@event4u/agent-config 6.0.0 → 7.0.0

package/src/scripts/ai-video/lib/adapter-contract.md

@@ -1,329 +0,0 @@
-# Adapter Contract (v2)
-
-> Single source of truth for every adapter under
-> `scripts/ai-video/adapters/`. Phase 4 Step 1 finalizes any open
-> point in this draft; **breaking changes bump the version pin
-> and require every adapter to be rerun against the fixture set**
-> (`scripts/ai-video/lib/fixtures/`).
-
-## Scope
-
-Every backend (OpenAI Images, Gemini Veo, Kling, Higgsfield, Sora,
-…) ships as one executable shell entry under
-`scripts/ai-video/adapters/<id>.sh`. The orchestrator never speaks
-to a network API directly — it speaks to one of these scripts.
-
-## Capability flag
-
-Each adapter declares its audio capability via a top-of-file
-comment and via the `capability` subcommand:
-
-```
-# capability: audio=native | audio=none
-```
-
-`audio=native` — the provider returns a muxed MP4 with synchronized
-dialogue / ambient. `audio=none` — video-only output; the
-orchestrator muxes the operator-supplied track at stitch time.
-
-A per-model adapter (e.g. Higgsfield) MAY declare `audio=per-model`
-and surface the capability via `capability --model <id>`.
-
-## Blueprint → provider translation
-
-The 12-block Cinematic Scene Blueprint (`scene-expander`) is the
-provider-agnostic intermediate representation. Adapters never see the
-raw blueprint — they consume the adapter-contract JSON below. The
-ONLY place provider-specific prompt grammar may be introduced is the
-`motion-choreographer` skill's per-provider encoder table (named
-moves for Veo, motion-intensity token for Kling, natural-language
-moves for Sora, preset ids for Higgsfield). If an adapter needs a new
-provider-specific prompt idiom, extend that encoder table — never the
-blueprint vocabulary. The anti-leak test in
-`tests/test_ai_video_blueprint_schema.py` enforces this boundary.
-
-## Audio ownership — intent, translation, validation (issue #180)
-
-Three layers, three owners — no layer may absorb another's job:
-
-1. **Intent — the blueprint (scene-expander).** DIALOGUE / AMBIENT
-   blocks are emitted whenever creatively warranted, provider-agnostic,
-   regardless of which adapter will render. The parser mirrors dialogue
-   into `requires.audio_native: true`.
-2. **Translation — the encoder (motion-choreographer).** Encodes audio
-   intent into the provider's grammar when `capability.audio = native`;
-   prepares the stitch-time mux fallback when `audio = none`. The
-   encoder is a translator, NEVER a validator — it does not decide
-   whether dropping dialogue is acceptable.
-3. **Validation — the orchestrator (`/video:scene`,
-   `/video:from-script`, `/video:from-song`).** Before submit, when
-   `requires.audio_native = true` meets `capability.audio = none`, the
-   flow STOPS and surfaces the mismatch with numbered options: switch
-   to an audio-native adapter · proceed without dialogue (ambient mux
-   only) · drop audio intentionally · override and attempt anyway
-   (operator-owned cost risk; verify the dry-run's `audio_embedded`
-   first). A downgrade decision is recorded by the encoder as an
-   `AUDIO DOWNGRADE` warning block in `motion-prompt.txt` and
-   `adapter-notes.md` — silent dialogue loss is a contract violation.
-
-`capability.audio` is a **contract commitment**, not a best-effort
-hint: an adapter whose rendered output contradicts its declared
-capability violates this contract (the capability ↔ dry-run coherence
-test in `tests/test_ai_video_adapter_contract.py` is the build-time
-guard; the orchestrator gate is the runtime guard — they are
-complementary, not redundant).
-
-## Subcommands
-
-Every adapter implements four:
-
-| Subcommand | Purpose | I/O |
-|---|---|---|
-| `submit` | Submit a render job to the backend | stdin JSON · stdout `{job_id}` |
-| `poll <job_id>` | Poll job status | stdout `{status: queued\|running\|done\|failed, progress?}` |
-| `fetch <job_id>` | Download artifacts after `status=done` | stdout `{video_path, audio_path?, audio_embedded}` |
-| `dry-run` | Return a deterministic fixture path without network | stdout same shape as `fetch` |
-
-`submit` + `poll` + `fetch` may be collapsed into a single
-`run` for synchronous backends (OpenAI Images) — the wrapper exposes
-the same stdout shape on stdout and an exit code on completion.
-
-## Stdin JSON (consumed by `submit` / `run`)
-
-```json
-{
-  "prompt": {
-    "style": "...",
-    "subject": "...",
-    "environment": "...",
-    "action": "...",
-    "camera": "...",
-    "lens": "...",
-    "lighting": "...",
-    "mood": "..."
-  },
-  "ref_images": ["/abs/path/frame.png", "..."],
-  "duration": 4.5,
-  "aspect": "16:9",
