Harden cinematic generation policies (#8)

Co-authored-by: Andrew Michael <AndrewMichael2020@users.noreply.github.com>

Author: AndrewMichael2020

.github/workflows/dry-run.yml

@@ -1,18 +1,35 @@
 name: dry-run
 on:
-  # Keep development testing local. Do not consume GitHub Actions minutes
-  # automatically on pushes or pull requests.
+  push:
+    branches: [main]
+  pull_request:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: dry-run-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.11', '3.12']
+    env:
+      # This workflow never receives provider credentials and never invokes --live.
+      DEEPINFRA_TOKEN: ''
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: ${{ matrix.python-version }}
+          cache: pip
       - run: python -m pip install -e . pytest
+      - run: video-gen-secret-scan
       - run: pytest -q
       - run: video-gen preflight --profile cad_10
+      - run: video-gen validate-stage2 sequences/clinic-reception-stage2.json

README.md

@@ -1,6 +1,6 @@
-# Auditable Cinematic Production Lab
+# Cinematic Production Lab
 
-[![Dry-run CI](https://github.com/AndrewMichael2020/auditable-cinematic-production-lab/actions/workflows/dry-run.yml/badge.svg)](https://github.com/AndrewMichael2020/auditable-cinematic-production-lab/actions/workflows/dry-run.yml)
+[![Dry-run CI](https://github.com/AndrewMichael2020/cinematic-production-lab/actions/workflows/dry-run.yml/badge.svg)](https://github.com/AndrewMichael2020/cinematic-production-lab/actions/workflows/dry-run.yml)
 [![Python 3.11+](https://img.shields.io/badge/Python-3.11%2B-3776AB?logo=python&logoColor=white)](pyproject.toml)
 [![Tests: pytest](https://img.shields.io/badge/tests-pytest-0A9EDC?logo=pytest&logoColor=white)](tests)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
@@ -26,8 +26,9 @@ open-ended generation demo:
   provider, cost, hash, lineage, and human-acceptance evidence.
 - **Honest QA:** accepted and rejected artifacts are retained separately; the latest rejected run
   has a documented voice-persona and lip-sync root-cause analysis.
-- **Safe automation:** GitHub workflows are manual-dispatch only, generation defaults to dry-run,
-  and the paid smoke test requires an explicit `LIVE` confirmation.
+- **Safe automation:** push and pull-request CI runs tests, a tracked-credential scan, configuration
+  preflight, and Stage 2 validation without provider credentials; the paid smoke test remains a
+  separate manual workflow requiring explicit `LIVE` confirmation.
 
 | Evidence | What it shows |
 |---|---|
@@ -54,6 +55,26 @@ orientation checks, face/mouth and action gates, perceptible ambience, outer fad
 human acceptance. The clinic v3 package is the first accepted Stage 2 delivery candidate; a second
 contrasting sequence is still required to exit the stage.
 
+## Architecture
+
+```text
+series + sequence manifests
+          ↓
+model / price / secret policy validation
+          ↓
+dry-run planner → reservation ledger → explicitly confirmed provider request
+          ↓                                  ↓
+typed provenance + media hashes        reported-cost reconciliation
+          ↓
+technical checks + human acceptance gates → FFmpeg delivery master
+```
+
+The CLI is the policy boundary. Configuration is validated before orchestration; live requests
+require a current human-reviewed pricing snapshot, explicit confirmation, an approved registered
+model, and a reservation that fits both the run profile and provider-account ceiling. Voice
+generation additionally requires a versioned canonical realization and approved audition hash.
+Provider uncertainty never triggers an automatic retry or fallback.
+
 ## Current pause and latest-run decision
 
 New generation is paused while production moves to an M5 Pro machine with 64 GB of memory. The
@@ -110,9 +131,11 @@ Choose exactly one run profile: **10, 15, or 20 dollars Canadian**, including a
 |---|---:|
 | CAD 10 | US$10.00 |
 | CAD 15 | US$9.75 |
-| CAD 20 | US$13.00 |
+| CAD 20 | US$15.00 |
 
-The program must stop before the selected US-dollar cap. It must also respect a DeepInfra account spending limit of no more than US$13.00 for the proof. DeepInfra reports actual cost in `inference_status.cost`; the local append-only ledger records both reserved and reported cost.
+The program must stop before the selected US-dollar cap. It must also respect a DeepInfra account
+spending limit of no more than US$20.00. DeepInfra reports actual cost in
+`inference_status.cost`; the local append-only ledger records both reserved and reported cost.
 
 Only sequential generation is allowed. Every request reserves its maximum expected cost before transmission. No recursive retries, parallel paid jobs, automatic provider fallback, or unbounded workflow reruns.
 
