movie-pipeline — Pipeline A, end-to-end (one slash-command)

1 · Scope

The whole of Figure 1 as ONE agent workflow: a fuzzy idea → a cross-model-audited, image-based movie + a clickable viewer. /movie-pipeline "«your fuzzy idea»" — and your coding agent (Claude, Codex, …) drives the chain below, pausing only at the two human story gates. "One command" = one slash-command an agent RUNS — not a deterministic shell binary (the /research-pipeline paradigm): it needs a coding-agent runtime, it is non-deterministic, and a skipped step is safe because each layer consumes the prior locked artifact — a missed step leaves the next gate's input unresolved and it fails closed, never ships something wrong.

2 · Who does what (roles / boundary)

3 · Phase contract

4 · New-project bootstrap

Copy the author-node shapes from examples/comic_min_author/; the full reference run (198-node trace) is examples/comic_m3_audit/. Give the project a movie.project.json with identity_ref — run_comic.py reads the canonical identity ref from it (fallback: assets/duo_canonical_ref_v001.png). Prereqs: codex + gemini CLIs + headless Chrome ($ARIS_CHROME > macOS app path > PATH). python3 cli/preflight.py checks the reviewer/render CLIs ONLY — it does NOT verify the mcp__codex__codex sidecar tool or an agent runtime, which the real bake needs.

5 · Phase 1 — author the source of truth (comic-author)

The DAG (each arrow is a cross-model --gate; two steps are HUMAN):

1. intent (HUMAN gate) → style lock → OUTLINE_DRAFT_VALID — the outline gate validates

NARRATIVE + CONTINUITY + safety only; it does not require referenced assets to be locked, it requires every referenced asset_id to be declared with a complete, generatable request.

1. outline approval (HUMAN gate) → provisional storyboard (structural pass; may reference draft

assets) → consolidated_asset_requests.

1. asset generation + review → assets LOCKED → OUTLINE_FINAL_LOCK (cheap re-check: the locked

assets still match the approved outline) → storyboard FINAL asset-resolution validation.

1. blueprints — the hard locked-asset barrier sits HERE, before blueprint authoring → prompts →

schema-valid comic.json.

This staged order is the contract: it replaces the old single-stage deadlock (an outline gate demanding locked assets that depend on a storyboard that depends on a locked outline). Draft-then-final-lock is how the cycle is broken; the asset barrier never moves past the blueprint boundary.

6 · P0 spending gate — zero PANEL credit before proof

Scope, honestly: the P0 cert gates the Phase-2/3 PANEL bakes (every metered run_comic.py run). It cannot gate Phase 1: the raster ASSET refs (S4) are also paid sidecar bakes and land before any P0 cert exists (assets must lock before comic.json compiles). Those pre-P0 spends are gated instead by the cross-model comic-asset-review-loop + the single-source collision gate.

Three-step handoff (never conflate them):

1. Agent fan-out (comic-cross-layer-gate --gate p0_proof — an

agent skill, not a binary): ≥2 cross-model reviews of the compiled comic.json + machinery, each written as a JSON file {family: "openai"|"google", verdict, blockers: [], comic_sha}.

1. Deterministic mint — run_p0_proof.py verifies and mints; it never runs a reviewer itself:

   python3 skills/comic-cross-layer-gate/scripts/run_p0_proof.py \
       --project examples/<name> --target <compile/intent anchor node_id> \
       --reviews p0_codex.json p0_gemini.json

Quorum = BOTH non-author families {openai, google} PASS (blockers == [], affirmative verdict) on the SAME comic_sha (sha256 of the exact comic.json bytes). Parseable alone is not quorum; a missing/unparseable/timed-out review does not count — never proceed on timeout (fail-closed). On pass it computes comic_sha + bake_plan_sha (= pickup_image.bake_plan_digest(run_comic.get_bake_plan())) and atomically writes decision:p0_proof_<slug>_<utcstamp> (node_type decision, status final, verdict advance, both digests in the payload) into wiki/nodes/.

