@polymorphism-tech/morph-spec 8.40.0 → 8.41.0

package/framework/skills/core/morph-uiux/SKILL.md

@@ -4,7 +4,7 @@ description: Conduz a fase opcional de UI/UX — design system, mockups, compone
 version: core
 when-to-invoke: ao tomar o ramo uiux (morph-spec advance --design), depois do Gate 1 e antes do morph-plan
 user-invokable: true
-cliVersion: "8.40.0"
+cliVersion: "8.41.0"
 ---
 
 # morph-uiux
@@ -32,7 +32,7 @@ Ao tomar o ramo opcional uiux: feature/bug cuja mudança cria ou altera superfí
    - **Sistemas, não telas isoladas** — mesmo critério da persona `ui-designer`: componentes reutilizáveis antes de composições de uso único.
    - **Toda tela sai com o checklist de tela preenchido** (template no passo 3) — a superfície, o volume esperado de dados, paginação, ordenação, filtro, os três estados (vazio, carregando, erro), o comportamento no mobile e abas × página longa. "Não se aplica" vale, **desde que escrito**. É o checklist que faz a lista de 2 000 linhas paginar: o que o design não decide não vira `doneCriteria` (`morph-plan` §5d), e o que não é critério ninguém entrega. Tela de dados segue os standards de `admin-app` (lista/tabela, formulário, feedback, estrutura de página), que a persona cita na superfície `admin-app`.
 
-3. **Despache `morph-ui-designer`** para o trabalho visual — dispatch é o default aqui (domínio diferente do Orchestrator, MORPH.md §6). `morph-ui-designer` tem o escopo das implementadoras (com Bash) + `Skill` + MCPs `stitch`/`gemini-image`/`playwright`/`context7`/`seedance`/`graphify`. Bash serve para `morph-spec standards --find`, `npx`, screenshot e leitura de `git`; build/test da suíte, `verify` e aprovação de gate continuam do orquestrador (cláusula 3, como nas outras personas).
+3. **Despache `morph-ui-designer`** para o trabalho visual — dispatch é o default aqui (domínio diferente do Orchestrator, MORPH.md §6). `morph-ui-designer` tem o escopo das implementadoras (com Bash) + `Skill` + MCPs `stitch`/`playwright`/`context7`/`graphify` + o MCP de mídia morph-assets (imagem e vídeo). Bash serve para `morph-spec standards --find`, `npx`, screenshot e leitura de `git`; build/test da suíte, `verify` e aprovação de gate continuam do orquestrador (cláusula 3, como nas outras personas).
 
    **Persona universal** (`ui-designer.stack = ["*"]` em `agents.json`, mesmo mecanismo de `evaluator`/`scout`): UI/UX importa sempre que há superfície de UI, então o subagent está registrado em **todo** projeto — .NET/Blazor incluído, não só Next.js. **Fallback** (caso raro: instalação anterior a essa mudança, `.claude/agents/morph-ui-designer.md` ainda não regenerado): `general-purpose` colando o campo `persona` (Read em `.morph/framework/agents.json`) no prompt, registrando o fallback no relatório — resolvido rodando `morph-spec setup-infra --reinstall`.
 
@@ -46,7 +46,7 @@ Ao tomar o ramo opcional uiux: feature/bug cuja mudança cria ou altera superfí
    Produza, NESTA ORDEM — design-system.md primeiro, os demais só como aplicável ao escopo:
    1. `design-system.md` — tokens (cor, tipografia, espaço, motion) consistentes com o projeto
    2. `mockups.md` — descrição estruturada de cada tela nova/alterada (+ imagem via MCP
-      gemini-image/stitch quando disponível; fallback: descrição textual detalhada).
+      stitch ou o MCP de mídia (imagem/vídeo) quando disponível; fallback: descrição textual detalhada).
       Cada tela é um `## Tela: <nome>` e traz, dentro dela, o checklist abaixo, com cada `…`
       trocado pela decisão — "não se aplica" vale se escrito; `…`, vazio ou "a definir" não.
       O que cada item decide: Superfície (admin-app | marketing-site — ela escolhe que

