feat: publish Agent Studio integrations and setup guide

docs/drama-minis-web.md

@@ -0,0 +1,29 @@
+# 网页调用 Drama Minis
+
+## 使用
+
+打开本机 http://127.0.0.1:5173/，在 Skills 中找到 `drama-minis-diagnosis`，点击「使用此 Skill」。页面返回 Chat 并填入任务草稿，点击发送即可读取原始 Skill。
+
+模型会确认分析日期、对比日期和账户范围。确认后，每次真实指标查询会弹出审批，检查日期与账户参数后点击「批准本次查询」。数据会由当前配置的模型处理。报告生成有独立审批，成功后工具卡提供 JSON、HTML 和 PDF 下载；PDF 失败不会显示虚假的 PDF 链接。
+
+`ads-analysis` 和「填入演示任务」仍使用模拟数据，不是这条真实业务链路。
+
+## 服务配置
+
+- `SWADS_MCP_TOKEN`：后端环境中的凭证，不写前端、源码或 Git。
+- `DRAMA_MINIS_SKILL_DIR`：默认用户目录 `.codex/skills/drama-minis-diagnosis`。
+- `PYTHON_EXECUTABLE`：默认 python3。
+- `CHROME_EXECUTABLE`：macOS 默认 Google Chrome；用于本地 A4 PDF。
+- 模型配置沿用网页 Settings 或服务器环境。
+
+本机另有 `scripts/start-private-server.mjs`，在构建后通过关闭回显的交互终端读取一行包含 swadsToken 与 llmKey 的 JSON，启动指定的 Qwen 网关后端。不要把凭证放在命令行参数或文件中；退出后恢复终端回显。凭证只在进程内，服务退出后需重新注入，脚本不是持久化密钥管理器。
+
+## 验证与限制
+
+2026-09-09 已通过真实网页验证：Qwen 成功读取 SKILL.md、metrics.md、reporting-playbook.md，成功调用 swads_whoami 与 metrics_catalog，随后询问周期和账户范围。未调用 metrics_semantic_query，未制作真实经营报告。
+
+验证结果：137 条自动化测试通过（包含新增窄屏 Skill→Chat 切换测试）；typecheck、lint、build 通过。原始 Python 渲染器的合成测试生成了 1 页中文 A4 PDF（594.96 × 841.92 pt），完成图像检查；不是经营数据证据。构建仍有约 599 kB 主包的非阻塞体积提示。
+
+默认测试覆盖 MCP 白名单、脱敏与错误、资源快照、审批、报告来源 ID、下载边界和前端下载卡。`node scripts/verify-minis-render.mjs` 是可选的离线渲染验证，使用人工合成数据调用原始 Skill Python 渲染器与本地 Chrome，不查询经营数据，不是经营报告。
+
+当前原始渲染器仅支持 USD 图表；非 USD 报告明确拒绝。报告与查询记录属于内存 Session，重启或重置后下载登记失效，请及时下载。工具审批与来源留档不能替代人工核对模型分析。

docs/editor-acceptance-title.md

@@ -0,0 +1,54 @@
+# 首次剪辑接入验收：Beneath the Ice
+
+用户于 2026-09-14 授权自行选择 CMS 剧目。固定选择：
+
+- 剧名：Beneath the Ice
+- drama_id：`06aa396d-175a-48ed-ad76-02786ef4d0a9`
+- CMS 语言：en；已发布；总集数 5。
+- 实际数据库：5 个分集均有非空片源记录，5 个分集均有英文字幕记录。
+
+选择理由：集数较少、源和英文字幕记录完整，便于首次全季证据覆盖及受限下载验收。这不是剧情、视觉质量或广告合规的评判。
+
+## 真实片源预检
+
+运行 `scripts/verify-editor-source.mjs`，使用用户已授权的管理员凭据，仅隐藏 stdin 输入，不记录账号密码或签名 URL。
+
+2026-09-14T02:10:23.661Z：第 1、3、5 集 CMS/admin 签名成功；签名 HLS manifest 全部 HTTP 200 且包含 `#EXTM3U`；英文字幕端点全部返回有效 WEBVTT 和时间轴。
+
+只读预检 PASS，不等于渲染或全片审核 PASS。本次没有下载视频分片，没有向模型发送 CMS 内容，没有修改数据库或上传广告。用户不需要再选择剧目。
+
+## 后续固定范围
+
+先在批准的素材范围内接通下载/抽帧及 Qwen 图片分析，再建立 fresh analysis_id + drama_id + fetched_at 绑定的 analysis v2；不能将本预检冒充视觉证据或诊断。
+
+2026-09-14 原始 Skill 已增加 `references/tiktok-adult-content-policy.md`，已读并补入网页 Skill 的受限资源清单。TikTok 官方成人内容页显示更新于 August 2026，本批已重新打开核对：<https://ads.tiktok.com/resources/help/article/tiktok-ads-policy-adult-content>。此时尚未选定任何广告视频片段，未生成内容审核 PASS；连续画面、音频与最终包装仍须按原 Skill 实审。
+
+禁止用仅抽帧/字幕/机器 QA 代替完整带声观看。下载、参考研究、方案审批、渲染及审核能力仍待完成，不声明 Agent Studio 已能自动成片。
+
+## 真实本地媒体验收（2026-09-14 11:50 CST）
+
+`scripts/verify-editor-media.mjs` 已执行成功，任务 `job_893a9bfb-1a78-4ecf-816c-c9c2cb4b7310`，数据位于 `.agent-studio-runtime/videos/job-kuZwme`。
+
+- 第 1 集：72.363 秒；第 3 集：84.694 秒；第 5 集：71.531 秒。
+- 三集真实 TS 分片下载、本地 MP4 解复用、音视频流检测、SHA-256 和英文 WEBVTT 保存成功。
+- 三集分别生成 3 张代表帧，合计 9 张，附实际时间和分集绑定。
+- 修复 CDN 对每条子路径重签 auth_key 的兼容问题，保留同源和同集目录约束；不保存签名地址。
+- 此次未向 Qwen 发送 CMS 字幕/图片；analysisValidated、renderingReady、humanReviewPassed 全为 false。
+
+这是本地准备验收，不代表模型诊断或最终成片完成。
+
+## 真实网页调用（2026-09-14 11:55 CST）
+
+网页真实 Qwen 已读取原 Skill 和 CMS 契约，并在页面批准后完成 `prepare_drama_sources`。任务 `job_b1280a06-450e-4982-935a-b2bd8dfb726f`，analysisId `analysis_d1b59a1a-e3a9-4706-9e19-e393cf894b48`，fetchedAt `2026-09-14T03:54:29.848Z`。三集的 9 张 288×512 JPEG 在结果卡全部实际加载。此任务仅传递准备结果元数据，仍未向 Qwen 发送字幕或图片。
+
+## 授权后的真实模型验收（2026-09-14 13:20 CST）
+
+用户已批准向现有 Qwen 网关发送本剧 E1/E3/E5 英文字幕和九张代表帧，不包含整集上传或广告发布。本次网页 Session 为 `ses_15453ae6-eb84-4926-8bf1-50950fa3f70b`，实际 job 为 `job_9e5a84cb-2f1f-4fac-8221-1f0e15681f5c`，analysisId 为 `analysis_98be9661-7738-477b-8d7d-e4f8f705d084`，fetchedAt 为 `2026-09-14T04:54:32.866Z`。真实素材保留于 `.agent-studio-runtime/videos/job-rdUnOV`。
+
+- 下载和 `read_drama_frames` 成功；网页分步观察已输出三集实际画面说明，引用九个真实 frameId/episodeId/time。
+- 综合分析及随后的分析校验请求仍出现空终止回复；没有调用成功的 `submit_drama_analysis`，没有分析 PASS、候选审核或真实 10 秒 MP4。
+- 独立 Agent 诊断能够处理同一九帧和字幕并返回正文（8192 输出预算；实际输出 2493 token）。这不能证明网页综合分析成功，尚未确定空回复根因。
+- 后端事件适配源码已增加空正文/仅思考和输出额度耗尽的失败处理，避免宣告成功；三项新测试先失败再通过。全量 183 项测试及 lint/typecheck/build 通过，构建仍有 613.62 kB 主包提示。为保留内存中的当前素材任务，运行中后端尚未重启加载此修复。
+- 更进一步的重复证据 + Skill 指令/校验脚本外传诊断被自动安全审批拒绝，需要用户明确批准后才能继续；未绕过拒绝。
+
+模型上下文曾刷新，媒体任务和 CMS 登录保留；不把对素材传输的批准当作人已观看、已审核或已授权发布。

