@oh-story/dsh 0.1.0

package/lib/drama/skills/short-drama-novel-analyze/scripts/selftest.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Offline self-test for the standalone novel index."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+from novel_index import build_index, sample_chapters, verify_index
+
+MINIMUM_PYTHON = (3, 9)
+if sys.version_info < MINIMUM_PYTHON:
+    raise SystemExit("selftest.py requires Python 3.9 or newer")
+
+
+def require(condition: bool, message: str) -> None:
+    if not condition:
+        raise AssertionError(message)
+
+
+def main() -> int:
+    with tempfile.TemporaryDirectory() as directory:
+        root = Path(directory)
+        source = root / "novel.txt"
+        index_path = root / "index.json"
+        source.write_text(
+            "第一章 起势\n"
+            + "人物做出选择，代价随之发生，旧关系因此失衡，新的目标也被迫提前。" * 4
+            + "\n第二章 反转\n"
+            + "旧承诺被新的证据推翻，人物必须在名誉与家人之间付出不可逆的代价。" * 4
+            + "\n",
+            encoding="utf-8",
+        )
+        index = build_index(source)
+        require(index["chapter_count"] == 2, "chapter count")
+        require(index["problems"] == [], "valid chapter index")
+        index_path.write_text(json.dumps(index, ensure_ascii=False), encoding="utf-8")
+        require(verify_index(index_path, source)["verified"] is True, "fresh index")
+        require(sample_chapters(index_path, 2)["sampled_count"] == 2, "sample count")
+
+        source.write_text(source.read_text(encoding="utf-8") + "变化\n", encoding="utf-8")
+        require(verify_index(index_path, source)["verified"] is False, "source drift")
+
+    print("5 self-tests passed")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/lib/drama/skills/short-drama-produce/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: short-drama-produce
+description: 在创作者明确确认后，执行短剧项目的图片、视频、TTS/配音或时间线音乐生产任务，并把结果与精简运行记录落回项目。用户说“生成这张图/这段视频/这句配音/这段配乐”“开始跑图/跑视频/合成语音/生成音乐”“把已确认提示词送去生产”，或要求批量执行已确认媒体任务时使用；不负责创作提示词、镜头、台词、歌词或声音身份，也绝不把预览、继续、预算说明或既有接受状态当作本次付费生产确认。
+license: MIT
+---
+
+# 确认后生产
+
+本技能只负责把已经写好的生产规格安全送到运行环境配置的 adapter。图片提示词仍归
+`$short-drama-image-prompts`，视频提示词归 `$short-drama-video-prompts`，台词与录音表归
+`$short-drama-write`，声音身份归 `$short-drama-assets`。
+
+## Quick Start
+
+先离线验证确认闸门、fixture adapter 和供应商 payload 编译，不发起远端请求：
+
+```bash
+python3 {技能目录}/scripts/selftest.py
+python3 {技能目录}/scripts/provider_adapters.py --selftest
+```
+
+## 硬闸门
+
+每次生产都必须经过以下四步，顺序不可合并：
+
+1. 建立一个有边界的 job：一种 modality、明确数量、完整 prompt/spec、参考文件、参数、输出路径和 adapter profile。
+2. 运行 `prepare`，把返回的完整预览展示给创作者，尤其是数量、prompt、references、outputs、
+   overwrite 与 adapter。
+3. 等创作者在**看到这份预览之后**明确确认。只有明确同意这项当前任务，才运行 `confirm`；
+   “继续”“都做完”“预算没问题”、上游内容已接受或之前确认过另一版，都不算本次生产确认。
+4. 运行 `run`。它会在启动 adapter 前消费一次确认；成功或失败后再次执行都必须重新确认，
+   防止失败重试意外产生第二笔费用。
+
+job、prompt、参数、输出路径或直接输入任一变化，旧确认立即失效。不得代替创作者填写确认。
+当前已确认 job 是本轮唯一工作单元；运行结束后回报结果并交还控制权，不自动准备下一批或启动审查。
+
+## 命令
+
+先把待执行任务写成 JSON；格式和 adapter 契约见