package/framework/standards/PROVENANCE.json

@@ -38,13 +38,13 @@
       "skills": []
     },
     {
-      "id": "gemini-image",
+      "id": "morph-image",
       "repo": "morph-HUB",
-      "path": "skills/gemini-image",
+      "path": "skills/morph-image",
       "envVar": "MORPH_HUB",
       "defaultCheckout": "R:/Polymorphism Tech/repos/morph-HUB",
-      "sourceTree": "ec0abd827badfd5cd6d4c5f8b1843f81a3d183fe",
-      "sourceCommit": "b6bbfff",
+      "sourceTree": "e55dcf307278583120601c3c5d55118302335f7b",
+      "sourceCommit": "c4c9164",
       "distilledOn": "2026-09-09",
       "distilledFrom": [
         "SKILL.md"

package/framework/standards/STANDARDS.json

@@ -1551,7 +1551,7 @@
         "errorbody": "#rule-2--error-path-tests-assert-the-response-body-not-just-the-status-code",
         "test-budget": "#test-budget"
       },
-      "digest": "Inject TimeProvider (never DateTime.UtcNow / DateOnly.FromDateTime(DateTime.UtcNow) directly in a handler or validator) and fake it with FakeTimeProvider (Microsoft.Extensions.TimeProvider.Testing) in integration tests — deterministic, no midnight-UTC flake, boundary dates (today vs. yesterday) become facts about the fake clock instead of when the suite happens to run. xUnit + WebApplicationFactory error-path tests (400/404/409) must assert the ProblemDetails response BODY (title/detail/violated field or error code), never just the HTTP status code — a status-only assertion lets the wrong validation rule or the wrong error branch pass silently as long as the status matches. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior (edge cases included) are rows of one [Theory], never copied [Fact]s; no test whose only assertion is a copy, config or prose string (that is an analyzer or a publish-time validation, outside the suite count); shared fixtures before new helpers; TDD for bugs (regression first) and pure logic; a surviving mutant is killed by tightening an assertion or adding a row, not by a new test.",
+      "digest": "Inject TimeProvider (never DateTime.UtcNow / DateOnly.FromDateTime(DateTime.UtcNow) directly in a handler or validator) and fake it with FakeTimeProvider (Microsoft.Extensions.TimeProvider.Testing) in integration tests — deterministic, no midnight-UTC flake, boundary dates (today vs. yesterday) become facts about the fake clock instead of when the suite happens to run. xUnit + WebApplicationFactory error-path tests (400/404/409) must assert the ProblemDetails response BODY (title/detail/violated field or error code), never just the HTTP status code — a status-only assertion lets the wrong validation rule or the wrong error branch pass silently as long as the status matches. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior (edge cases included) are rows of one [Theory], never copied [Fact]s; no test whose only assertion is a copy, config or prose string (that is an analyzer or a publish-time validation, outside the suite count); shared fixtures before new helpers; bugs and pure logic get tests in any order — the implementer runs its own filter once, never red-green cycles nor production mutation (the Gate 3 mutation proof shows the test bites); a surviving mutant is killed by tightening an assertion or adding a row, not by a new test.",
       "verifiedAgainst": ".NET 10 + xUnit 2 + `Microsoft.Extensions.TimeProvider.Testing`.",
       "provedBy": []
     },
@@ -1850,8 +1850,8 @@
         "favicon-og": "#the-two-assets-everyone-forgets",
         "variations": "#variations-and-cost"
       },
-      "digest": "Guidelines for generating project images with the Gemini Image MCP: when to use AI versus stock versus SVG, prompt patterns, aspect ratios, iterative editing and assets.md format. Core principle is brand fidelity over invention: always pass the client's real assets as referenceImages via edit_image rather than generating in a vacuum, never AI-recreate a property developer's architectural render or a physical product (animate or reference the real one), and chain derivatives from an approved hero so the whole set shares light, palette and identity. Frame anything destined to become video WITHOUT a face, because video moderation is stricter (E005), and generate scrub frames at the video's exact ratio with the subject opposite the copy. Always produce the two forgotten assets: a favicon derived from the real logo (never a new one) and a 1200x630 OG share image. Offer two to three genuinely different variations per image, varying angle, light or composition rather than the seed, and never advance with a weak image because every derivative inherits it.",
-      "verifiedAgainst": "Gemini Image MCP + Next.js 15 `next/image`.",
+      "digest": "Guidelines for generating project images with the morph-assets MCP (OpenRouter; default openai/gpt-image-2.5-flare, drafts on mai-image-2.6-flash, gemini-3.1-flash-image for 2K/4K or 6-14 refs; models: [...] compares): when to use AI versus stock versus SVG, prompt patterns, aspect ratios, iterative editing and assets.md format. Core principle is brand fidelity over invention: always pass the client's real assets as references (or @brand with a project) via edit_image rather than generating in a vacuum, never AI-recreate a property developer's architectural render or a physical product (animate or reference the real one), and chain derivatives from an approved hero so the whole set shares light, palette and identity. Frame anything destined to become video WITHOUT a face, because video moderation is stricter (E005), and generate scrub frames at the video's exact ratio with the subject opposite the copy. Always produce the two forgotten assets: a favicon derived from the real logo (never a new one) and a 1200x630 OG share image. Offer two to three genuinely different variations per image (variants returns a contact sheet), varying angle, light or composition since seed is not supported by the GPT Image/Gemini models, and never advance with a weak image because every derivative inherits it. Copy to render goes between double quotes; CONFIRMATION_REQUIRED needs human approval and a confirmToken.",