docs/editor-cms-web.md

@@ -0,0 +1,56 @@
+# Short Drama Editor：当前网页接入状态
+
+2026-09-14。实现位于 `feature/agent-studio-build` 本地工作树，尚未声明完整剪辑能力。
+
+## 已接通
+
+- 发现本机原始 `swads-short-drama-editor`，按显式清单复制其指令、引用和脚本到会话只读快照；原 Skill 不变。
+- 页面左侧 `CMS 连接与选剧`：Supabase shorts-sg 管理员登录、目录搜索、分页、选剧填入聊天。
+- 密码只经本机 API 发往固定 Supabase 登录服务；不写文件、浏览器存储、聊天或模型工具。会话凭证留在后端内存。断开/重置清除本应用连接，不注销其他 CMS 客户端。
+- 模型工具：`cms_connection_status`、`cms_list_dramas`、`cms_drama_inventory`、`cms_read_subtitle`。后三者需要页面审批，明确将所选内容发送给当前模型网关。
+- `complete` 仅代表数据库目录及源记录齐全，`playbackVerified` 仍为 false，不能代替真实取片测试。
+- `prepare_drama_sources`：单次最多 5 集 / 1 GiB 下载；固定 CMS/CDN、分路径签名、有限 VOD TS 清单、本地 FFmpeg 无网络解复用和 3 张/集代表帧。`editor_job_status` 返回本会话任务元数据；`read_drama_frames` 必须经另一次页面审批才将字幕和图片交给当前模型。
+- 素材结果卡展示绑定分集和时间的本地代表帧。图片端点只接受已登记 Session/job/frame，禁止缓存；SSE 仅保留图片数量和元数据，不写入原图 base64 或原始字幕。
+- `submit_drama_analysis` 将实际 CMS 分类、简介、分集、字幕原文和帧 ID/时间与本次不可变 analysis_id 对齐，调用原始分析校验器；失败不放行。
+- `propose_drama_selection` 提交候选区间，网页提供带原声源视频和逐段审核记录。模型没有审核批准工具。
+- `submit_editor_plan` 绑定已审核源区间和全部分析工件，调用原始 recipe/hook 校验器；候选参考先由人核实完整视频、来源、内容与证据，再运行原始参考评分。默认不启用 C 级参考。
+- `render_editor_preview` 在版本审核及页面批准后调用原始渲染和 QA，输出 10 秒 REVIEW MP4。渲染前重新校验源文件 SHA-256；字幕由真实 VTT 映射，截断句子的边界阻断。播放器/下载支持登记文件的 HTTP Range，不接受任意文件路径。
+
+## 使用
+
+1. 在已启动的本地网页展开 `CMS 连接与选剧` 并登录，密码不要发进聊天框。
+2. 搜索剧目，选定一部授权英文剧，再点击该 Skill 的使用入口或直接描述任务。
+3. 审批前核对剧目、分集、语言与当前模型网关。下载到本机和发送模型分析是两次独立审批。
+4. 分析通过后，点工具卡中的“打开剪辑审核与预览”。完整观看所选区间并听原声，填写真实逐段观察和政策核对记录。不能把勾选当作形式步骤，疑点未解决就要求更换完整场景。
+5. 提供真实短剧营销参考证据，核对方案、完整参考与字幕。审核通过后在聊天输入“继续”，批准本次渲染。预览可播放/下载，但仍为 REVIEW，不允许当作已完成最终内容审核的广告或直接上传。
+
+后端需通过启动环境设置 `CMS_SUPABASE_PUBLISHABLE_KEY`（公开客户端 key，不是 service_role）；可通过 `scripts/start-private-server.mjs` 的隐藏输入字段 `cmsPublishableKey` 传入。邮箱和密码不能作为此脚本的启动配置。重启后须重新登录；新会话不能继承旧会话认证。
+
+## 验证证据
+
+- 最新素材流水线回归：162 项测试通过，lint、typecheck、build 通过；9 张代表帧已在真实网页实际加载。构建仍提示主 JS 包超过 500 kB，不影响当前验收。
+- 146 项测试通过，lint、typecheck、build 通过；构建仍有主 JS 包超过 500 kB 的体积提示。
+- 真实管理员登录及网页 API 首页面目录读取成功（30 项）；没有修改 CMS。
+- `scripts/verify-editor-api.mjs` 实测 PASS：走 Vite 网页代理，真实 Qwen 读取 Skill 和 CMS 契约，调用已连接状态工具并返回回复。测试不向模型发送 CMS 业务内容，结束后清除测试连接和会话。
+- 浏览器实测显示 4 个 Skill，登录成功并显示真实目录；从聊天框发起检查后，两个 `read` 及 `cms_connection_status` 均显示完成，回复明确列出尚未接入的能力。旧错误页无法直接恢复，新测试页可正常访问并已保留。
+- 修复 Vite 字符串代理默认 `changeOrigin: true` 导致 CMS 同源校验失败的问题，显式保留 Host；未放宽安全校验。
+
+## 尚未接通，不能宣称完成
+
+授权 HLS 下载、本地 FFmpeg 解复用及抽帧已完成真实验收。本轮已实现原始校验/渲染/QA、不可变审核记录与 REVIEW 下载，但尚未以真实剧集跑通整个网页链路。2026-09-14 用户已批准本次 Beneath the Ice 第 1/3/5 集英文字幕和九帧传输 Qwen；该批准不包含整集上传、发布或人工内容审核。真实参考证据仍需提供，没有配置网页自动公共搜索。最终完整带声审片及 final/ 导出没有自动放行功能。
+
+本轮工程证据：180 项回归测试通过。独立测试使用明确标注的合成视频和测试证据串联原始脚本，生成 10 秒 1080×1920 H.264/AAC 字幕 MP4；这些测试数据不代表真实剧情、爆款参考或内容审核 PASS。测试覆盖未审核阻断、未知源、版本哈希、源文件变化、C 级参考阻断、字幕映射、私有视频 Range 及前端无默认勾选。
+
+2026-09-14 12:48（上海）新版服务已重启，验证页新会话 `ses_f7cc79...3f75` 已用原授权账号重新登录 CMS。实际从网页发起只读检查，Qwen 成功读取原 SKILL.md 并调用 `cms_connection_status`，确认 `submit_drama_analysis` / `propose_drama_selection` / `submit_editor_plan` / `render_editor_preview` 已注册，公共参考搜索未配置。本轮网页检查未向模型发送剧情、字幕或图片，也未下载/渲染真实剧集。旧媒体文件保留，但旧会话任务不能自动续跑。
+
+Qwen3.8-27B-FP8 已通过同一网关 Responses API 的双图识别测试，不需要另接视觉模型。随后已将当前网页会话设置为支持图片，并通过真实网页上传/附件 API/模型流式回复链路测试：附件中的蓝色三角形、绿色圆形、红色正方形及其左右顺序全部识别正确。测试只发送合成几何图，未发送 CMS 素材。
+
+2026-09-14 已通过更新后的启动脚本重启本地后端，新会话默认启用已验证的 Qwen 图片能力；已在验证网页重新登录 CMS。重启会清除本应用会话认证，但不会修改 CMS 账户。
+
+聊天附件识图已可用。`cms_connection_status` 已返回实际注册的媒体能力；能力已注册不等于当前任务已过审核。具体以 `editor_job_status` 和网页审核状态为准。完整验收仍需真实参考证据及逐段内容审核。不能用几何图测试或代表帧准备成功替代真实视频分析、成片审核或原 Skill 的 PASS 门槛。
+
+## 本地缓存限制
+
+2026-09-14 13:20 更新：本次授权后的九帧/字幕读取及网页画面观察成功；综合分析仍空回复，真实 MP4 尚未生成。排障与当前任务标识见 `editor-acceptance-title.md`。新增空回复/输出额度失败处理已通过 183 项测试及构建，但当前服务为保留内存任务尚未重启加载。进一步将 Skill 指令、校验脚本连同既定证据发送网关的重复诊断被自动安全审批阻止，等待明确范围授权。
+
+每会话最多 3 次素材准备，全进程同时只运行一个重型任务；下载上限不含 MP4 解复用副本。素材保存在私有 `.agent-studio-runtime/videos/job-*`，失败任务和已完成媒体不会自动清除。当前仅保存元数据和文件，不支持重启后自动认领/续跑；跨会话全局磁盘配额与缓存清理界面尚未实现。

docs/event-mapping.md

@@ -10,9 +10,9 @@ Pi 发出的事件首先经过 `PiEventAdapter` 变成经过裁剪和脱敏的 `
 | HTTP message input | `user.message` | user message，附件仅为 IDs |
 | Harness 开始 run | `run.started` | `isRunning=true`，显示停止按钮 |
 | `message_update.text_delta` | `assistant.delta` | 按稳定 messageId 追加文本 |
-| assistant `message_end` | `assistant.completed` | assistant message complete |
+| 最终 assistant `message_end`（非 toolUse / error） | `assistant.completed` | assistant message complete |
 | `tool_execution_start` | `tool.requested` | 创建工具调用 part |
-| `tool_execution_end` 成功 | `tool.completed` | 工具卡显示 result |
+| `tool_execution_end` 成功 | `tool.completed` | 自定义工具使用 Pi result.details 展示指标和保存结果 |
 | `tool_execution_end` 失败 | `tool.failed` | 工具卡显示安全错误 |
 | Broker 请求 | `approval.required` | 打开服务器审批 Dialog |
 | Broker 决策 / 超时 / 取消 | `approval.resolved` | 关闭 pending 状态 |
@@ -41,6 +41,8 @@ flowchart LR
 
