would clobber an already-submitted
draft and report a false success."""
agent_id = uuid4()
older = _FakeTask(
assigned_to=agent_id,
draft={"occasion": "occ-a", "composition_id": "already-submitted"},
)
active = _FakeTask(assigned_to=agent_id, draft={"occasion": "occ-b"})
task_svc = _mock_active_task(monkeypatch, active)
env = await _actions("developer", "ux_ui").propose_video(
agent_id=agent_id, **_valid_kwargs(composition_id="occ-b-composition")
)
assert env.error is None
task_svc.get_active_task_for_agent.assert_awaited_once_with(agent_id)
assert env.task_id == str(active.id)
active_draft = markers.get_video_draft(active)
assert active_draft is not None
assert active_draft["composition_id"] == "occ-b-composition"
older_draft = markers.get_video_draft(older)
assert older_draft is not None
assert older_draft["composition_id"] == "already-submitted" # untouched
# --------------------------------------------------------------------------- #
# happy path — marker merge
# --------------------------------------------------------------------------- #
@pytest.mark.asyncio
async def test_propose_video_merges_onto_active_task_draft(
monkeypatch: pytest.MonkeyPatch,
) -> None:
agent_id = uuid4()
authoring = _FakeTask(
assigned_to=agent_id,
draft={"occasion": "release v1.0.0", "script": "script", "brief": "brief"},
)
_mock_active_task(monkeypatch, authoring)
env = await _actions("developer", "ux_ui").propose_video(
agent_id=agent_id, **_valid_kwargs(input_props={"title": "Launch"})
)
assert env.error is None
assert env.status == "video_proposed"
assert env.task_id == str(authoring.id)
draft = markers.get_video_draft(authoring)
assert draft is not None
# existing fields survive the merge
assert draft["occasion"] == "release v1.0.0"
assert draft["script"] == "script"
assert draft["brief"] == "brief"
# new fields land
assert draft["composition_id"] == "release-announcement-v1"
assert draft["input_props"] == {"title": "Launch"}
assert draft["x_caption"] == _valid_kwargs()["x_caption"]
assert draft["tiktok_caption"] == _valid_kwargs()["tiktok_caption"]
assert draft["platforms"] == ["x", "tiktok"]
@pytest.mark.asyncio
async def test_propose_video_defaults_input_props_to_empty_dict(
monkeypatch: pytest.MonkeyPatch,
) -> None:
agent_id = uuid4()
authoring = _FakeTask(assigned_to=agent_id)
_mock_active_task(monkeypatch, authoring)
env = await _actions("developer", "ux_ui").propose_video(
agent_id=agent_id, **_valid_kwargs()
)
assert env.error is None
draft = markers.get_video_draft(authoring)
assert draft is not None
assert draft["input_props"] == {}