+      "verifiedAgainst": "morph-assets MCP (OpenRouter; default model `openai/gpt-image-2.5-flare`) + Next.js 15 `next/image`.",
       "provedBy": []
     },
     {
@@ -1889,8 +1889,8 @@
         "cost-ladder": "#section-4-the-cost-ladder",
         "prompt-skeleton": "#section-5-prompt-skeleton"
       },
-      "digest": "The decisive rule: a perfect loop has an end frame identical to its start, which is right for a self-playing ambient background and WRONG for scroll scrubbing, because start and end look the same and the page reads as frozen while the user scrolls. Scroll-driven footage needs directional movement via generate_video with an endImage (push-in/dolly is the most reliable, then reveal, pull-back, slow tilt); avoid orbits and any movement that returns to its origin. Client architectural renders are animated with img2vid, never AI-recreated. Human faces repeatedly trip moderation (E005), so crop the face out of frame (neck down, hands, product) and reserve faces for static image generation. Always climb the cost ladder: fast/480p/4s draft to judge framing and movement, 1080p only after approval, then re-extract frames with a bumped cache-bust. Prompts read like director notes with no hype words, and must reserve a calm dark region for the page copy with the subject on the opposite side. Generation is async: generate_video returns a request_id polled via get_video; list_videos reads local history and spends no credits.",
-      "verifiedAgainst": "seedance MCP (generate_video, generate_loop_video, get_video, list_videos) over Replicate.",
+      "digest": "The decisive rule: a perfect loop has an end frame identical to its start, which is right for a self-playing ambient background and WRONG for scroll scrubbing, because start and end look the same and the page reads as frozen while the user scrolls. Scroll-driven footage needs directional movement via generate_video with an endImage (push-in/dolly is the most reliable, then reveal, pull-back, slow tilt); avoid orbits and any movement that returns to its origin. Client architectural renders are animated with img2vid, never AI-recreated. Human faces repeatedly trip moderation (E005), so crop the face out of frame (neck down, hands, product) and reserve faces for static image generation. Always climb the cost ladder: seedance-1-5-pro 480p draft to judge framing and movement, then promoteFrom to seedance-2.0 1080p only after approval (same prompt, frames and seed), then re-extract frames with a bumped cache-bust. seedance-2.0-mini does NOT respect endImage and Veo 3.1 Lite/Fast are inconclusive, so scrub only on Seedance 1.5 Pro/2.0 and check the last-frame SSIM QA. Video has no ZDR on OpenRouter: nothing sensitive in the frames. Prompts read like director notes with no hype words, and must reserve a calm dark region for the page copy with the subject on the opposite side. Generation is async via the morph-assets MCP (OpenRouter): a running job is polled with get_video (several ids at once), never by resending generate_video; library reads local history and spends no credits; media_tool extracts scrub frames and posters.",
+      "verifiedAgainst": "morph-assets MCP (generate_video, generate_loop_video, get_video, library, media_tool) over OpenRouter; models `bytedance/seedance-1-5-pro` and `bytedance/seedance-2.0`.",
       "provedBy": []
     },
     {
@@ -2371,7 +2371,7 @@
         "e2e": "#test-file-co-location",
         "test-budget": "#test-budget"
       },
-      "digest": "Vitest for unit tests, React Testing Library for component tests. Mock next/navigation with vi.mock. Test Server Actions with direct function calls. Use MSW for API mocking in component tests. Playwright for E2E tests against running app. Never test implementation details — test user behavior and output. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior are rows of one it.each, never copied it() blocks; no test whose only assertion is a copy string (lint or publish-time validation instead); shared wrappers, MSW handlers and factories before new helpers; TDD for bugs and pure logic, component tests may come after the code.",
+      "digest": "Vitest for unit tests, React Testing Library for component tests. Mock next/navigation with vi.mock. Test Server Actions with direct function calls. Use MSW for API mocking in component tests. Playwright for E2E tests against running app. Never test implementation details — test user behavior and output. Test budget per task: one test per postcondition plus one regression test per bug, more only with a one-line justification in the task; scenarios of the same behavior are rows of one it.each, never copied it() blocks; no test whose only assertion is a copy string (lint or publish-time validation instead); shared wrappers, MSW handlers and factories before new helpers; bugs and pure logic get tests in any order — the implementer runs its own filter once, never red-green cycles nor production mutation.",
       "verifiedAgainst": "Vitest 3 + React Testing Library 16 + MSW 2.",
       "provedBy": []
     },