 真实路径匹配避免仅凭用户提供的字符串伪造 Skill 活动。事件由 Session 队列串行处理，因此异步 `realpath` 不会导致 read end 越过 read start。
 
+运行时索引匹配 Session 内的只读 Skill 正文快照，目录面板仍展示来源路径。模型尚未输出文本时，首个工具事件也会建立 assistant 消息，避免工具卡片一直隐藏到最终回复。
+
 ## 顺序、重放与去重
 
 - 每个 Session 的 sequence 从 1 单调递增。

docs/image-to-video-2s-web-test.md

@@ -0,0 +1,43 @@
+# 同图 2 秒网页复测
+
+日期：2026-09-15，Asia/Shanghai。用户要求再生成一条2秒视频，沿用其提供的 IMG_5598.jpeg。只制作预览，不发布广告、不分配账户、不使用 CMS。
+
+## 首次复测与修复
+
+网页任务 `i2v_db33dcee-a002-4139-8d20-382d21b73b2e` 在独立图片审批后停于 initializing_upload。保存的真实回执为 `reused:true`、空 upload_url，并包含匹配图片哈希、格式、大小的 reused_file 和已有 asset ID。程序错误地要求新 PUT URL，因而报 unknown_upload。没有执行 PUT、完成上传或 H3 提交。原记录和回执保持不动。
+
+修复：initialize 显式区分新票据和已有素材；复用必须核对 SHA256、MIME、字节数、image 类型、非空素材 ID。服务保存已核对素材后进入 awaiting_submission，不执行 PUT/finalize，也不自动生成。独立生成审批不变。两项回归先失败后通过；全量228项测试、lint/typecheck/build通过，独立只读复审无阻断问题。
+
+重置会话被安全检查阻止，未执行；另开测试页，原页和任务保留。没有绕过删除保护、重置未知记录或运行恢复脚本。
+
+## 修复后的正常网页流程
+
+- 新任务：`i2v_e0785c65-afb1-45d6-9b57-3b6053921d77`。
+- 标题：海边洞窟画作 · 2秒网页验收。
+- 图片哈希沿用原图规范化结果，未更换素材；固定2秒、9:16、768p、H3 ref2va。
+- 网页选图、填表、准备任务并发送自动填入的消息。
+- Qwen 读取真实 Skill 和全部三份参考说明。
+- 网页图片审批：`ap_a4bd5c08-4a63-492c-86ad-0d503fd26d86`，程序正确接收已有素材，不再传图片字节。
+- 网页独立 H3 审批：`ap_f1d32143-9bc1-4709-9be3-d75fb5f0db9d`。
+- 唯一真实生成任务：`cmjob-f7b9c8c644c6488e`，已保存原始提交回执和 job ID。
+- 此阶段状态：running。后续只查询这个 job，不重投。
+
+至生成提交阶段，新的验收任务没有人工改记录或后台恢复。下面记录实际收片结果，不能将此前阶段的无干预结论扩展到整个流程。
+
+## 成片、原生帧数与最终结果
+
+同一 job 成功，网页轮询自动收取 MP4。但原片为56帧、24fps，即2.333333秒，音轨2.304秒，超过旧0.25秒自动裁尾上限，故严格校验使任务失败。没有重新生成。
+
+只读核对实际 H3 worker `h3_frame_count`：24fps 帧数向上对齐到 `17k+5`。2秒的48帧对齐后为56帧；此前10秒的240帧对齐后为243帧。修复只在24fps且实测时长匹配这个精确网格时放宽裁尾范围；其他输出保留原0.25秒上限，短片、音轨缺失、非整帧目标等继续拒绝。真实FFmpeg回归覆盖56帧裁至48帧，并证明原片保留、帧率不变和非网格超长输出被拒绝。
+
+已失败的这一条使用 `recover-two-second-duration.mjs` 做**本地恢复**：停止本机服务器，核对任务、revision13、job、原片SHA256，备份原记录，调用生产裁切函数及原Skill验证，再注册成片。没有再次上传或生成。最终结果：
+
+- 实际音视频均 **2.000秒**，768×1344，24fps，48帧。
+- 原片 candidate.mp4 保留，SHA256 `61c84bd7a19c9025656810e6afb5f3954d9f3a6f9aa0a5078d7753a710862810`。
+- 最终 video.mp4 为854,692字节，SHA256 `e3fd8717f80eeb350e1e281fcb505fb7bf145605225137761c91f3a06ab399b1`。
+- 原Skill完整解码、时长、音轨及音量技术检查通过，声音内容未试听，不标记audio reviewed。
+- 5个时点画面抽查未见上一条新增的真实手持画作镜头，保留整幅画及竖屏留白，变化较轻微；不作正式素材审核通过声明。
+- 网页播放器实际加载duration2、readyState4、errornull，可正常启动播放；下载HTTP200、video/mp4、正确attachment文件名及字节数。
+- 最终228项全量测试、lint/typecheck/build通过，git diff --check通过；复用与原生帧数修复均经独立只读复审，无阻断问题。
+
+**验收结论：2秒视频已交付，网页播放/下载可用；本轮仍经过收片后的本地恢复，不是无干预全链路验收通过。** 修复已进入正常程序，但没有为了再次证明无干预而追加生成任务。

docs/image-to-video-acceptance.md

@@ -0,0 +1,33 @@
+# 图生视频接入验收记录
+
+日期：2026-09-15（Asia/Shanghai）。本页区分工程验证与真实生成结果。
+
+追加2秒复测：已交付2.000秒音视频，并补修同图去重返回及H3 `17k+5`原生帧数处理。网页审批、真实提交、自动下载成功；收片校验后仍需一次本地恢复，因此尚不能声称全程无干预。最终228项测试及lint/typecheck/build通过。详见 image-to-video-2s-web-test.md。
+
+最新现场结果：用户图片已生成真实10秒视频，任务 cmjob-894ca2faddd34ff7。Agent Studio 已自动收取原片，经原速裁掉0.125秒超长尾帧后，最终音视频均10.000秒、768×1344、24fps。网页播放器已实际播放到片尾，下载接口返回200。恢复有操作者干预，不是无干预的全网页成功；画面有模型添加手持画作的偏差，作为接入测试预览交付，不是正式素材质量通过。详情见 image-to-video-live-artwork-test.md。
+
+## 已验证
+
+- 当前页面 Skills →「图片 → 有声视频」可接收本地单张图片，固定图片、提示词和目标时长，创建本地草稿并填入聊天输入框。
+- 当前配置的 Qwen 在真实运行中读取原始 swads-image-to-video Skill 和 references/swads.md；流程不调用 CMS。
+- 用明确标注 LOCAL UI TEST 的合成图验证了网页审批：外传对话框展示准确缩略图、提示词、10 秒目标、H3 ref2va、9:16、768p 和入库副作用；确认未默认勾选。
+- 拒绝上传后模型停止，草稿仍在本机。刷新页面和重启后端后，同一草稿及缩略图仍可查看。
+- 347px 实际侧栏宽度下的新表单布局已验证无横向裁切。
+- 当前 MCP 的只读工具发现与身份查询通过，权限含生成/上传。本次已实际上传参考图、完成入库、尝试一次生成提交；未分配账户、审核或发布。
+- 原 Skill 视频校验器在本地合成 10 秒测试视频上通过完整解码、音轨、尺寸、帧率、时长和哈希检查；视听人工审核仍为 pending。这不是 H3 成片。
+- 修复了提交回执写入后、主记录更新前中断的恢复窗口。自动化测试证明匹配回执恢复原任务查询、不重投；冲突或无效回执保持隔离。
+- 临时取片失败可在重启后继续查询原 job、收取新的 artifact；确定性媒体验证失败仍阻断。恢复与取片问题均已独立复审通过。
+- 初始实现验证为218项测试；本次新增上传参数、错误识别与回执留存回归。已有主包超过 500 kB 提示在此前验收文档中也存在。
+- 本次修复最终验证：223项全量测试通过；lint/typecheck/build退出0；类型修正后24项相关回归再次通过，git diff --check通过。独立只读复审未发现阻断问题。已重启加载最新修复版本，未知提交继续保留，未重投。
+
+## 尚未验证
+
+用户参考图及两项审批、上传入库、真实生成、实际10秒成片、完整解码、MP4下载和网页播放均已核实。尚未核实实际费用和声音内容；画面抽查已发现手持画作/运镜偏离提示词，不作效果合格声明。
+
+旧超长标识请求经后台核查确认未创建任务；修复后的真实任务已完成并交付网页预览，没有重复生成。原片保留，最终10秒由保留原速的短尾裁切得到。LOCAL UI TEST 草稿禁止外传；旧初始化失败任务保持隔离。最新全量226项测试、lint/typecheck通过，独立复审无阻断问题。
+
+## 本地使用
+
+打开 http://127.0.0.1:5173/，进入 Skills 的「图片 → 有声视频」，选择参考图并填写要求。点击「准备本地任务」后，在聊天中发送已填好的消息，逐项核对图片外传和生成审批。无需 CMS 登录。遇到提交状态未知时不要新建任务盲目重试。
+
+原有工作树和未提交修改均保留；本次新增实现与修复记录为 40e03e3、cc80265、2ad089d，既有脏文件中的接线增量仍保留在工作树中，不能仅靠这些提交重建整个运行版本。