+[adapter-contract.md](references/adapter-contract.md)。命令由
+[production_tool.py](scripts/production_tool.py) 提供，然后运行：
+
+```text
+python3 <本技能目录>/scripts/production_tool.py prepare <project> --job <job.json>
+python3 <本技能目录>/scripts/production_tool.py confirm <project> --job-id <id> --confirmation "CONFIRM <id> <code>"
+python3 <本技能目录>/scripts/production_tool.py run <project> --job-id <id> --adapter-config <outside-project-config.json>
+python3 <本技能目录>/scripts/production_tool.py status <project> --job-id <id>
+python3 <本技能目录>/scripts/production_tool.py audit <project>
+```
+
+`prepare` 只验证并预览，不生产。`confirm` 只保存与当前 job 指纹绑定的一次性确认。
+`run` 才启动 adapter。`audit` 只对账本地任务历史、失败后恢复、重复内容尝试和当前输出字节，
+不会调用供应商，也不把技术成功、文件存在或哈希一致写成媒体质量结论。同一 job 存在未决
+`running` attempt 时禁止重新 prepare、confirm 或 run；先等待完成或排查遗留 attempt。
+
+## 输入选择
+
+- **image**：读取当前图片 prompt/spec、必要参考图和明确的输出尺寸/数量。
+- **video**：读取当前 motion spec、对应 shot/keyframe、必要首尾帧和时长/画幅。
+- **tts**：读取当前录音表中的原句、说话人/声音参考和本句表演要求；不得在生产 job 中改词。
+- **music**：读取已接受的时间线音乐规格；主题曲使用已确认歌词，纯配乐不携带歌词。供应商不能
+  精确承诺时长时，生成 source track 后仍由剪辑按 `mix_intent` 完成落点、循环、淡入淡出和对白 ducking。
+
+一个 job 不混合 modality。大批量工作拆成创作者能看清数量和成本边界的小 job；不为方便把整季
+隐式塞进一次确认。
+
+## Adapter 边界
+
+adapter 配置必须在项目外，只包含 argv 命令和超时；凭据由 adapter 自己从进程环境或系统凭据
+存储读取。项目 job、确认记录、运行记录和 Dashboard 都不得保存密钥。
+
+脚本以 JSON stdin 调用 argv 数组，不使用 shell，不拼接命令。adapter 返回本地临时文件；工具只
+接受与已确认 targets 完全一致的结果，并把完整文件原子复制到项目的 `production/制作成果`
+目录。项目和上游 Skill 不写死供应商、模型或即将变化的 API。
+
+本技能可选提供三个 stdlib adapter，均通过项目外 adapter config 选择，凭据只从运行环境读取：
+
+- [Seedance](references/providers/seedance.md)：模型/Endpoint ID 必须由账号显式配置；内置 runtime
+  只承诺已验证的 text-to-video，未配置可信上传时本地参考图 fail closed。
+- [GPT Image 2](references/providers/gpt-image-2.md)：无参考图走 generation，有参考图走 edit；
+  固定高保真引用并校验尺寸、格式与透明背景限制。
+- [MiniMax Music](references/providers/minimax-music.md)：使用 `music-3.0` 与 hex 结果，区分主题曲
+  和纯配乐，不伪造时长请求字段。
+
+这些 adapter 是已验证请求契约，不是账号可用性或生成质量保证；正式生产仍必须通过上面的本次
+确认闸门，并由审查 Skill 判断产物质量。
+
+仓库自带 `fixture_adapter.py` 只用于离线测试，不代表真实生成质量或默认生产 adapter。
+
+## 结果与复核
+
+成功后回报实际输出路径、媒体类型和运行状态；不要把“adapter 返回成功”写成质量结论。
+多任务或重试后先运行 `audit`：终态失败按 `retryable` 路由，重试仍须新的明确确认；输出缺失或
+文件的哈希或大小不再等于运行记录时，先复核当前字节或重新生产。`repeated_content` 只是成本与诊断信号，
+不能自动判定同文重试合理或不合理；`running_attempt` 是未决运营状态，audit 必须返回 attention。
+失败按三路走。超时、限流、服务端错误这类技术失败可做有上限重试。失败信息点名了被拒的是哪
+一项输入——提示词文本、参考图或音频——就先改那一项再投：文本被拒改写那一句，把「一拳砸在
+对方脸上，血顺着下巴滴」换成「一拳挥空，对方侧身避开，桌上的杯子被带倒」；参考图被拒换一张
+构图与角色一致、画面本身合规的图；音频被拒重录那句台词。改动写进新的 job 重新 prepare，让创
+作者在预览里看到改的是哪一项再确认；原样重投的那次确认不产生修复，只产生一笔费用。重复内容
+缺陷回到对应 prompt/spec owner。
+如需质量复核，报告可把已有结果另行交给 `$short-drama-review`；不要在生产调用中自动启动复核。
+Dashboard 只负责展示这些文件和运行摘要，不提供 adapter 设置或生产按钮。

package/lib/drama/skills/short-drama-produce/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "短剧生产"
+  short_description: "确认后安全执行图片、视频和语音生产任务，并保留可审计运行记录"
+  default_prompt: "Use $short-drama-produce to preview a bounded media job, request explicit confirmation, then execute it safely."