package/framework/standards/backend/dotnet/testing.md

@@ -128,8 +128,10 @@ regression test per bug fixed**. Going above it takes a one-line justification i
 - **Shared fixture by default.** Reuse the project's `WebApplicationFactory` fixture, fakes and
   builders. Before writing a new helper, look for the existing one (`morph-spec graph explain
   <Name>`; fallback without a graph: `grep -rn`).
-- **TDD where it pays:** a bug gets its regression test first (red, then the fix), and so does pure
-  logic. Integration and endpoint tests may come after the code.
+- **Order is free, proof is not the implementer's:** a bug gets a regression test, and pure logic
+  gets its tests, in whatever order the code comes out. The implementer does not run red→green
+  cycles nor mutate production code to watch a test fail; it runs its own filter once before the
+  report, and the Gate 3 mutation proof is what shows the test bites.
 - **A surviving mutant** of the Gate 3 mutation proof is killed by tightening an existing assertion
   or adding a table row, not by one new test per mutant.
 

package/framework/standards/frontend/design-system/ai-image-generation.md

@@ -2,10 +2,10 @@
 
 > **Scope:** nextjs
 > **Layer:** 1 (load when relevant)
-> **Keywords:** image, gemini, asset, ai-generation, placeholder, mcp, next/image
+> **Keywords:** image, gpt-image, gemini, openrouter, morph-assets, asset, ai-generation, placeholder, mcp, next/image
 > **Load When:** feature has UI components requiring image assets
 
-**Verified against:** Gemini Image MCP + Next.js 15 `next/image`. Last-verified: 2026-05-20.
+**Verified against:** morph-assets MCP (OpenRouter; default model `openai/gpt-image-2.5-flare`) + Next.js 15 `next/image`. Last-verified: 2026-09-27.
 