docs/image-to-video-cat-recovery.md

@@ -0,0 +1,41 @@
+# Cat upload recovery — 2026-09-16
+
+## Scope and evidence
+
+- Original task: `i2v_6d07ef38-e230-4da3-b337-435c65cb912d`, title `test`, exact duration 3 seconds.
+- Frozen reference SHA-256: `5a4220f1fc37a110f3801bbc35119921ec7871b4c94d2233078af20951f4c880`.
+- Original initialization failed with upstream HTTP 500 at 2026-09-15T09:23:36.444Z. No upload ticket, asset or generation job was stored locally. The historical server-side root cause remains unconfirmed.
+- On 2026-09-16 immediately before recovery, a READ ONLY query of `direct_upload_tickets`, scoped to this exact content hash and original tenant, returned zero matching rows. This is current reconciliation, not proof that no historical ticket ever existed.
+- The original record (revision 2), original error receipt, owner, frozen prompt, duration and reference bytes were preserved. An exclusive one-shot recovery marker and backup were written privately. No token or signed storage URL is recorded in this document.
+
+## Executed recovery
+
+`scripts/recover-confirmed-cat-upload.mjs` performed one user-authorized upload attempt with the local server stopped, using the production image-video service and adapter. It fails closed on changed task/revision/hash/identity, stale reconciliation, an existing recovery marker, or an online local server. Its remote wrapper prohibits generation submission.
+
+- Initialize: success, 2026-09-16T04:11:36.699Z.
+- Image PUT: completed; finalization receipt returned `finalizing` at 2026-09-16T04:11:37.317Z.
+- Normal server read/refresh: `awaiting_submission` at 2026-09-16T04:12:41.023Z.
+- Browser: existing page reconnected and Skills panel showed the cat task as `参考图已入库 · 待生成审批`, with original title, prompt and 3-second target.
+- H3 submission: **not performed**. No generated cat video is claimed.
+- Focused regression run: 3 files / 29 tests passed (`image-video.test.ts`, `image-video-mcp.test.ts`, `image-video-duration.test.ts`).
+
+## Continuation repair — completed 2026-09-16
+
+Session registry and browser chat are in-memory. After restart the task remains visible, but its original session no longer exists. The new explicit continuation flow preserves the existing tool owner checks; it does not silently reassign tasks or restore old chat history.
+
+After user design approval, implemented `继续此任务` for local drafts and references awaiting generation. Clicking it shows an unchecked local-session continuation confirmation. The strict JSON, local-origin route validates the live idle target, original owner inactivity, frozen revision, state and reference hash. Ownership history is saved privately and all original image/request/upload/asset bindings remain intact. Unknown results and already-submitted jobs cannot be reset through continuation. The model has no continuation tool.
+
+After confirmation, the UI fills (but does not send) the original task's chat request. An already-imported reference requests only status verification followed by separate H3 generation approval, not another upload. Late responses are discarded on session changes; the target is revalidated within the task lock. If the original session is still active, return to its existing page instead of transferring it.
+
+Live browser verification on the user's cat task:
+
+- Confirmation button initially disabled until the checkbox was checked.
+- Local continuation succeeded, revision 9 → 10, one ownership-history entry.
+- State remained `awaiting_submission`, no generation job appeared.
+- Upload ID, asset ID, reference hash and request hash were unchanged.
+- Remote receipt count remained 3; no additional upload/finalize/submit.
+- Browser returned to Chat with exact original 3-second request filled in and Send enabled; no message was automatically sent.
+- Regression verification: 236 tests passed (13 shared, 152 harness, 46 web, 25 server); typecheck, lint and build passed. Existing web chunk-size warning remains.
+- Bounded independent review found two session-lifecycle races; both received failing regression tests and fixes, and follow-up review reported no blockers.
+
+This verifies continuation, not unattended image-to-video acceptance or a proven root-cause fix for the historical upstream 500. Cat video generation still requires the user's separate approval.