@@ -159,6 +182,7 @@ test dependency, then validate the complete dry-run path:
 
 ```bash
 python -m pip install -e . pytest
+video-gen-secret-scan
 pytest -q
 video-gen preflight --profile cad_10
 video-gen validate-scene
@@ -183,7 +207,7 @@ perceptual lip sync, essential action, reference fidelity, persona/voice, ambien
 stitch integrity all have explicit human evidence.
 
 Generated ledgers and media normally live under ignored `runs/` and `outputs/` directories. Selected
-auditable live runs may be force-added on a dedicated branch. Inspect and
+evidence-complete live runs may be force-added on a dedicated branch. Inspect and
 human-approve the four compiled prompts from `scenes/golden-scene.json` before any live draft run.
 
 When moving to another machine, transfer ignored run folders separately from Git and verify their
@@ -217,9 +241,11 @@ Use `audit-artifacts` before cleanup. `prune-artifacts` is a dry run unless `--a
 only removes previews, sampled-frame sheets, and other deterministic derivatives. It retains raw and
 final media, ledgers, manifests, reports, hashes, and compact references fail-closed.
 
-The repository workflows are manual-dispatch only; development pushes and pull requests do not
-start generation. If a human later chooses to run **live DeepInfra smoke test** and enters `LIVE`,
-the workflow makes exactly one FastWan request (maximum reserved
+The automatic **dry-run** workflow runs on pushes to `main` and pull requests across Python 3.11 and
+3.12. It receives no provider credential and never invokes `--live`; it scans tracked files for
+credential-shaped material, runs the test suite and configuration preflight, and validates the typed
+Stage 2 sequence. If a human later chooses to run **live DeepInfra smoke test** and enters `LIVE`,
+that separate manual workflow makes exactly one FastWan request (maximum reserved
 cost US$0.0125), never retries it, and retains the generated clip, append-only SQLite ledger,
 compiled prompt, command result, hashes, and JSON audit export as a workflow artifact for 30 days.
 Signed query parameters from provider output URLs are deliberately excluded from the ledger.

project.json

@@ -139,6 +139,7 @@
   },
   "pricing": {
     "verified_at": "2026-08-03",
+    "max_age_days": 30,
     "currency": "USD",
     "fail_if_unverified_or_increased": true,
     "price_refresh_requires_human_approval": true

pyproject.toml

@@ -10,11 +10,11 @@ requires-python = ">=3.11"
 
 [project.scripts]
 video-gen = "video_gen.cli:main"
+video-gen-secret-scan = "video_gen.secret_scan:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["src"]
-

series/surrey-care/series.json

@@ -31,7 +31,24 @@
         "provider_voice": "Unified Chatterbox performance master, seed 3407",
         "language": "English (US provider setting), directed as Canadian English",
         "accent_direction": "Natural Lower Mainland Canadian English; composed clinical pacing; no generic American announcer tone and no stylized Punjabi accent.",
-        "performance_baseline": "Low-key, clear and empathetic with a restrained dramatic arc: professional warmth, precise B.C. Services Card diction, concerned weight on inactive M.S.P., then compassionate but firm uncertainty. Generate the sequence in one continuous take and split only at deliberate pauses."
+        "performance_baseline": "Low-key, clear and empathetic with a restrained dramatic arc: professional warmth, precise B.C. Services Card diction, concerned weight on inactive M.S.P., then compassionate but firm uncertainty. Generate the sequence in one continuous take and split only at deliberate pauses.",
+        "voice_realization": {
+          "voice_realization_id": "vr-amrit-chatterbox-3407-v1",
+          "effective_persona_version": "pv01",
+          "provider_model_id": "ResembleAI/chatterbox-turbo",
+          "provider_voice": "Unified Chatterbox performance master, seed 3407",
+          "immutable_settings": {
+            "seed": 3407,
+            "response_format": "wav"
+          },
+          "approval": {
+            "status": "pending_human_audition",
+            "audition_path": "runs/clinic-stage2-20260803T060048Z/audio/amrit-sequence-master-performance-v2.wav",
+            "audition_sha256": "abf02c5a048fa05da4ec6edd0ebe3099b57288b59a5a9055a6c53dbeb71d77bf",
+            "reviewed_by": null,
+            "reviewed_at": null
+          }
+        }
       },
       "reference_pack": {
         "version": "rp01",
@@ -62,7 +79,24 @@
         "provider_voice": "Puck (Male)",
         "language": "English (US provider setting), directed as Canadian English",
         "accent_direction": "Natural Lower Mainland Canadian English with restrained Korean-influenced cadence only if stable; no caricature and no accent switching.",
-        "performance_baseline": "Quiet, tired and direct, with short breaths and no theatrical distress."
+        "performance_baseline": "Quiet, tired and direct, with short breaths and no theatrical distress.",
+        "voice_realization": {
+          "voice_realization_id": "vr-daniel-puck-v1",
+          "effective_persona_version": "pv01",