package/lib/drama/skills/short-drama-produce/references/adapter-contract.md

@@ -0,0 +1,140 @@
+# Adapter Contract
+
+## Job file
+
+```json
+{
+  "schema_version": "1.0",
+  "job_id": "EP001-SHOT001-image",
+  "modality": "image",
+  "adapter": "studio-image",
+  "prompt": "the complete prompt sent to production",
+  "source": "剧集/EP001/storyboard/keyframe-prompts.md",
+  "references": ["输入/approved-character-reference.png"],
+  "outputs": ["剧集/EP001/制作成果/images/SHOT001.png"],
+  "parameters": {"width": 1080, "height": 1920},
+  "overwrite": false
+}
+```
+
+- `modality`: `image`, `video`, `tts`, or `music`. `tts` is one bounded spoken
+  utterance; `music` is a separately accepted timeline-level cue or song and
+  must not be smuggled into every shot's video job.
+- `source`: optional current project text/spec that owns the prompt.
+- `references`: zero to sixteen current project files actually sent to production.
+- `outputs`: one to sixteen unique paths rooted at top-level `production/` or
+  `剧集|episodes/<EP>/制作成果|production/`; extensions must match the modality.
+  A nested directory merely named `production` does not grant write access to
+  protected input or delivery trees.
+- `parameters`: provider-neutral public settings only. Secret-like keys are rejected.
+- `overwrite`: must be explicitly true to replace an existing result.
+
+`prepare` records internal digests of source/reference bytes and returns the exact confirmation phrase. Callers never
+calculate those digests. A changed input requires prepare and confirmation again.
+
+## Adapter config
+
+Keep this file outside the project:
+
+```json
+{
+  "adapters": {
+    "studio-image": {
+      "command": ["python3", "/opt/studio/image_adapter.py"],
+      "timeout_seconds": 600
+    }
+  }
+}
+```
+
+`command` is an argv array, never a shell string. Timeout is 1–3600 seconds. Do not put credentials in this file;
+let the adapter read its environment or operating-system credential store.
+
+## Adapter stdin
+
+The adapter receives one UTF-8 JSON document as raw stdin bytes. Read the
+binary stream (for example `json.load(sys.stdin.buffer)`) rather than relying
+on the machine locale. The document contains the confirmed job plus:
+
+- `run_id`: unique attempt ID;
+- `project_root`: local absolute path to a private, run-scoped snapshot containing
+  the exact confirmed `source` and `references`. It is not the live creator
+  project and is deleted after the attempt.
+- `output_root`: empty private, run-scoped staging directory owned by the
+  production tool. Every adapter output source must be a direct regular-file
+  child of this directory. The whole directory is deleted after success or
+  failure.
+
+It may translate provider-neutral parameters into its chosen SDK/API. Optional
+provider adapters under `scripts/` document and implement known translations;
+the project job remains provider-neutral, and adapter selection, model access,
+polling and credentials stay in the external runtime configuration.
+
+## Adapter stdout
+
+On success, write one bounded UTF-8 JSON object to stdout. Portable adapters
+should ASCII-escape JSON strings so Windows locale settings cannot corrupt
+project paths:
+
+```json
+{
+  "outputs": [
+    {
+      "target": "剧集/EP001/制作成果/images/SHOT001.png",
+      "source": "/temporary/adapter/result.png"
+    }
+  ],
+  "provider_job_id": "optional-public-id"
+}
+```
+
+Targets must appear in exactly the confirmed order. Sources must be direct
+regular-file children of `output_root`, not symlinks. The tool opens each source
+without following links, copies the pinned bytes into the project, records
+size/media type/checksum, and removes staging. It never stores adapter
+stdout/stderr or environment values.
+
+On a provider failure, an adapter may write only this whitelisted evidence to stdout:
+
+```json
+{
+  "error": {
+    "provider": "studio-image",
+    "category": "rate_limit",
+    "code": "rate_limit_exceeded",
+    "http_status": 429,
+    "request_id": "request_safe_123",
+    "retryable": true
+  }
+}
+```
+
+Never include provider messages, response bodies, prompts, paths or credentials.
+The production run record keeps only validated fields; malformed failure output
+is replaced with a generic adapter exit code.
+
+A nonzero exit, timeout, malformed response or mismatched output marks the run failed. Because the adapter may have
+submitted paid work before failing locally, confirmation is consumed as soon as execution starts; retry only after a
+new creator confirmation. A job with an unresolved `running` attempt cannot be prepared, confirmed, or run again;
+wait for its terminal record or investigate the interrupted attempt first.
+
+## Operational reconciliation
+
+`production_tool.py audit <project>` reads only local production metadata and the
+current output bytes. It reports terminal failures, retryable failures, recovered
+jobs, unresolved running attempts, repeated content fingerprints, and missing or
+changed outputs. Terminal state, recovery, and repeated output claims are ordered
+by validated completion time rather than start time. For paths written more than
+once, the latest completed successful claim is authoritative for this operational
+check. Only attempts bound to the current stored job fingerprint can claim its
+current outputs; older fingerprints remain visible as `superseded` attempt history.
+A successful record must declare exactly the current job's output set and media
+types before any output claim is trusted. Jobs, confirmations, run records, and the
+production lock use pinned no-follow directories where directory FDs are available,
+and reparse/identity checks on the portable fallback. A linked parent chain fails
+closed instead of redirecting state outside the project.
+
+The audit deliberately returns `quality_verdict: not_assessed`. A provider success,
+retry recovery, file presence, size, or checksum proves execution/custody only; it
+does not prove identity, performance, continuity, lip-sync, mix, edit, or audience
+quality. Those claims require an authorized observation and a separate review.