-  "seed": 1234567,
-  "audio": {
-    "dialogue": ["speaker: \"line\"", "..."],
-    "ambient": ["rain on metal", "..."],
-    "language": "en",
-    "enable_native_audio": true
-  },
-  "negative": ["centered framing", "..."]
-}
-```
-
-`ref_images`, `duration`, `aspect`, `seed`, `audio`, `negative` are
-optional. `prompt.*` blocks are mandatory. Unknown top-level keys
-are logged to stderr and ignored.
-
-### `model_id` — multiplexer model selection (additive, v2)
-
-Multiplexer adapters (`fal`, `replicate`) reach many models through one
-provider API. The optional top-level `model_id` stdin key selects the
-model for **this job**, overriding the provider's XML `<default-model>`.
-Single-model adapters ignore it (unknown-key rule above). Rules:
-
-- `model_id` is **tainted input** — adapters validate it against a
-  strict charset whitelist before it touches a URL, and reject parent
-  traversal. It never appears in a filesystem path.
-- `poll` / `fetch` are **stateless**: adapters MUST NOT persist poll
-  state between calls. When the provider's status URL needs the model
-  (fal), the adapter encodes it into the returned `job_id`
-  (`<model_id>::<request_id>`) and re-validates both segments on every
-  poll/fetch.
-- Per-model capabilities (`min_duration`, `max_duration`, `audio_sync`,
-  `aspect`, modeled cost) live in
-  `scripts/ai-video/lib/model-capabilities/<adapter>.json` and are
-  surfaced via `capability --model <id>`. Entries are
-  `verified: false` until a real smoke trace exists for that model —
-  consumers must surface the flag, never trust the numbers silently.
-
-### Lip-sync adapters — `kind="lipsync"` stdin shape (additive, v2)
-
-A lip-sync adapter (e.g. `syncso`) is a **post-process** render job: it
-consumes a finished clip plus one audio line instead of prompt blocks.
-Its `submit` stdin is:
-
-```json
-{
-  "video_url": "https://…/scene-0007.mp4",
-  "audio_url": "https://…/line-0003.wav",
-  "model_id": "lipsync-2"
-}
-```
-
-- Both URLs MUST be https and fetchable by the provider; a local path
-  is rejected with exit 7 and the host-the-artifacts hint (the
-  orchestrator hosts the clip + the WAV cut from the song first).
-- **Local lip-sync variant** (`musetalk`): a local engine consumes
-  `video_path` / `audio_path` instead — validated local files per the
-  local-source rule below; a URL is rejected with the
-  use-the-hosted-adapter hint. Synchronous local inference ships as the
-  collapsed `run` subcommand and still honours `AIV_DRYRUN`.
-- `poll` / `fetch` follow the normal v2 triple; the fetched clip embeds
-  the driving audio (`audio_embedded: true`, capability `audio=native`)
-  — dropping its track at mux would desync the mouth.
-- **Sparse-budget discipline:** per-song limits live machine-readable
-  in `model-capabilities/<id>.json` under `lipsync_budget`
-  (`max_segments_per_song`, `max_segment_seconds`,
-  `frontal_close_up_only`, `cost_gate`). The **orchestrator** enforces
-  them before any submit — the adapter renders single segments and
-  never sees the whole song.
-
-### Local providers — local-source rule (additive, v2)
-
-A **local** provider (e.g. `comfyui` — the engine runs on the operator's
-machine/container, ADR-060) consumes local *input* paths instead of the
-https-only rule written for hosted lip-sync inputs: the https rule exists
-because a hosted provider must fetch the bytes over the network; a local
-engine reads them from the shared volume. Local input paths are still
-validated (`aiv_validate_artifact_path` against the project root when the
-orchestrator scoped the call) before use. Everything else is unchanged —
-the async `submit/poll/fetch` triple, the trust boundary on *returned*
-artifacts, and the fixture-backed `dry-run`. A local render that has no
-provider charge reports `cost_estimate: 0.0` (a **known** zero); an
-*omitted* estimate still means unknown and is never treated as `0`.
-
-### `<enabled>` — provider kill-switch (additive, v2)
-
-A provider block in `agents/.ai-video.xml` MAY carry
-`<enabled>false</enabled>`. Adapters check it
-(`aiv_provider_enabled <id>`) before any network subcommand and refuse
-with exit 6 when disabled — the operator can take a misbehaving
-provider out of rotation without editing every procedure that names it.
-A missing element means enabled (existing configs keep working).
-
-## Stdout JSON (emitted by `fetch` / `run` / `dry-run`)
-
-```json
-{
-  "video_path": "/abs/path/scene-0001.mp4",
-  "audio_path": "/abs/path/scene-0001.wav",
-  "audio_embedded": true,
-  "cost_estimate": 0.12
-}
-```
-
-Semantics:
-
-- `cost_estimate` (optional, USD float) — the modeled cost of the
-  equivalent **live** render for this scene, surfaced on `dry-run`