+          "provider_model_id": "PrunaAI/p-video-avatar",
+          "provider_voice": "Puck (Male)",
+          "immutable_settings": {
+            "seed": 0,
+            "voice_language": "English (US)"
+          },
+          "approval": {
+            "status": "not_auditioned",
+            "audition_path": null,
+            "audition_sha256": null,
+            "reviewed_by": null,
+            "reviewed_at": null
+          }
+        }
       },
       "reference_pack": {
         "version": "rp01",

src/video_gen/cli.py

@@ -25,7 +25,7 @@
 from .retention import audit_run_artifacts, prune_recomputable_artifacts
 from .stage2 import (audit_stage2_sequence, compile_stage2_prompt,
                      compile_stage2_take_prompt,
-                     load_stage2_sequence)
+                     load_series, load_stage2_sequence)
 
 
 def parser() -> argparse.ArgumentParser:
@@ -114,14 +114,18 @@ def parser() -> argparse.ArgumentParser:
     speech.add_argument("--profile", default="cad_10")
     speech.add_argument("--text", required=True)
     speech.add_argument("--seed", type=int, default=0)
+    speech.add_argument("--series-manifest")
+    speech.add_argument("--character-id")
     speech.add_argument("--live", action="store_true")
     speech.add_argument("--confirm-live", action="store_true")
     speech.add_argument("--result")
     avatar = commands.add_parser("plan-avatar", help="generate one explicitly approved partner lip-sync clip")
     avatar.add_argument("--profile", default="cad_10")
     avatar.add_argument("--image", required=True)
     avatar.add_argument("--script", required=True)
-    avatar.add_argument("--voice", required=True)
+    avatar.add_argument("--voice")
+    avatar.add_argument("--series-manifest")
+    avatar.add_argument("--character-id")
     avatar.add_argument("--gaze-direction", choices=["screen_left", "screen_right"], required=True)
     avatar.add_argument(
         "--speaker-position", choices=["only_person", "frame_left", "frame_right"],
@@ -271,6 +275,23 @@ def image_video_audio_input(value: str | Path, *, live: bool = False) -> str:
     return f"data:{media_type};base64,{base64.b64encode(source.read_bytes()).decode()}"
 
 
+def canonical_voice_binding(
+    series_manifest: str | None, character_id: str | None,
+) -> tuple[str, dict] | None:
+    if series_manifest is None and character_id is None:
+        return None
+    if not series_manifest or not character_id:
+        raise VideoGenError("voice binding requires --series-manifest and --character-id together")
+    series = load_series(series_manifest)
+    persona = next(
+        (item for item in series["canonical_personas"] if item["character_id"] == character_id),
+        None,
+    )
+    if persona is None:
+        raise VideoGenError(f"unknown canonical character: {character_id}")
+    return persona["voice"]["provider_voice"], persona["voice"]["voice_realization"]
+
+
 def main(argv: list[str] | None = None) -> int:
     args = parser().parse_args(argv)
     try:
@@ -478,19 +499,30 @@ def main(argv: list[str] | None = None) -> int:
             partner_avatar_attempt_cap=args.partner_avatar_attempt_cap,
         )
         if args.command == "plan-speech":
+            voice_binding = canonical_voice_binding(args.series_manifest, args.character_id)
             request = orchestrator.run_speech(
-                args.text, seed=args.seed, live=args.live, confirmed=args.confirm_live)
+                args.text, seed=args.seed, live=args.live, confirmed=args.confirm_live,
+                voice_realization=(voice_binding[1] if voice_binding else None),
+            )
             emit_json({**request.__dict__, "reserved_usd": str(request.reserved_usd)}, args.result)
             return 0
         if args.command == "plan-avatar":
+            voice_binding = canonical_voice_binding(args.series_manifest, args.character_id)
+            voice = args.voice or (voice_binding[0] if voice_binding else None)
+            if not voice:
+                raise VideoGenError(
+                    "avatar generation requires --voice or a canonical series voice binding"
+                )
             request = orchestrator.run_avatar(
-                avatar_image_input(args.image, live=args.live), args.script, args.voice,
+                avatar_image_input(args.image, live=args.live), args.script, voice,
                 seed=args.seed,
                 max_seconds=args.max_seconds, gaze_direction=args.gaze_direction,
                 speaker_position=args.speaker_position,
                 response_anticipation=args.response_anticipation,
                 performance_direction=args.performance, live=args.live, confirmed=args.confirm_live,
-                allow_partner=args.allow_partner_avatar, output_dir=args.output_dir)
+                allow_partner=args.allow_partner_avatar,
+                voice_realization=(voice_binding[1] if voice_binding else None),
+                output_dir=args.output_dir)
             emit_json({**request.__dict__, "reserved_usd": str(request.reserved_usd)}, args.result)
             return 0
         if args.command == "plan-image-video":