 ---
 
@@ -13,7 +13,7 @@
 
 | Use Case | Approach | Examples |
 |----------|----------|---------|
-| **AI generation** | Gemini Image MCP | Hero images, brand illustrations, feature-specific visuals, empty states, background panels |
+| **AI generation** | morph-assets MCP | Hero images, brand illustrations, feature-specific visuals, empty states, background panels |
 | **Stock photos** | External sources | Generic content (people in offices, nature scenes, stock portraits) |
 | **SVG/CSS** | Code-based | Icons, patterns, gradients, geometric shapes, loading animations |
 | **Skip** | Other tools | Screenshots (Playwright), diagrams (Mermaid), logos (vector tools) |
@@ -22,7 +22,7 @@
 
 ## Brand Fidelity: Reference, Don't Invent
 
-The advantage of an image MCP over generating from scratch is staying consistent with the client's **real** assets. Pass them as reference (`edit_image` with `referenceImages`) rather than generating in a vacuum. A generated look-alike is a different product, and the client sees it immediately.
+The advantage of an image MCP over generating from scratch is staying consistent with the client's **real** assets. Pass them as reference (`edit_image` / `references`, or `@brand` with a `project`) rather than generating in a vacuum. A generated look-alike is a different product, and the client sees it immediately.
 
 Two cases where this is a hard rule:
 
@@ -34,46 +34,60 @@ Two cases where this is a hard rule:
 Generate the **hero first**. Once approved, use it as the reference for every derived image (detail shots, cards, scene variants), so the whole set shares light, palette and identity instead of looking like separate photo shoots.
 
 ```
-hero -> [approved] -> derivatives with the approved hero as referenceImages -> [approved per image]
+hero -> [approved] -> derivatives with the approved hero as references -> [approved per image]
 ```
 
 Skipping this chain is the most common cause of a page whose images do not feel like one set.
 
-## Gemini Image MCP API
+## morph-assets MCP API
+
+One MCP for image and video, all models through OpenRouter. `model` accepts any OpenRouter image model by id, alias (`flare`, `mai flash`, `nano banana 2`, `nano banana pro`) or approximate name.
+
+| Role | Model |
+|------|-------|
+| Default (editing with refs, text) | `openai/gpt-image-2.5-flare` |
+| Draft | `microsoft/mai-image-2.6-flash` (max 5 refs) |
+| 2K/4K output or 6-14 references | `google/gemini-3.1-flash-image` |
 
 ```javascript
 // Generate a new image
-mcp__gemini-image-mcp__generate_image({
-  prompt: string,           // Text description (max 5000 chars, narrative style)
+mcp__morph-assets__generate_image({
+  prompt: string,           // Narrative description; copy to render goes between double quotes
+  model?: string,           // Default: openai/gpt-image-2.5-flare
+  models?: string[],        // 2-4 models: same request in each, cost per model (to choose)
   aspectRatio?: "1:1" | "2:3" | "3:2" | "3:4" | "4:3" | "9:16" | "16:9",
+  resolution?: "1K" | "2K" | "4K", // Only on models that support it
+  variants?: number,        // 1-4, returns a contact sheet for the review
+  references?: string[],    // Paths, URLs, library ids, "@brand", "@brand:name"
+  project?: string,         // Client project: output dir, brand refs, budget
   outputPath?: string,      // File path to save (e.g., "public/images/feature/hero.png")
-  model?: string,           // Default: gemini-2.5-flash-image
+  dryRun?: boolean,         // Estimate cost only
+  confirmToken?: string,    // Repeat a CONFIRMATION_REQUIRED call after approval
 })
 
-// Edit an existing image
-mcp__gemini-image-mcp__edit_image({
-  imageSource: string,      // Path to image or image ID
+// Edit an existing image (the base image goes as the 1st reference)
+mcp__morph-assets__edit_image({
+  image: string,            // Path to image or library id
   prompt: string,           // Short, targeted edit instructions (1-2 sentences)
+  references?: string[],
   outputPath?: string,
 })
 
-// Continue editing last image
-mcp__gemini-image-mcp__continue_editing({
+// Continue editing the last image of the project
+mcp__morph-assets__continue_editing({
   prompt: string,           // One adjustment at a time
+  imageId?: string,         // Default: the last image
 })
 
-// List generated images
-mcp__gemini-image-mcp__list_images({
-  type?: "generated" | "edited" | "all",
-  limit?: number,
-})
+// History and metadata (replaces list_images / get_image_info)
+mcp__morph-assets__library({ op: "list" | "search" | "info" | "tag" | "project_get" | "project_set", ... })
 
-// Get image details
-mcp__gemini-image-mcp__get_image_info({
-  imageId?: string,         // Defaults to last image
-})
+// Pick a model from the curation (verified vs broken)
+mcp__morph-assets__list_models({ kind: "image", needs?: "refs>=5", task?: string })
 ```
 