-  (and echoed on `fetch` / `run` as the actual when known). The
-  orchestrator sums it across scenes for the batch cost gate and the
-  `--max-spend-usd` kill-switch. Omitted when the adapter cannot price
-  the call — the gate then shows the scene as `unknown` and never treats
-  a missing estimate as `0`.
-- `audio_embedded: true` — `video_path` is a muxed MP4 with audio;
-  `audio_path` is omitted or echoes the same path. Stitcher
-  pass-through.
-- `audio_embedded: false` with `audio_path` — separate track to mux
-  at stitch time via `ffmpeg`.
-- `audio_embedded: false` without `audio_path` — video-only;
-  operator supplies the audio bed at stitch time.
-
-## Trust boundary (v2)
-
-The artifact paths an adapter emits on `fetch` / `run`, and the bytes it
-downloads, are **untrusted provider output**. A buggy or hostile backend
-must not be able to make the orchestrator read `/etc/passwd`, follow a
-symlink out of the project, inject into the `ffmpeg` concat list, or fill
-the disk. Three rules, enforced by `scripts/ai-video/lib/adapter-common.sh`:
-
-1. **Project-scoped artifacts.** Live `fetch` writes downloads into the
-   scene-scoped output dir (`aiv_scene_dir <project> <scene_id>` →
-   `<project>/scenes/<scene_id>/`) and returns a path under it. The
-   orchestrator passes every consumed path through
-   `aiv_validate_artifact_path <project_root> <path>`, which canonicalizes
-   the path and **rejects** anything that escapes the root, is a symlink,
-   carries a parent-traversal (`..`), or contains injection / control
-   characters (`'`, `` ` ``, `$(`, newline). The consumer (`stitch.sh`)
-   re-validates before handing a path to `ffmpeg`.
-2. **Size cap.** Downloads go through `aiv_fetch_url <url> <dest>
-   [max_bytes]`, which caps a single artifact at `aiv_max_artifact_bytes`
-   (default 512 MiB, override `AIV_MAX_ARTIFACT_BYTES`) and times out
-   (`AIV_FETCH_TIMEOUT`, default 120 s). A runaway stream fails closed.
-3. **Opaque paths only.** `video_path` / `audio_path` SHOULD be returned
-   relative to the scene dir (or absolute under it). An absolute path
-   outside the project root is a contract violation and is rejected — it
-   is never consumed.
-
-Dry-run fixtures are committed, trusted inputs and are exempt (no network,
-no provider-controlled path).
-
-## Error contract
-
-Adapter failure: **non-zero exit code** AND a JSON file at
-`<project>/scenes/<scene_id>/error.json`:
-
-```json
-{
-  "adapter": "gemini-veo",
-  "subcommand": "fetch",
-  "job_id": "...",
-  "exit_code": 7,
-  "stderr_tail": "...",
-  "retryable": true,
-  "user_action": "regenerate-prompt | retry | skip | abort"
-}
-```
-
-`retryable: false` means a prompt or input change is required —
-the orchestrator MUST NOT auto-retry. `retryable: true` does **not**
-authorize auto-retry either; the orchestrator surfaces a single
-numbered-options block (retry · regenerate prompt · skip · abort)
-per `non-destructive-by-default` and waits.
-
-## Dry-run
-
-`AIV_DRYRUN=true` (set by command default; see Phase 5 Step 6) OR
-the explicit `dry-run` subcommand:
-
-- No network call.
-- Stdout JSON points at a deterministic fixture under
-  `scripts/ai-video/lib/fixtures/<adapter-id>/`.
-- Exit code 0.
-
-Fixtures are committed and cover one happy path per adapter.
-Phase 6 golden runs assert byte-identical stdout under
-`AIV_DRYRUN=true`.
-
-## Logging & redaction
-
-- **stderr only** for log output. Stdout is reserved for the
-  contract JSON.
-- Every adapter MUST source `scripts/ai-video/lib/redact.sh` and
-  pipe network responses through `aiv_redact_stream` before any
-  `>&2` write. API keys, bearer tokens, and operator-registered
-  secrets are masked.
-
-## Strict-mode shell
-
-Every adapter:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-. "$(dirname "$0")/../lib/redact.sh"
-. "$(dirname "$0")/../lib/load-config.sh"
-```
-
-`shellcheck` clean (Phase 4 Step 9).
-
-## Versioning
-
-This contract is `v2`. Backward-incompatible changes (renamed
-field, removed subcommand, changed stdout shape) bump the version and
-require an `adapter-contract` migration note plus a rerun of every
-adapter against the fixture set.
-
-**v1 → v2 migration.** Additive, no stdout-field change — the
-`{video_path, audio_path?, audio_embedded}` shape is unchanged, so
-committed fixtures stay valid. v2 adds the **Trust boundary** section
-above: live `fetch` MUST write into the scene-scoped dir and route every
-consumed artifact path through `aiv_validate_artifact_path` and every
-download through `aiv_fetch_url`. Existing dry-run-only adapters need no
-change; the obligation lands when their live `submit/poll/fetch` is wired.