docs/image-to-video-live-artwork-test.md

@@ -0,0 +1,78 @@
+# User artwork live H3 test
+
+2026-09-15 Asia/Shanghai. User supplied IMG_5598.jpeg and explicitly asked to test video generation after discussion of SW Ads upload + H3 generation. Only this supplied image is authorized; old synthetic drafts are not.
+
+Target: one10-second H3 ref2va video through Agent Studio UI, existing9:16/768p defaults. Preserve original painted composition with neutral margins if necessary; subtle flags/sails/water/guest movement; sea and breeze ambience, no dialogue/music. Do not change duration/provider or submit another job without a confirmed safe reason. No account assignment, review approval or advertisement publication.
+
+Task: i2v_2ef50a3d-c9ce-4264-b484-539e0122bb67. Title: 海边洞窟画作 · 10秒实测.
+
+Original photo kept unchanged. Local webpage attachment normalized and copied into the registered durable task. This record currently proves local draft/Skill request only, not upload or H3 success.
+
+Read-only video_h3_workers: four online idle workers before submission. Availability does not prove duration support or cost.
+
+## Actual result: FAILED before reference transfer / H3 submission
+
+- Web form created the registered task and Qwen read the actual Skill and all three references.
+- Confirmed the exact supplied artwork/10-second prompt in the separate upload approval and approved once. No H3 generation approval was requested or granted.
+- Result became unknown_upload. On-disk record revision2 has no upload receipt, assetId or jobId. State transitioned from initializing_upload to unknown_upload before an upload receipt could be parsed/saved; the sequential put() stage was therefore not reached. Whether a remote initialization ticket was reserved is unknown.
+- Read-only current MCP listTools + exact submitted-argument validation passed. Normalized local reference is JPEG,2571635bytes. This diagnostic did not invoke upload or generation.
+- Existing code discards the original remote/response-parser error, so the specific upstream or parser cause cannot be recovered from the task record. No blind initialization/import retry, new task or alternate-provider call was made.
+- This is a real integration failure, not a video-generation success. The previous automated/boundary tests did not validate this actual initialization response. Repair needs sanitized private error/receipt preservation, actual response-contract diagnosis and another controlled same-image acceptance run.
+
+## Repair investigation
+
+User authorized repair. One controlled metadata-only diagnostic initialization used the same normalized reference hash and a distinct `-diagnostic-1.jpeg` filename. Actual tool response: `{"error_code":"invalid_arguments","detail":"push begin needs: ratio, prompt"}` with MCP `isError:false`; no upload ticket was returned and no picture bytes or H3 request were sent.
+
+Root cause: live input JSON Schema marks these fields optional, but direct-upload begin requires ratio and prompt at runtime. The adapter omitted both and treated the provider error body as a successful payload, then lost the error during receipt parsing. The fix sends the frozen prompt and existing 9:16 ratio on begin/finish, recognizes provider error_code responses, and persists a sanitized failure stage/code without exposing remote details. Three new regression cases failed before the fix and passed afterward. Original unknown task remains quarantined; controlled new same-image acceptance run follows, not a reset of the original record.
+
+## Controlled repair acceptance
+
+New browser-created task: `i2v_4d14f754-c120-4a1d-a1cc-cc39af4bb4e7`, title 海边洞窟画作 · 修复验收10秒. Same user reference, same normalized hash, prompt and 10-second target. Actual Skill and references read; independent upload approval accepted in browser.
+
+Initialization and image-byte PUT succeeded. Saved upload ID `du-f9eae1fb99e045f6`. Finish exposed a second runtime requirement: `{"error_code":"invalid_arguments","detail":"push finish needs: file_name, content_type, size_bytes"}`. Read-only lookup of this exact upload returned initiated, matching filename/hash/2571635 bytes and no asset ID. No second image upload was performed.
+
+Fix now shares identical file metadata between begin and finish, passing the actual validated bytes through service.finalize. Regression test reproduced this finish rejection before the fix and passes afterward. A controlled operator recovery completed this same upload ticket with corrected metadata and returned finalizing. This was an explicit repair intervention, **not an uninterrupted all-web success**. The browser's own i2v_status then recovered the existing task to awaiting_submission. No record reset, ownership reassignment or alternate-provider request occurred.
+
+## Earlier blocker: H3 submission outcome unknown (reconciled below)
+
+The configured Qwen Responses connection returned MODEL_EMPTY_RESPONSE on three continuations. Switching the same gateway/model to Chat Completions (and therefore refreshing the model conversation context) restored actual Skill reads, status tool calls and the independent H3 approval. This does not establish which of protocol/context caused the original empty response. No provider or model change was made.
+
+One H3 generation approval was accepted in the browser, but i2v_submit returned unknown_submission without a job ID. The deployed submit catch still discarded the specific response/parse failure, so no claim that H3 accepted, rejected, or generated a video is supported. Original 10-second parameters retained; no new submission or automated retry followed. Workers being idle does not prove no job was created. Available read-only tools do not expose lookup by idempotency key; harness_run_inspect requires a known run ID or flow kind and did not resolve this task.
+
+Reconciliation identifiers (not credentials):
+- Task: i2v_4d14f754-c120-4a1d-a1cc-cc39af4bb4e7
+- Reference asset: casset-01ddea3b9bb14c2f
+- Submit outcome timestamp: 2026-09-15T05:50:46.577Z
+- Idempotency key: i2v_4d14f754-c120-4a1d-a1cc-cc39af4bb4e7/ba340e1bc788b28d9d54bcb7861027df1197135de3b08556e24d8a32c39a9d06
+
+Follow-up repair saves original mutation responses in private 0600 per-task files before interpreting them, binding operation/revision/request hash; public messages contain only controlled stage/error codes. Regression reproduced missing receipt persistence and sanitized submit diagnostic failure before fixes. At this checkpoint no video had been delivered and the task remained quarantined pending backend reconciliation.
+
+## Confirmed rejection and controlled recovery — 2026-09-15
+
+The operator located the actual SW Ads gateway source and performed a narrowly scoped READ ONLY query against the corresponding service database. Matching the original idempotency key or reference asset within the correct organization returned **0 media jobs**. Only after that verification, a same-original-key diagnostic returned `invalid_arguments: idempotency_key must be at most 87 characters`. The gateway adds a caller namespace within a 128-character limit and rejects overlength keys before job creation. No duplicate generation was created by this diagnostic.
+
+The adapter now sends a 68-character key containing a full SHA-256 binding of task ID and frozen request hash. Regression first reproduced the rejection, then proved accepted submission, stable duplicate identity and distinct identities for different tasks/requests. Existing unknown-submission guards were not relaxed.
+
+`scripts/recover-confirmed-artwork-submit.mjs` performed one exact-task recovery with the local server stopped: required revision14/unknown state/no job/exact asset and hashes; saved the original record and reconciliation evidence privately; preserved owner and draft; reused the existing image asset without another upload; submitted through the production service. It is a one-shot operator intervention, not evidence of uninterrupted all-web success.
+
+Confirmed real job: **cmjob-894ca2faddd34ff7**. Receipt and main task record are saved. The restarted Agent Studio shows this same job as generating and polls it without resubmission.
+
+The real backend artifact contract uses `storage_url`, not `url`. Another red-green regression covers registered MP4 collection alongside JSON metadata and blocks conflicting URLs or foreign-job artifacts.
+
+## Actual delivered preview and browser verification
+
+The same job succeeded. The normal server collected its MP4 automatically, but strict validation correctly rejected the provider's 10.125-second video / 10.112-second audio (243 frames at 24fps, 768×1344). No second generation was submitted.
+
+The collector now handles a bounded provider frame overrun of at most0.25seconds: it requires sufficient audio/video, compatible constant frame timing, trims only the tail at original speed, preserves the provider MP4, and applies the original Skill's full technical verification to the result. It never stretches, loops, pads missing time or accepts a too-short output. A real-FFmpeg regression exercises original-speed frame count, exact duration, original-byte preservation, and short/excessive-output rejection.
+
+For this already-failed task, the stopped-server local-only `recover-artwork-duration.mjs` checks exact revision28/job/source hash, backs up the record, processes the registered local candidate, and registers the verified result. This is a second explicit operator recovery, not an uninterrupted all-web claim.
+
+- Original `candidate.mp4`: SHA256 e7f0597eede161024de72aed6106e513f6972a7b7006ff40dcdbdea90cee583d, retained unchanged.
+- Final `video.mp4`: SHA256 26a7b49e5f49b9b5507340669dc902ebd1583ebfcad06fd724e8831c8afd06c2, 9,772,338bytes.
+- Actual video **10.000s**, actual audio **10.000s**, **768×1344,24fps**, complete decode and original Skill audio checks passed.
+- Agent Studio task is `ready` and displays player/download. Browser metadata: duration10,readyState4,errornull. Keyboard-started playback reached currentTime10,endedtrue,errornull.
+- Local download endpoint returned HTTP200,video/mp4,attachment disposition and the exact final byte count.
+- Contact sheet sampled five moments. **Creative deviation:** H3 introduced real hands handling the painting and camera movement; it did not follow the intended fixed-camera subtle animation inside the painting. This is an integration preview, not a creative-quality pass. Audio content has not been listened to; no claim of full audio review.
+- Final full verification before copy-only UI text update: **226 tests**, lint and typecheck passed; build passed. Independent read-only review found no blocking issue in key/artifact handling or duration processing. The one-shot credential helper now checks terminal echo is disabled; the actual credential entry already used disabled echo.
+
+Result: actual supplied image → real H3 job → automatic local collection → exact-duration local processing → web playback/download demonstrated, with the operator repair interventions and visual limitation explicitly recorded. No CMS, account assignment, review approval, publication or duplicate generation.

docs/live-model-verification.md

@@ -0,0 +1,40 @@
+# 真实模型联调验收
+
+日期：2026-09-09。本地开发版本，未部署到公网。
+
+## 使用的连接
+
+- 模型：`Qwen3.8-27B-FP8`。
+- 协议：OpenAI Responses。
+- 网关：`https://gateway.pencil-stub.com/v1`。
+- API Key 仅在当前 Session / Pi 凭证内存中使用，没有写入源代码、配置文件或 Git。
+- 仅验收文本能力；未确认该模型的图片能力，当前连接配置为 text-only。Anthropic 协议未做完整链路验收。
+
+## 实测结果
+
+- 简单文字请求返回“连接成功”，SSE 产生文本增量和正常结束事件。
+- `ads-analysis`、`report-writer` 均产生 `skill.requested` 和 `skill.loaded`。
+- `mock_ads_metrics` 返回演示数据；页面显示 Spend 10000、Revenue 21800、ROAS 2.18。
+- 页面出现待审批对话框。点击“批准并保存”后观察到 `approval.resolved: approved`，继而 `save_report_draft` 成功。
+- 最终报告实际写入 Session 的 `report.md`，879 字节；包含五个章节并注明模拟数据。
+- 模型返回“保存成功：report.md”，运行正常结束。
+- 从页面输入并发送测试消息后，真实模型返回“页面发送正常。”；页面未记录 console error。
+
+验收 Session：`ses_ffbe9bca-275c-4004-9fa2-271c2db9cc1a`。该标识仅用于本次本地验收，不是持久会话；重启后不能据此恢复内存数据。
+
+## 修复与回归
+
+- 将 Skill 正文复制到会话内只读快照，并同步运行时索引，保持原有路径守卫。
+- 将 Pi 自定义工具的 `result.details` 映射给页面工具卡。
+- 不再将工具调用轮次结束误报为整个回复完成；模型错误不再被当成正常完成。
+- 模型先调用工具、尚未输出文本时，页面仍即时显示工具卡。
+- 本地 Session 和 runtime 目录加入 Git 忽略。
+
+最终检查全部通过：127 条测试（shared 13、harness 71、server 17、web 26）、生产构建、类型检查、Lint、`git diff --check`。构建仍有主 JS 包超过 500 kB 的体积提示，不影响本次功能验收。
+
+## 仍需注意
+
+- 广告数据是内置 fixture，不是真实投放平台数据。
+- 本轮首次较长报告在结尾出现不完整句子；最终验收改用短报告并确认完整输出。长报告仍需控制长度或提高模型输出上限，并人工审阅数字与结论。
+- Skill 快照目前只包含 `SKILL.md`，额外引用、脚本和资源文件没有自动开放。
+- 保留当前页面可继续使用已配置会话；刷新页面、重置会话或重启服务后可能需要重新配置。

docs/security-boundaries.md

@@ -25,6 +25,7 @@
 ### 路径与写入
 
 - 每个 Session 使用独立随机目录。
+- 已发现的 Skill 正文复制到 Session 内只读快照；Pi 仅使用该快照清单，不向模型工具开放项目或用户目录。Drama Minis 额外复制明确白名单内的两份参考文档、主题、渲染脚本及两份结构示例；逐段拒绝符号链接，单文件上限 1 MiB。其他 Skill 默认仍只复制正文。
 - realpath + relative containment 防止 `..` 和绝对路径逃逸。
 - 逐段拒绝符号链接，并保护 `.env`、`.git`、`.ssh` 和常见私钥名。
 - write tool 只能调用 `SafeWorkspace.writeReportDraft`，目标固定为 `report.md`，临时文件以独占创建并原子 rename。
@@ -42,10 +43,20 @@
 
 - allowlist 只开放课堂所需 read-only 工具。
 - 未知工具默认拒绝。
-- `save_report_draft` 在 Pi tool preflight 阶段等待服务器 Broker。
+- `save_report_draft`、真实指标查询 `metrics_semantic_query`、报告生成 `generate_minis_report` 在 Pi tool preflight 阶段等待服务器 Broker。查询审批展示实际参数与第三方模型数据处理提示。
 - 审批绑定 approvalId、runId 和 toolCallId；支持 approve、deny、expired、cancelled。
 - Browser 点击不是最终事实，只有 `approval.resolved` 事件能改变投影状态。
 