+**Cost gate:** every call estimates cost first. Above US$2, over the project budget or with an unknown price, the tool returns `CONFIRMATION_REQUIRED` + `confirmToken`; get human approval and repeat the same call with the token. Use `dryRun: true` before large batches or 4K.
+
 ## Prompt Engineering Patterns
 
 ### Design-System-Aware Prompts
@@ -101,7 +115,7 @@ Describe what the image will BE in the UI, not just the subject:
 
 ### Narrative Style
 
-Gemini responds best to coherent paragraphs. Build prompts by layering:
+GPT Image, Gemini and MAI all respond best to coherent paragraphs. Build prompts by layering:
 
 1. **Subject** — hyper-specific description
 2. **Environment** — foreground, mid-ground, background (layered for depth)
@@ -148,9 +162,9 @@ One change at a time:
 - "More serious expression"
 
 ### Text Rendering
-The model frequently misspells words. After generating any image with text:
+Put the exact copy between double quotes in the prompt (`the headline "Summer Sale"`) so the model renders it literally; GPT Image (the default) is the strongest at text. Models can still misspell words. After generating any image with text:
 1. View the result
-2. If text is wrong: `continue_editing` with "Fix the text — it should read '{correct text}' exactly. Keep everything else."
+2. If text is wrong: `continue_editing` with "Fix the text — it should read "{correct text}" exactly. Keep everything else."
 3. Expect 2-3 iterations for correct text
 
 ## Aspect Ratio Guide
@@ -267,7 +281,7 @@ For a frame that will drive a scroll scrub, also generate at the exact ratio the
 
 ## Variations and Cost
 
-Generate **two or three variations per image**, varying angle, light or composition, **not just the seed**. Seed-only variation produces near-identical options and wastes the review.
+Generate **two or three variations per image** (`variants: 2-3` returns a contact sheet for the review), varying angle, light or composition. Seed is not supported by the GPT Image / Gemini models, so variation has to come from the prompt; near-identical options waste the review. To choose between models or directions, `models: [...]` runs the same request on 2-4 models with the cost of each.
 
 If none are good, regenerate at the same step with the prompt adjusted by the feedback. **Do not advance with a weak image**: every derivative, any footage built from it, and the final page all inherit its quality.
 