package/lib/drama/skills/short-drama-produce/references/providers/gpt-image-2.md

@@ -0,0 +1,24 @@
+# GPT Image 2 adapter
+
+Adapter command:
+
+```json
+{"command": ["python3", "/absolute/path/provider_adapters.py", "gpt-image-2"], "timeout_seconds": 600}
+```
+
+Required environment: `OPENAI_API_KEY`. `OPENAI_BASE_URL` optionally overrides the default
+`https://api.openai.com/v1` and must remain HTTPS.
+
+The job must have modality `image` and exactly one output. With no references, the adapter sends JSON to
+`POST /images/generations`. With one to sixteen references, it sends an `image[]` multipart edit to
+`POST /images/edits`. The model is always `gpt-image-2`, `n` is always one, and the single returned `b64_json` image is
+written to a private temporary file.
+
+Supported public parameters are `width` plus `height` (compiled to `size`), or `size`, and `quality`, `background`, and
+`moderation`. References use GPT Image 2's high-fidelity behavior without sending the older `input_fidelity` field.
+Transparent backgrounds are rejected because GPT Image 2 does not support them. The output extension selects `png`,
+`jpeg`, or `webp`.
+
+Protocol references: [GPT Image 2 model](https://developers.openai.com/api/docs/models/gpt-image-2),
+[image generation](https://developers.openai.com/api/reference/resources/images/methods/generate), and
+[image edits](https://developers.openai.com/api/reference/resources/images/methods/edit).

package/lib/drama/skills/short-drama-produce/references/providers/minimax-music.md

@@ -0,0 +1,25 @@
+# MiniMax Music adapter
+
+Adapter command:
+
+```json
+{"command": ["python3", "/absolute/path/provider_adapters.py", "minimax-music"], "timeout_seconds": 600}
+```
+
+Required environment: `MINIMAX_API_KEY`. `MINIMAX_BASE_URL` optionally overrides the default
+`https://api.minimax.io/v1` and must remain HTTPS.
+
+The job uses the suite's `music` modality and must have exactly one output. The production prompt becomes the
+music style/mood prompt. Supported public parameters are `lyrics`, `is_instrumental`, `sample_rate`,
+`bitrate`, and `format`. Vocal jobs require exact accepted lyrics. The requested format must match the target extension
+and be `mp3` or `wav`.
+
+For this confirmed-production profile, `lyrics_optimizer` is rejected even when `true` is requested: supplier-authored lyrics would not have
+appeared in the preview and cannot satisfy creator ownership or licensing. A vocal job therefore requires the exact
+accepted lyrics; an instrumental job carries neither lyrics nor an optimizer request.
+
+The request always uses model `music-3.0`, non-streaming `output_format: hex`, and
+`POST /music_generation`. The adapter validates `base_resp.status_code`, decodes `data.audio` as hexadecimal bytes,
+and writes it to a private temporary file.
+
+Protocol reference: [MiniMax Music Generation](https://platform.minimax.io/docs/api-reference/music-generation).