+### Drama Minis 真实数据与报告
+
+- 服务端使用官方 MCP SDK，固定 swads HTTPS 地址，禁止重定向，只开放身份、目录和语义查询；未开放广告修改接口。
+- swads token 仅由服务端环境注入，缺失时明确失败。源工具结果按 token 精确脱敏，不使用模拟数据替代失败。
+- 报告必须引用同一 Session 已成功的真实查询 ID，JSON 保存查询参数和原始返回；这提供可追溯性，但不自动证明模型计算的每个字段正确。
+- 仅运行管理员指定 Skill 中的固定 Python 渲染脚本，模型不能指定任意命令。Python/Chrome 子进程不继承 API 凭证。Chrome 禁止背景网络并使用临时 profile；这不是通用网络隔离。
+- 当前原始渲染器的图表单位固定为 USD，因此其他币种明确拒绝生成，不静默换算或合并。
+- 下载限定 Session、注册 report ID 与 json/html/pdf 三种格式；no-store、nosniff、attachment、沙盒 CSP。PDF 失败时仅返回 HTML/JSON 及明确提示。
+- 仍是单用户 localhost 原型，无用户级身份认证。不得直接暴露公网或作为多租户生产服务。
+
 ## 不提供的隔离
 
 Pi 没有内置 Sandbox，Project Trust 也不是 Sandbox。Pi Agent、Extension、Sharp 和所有 Node 依赖继承启动进程的用户权限与网络权限。应用层路径校验和审批不能防御依赖漏洞、Node 进程逃逸、同用户数据读取或不受控的出站模型请求。

docs/superpowers/plans/2026-09-09-drama-minis-integration.md

@@ -0,0 +1,11 @@
+# Drama Minis 网页接入
+
+用户已授权直接实施，并允许 swads 数据传递到已配置的 Qwen 网关。正式经营查询仍须由页面用户确认周期、对比周期和账户范围。
+
+1. 扩展 Skill 快照：仅复制显式允许的引用、脚本、CSS 和结构示例；保持原始 Skill 不变，拒绝路径逃逸和符号链接。
+2. 接入官方 MCP HTTP 客户端：仅映射 swads_whoami、metrics_catalog、metrics_semantic_query；凭证来自服务器 SWADS_MCP_TOKEN，不经过浏览器或模型。真实查询逐次等待页面批准。
+3. 封装固定报告生成器：校验 JSON，在会话私有目录运行已知 Python 脚本；生成 HTML 和 A4 PDF。PDF 失败时明确返回 HTML 与原因，不伪造成功。
+4. 网页增加 Skill 调用入口、真实查询确认和报告下载卡片；固定 Session 产物端点禁止路径遍历。
+5. 验收：先失败测试后实现，运行全套检查；真实网页验证 Skill 读取、引用、swads 连接和参数确认。未获日期/范围确认前不自动查询真实指标。报告渲染使用明确标注的测试数据验证，不作为真实经营报告交付。
+
+不开放通用 shell，不导入其他 Codex MCP 权限，不修改原始 Skill，不做公网部署。

docs/superpowers/plans/2026-09-14-editor-cms-connection.md

@@ -0,0 +1,52 @@
+# Editor CMS Connection Implementation Plan
+
+> **For agentic workers:** Use superpowers:executing-plans inline. The user requests direct execution; do not pause for another execution-mode choice.
+
+**Goal:** Let the web app load the real editor Skill and authenticate its own CMS session, then read genuine drama inventory and subtitles without exposing credentials.
+**Architecture:** First implement the CMS/auth boundary as a separately testable milestone. It does not claim render readiness; the subsequent media milestone requires an authenticated source and explicit model/footage authorization. Original Skill and CMS code remain unchanged.
+**Tech Stack:** Existing Fastify, React, Pi, Zod, pinned official Supabase JS client.
+**Spec:** `docs/superpowers/specs/2026-09-10-short-drama-web-design.md`.
+
+**2026-09-14 execution checkpoint:** Auth/API/UI/read-only tools are implemented. Full suite: 146 passed, lint/typecheck/build passed. Real login, 30-item catalog, Skill + CMS contract reads and status tool passed through the Vite/API/real-Qwen chain. Browser login/catalog also passed. Detailed evidence and remaining limitations: `docs/editor-cms-web.md`. Checklists below retain unverified cases (including explicit expiry, busy API mutation and browser content approval); do not interpret this milestone as full video acceptance.
+
+## Global Constraints
+
+- localhost single-user app; no CMS writes, RLS changes, service_role, arbitrary shell or uploads.
+- Authentication is a separate UI form; no password/token in chat, model tools, SSE or disk. Session reset clears only this app's CMS connection.
+- Fixed Supabase project and CMS origin; reject redirects. Only verified app_metadata.role=admin is accepted, matching actual backend checks.
+- Skill source is read-only; copy only explicitly enumerated references and script dependencies.
+- Do not equate readable Skill/catalog with a finished video pipeline.
+
+### Task 1: Authenticated CMS boundary
+
+Files: `packages/harness/src/cms/cms-connection.ts`, `packages/harness/tests/cms-connection.test.ts`.
+Interface: `CmsConnection({publishableKey,fetch?})`: `login(email,password)`, `status()`, `clear()`, `listDramas(query,offset)`, `inventory(dramaId)`, `subtitle(dramaId,episodeId,locale)`.
+
+- [ ] RED: create real service tests with injected external HTTP responses. Assert no data query before login; fail non-admin even with user_metadata.admin; status omits passwords/tokens; subtitle rejects an episode not in the requested drama; inventory completeness preserves missing sources. Example: `await expect(cms.listDramas('',0)).rejects.toMatchObject({code:'CMS_LOGIN_REQUIRED'})`.
+- [ ] Run `../../node_modules/.bin/vitest run tests/cms-connection.test.ts` in harness and observe missing implementation failure.
+- [ ] GREEN: use official `createClient(url,key,{auth:{persistSession:false,autoRefreshToken:false,detectSessionInUrl:false}})`. Call `signInWithPassword` then `getUser` and verify role. Fetch only known tables/selects, validate all returns with Zod; fixed CMS subtitle route and bounded responses. Never return raw SDK errors.
+- [ ] Verify tests and TypeScript, including expiry and disconnect; review credential lifecycle and request destinations.
+
+### Task 2: Session API and login UI
+
+Files: `apps/server/src/routes/cms.ts`, `apps/server/src/app.ts`, `apps/server/src/index.ts`, `apps/web/src/components/cms/CmsPanel.tsx`, `apps/web/src/App.tsx`, corresponding route/component tests.
+Interface: GET/POST/DELETE `/api/sessions/:sessionId/cms/connection`; GET `/api/sessions/:sessionId/cms/dramas?q=&offset=`. All authenticated CMS objects are mapped by Session; dispose clears them.
+
+- [ ] RED: API rejects unknown Session, cross-origin mutation, concurrent login, busy mutation; private fields never appear in status. UI password empties on submission/failure/close; authenticated catalog selection fills an exact drama ID in Chat.
+- [ ] Run test files and observe failures before implementation.
+- [ ] GREEN: fixed-origin backend API, JSON-only login body, same-origin/fetch metadata guard, bounded login attempts, no-store. Status communicates `connected` and `expiresAt`; no user email or credentials to model. UI accessible labels, pending/error states and an explicit notice of the destination receiving credentials.
+- [ ] Verify route and UI tests; unchanged report flow passes.
+
+### Task 3: Real Skill and read-only tools
+
+Files: `packages/harness/src/cms/editor-tools.ts`, `apps/server/src/index.ts`, tool policy, Skill and web tests.
+Interfaces: `cms_connection_status`, `cms_list_dramas`, `cms_drama_inventory`, `cms_read_subtitle`. Model never calls login or changes the connection. Inventory and subtitle access require page approval because they can disclose licensed/nonpublic content to the configured model.
+
+- [ ] RED: Skill snapshot reads full reference hierarchy; tools reject data access before login; policy asks for content reads; discovery alone does not claim rendering ready.
+- [ ] GREEN: enumerate trusted Skill resources, register tools only with that Skill, strict tool argument schemas, inject runtime instruction to report missing media/vision/research capability honestly and never use demo data.
+- [ ] Run all tests, lint, typecheck, build, then restart only the local Agent Studio service with secrets via hidden stdin.
+- [ ] Browser verify Skill entry, original instructions, login form and capability/status tools; request the user to authenticate through the form for the real CMS flow. Stop at a genuine missing login instead of inventing an admin session.
+
+## Remaining full-workflow milestones (not claimed by this plan)
+
+After real CMS login is available: approved bounded HLS download; vision evidence and analysis v2 gate; configured reference research and scoring; immutable plan approval; fixed Python/FFmpeg worker with cancellation/quota; machine QA; human sound/viewing review; versioned downloads/export. Each requires its own test-first plan against the full spec. The task remains incomplete until these are verified on user-selected licensed footage.