package/src/scripts/ai-video/lib/fixtures/comfyui/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/comfyui/scene-0001.mp4","audio_embedded":false,"cost_estimate":0.0}

package/src/scripts/ai-video/lib/fixtures/fal/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/fal/scene-0001.mp4","audio_embedded":false,"cost_estimate":0.4}

package/src/scripts/ai-video/lib/fixtures/gemini-veo/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/gemini-veo/scene-0001.mp4","audio_embedded":true,"cost_estimate":0.5}

package/src/scripts/ai-video/lib/fixtures/higgsfield/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/higgsfield/scene-0001.mp4","audio_embedded":false,"cost_estimate":0.1}

package/src/scripts/ai-video/lib/fixtures/kling/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/kling/scene-0001.mp4","audio_embedded":false,"cost_estimate":0.14}

package/src/scripts/ai-video/lib/fixtures/musetalk/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/musetalk/lipsync-0001.mp4","audio_embedded":true,"cost_estimate":0.0}

package/src/scripts/ai-video/lib/fixtures/openai-images/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/openai-images/scene-0001.png","audio_embedded":false,"cost_estimate":0.04}

package/src/scripts/ai-video/lib/fixtures/replicate/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/replicate/scene-0001.mp4","audio_embedded":false,"cost_estimate":0.35}

package/src/scripts/ai-video/lib/fixtures/sora/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/sora/scene-0001.mp4","audio_embedded":true,"cost_estimate":0.5}

package/src/scripts/ai-video/lib/fixtures/syncso/result.json

@@ -1 +0,0 @@
-{"video_path":"src/scripts/ai-video/lib/fixtures/syncso/lipsync-0001.mp4","audio_embedded":true,"cost_estimate":0.5}