package/lib/drama/skills/short-drama-produce/references/providers/seedance.md

@@ -0,0 +1,40 @@
+# Seedance adapter
+
+Adapter command:
+
+```json
+{"command": ["python3", "/absolute/path/provider_adapters.py", "seedance"], "timeout_seconds": 3600}
+```
+
+Required environment:
+
+- `ARK_API_KEY`: Volcengine Ark API key.
+- `SEEDANCE_MODEL`: the exact enabled model/endpoint ID. There is intentionally no model default; in particular the
+  adapter never assumes Seedance 2.0.
+
+Optional environment:
+
+- `SEEDANCE_BASE_URL` (default `https://ark.cn-beijing.volces.com/api/v3`)
+- `SEEDANCE_POLL_INTERVAL` (default `5` seconds)
+- `SEEDANCE_TIMEOUT_SECONDS` (default `1800` seconds)
+- `SEEDANCE_ALLOWED_RATIOS`: comma-separated subset explicitly supported by
+  the configured model, such as `9:16,16:9`.
+- `SEEDANCE_MIN_DURATION` and `SEEDANCE_MAX_DURATION`: the configured model's
+  explicit inclusive duration range. Set both or neither.
+
+The job must have modality `video` and exactly one `.mp4` output. Optional
+`duration` and `ratio` parameters are accepted only when the external runtime
+profile above explicitly permits their values. The broad parser envelope is
+1–15 seconds and `adaptive`, `1:1`, `3:4`, `4:3`, `9:16`, `16:9`, or `21:9`,
+but it is never treated as proof that a particular model supports the whole
+set. Values are compiled into the documented prompt switches `--dur` and
+`--ratio`, not sent as unverified top-level fields.
+The bundled runtime adapter currently supports text-to-video only. Local references fail closed because the public video
+contract does not prove that a local data URL is accepted. A deployment that needs image-to-video must add an external,
+authorized upload step and call `compile_seedance_payload` with the resulting HTTPS or `asset://` URI; do not put a
+temporary provider URL into the creator project.
+
+The adapter creates an asynchronous task, polls `GET /contents/generations/tasks/{id}` until a terminal state, and
+downloads `content.video_url` into a private temporary directory. Any unknown status fails closed.
+
+Protocol reference: [Volcengine video generation API](https://www.volcengine.com/docs/82379/1520757).

package/lib/drama/skills/short-drama-produce/scripts/fixture_adapter.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Offline adapter fixture for image, video, TTS, and music production tests."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import struct
+import sys
+import wave
+from pathlib import Path
+
+MINIMUM_PYTHON = (3, 9)
+if sys.version_info < MINIMUM_PYTHON:
+    raise SystemExit(
+        "short-drama-produce fixture needs Python {}.{} or newer".format(
+            *MINIMUM_PYTHON
+        )
+    )
+
+PNG = base64.b64decode(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII="
+)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--fail", action="store_true")
+    args = parser.parse_args()
+    job = json.load(sys.stdin.buffer)
+    if args.fail:
+        return 7
+    directory_raw = job.get("output_root")
+    if not isinstance(directory_raw, str):
+        return 8
+    directory = Path(directory_raw)
+    if not directory.is_absolute() or not directory.is_dir() or directory.is_symlink():
+        return 8
+    outputs = []
+    for index, target in enumerate(job["outputs"]):
+        suffix = Path(target).suffix.lower()
+        path = directory / f"output-{index}{suffix}"
+        if job["modality"] == "image":
+            path.write_bytes(PNG)
+        elif job["modality"] == "video":
+            path.write_bytes(b"\x00\x00\x00\x18ftypisom" + b"\x00" * 24)
+        else:
+            with wave.open(str(path), "wb") as handle:
+                handle.setnchannels(1)
+                handle.setsampwidth(2)
+                handle.setframerate(8000)
+                handle.writeframes(struct.pack("<h", 0) * 80)
+        outputs.append({"target": target, "source": str(path)})
+    json.dump({"outputs": outputs, "provider_job_id": "fixture-local"}, sys.stdout)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())