1. Preflight consume — run_comic.py scans the wiki for that node and REJECTS any cert whose

comic_sha/bake_plan_sha is missing or mismatches the CURRENT comic.json + bake plan: a stale cert after any comic.json edit fail-closes with a message pointing back to run_p0_proof.py. The JS engine (packages/core/spiral_engine.js) never scans the wiki — it takes the boolean arg p0ProofClean:true (skip: skipP0Proof:true); only run_comic.py does the node scan + digest verification. --skip-p0-proof bakes UNAUDITED and forces the run non-shippable (p0_skipped:true).

7 · Phase 2/3 — the audited spiral, page by page (comic-director)

There is NO whole-movie driver yet — run_comic.py takes exactly one --page + its --panels; the agent iterates comic.json's pages[] itself (a run_movie.py project driver is planned, not shipped):

python3 skills/comic-director/scripts/run_comic.py --project examples/<name> \
    --page <PAGE> --panels S01,S02 [--bake-mode=agent] [--finalize] [--dry-run]

Per panel: render the content-SVG blueprint → agent `mcp__codex__codex` sidecar bake → 3-reviewer panel_gate (blind transcribe → deterministic token-diff; a +6.25 where +6.2 is expected is rejected) → KEEP / RETRY (≤4) / cross-frame rollback → page assembly_gate (≤6 rounds; a panel drifting ≥2 rounds escalates to an author-layer rewrite_storyboard, because a re-bake can't fix a spec problem) → project to comic.json → --finalize builds the single-file viewer and FAILS (exit 4) if the build rc≠0.

Per-page cadence: every KEEP writes image_path/active_attempt_id back into comic.json, which changes its bytes — so the P0 cert goes stale between pages by design. Before each subsequent paid page run: re-run the zero-credit fan-out on the current comic.json + re-mint via run_p0_proof.py. Cheap, and it is what "the cert acquits exactly what you are about to spend on" means.

Model claims, honestly: the bake model is pinned gpt-5.5 + xhigh as a single compat default in run_comic.get_bake_plan() (contract bakereq/v1; config-driven override plumbing is planned, not shipped — changing any knob invalidates prior P0 certs via bake_plan_sha). The Codex CLI reviewers pin NO model — they follow the local codex config (currently gpt-5.6-sol) at effort xhigh (--review-effort); Gemini reviewers run auto-gemini-3. The narrative "cc" reviewer slot currently shells the codex CLI and its wiki provenance honestly records "openai" (a configurable --narrative-reviewer is planned, not implemented); cross-family acquittal vs the Claude author still holds via Gemini + Codex. There is no --effort flag on run_comic.py or run_spiral.py — only --review-effort exists; bake effort lives in the P0-bound plan.

8 · The bake sidecar (pointer, not a copy)

The bake is the skill agent calling mcp__codex__codex: the core writes <out>.bakereq.json, the agent services it with exactly those params and writes <out>.bakestatus.json (bounded raw mcp_output + request_id verbatim — both mandatory), and the core verifies the explicit out-path via pickup_image.py --out-existing. The full request/status field contract + agent-wrapper SOP lives in ONE place: comic-director §"Bake seam contract" + §"Who runs --bake-mode=agent" — do not re-derive it here or anywhere else.

9 · Failure matrix

10 · Resume / fresh-run SOP

Throttle ⇒ fresh run for the remaining panels of that page (the run report names the resume panel); flagged / needs_human panels are non-shippable until a human decides. A crashed run is re-run per page — KEEP'd panels are already projected into comic.json, and the P0 digest binding (§7) tells you whether the cert must be re-minted first (after any comic.json change: yes).

11 · CI vs agent boundary

Only these are agent-free (what tests/smoke.sh + CI actually exercise):

12 · Ship checklist

• [ ] Every page's run report: shippable:true, flagged_for_human empty, all kept panels page_accepted.
• [ ] p0_skipped:false on every run — --skip-p0-proof was never used.
• [ ] Every paid run started from a P0 cert whose digests matched that run's exact comic.json + bake plan.
• [ ] --finalize exited 0 with finalize:true (viewer build rc=0) → examples/<name>/outputs/index.html.
• [ ] Optionally comic-blind-comparison-review double-blind

A/Bs it vs a naive one-shot baseline to prove the pipeline earned its cost.

Protocols

acceptance-gate — the human gates intent+outline; a different model family acquits the rest (loop can DRIVE, can't ACQUIT) · artifact-integrity — the agent that authors a layer never judges its own layer · reviewer-independence · external-cadence.