package/src/scripts/ai-video/lib/load-config.sh

@@ -1,180 +0,0 @@
-#!/usr/bin/env bash
-# scripts/ai-video/lib/load-config.sh — provider config loader for /video:*.
-#
-# Parses agents/.ai-video.xml with xmllint --xpath and surfaces a single
-# provider's settings as AIV_KEY / AIV_ENDPOINT / AIV_MODEL / AIV_DRYRUN
-# env vars to its caller. The key is NEVER echoed — status output is only
-# `present` or `missing`.
-#
-# Usage (sourced):
-#
-#   . scripts/ai-video/lib/load-config.sh
-#   aiv_load_provider gemini-veo
-#   echo "key: $(aiv_key_status)"     # → present | missing
-#   echo "endpoint: $AIV_ENDPOINT"
-#   echo "dryrun: $AIV_DRYRUN"
-#
-# Usage (CLI status check, no key echoed):
-#
-#   bash scripts/ai-video/lib/load-config.sh status gemini-veo
-#   → provider=gemini-veo key=present dryrun=true model=veo-3.0-generate-001
-#
-# Defaults:
-#   - AIV_DRYRUN defaults to `true` when not set in XML
-#   - AIV_DRYRUN can be overridden by the AIV_DRYRUN env var set by caller
-#   - missing file is non-fatal in `status` mode (prints all-missing line)
-
-set -u
-
-AIV_CONFIG_PATH="${AIV_CONFIG_PATH:-agents/.ai-video.xml}"
-
-_aiv_xpath() {
-  # $1 = xpath expression; reads from $AIV_CONFIG_PATH
-  # Returns text content or empty string. Never errors on missing path.
-  if [ ! -f "${AIV_CONFIG_PATH}" ]; then
-    printf ''
-    return 0
-  fi
-  if ! command -v xmllint >/dev/null 2>&1; then
-    printf ''
-    return 0
-  fi
-  xmllint --xpath "string(${1})" "${AIV_CONFIG_PATH}" 2>/dev/null || printf ''
-}
-
-aiv_default_image_provider() {
-  _aiv_xpath '/ai-video/default-image-provider'
-}
-
-aiv_default_video_provider() {
-  _aiv_xpath '/ai-video/default-video-provider'
-}
-
-aiv_load_provider() {
-  local pid="${1:-}"
-  if [ -z "${pid}" ]; then
-    echo "aiv_load_provider: provider id required" >&2
-    return 2
-  fi
-
-  # Resolve from the top-level <provider> blocks OR the <extra> slot.
-  local base="(/ai-video/provider[@id='${pid}']|/ai-video/extra/provider[@id='${pid}'])"
-
-  AIV_PROVIDER_ID="${pid}"
-  AIV_KEY="$(_aiv_xpath "${base}/api-key")"
-  # Keypair-auth providers (e.g. Kling: JWT signed from AccessKey+SecretKey)
-  # carry <access-key>/<secret-key> instead of <api-key>. Empty for others.
-  AIV_ACCESS_KEY="$(_aiv_xpath "${base}/access-key")"
-  AIV_SECRET_KEY="$(_aiv_xpath "${base}/secret-key")"
-  AIV_ENDPOINT="$(_aiv_xpath "${base}/endpoint")"
-  AIV_MODEL="$(_aiv_xpath "${base}/default-model")"
-  AIV_KIND="$(_aiv_xpath "${base}/@kind")"
-
-  local dryrun_xml
-  dryrun_xml="$(_aiv_xpath "${base}/dry-run")"
-  # Caller-set AIV_DRYRUN takes precedence; otherwise XML; otherwise true.
-  if [ -n "${AIV_DRYRUN:-}" ]; then
-    : # respect caller
-  elif [ -n "${dryrun_xml}" ]; then
-    AIV_DRYRUN="${dryrun_xml}"
-  else
-    AIV_DRYRUN="true"
-  fi
-  export AIV_DRYRUN
-
-  # Tuning fields — adapters read these directly when present.
-  AIV_TUNING_ASPECT="$(_aiv_xpath "${base}/tuning/aspect")"
-  AIV_TUNING_FPS="$(_aiv_xpath "${base}/tuning/fps")"
-  AIV_TUNING_MAX_DURATION="$(_aiv_xpath "${base}/tuning/max-duration")"
-  AIV_TUNING_AUDIO_NATIVE="$(_aiv_xpath "${base}/tuning/audio-native")"
-  AIV_TUNING_PRESET="$(_aiv_xpath "${base}/tuning/preset")"