docs/superpowers/plans/2026-09-14-editor-media-pipeline.md

@@ -0,0 +1,54 @@
+# Editor Media Pipeline Implementation Plan
+
+> Execute inline using executing-plans and test-driven-development; the user already requested execution, no further execution-mode confirmation.
+
+**Goal:** Prepare actual licensed source media and return auditable frames/subtitles through Agent Studio, then enforce original analysis, reference, recipe, render and review gates.
+**Architecture:** Fixed CMS/admin signing; bounded same-CDN HTTPS HLS retrieval to local files; FFmpeg/FFprobe without network or inherited secrets. Per-session service and explicit approval tools reuse the existing Harness. Rendering cannot run until analysis and reference gates pass.
+**Tech Stack:** Existing TypeScript/Fastify/Pi/React; pinned ffmpeg-static 5.3.0, ffprobe-static 3.1.0; bundled Python 3.12 and original Skill validators.
+**Spec:** `docs/superpowers/specs/2026-09-10-short-drama-web-design.md`.
+
+## Constraints
+
+No CMS writes, uploads, source overwrites, arbitrary shell or credential/URL exposure. First acceptance title is `06aa396d-175a-48ed-ad76-02786ef4d0a9` (Beneath the Ice). Read-only preflight is already PASS. Metadata completeness is not media analysis. Content review must follow the newly added adult-content gate, never fabricate reviewer PASS.
+
+### 1. Source preparation
+
+Files: `cms/cms-connection.ts`, `media/hls.ts`, `media/media-worker.ts`, `media/editor-service.ts`, matching harness tests.
+
+- [ ] Write failing tests for HLS target-origin/path escapes, encrypted/byte-range playlists, master nesting, segment count/duration/byte limits; valid playlists become local filenames without signed URLs.
+- [x] Implement `parseHls(text:string): {kind:'master',variants:string[]} | {kind:'media',segments:{uri:string,duration:number}[],duration:number}`. Only finite VOD MPEG-TS sources; reject unsupported formats explicitly, never silently skip encryption or audio renditions.
+- [x] Add `CmsConnection.playback(dramaId,episodeId)` returning signed URL only to server-side service after exact inventory binding and admin checks.
+- [x] `EditorService.prepare({dramaId,episodeNumbers},signal)` allows at most 5 episodes, 30 minutes/episode, 1 GiB/task download. Fetch fixed public CDN, no redirects, preserve CDN-issued per-path signing query only on same episode-directory assets. Localize manifests before invoking FFmpeg with `file,crypto,data` protocol allowlist; no network credentials in child env.
+- [ ] Probe real local MP4 for audio and video, hash sources; create representative JPEGs, save captions and source/time bindings in private runtime. Cancellation aborts fetch and kills process group.
+
+### 2. Web tools and artifacts
+
+Files: `media/editor-tools.ts`, server assembly and routes, tool policy and approval UI.
+
+- [x] Expose `prepare_drama_sources` with exact IDs/quotas (approval), `read_drama_frames` returning small selected JPEG images plus time/source binding (approval), `editor_job_status` (read-only).
+- [x] Keep normal image-tool results out of SSE base64 payloads. Expose only registered frame IDs scoped to owning Session, with no-store/nosniff and inline JPEG display. Model must read Skill before analysis; no shell access.
+- [ ] Verify actual first/middle/last source download, image tool result acceptance by existing Qwen, and genuine transcript evidence. A safe extraction result can be claimed only after probing output.
+
+### 3. Analysis and downstream gates
+
+Files: validator bridge and video job routes/review components, separate tests following the verified interfaces above.
+
+- [x] Bind every analysis submission to freshly prepared drama_id/fetched_at and server-issued analysis_id. Server compares actual subtitle/frame IDs before invoking original validator; reject invented evidence, paths or PASS flags.
+- [ ] After diagnosis PASS, obtain verified public short-drama references through a separately configured source or user-supplied direct evidence; never claim current Codex search is inherited by the webpage. Missing reference access/evidence is a genuine gate requiring input, not an automatic Tier C downgrade.
+- [x] Bind immutable recipe and content-review records to the same analysis and approved source IDs; user approves exact plan hash. Run original render_exact and machine QA with bounded child process and minimum environment. Verified with synthetic engineering fixtures; real-drama acceptance remains pending.
+- [ ] Serve REVIEW preview/ranged download only for registered artifacts; final export requires human full-playback-with-sound review bound to exact video hash, plus existing content/story gates.
+
+### Verification and persistence
+
+- [ ] Run baseline/regression tests, original validators, typecheck/lint/build. Keep progress in this plan, avoid claiming later unchecked gates complete.
+- [x] Restart only the local service after build; fresh web Session must enable verified Qwen image capability by default. Credentials remain in memory, require re-login after restart.
+- [ ] Run real browser task to a genuine review/approval gate. Do not stop at a preflight or after writing a plan.
+
+## 2026-09-14 execution evidence
+
+- Real local acceptance passed: episodes 1/3/5 downloaded, remuxed with audio/video, probed, SHA-256 recorded, 9 JPEGs and English VTT saved.
+- Real browser run loaded the original Skill and CMS contract, requested page approval, then successfully ran `prepare_drama_sources` for all three episodes. Job `job_b1280a06-450e-4982-935a-b2bd8dfb726f`; nine actual 288×512 images loaded in the result card.
+- Licensed subtitles/frames have NOT yet been sent to Qwen. Separate transmission authorization remains pending. Do not equate the model's earlier synthetic-image test with a real-drama analysis pass.
+- Original analysis/recipe/hook validators, reference scorer, renderer and machine QA are now connected. Source and plan review endpoints are human-only; tools cannot submit approval. REVIEW video routes support byte ranges, with frontend playback/download. Actual model transmission and real-title end-to-end acceptance remain pending.
+- Fresh synthetic integration produced actual 10-second H.264/AAC/1080×1920 with original source audio and mapped English subtitles. It does not establish licensed-drama analysis, real reference evidence, or semantic content PASS.
+- Local persisted files are not yet restart-resumable. Global disk-cache quota, automatic public reference search and final-stage export remain open; final PASS is never synthesized.

