@giveitsmaller/contracts 0.79.0 → 0.81.0

package/operations/schemas/thumbnail.yaml

@@ -103,15 +103,28 @@ operation:
         # input file scanning rather than full processing time.
         short_form:
           availability: stable
+          # RAISED 2026-09-26 (owner decision, 607(d)) to what the worker PROVED
+          # (lambdas staging corner run, git-2166848): 30 min passes in ~1 s (FFmpeg
+          # seeks without decoding the footage before it), and size passes to
+          # 995,015,958 B; it FAILS at ~1 GiB because the input is downloaded whole
+          # to a 1 GiB /tmp. 950,000,000 B leaves headroom under that failure.
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: proven
+            max_input_duration: proven
           constraints:
-            max_input_duration: "PT5M"
-            max_input_size_bytes: 524288000
+            max_input_duration: "PT30M"
+            max_input_size_bytes: 950000000
         long_form:
           # Stays planned (CON-1 flips only compress.video.long_form +
           # merge.video.long_form_re_encode). Per-tier caps per ADR-0011 —
           # advertised shape; availability gates execution off (422).
           # No max_output_size_bytes: thumbnail output is a single bounded image.
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)
@@ -265,6 +278,10 @@ operation:
       # literal and the value `compression_lambdas`' manifest has declared since
       # 2026-08-25. Undeclared here until now, which is why a create could be
       # accepted and then refused: see jLxWpQEZ.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 157286400
       # Same 16MP output-area wall as image (width*height <= max_output_pixels).
       # The page is rendered at 150 DPI (render-side ~25MP raster) then resized;
@@ -403,6 +420,10 @@ operation:
       # 2026-07-18 — THIRTY-NINE DAYS before a 128,232,024-byte EPUB was accepted,
       # billed, and refused by it on 2026-08-26. The number was public on their
       # side the whole time; the silence was HERE. jLxWpQEZ.
+      # PROVEN 2026-09-26: lambdas staging corner run (git-2166848), within 1-2% of the ceiling;
+      # one step past is refused by the worker. vm_shared 10_Now/lambdas-corner-doc-results-2026-09-26.md
+      ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+        max_input_size_bytes: proven
       max_input_size_bytes: 104857600
       max_output_pixels: 16000000
       options:

package/operations/schemas/transform.yaml

@@ -140,12 +140,20 @@ operation:
         # planned until the Fargate re-encode route is real and costed (ADR-0026).
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
             max_output_size_bytes: 524288000
         long_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/video_text_watermark.yaml

@@ -28,7 +28,7 @@ operation:
 
     ⚠️ An already-accepted workflow is NOT cancelled — availability is checked at
     create — and it is NOT thereby doomed. ⛔ The withdrawal rests on ONE measured
-    point: a 435 MB / 300 s real 1080p source KILLED at 604 s with no output.
+    point: a real 1080p source at the sold ceiling, KILLED just past the 600 s cap with no output.
     Work far enough inside the 600 s cap still completes, and NOTHING MEASURED
     SAYS WHERE THE BOUNDARY IS. What a caller sees when a job crosses it is NOT
     SETTLED — see the CHANGELOG entry for 2.203.0; this contract does not pin
@@ -49,6 +49,9 @@ operation:
       processing_class:
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
@@ -65,19 +68,18 @@ operation:
           # move DOWN, not up.
           #
           # Encode time is a LINE, slope AND intercept, and each ceiling is that
-          # line solved for the cap and FLOORED: `derivation` holds the inputs
-          # and a test recomputes the ceiling from them. ⛔ Dropping the
-          # intercept gives 276 s at 720p, and 2.167 × 276 + 3 = 601.1 s — past
-          # the cap the number exists to respect (the CHANGELOG 2.203.0 record
-          # made this correction once already). One constant generates both
-          # rows, ~2.35 s per megapixel-second on this worker; when the cap is
-          # derived from the runtime deadline (3JT9S3On) the rows are
-          # RECOMPUTED from `derivation`, not re-measured. An earlier
-          # extrapolation of 145 s at 1080p measured 124 s-before-the-intercept:
-          # 18% optimistic, the same direction as every estimate that day.
+          # line solved for the cap and FLOORED. The measured POINTS live in ONE
+          # place, this operation's `evidence` block in
+          # schemas/manifest-divergence-register.yaml (6gdvD3yZ). `derivation`
+          # below is the line those points give, and a test asserts the two
+          # agree (tests/test_evidence_figures_are_derived.py). Dropping the
+          # intercept over-sells 720p past the cap, which the CHANGELOG 2.203.0
+          # record corrected once already; the checker recomputes every ceiling
+          # from `derivation`. When the cap is derived from the runtime deadline
+          # (3JT9S3On) the rows are RECOMPUTED, not re-measured.
           #
-          # `gt_1080p` is NOT SERVED on short_form: the constant predicts ~31 s
-          # of 4K, an extrapolation 4x beyond anything measured, and neither
+          # `gt_1080p` is NOT SERVED on short_form: the constant's prediction
+          # for 4K is an extrapolation 4x beyond anything measured, and neither
           # lambdas nor contracts publishes it as a number. One real 4K cell
           # replaces it with a measured row.
           #
@@ -96,12 +98,12 @@ operation:
               basis: measured
               derivation: { slope_s_per_s: 2.167, intercept_s: 3.0, cap_s: 600 }
               constraints:
-                max_input_duration: "PT4M35S"     # 275 s = floor((600 - 3) / 2.167)
+                max_input_duration: "PT4M35S"     # floor((cap - intercept) / slope)
             p1080:
               basis: measured
               derivation: { slope_s_per_s: 4.867, intercept_s: -3.0, cap_s: 600 }
               constraints:
-                max_input_duration: "PT2M3S"      # 123 s = floor((600 + 3) / 4.867)
+                max_input_duration: "PT2M3S"      # floor((cap - intercept) / slope)
             gt_1080p:
               basis: not_served
             unknown:
@@ -110,6 +112,11 @@ operation:
                 max_input_duration: "PT4M35S"     # = le_720p (decision 343)
         long_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/operations/schemas/video_watermark.yaml