-  AIV_TUNING_QUALITY="$(_aiv_xpath "${base}/tuning/quality")"
-  AIV_TUNING_BEST_OF_N="$(_aiv_xpath "${base}/tuning/best-of-n")"
-  export AIV_TUNING_ASPECT AIV_TUNING_FPS AIV_TUNING_MAX_DURATION \
-    AIV_TUNING_AUDIO_NATIVE AIV_TUNING_PRESET AIV_TUNING_QUALITY \
-    AIV_TUNING_BEST_OF_N
-
-  # Register keys with redact.sh if loaded — adapters always source both.
-  if command -v aiv_redact_register >/dev/null 2>&1; then
-    aiv_redact_register "${AIV_KEY}"
-    [ -n "${AIV_ACCESS_KEY}" ] && aiv_redact_register "${AIV_ACCESS_KEY}"
-    [ -n "${AIV_SECRET_KEY}" ] && aiv_redact_register "${AIV_SECRET_KEY}"
-  fi
-
-  return 0
-}
-
-aiv_key_status() {
-  # Any value carrying the REPLACE-ME marker is a template placeholder —
-  # regardless of the prefix shape (`fal-REPLACE-ME`, `r8_REPLACE-ME`, …).
-  case "${AIV_KEY:-}" in
-    ""|*"REPLACE-ME"*) printf 'missing' ;;
-    *) printf 'present' ;;
-  esac
-}
-
-# aiv_keypair_status — `present` only when BOTH halves of an
-# AccessKey/SecretKey pair are set and neither is a template placeholder.
-aiv_keypair_status() {
-  case "${AIV_ACCESS_KEY:-}" in ""|*"REPLACE-ME"*) printf 'missing'; return 0 ;; esac
-  case "${AIV_SECRET_KEY:-}" in ""|*"REPLACE-ME"*) printf 'missing'; return 0 ;; esac
-  printf 'present'
-}
-
-# aiv_provider_enabled <provider-id> — operator kill-switch. Reads the
-# optional <enabled> element on the provider block; only an explicit
-# `false` disables (missing element = enabled, so existing configs keep
-# working). Adapters check this before any network subcommand so the
-# operator can take a misbehaving provider out of rotation without
-# editing every procedure that names it.
-aiv_provider_enabled() {
-  local pid="${1:-}" val
-  if [ -z "${pid}" ]; then
-    printf 'false'
-    return 0
-  fi
-  val="$(_aiv_xpath "(/ai-video/provider[@id='${pid}']|/ai-video/extra/provider[@id='${pid}'])/enabled")"
-  case "${val}" in
-    false|FALSE|0|no|NO) printf 'false' ;;
-    *) printf 'true' ;;
-  esac
-}
-
-# CLI mode — only `status <provider-id>` is supported; never echoes the key.
-if [ "${BASH_SOURCE[0]:-}" = "${0}" ]; then
-  cmd="${1:-}"
-  case "${cmd}" in
-    status)
-      pid="${2:-}"
-      if [ -z "${pid}" ]; then
-        echo "usage: load-config.sh status <provider-id>" >&2
-        exit 2
-      fi
-      aiv_load_provider "${pid}" >/dev/null
-      # Keypair-auth providers report the pair; single-key providers the key.
-      key_field="$(aiv_key_status)"
-      if [ -n "${AIV_ACCESS_KEY:-}${AIV_SECRET_KEY:-}" ]; then
-        key_field="$(aiv_keypair_status) (access+secret pair)"
-      fi
-      printf 'provider=%s key=%s dryrun=%s model=%s endpoint=%s kind=%s\n' \
-        "${AIV_PROVIDER_ID}" \
-        "${key_field}" \
-        "${AIV_DRYRUN:-true}" \
-        "${AIV_MODEL:-}" \
-        "${AIV_ENDPOINT:-}" \
-        "${AIV_KIND:-}"
-      ;;
-    defaults)
-      printf 'default-image-provider=%s\n' "$(aiv_default_image_provider)"
-      printf 'default-video-provider=%s\n' "$(aiv_default_video_provider)"
-      ;;
-    "")
-      echo "usage: load-config.sh {status <id> | defaults}" >&2
-      exit 2
-      ;;
-    *)
-      echo "load-config.sh: unknown subcommand '${cmd}'" >&2
-      exit 2
-      ;;
-  esac
-fi