docs/superpowers/plans/2026-09-15-image-to-video-web.md

@@ -0,0 +1,71 @@
+# Image-to-video Web Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Integrate the real CMS-free image-to-video Skill with durable H3 tasks and a usable web interface.
+**Architecture:** Reuse attachment validation and approval broker; add a separate durable service and restricted MCP adapter. Keep image generation jobs independent of in-memory CMS/editor jobs and chat history.
+**Tech Stack:** Existing TypeScript/Pi/Fastify/React/Vitest; original Skill Python media validator; existing ffmpeg-static/ffprobe-static.
+**Spec:** `docs/superpowers/specs/2026-09-15-image-to-video-web-design.md` (approved by user).
+
+## Global Constraints
+
+- 不依赖 CMS 登录、剧名、字幕或旧剪辑器的参考/选段审核。
+- 首版只做单图新生成，不提供原片续接、批量生成、自动选图或生成封面功能。
+- 不自动调用 Seedance 或其他付费提供商；不宣称 H3 免费或已支持 10 秒。
+- 本地参考图外传和生成提交分别审批；不得自动审核素材、分配账户或发布广告。
+- 重启后已知 job_id 只查原任务；未知提交不得盲重投。不得伪造时长或审核 PASS。
+- 不发送密钥至模型/前端/日志。媒体端点必须防路径穿越、SSRF、重定向和错误内容。
+- 保留所有已有脏改动；仅提交本任务新增文件和本任务增量，不提交无关旧改动。
+
+### Task 1: Complete vertical slice (durable service, tools, routes and UI)
+
+**Files:**
+- Create focused modules under `packages/harness/src/image-video/`: contracts, store/service, MCP adapter, media validation, tools. Tests under `packages/harness/tests/image-video*.test.ts`.
+- Modify `packages/harness/src/tools/swads-mcp.ts` only to expose reusable validated discovery/call plumbing if needed; preserve existing analytics allowlist. Export new modules through `packages/harness/src/index.ts`.
+- Modify `apps/server/src/index.ts`, `apps/server/src/app.ts`; create `apps/server/src/routes/image-video.ts` and tests `apps/server/tests/image-video-api.test.ts`.
+- Create `apps/web/src/components/tools/ImageVideoPanel.tsx` and tests `apps/web/tests/image-video.test.tsx`; integrate `App.tsx`, `ApprovalDialog.tsx`, `ToolFallback.tsx` and `components.css` as needed. Preserve current CMS UI but never require it for this flow.
+- Modify `packages/harness/src/tools/tool-policy.ts`, `pi-event-adapter.ts` for the new tools and safe public details.
+- Create `docs/image-to-video-web.md` with actual usage and explicit test/live limitations.
+
+**Interfaces / implementation guidance:**
+
+Use task IDs `i2v_<uuid>` and a versioned private JSON record with server-owned paths, ownerSessionId, stable request hash, reference hash, upload receipts, jobId, state, timestamps and revision. A local draft operation (`i2v_create_task`) resolves an attachment from the requesting Session and copies approved-local image bytes into the durable task directory; it must not upload. Subsequent tools `i2v_upload_reference` (ask), `i2v_submit` (ask), `i2v_status` (allow) consume only registered taskId, not arbitrary URL, tenant, file path or provider arguments. Preserve prompt/duration/image bindings from the draft through approval. Do not give a model a general mutation tool.
+
+```ts
+type ImageVideoDraft = { attachmentId: string; title: string; prompt: string; durationSeconds: number };
+type ImageVideoPublicTask = {
+  id: string; title: string; prompt: string; durationSeconds: number;
+  state: string; createdAt: string; updatedAt: string;
+  referenceUrl: string; videoUrl?: string; jobId?: string;
+  error?: string; validation?: unknown;
+};
+```
+
+Use private service methods `create(sessionId, draft)`, `upload(sessionId, taskId)`, `submit(sessionId, taskId)`, `refresh(taskId)` and `list()/view(taskId)` with public redacted return DTOs. Tools must enforce owner Session. A same-origin, read-only local task history can display registered tasks across process restarts without granting a new Session permission to mutate them. No automatic cross-session reassignment. Keep already-submitted jobs collectible after restart, even when their old chat Session no longer exists. A timer or UI read-only refresh should resume job polling without involving the LLM. Query at most once per 30–60 seconds; serialize each task and coalesce concurrent requests.
+
+Use `/api/image-video/tasks` for redacted local history and registered media read endpoints. Creation is a Session-scoped route and/or tool. Prefer a small dedicated image input + draft form that uses the existing attachment endpoint, then invokes this Skill through the composer with the exact draft/attachment identifiers; this allows references even without vision-enabled Qwen. Keep all transfer approvals explicit. If the model needs image inspection, explain current model image transmission separately; server thumbnail display is not model transmission.
+
+Discover and validate required MCP tool schemas via `listTools` before submission; rely on actual structured response shapes, not guessed backend endpoints. Root controller will supply read-only live contract observations. Identity/platform ambiguity blocks upload. Persist every potentially mutating intent before calling remote tools. A timeout around submit must persist unknown_submission, never return to ready. A known returned job ID must be persisted even if user cancelled waiting; preserve in-flight result handling. Before a source upload retry, distinguish uninitiated, known upload receipt and unknown initialization/finalization; never duplicate an uncertain import blindly.
+
+MP4 download uses only registered job artifact HTTPS URL, DNS/public-address checks and bounded bytes/time, no redirects. Validate full decode, video dimensions/frame rate/duration and audio using the original Skill `scripts/media.py verify`; exact-duration mismatch is failure, not ready. Store validation report and hash; preview remains not human reviewed. Bound process time and prohibit media tools from network access. Reuse existing safe media runtime helpers where suitable, without copying CMS download logic or fixed CMS hosts.
+
+- [x] **Step 1: RED — durable state tests.** Test draft ownership, no external operations on create, separate approvals, duplicate concurrent submit, persisted job after reload, unknown submit blocks retry, unknown import blocks retry, stale task revisions, safe public DTO, independent CMS. Example behavioral assertion:
+```ts
+await expect(service.submit("ses_other", task.id)).rejects.toMatchObject({code:"I2V_TASK_NOT_FOUND"});
+expect(remoteSubmissions).toHaveLength(0);
+```
+Run the focused harness tests and record real failing assertions before implementation. External provider/network calls may be faked, not service state or persistence.
+- [x] **Step 2: GREEN — implement minimal service and remote boundary.** Atomic records, strict persisted schema, locked task operations, known-ID polling, safe URL/media validation. Validate recorded state by constructing a new service against the same temporary directory and proving no duplicate remote submit.
+- [x] **Step 3: RED/GREEN — API and tool access.** Add tests of denied approval/no side effects, cross-session task binding, durable history after registry restart, same-origin JSON mutation requirements, registered-only media, HTTP 206/416 and no-store. Implement routes and tool policy, original Skill resource snapshot and production wiring. Deny unknown tool names.
+- [x] **Step 4: RED/GREEN — real UI behavior.** Test image/draft input, exact approval parameters and thumbnail, unchecked decisions, loading/error/queue states, restored tasks, periodic status fetch with cleanup, registered-only video links and actual native player/download. Use jsdom only as component evidence, not end-to-end real generation proof.
+- [x] **Step 5: Verify and self-review.** Run focused tests per iteration then full `CI=true pnpm --config.verify-deps-before-run=false test`, lint, typecheck and build. Review actual diff for credential reflection, arbitrary paths, duplicate requests and existing dirty edits. Write report with RED/GREEN evidence and all remaining live unknowns. Commit only isolated task changes; if modifying already-dirty files, use a task-specific delta commit or leave those files uncommitted and document why rather than absorbing unrelated edits.
+
+### Task 2: Independent review and live acceptance
+
+**Files:** Review package/report in plan workspace; update `docs/image-to-video-web.md` with exact evidence. Root controller owns service start, browser and live acceptance, not the implementer.
+
+- [x] **Step 1:** Independent review the new feature diff for spec compliance and code quality, especially restart/approval/unknown-submission semantics. Fix important findings with covering tests before live mutation.
+- [x] **Step 2:** Run latest test/lint/typecheck/build; start local backend using existing hidden credential input without printing or saving keys. Read-only current MCP identity/schema checks must use the configured application token as well as connected-tool discovery.
+- [x] **Step 3:** Browser test catalog discovery, new draft, reference preview, approval refusal and task history restoration with no CMS connection. Synthetic boundary tests must be visibly labelled as such.
+- [ ] **Step 4:** If there is a user-authorized reference image, submit one actual H3 task through page approvals. Otherwise stop at image selection; do not transmit earlier CMS images or manufacture approval of a new image. User's approval of this implementation is not approval of an unspecified remote submission.
+- [ ] **Step 5:** If a real job exists, poll it rather than resubmit, collect its exact MP4, run technical checks, watch/listen and verify actual webpage playback/download. If blocked on duration/provider/image approval, report that specifically; do not claim real generation completion.

docs/superpowers/specs/2026-09-10-short-drama-web-design.md

@@ -12,9 +12,9 @@
 
 - 既有后端已有 Skill 只读快照、工具白名单、审批、Session/SSE 和受限报告下载。
 - 现有 swads 连接只映射身份、指标目录、指标查询；没有网页 CMS 取片能力。swads token 不等于 CMS 管理员凭证。
-- 已配置 Qwen 连接在项目中声明为 text-only。不能仅打开 supportsImages 开关就视为已验证的视觉模型。
+- 最初 Qwen 连接在项目中声明为 text-only；2026-09-14 已实测同一网关的 Responses 双图识别成功，当前网页会话启用图片后也通过上传及识别测试。无需额外视觉模型，但 CMS 抽帧/证据绑定流程仍未实现；不能仅打开 supportsImages 开关就视为该流程已完成。
 - bundled Python 已实测为 3.12.14，可用于 Skill 所需 audioop；当前 PATH 与已检查的 bundled bin 中未发现 FFmpeg/FFprobe。安装或指定媒体运行时需先确认可用来源。
-- CMS 管理端地址/后端项目尚未指定。连接器在确认前必须返回明确的未配置状态，不猜测 API，不搜索或抽取无关应用凭证。
+- 2026-09-14 用户提供 `https://swave.pencil-stub.com/`。已从本机 `/Users/wenxinduan/codex-outputs/Short` 核对到同一项目：`.ops/README.md` 中 CMS 为 `/swave/`，后端为 `/swave-api/`。Supabase 为 `shorts-sg`（`lmcysqgfhoxppwuorsmu`），已只读核对 drama、episode、episode_source、subtitle_track 表结构。不得搜索或抽取浏览器存储中的凭证。
 
 ## 3. 方案选择
 
@@ -91,4 +91,6 @@ VideoJob 使用独立 UUID、Session 所属关系、固定 drama_id 和不可变
 
 ## 8. 实现前需要的输入
 
-首先由用户提供应复用的 CMS 后端项目路径或管理端地址；暂不需要在聊天发送密码。通过只读检查确定实际连接契约，再确认视觉与参考研究连接。不得因缺少这些信息而退化成假素材演示并标记完成。
+CMS 入口和本机源码已定位，不再要求用户重复提供。`backend/app/routers/cms_playback.py` 确认专用签名接口为 `GET /api/v1/cms/playback/{episode_id}`，字幕为同路径下 `/subtitles/{locale}.vtt`；生产完整前缀为 `https://swave.pencil-stub.com/swave-api`。它们依赖有效 Supabase 用户会话及后端管理员判定，不能用 swads token 或匿名 key 替代。
+
+还需通过受支持的登录/授权流程配置 Agent Studio 自己的 CMS 会话，不能抽取另一浏览器的登录存储；然后确认视觉与参考研究连接并执行实际取片验收。源码接口已确认不等于线上授权取片已验证。不得因缺少这些条件而退化成假素材演示并标记完成。