@@ -28,8 +28,8 @@ operation:
 
     ⚠️ An already-accepted workflow is NOT cancelled — availability is checked at
     create — and it is NOT thereby doomed. ⛔ The withdrawal rests on ONE measured
-    point: the same source plus a PNG overlay, KILLED at 606 s with no output, on
-    3008 MB — 47% more memory than `video_text_watermark` and dead at the same
+    point: the same source plus a PNG overlay, KILLED just past the 600 s cap with no output, on
+    47% more memory than `video_text_watermark` and dead at the same
     second, which is what rules out resizing the function as the remedy. Work far
     enough inside the 600 s cap still completes, and NOTHING MEASURED SAYS WHERE
     THE BOUNDARY IS. What a caller sees when a job crosses it is NOT
@@ -70,12 +70,20 @@ operation:
       processing_class:
         short_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
           constraints:
             max_input_duration: "PT5M"
             max_input_size_bytes: 524288000
             max_output_size_bytes: 524288000
         long_form:
           availability: planned
+          ceiling_basis:   # 607(d): proven at the declared value, or not yet (FORMAT.md §ceiling_basis)
+            max_input_size_bytes: unproven
+            max_input_duration: unproven
+            per_tier.max.max_input_size_bytes: unproven
+            per_tier.enterprise.max_input_size_bytes: unproven
           constraints:                            # baseline = every tier without a per_tier_constraints override
             max_input_duration: "PT12H"
             max_input_size_bytes: 5000000000       # 5 GB (Pro)

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@giveitsmaller/contracts",
-  "version": "0.79.0",
-  "description": "Generated contract types for GISL (Give It Smaller). Generated from compression_contracts spec v2.214.0.",
-  "gislContractsSpec": "v2.214.0",
+  "version": "0.81.0",
+  "description": "Generated contract types for GISL (Give It Smaller). Generated from compression_contracts spec v2.216.0.",
+  "gislContractsSpec": "v2.216.0",
   "license": "Apache-2.0",
   "homepage": "https://docs.giveitsmaller.com",
   "bugs": {
@@ -30,6 +30,7 @@
     },
     "./openapi/api.yaml": "./openapi/api.yaml",
     "./asyncapi/events.yaml": "./asyncapi/events.yaml",
+    "./resolution-bands.yaml": "./resolution-bands.yaml",
     "./availability/availability.json": "./availability/availability.json",
     "./accepted-options/accepted-options.json": "./accepted-options/accepted-options.json",
     "./accepted-options/image-output-routes.json": "./accepted-options/image-output-routes.json",
@@ -63,7 +64,8 @@
     "accepted-options/accepted-options.json",
     "accepted-options/image-output-routes.json",
     "operation-capabilities/operation-capabilities.json",
-    "code-builder/code-builder-metadata.json"
+    "code-builder/code-builder-metadata.json",
+    "resolution-bands.yaml"
   ],
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist', {recursive: true, force: true})\"",

package/resolution-bands.yaml

@@ -0,0 +1,32 @@
+# Resolution bands — the ONE declaration of the band names and their bounds.
+#
+# Read by `processing_class.<class>.resolution_bands` in schemas/operations/*.yaml
+# (every band below, plus `unknown_band`, must be declared there), by
+# scripts/check-resolution-bands.py, and by consumers that pick a band for an
+# input. The OpenAPI `ResolutionBand` enum is these names plus `unknown_band`,
+# held equal by a test. Do not restate the bounds anywhere else.
+#
+# A band is chosen by FRAME PIXELS = width x height from the upload probe,
+# never by height alone: a portrait 1080x1920 clip is the same work as its
+# landscape twin. Measured reason (lambdas, 2026-09-15, GxQPL4IY): encode cost
+# is linear in megapixel-seconds — 2.351 s per Mpx·s at 720p, 2.347 at 1080p,
+# 0.2% apart — so pixel count is the axis the cost runs on.
+#
+# An input lands in the FIRST band whose `max_frame_pixels` it does not
+# exceed; the last band has no bound. ORDER IS LOAD-BEARING and the checker
+# enforces it: strictly ascending bounds, exactly one unbounded band, last.
+#
+# `unknown_band` applies when the probe has no width or no height. It is a
+# DECLARED band with its own ceilings in every class, never a fallback each
+# consumer implements (decision 343).
+
+schema_version: "1.0.0"
+
+bands:
+  - name: le_720p
+    max_frame_pixels: 921600    # 1280 x 720
+  - name: p1080
+    max_frame_pixels: 2073600   # 1920 x 1080
+  - name: gt_1080p
+
+unknown_band: unknown