package/src/scripts/ai-video/lib/redact.sh

@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-# scripts/ai-video/lib/redact.sh — secret-scrubbing helper for /video:* adapters.
-#
-# Sourced by every adapter under scripts/ai-video/adapters/*.sh. Provides
-# two helpers:
-#
-#   aiv_redact_register <secret>   — register a string to scrub (idempotent)
-#   aiv_redact <text>              — print text with every registered
-#                                    secret replaced by ***REDACTED***
-#
-# Iron Law: an API key must never reach stdout/stderr verbatim. Adapters
-# pipe every network response, curl error, and trace through aiv_redact
-# before printing. Empty / unset values are skipped silently — an unset
-# secret cannot leak.
-#
-# Pure bash, no external dependencies. Safe under `set -euo pipefail`.
-
-# Guard against double-source.
-if [ -n "${AIV_REDACT_LOADED:-}" ]; then
-  return 0 2>/dev/null || exit 0
-fi
-AIV_REDACT_LOADED=1
-
-# Registry of secrets to scrub. Newline-separated; populated by
-# aiv_redact_register. Never echoed.
-AIV_REDACT_SECRETS=""
-
-aiv_redact_register() {
-  local secret="${1:-}"
-  # Treat empty / placeholder values as no-op so adapters can call this
-  # unconditionally without leaking the placeholder string.
-  case "${secret}" in
-    ""|"REPLACE-ME"|*"-REPLACE-ME") return 0 ;;
-  esac
-  # Require a minimum length so single characters do not nuke the log.
-  if [ "${#secret}" -lt 8 ]; then
-    return 0
-  fi
-  # Idempotent — skip if already registered.
-  case "${AIV_REDACT_SECRETS}" in
-    *"${secret}"*) return 0 ;;
-  esac
-  AIV_REDACT_SECRETS="${AIV_REDACT_SECRETS}${secret}
-"
-}
-
-aiv_redact() {
-  local input
-  if [ "$#" -gt 0 ]; then
-    input="$*"
-  else
-    input="$(cat)"
-  fi
-  if [ -z "${AIV_REDACT_SECRETS}" ]; then
-    printf '%s\n' "${input}"
-    return 0
-  fi
-  # Apply replacements one secret at a time using awk so special chars
-  # in the secret cannot break a sed expression. Use a here-string to
-  # avoid running the loop in a subshell (which would discard mutations
-  # to ${input}).
-  local secret
-  while IFS= read -r secret; do
-    [ -z "${secret}" ] && continue
-    input="$(printf '%s' "${input}" | awk -v s="${secret}" '
-      {
-        out = ""
-        rest = $0
-        while ((i = index(rest, s)) > 0) {
-          out = out substr(rest, 1, i - 1) "***REDACTED***"
-          rest = substr(rest, i + length(s))
-        }
-        print out rest
-      }')"
-  done <<< "${AIV_REDACT_SECRETS}"
-  printf '%s\n' "${input}"
-}
-
-# Convenience wrapper: pipe stdin through aiv_redact line by line so
-# adapters can do `curl … 2>&1 | aiv_redact_stream`.
-aiv_redact_stream() {
-  while IFS= read -r line; do
-    aiv_redact "${line}"
-  done
-}

package/src/scripts/ai_council/__init__.py

@@ -1,40 +0,0 @@
-"""ai_council — external-AI consultation module.
-
-The host agent uses this to poll independent models (OpenAI, Anthropic)
-for second opinions on roadmaps, diffs, free-form prompts, or file sets.
-Council members never see the host agent's reasoning — only the artefact
-plus a neutral system prompt asking for an independent critique.
-
-Architecture:
-    clients.py      — ExternalAIClient ABC + concrete OpenAI/Anthropic
-                      impls + 0600 key loaders (no env-var fallback).
-    bundler.py      — Context bundling with redaction + size guard.
-    orchestrator.py — Parallel fan-out, error normalisation, cost cap.
-    prompts.py      — Neutrality system-prompt templates per input mode.
-
-Trust boundary: this module makes networked, paid calls. Tokens come
-exclusively from ``~/.event4u/agent-config/<provider>.key`` (mode 0600;
-legacy ``~/.config/agent-config/<provider>.key`` is read as a fallback
-for pre-2.4 installs). The module never edits files, never opens PRs,
-never merges — output is text only, advisory.
-"""
-
-from scripts.ai_council.clients import (
-    AnthropicClient,
-    CouncilResponse,
-    ExternalAIClient,
-    KeyGateError,
-    OpenAIClient,
-    load_anthropic_key,
-    load_openai_key,
-)
-
-__all__ = [
-    "AnthropicClient",
-    "CouncilResponse",
-    "ExternalAIClient",
-    "KeyGateError",
-    "OpenAIClient",
-    "load_anthropic_key",
-    "load_openai_key",
-]