@@ -282,7 +296,7 @@ If none are good, regenerate at the same step with the prompt adjusted by the fe
 - [ ] `priority` prop set for above-the-fold images
 - [ ] Build compiles after integration (`npm run build`)
 - [ ] Image visible in dev server at correct route
-- [ ] Client assets passed as `referenceImages`; nothing generated in a vacuum
+- [ ] Client assets passed as `references` (or `@brand`); nothing generated in a vacuum
 - [ ] Real renders and real product photos used as-is, never AI-recreated
 - [ ] Hero approved first, then used as reference for derivatives
 - [ ] Images headed for video framed without faces

package/framework/standards/frontend/design-system/ai-video-generation.md

@@ -2,10 +2,10 @@
 
 > **Scope:** frontend-design-system
 > **Layer:** 3
-> **Keywords:** video generation, seedance, img2vid, endImage, directional footage, loop video, E005 moderation, cost ladder
+> **Keywords:** video generation, seedance, morph-assets, openrouter, img2vid, endImage, directional footage, loop video, E005 moderation, cost ladder, promoteFrom
 > **Load When:** producing footage for a scroll-driven page or animating a client render
 
-**Verified against:** seedance MCP (generate_video, generate_loop_video, get_video, list_videos) over Replicate. Last-verified: 2026-08-21.
+**Verified against:** morph-assets MCP (generate_video, generate_loop_video, get_video, library, media_tool) over OpenRouter; models `bytedance/seedance-1-5-pro` and `bytedance/seedance-2.0`. Last-verified: 2026-09-27.
 
 ---
 
@@ -38,6 +38,13 @@ Give a start image and an end image, and let the model interpolate a camera trav
 1. Pick or generate the **start frame**: the wide shot, the resting state.
 2. Pick or generate the **end frame** (`endImage`): the destination of the movement (a detail in close-up, a revealed facade).
 3. Call `generate_video { prompt, image: start, endImage: end }`. The prompt describes the camera movement between the two.
+4. Check the **last-frame QA** in the response (SSIM of the real last frame against `endImage`): ✅ respected, ⚠️ does not match, ≈ inconclusive. A ⚠️ means the model ignored `endImage` and the take will not scrub as designed.
+
+**Models that respect `endImage` (verified 2026-09-27):** Seedance 1.5 Pro and Seedance 2.0. Use them for scrub.
+
+- `seedance-2.0-mini` does **not** respect `endImage` (it overshoots the end frame). Do not use it for scrub.
+- Veo 3.1 Lite/Fast came out **inconclusive** on the last-frame check. Do not rely on them for scrub until re-verified.
+- `aspectRatio: "adaptive"` does not exist on OpenRouter: omit `aspectRatio` to inherit the ratio of the start frame.
 
 **Movements that scrub well:**
 
@@ -52,11 +59,12 @@ Give a start image and an end image, and let the model interpolate a camera trav
 
 ## Section 3: Faces Trip Moderation
 
-Img2vid with a **human face** repeatedly fails moderation (error E005). The workaround that works is to **crop the face out of frame** before generating.
+Img2vid with a **human face** repeatedly fails moderation (it surfaced as error E005 on Replicate and still trips moderation through OpenRouter). The workaround that works is to **crop the face out of frame** before generating.
 
 - Frame from the neck down (garment, hands, fabric) rather than the whole person. For tailoring, craft and manufacturing this usually improves the shot, because the product becomes the subject.
 - Hands working (at a cuff, a button, the material) pass reliably and carry the craft story.
 - If the client insists on a face, generate the **static image** with it (image generation is more permissive) and reserve video for the face-free shots.
+- **Video has no ZDR (zero data retention) on OpenRouter:** the provider may retain the frames. Nothing sensitive in them (documents, screens with client data, identifiable people).
 
 ---
 
@@ -64,8 +72,10 @@ Img2vid with a **human face** repeatedly fails moderation (error E005). The work
 
 Every generation costs money and you rarely nail the movement on the first attempt.
 
-1. **Draft:** fast model, 480p, 4s. Enough to judge framing and movement.
-2. **Final:** only after the draft is approved, regenerate at 1080p. Then re-extract frames and swap them into the build **with a cache-bust** (`?v=N`), or the browser serves the old ones. See `frontend/scroll-driven/frame-scrub.md`.
+1. **Draft:** the default model (`bytedance/seedance-1-5-pro`), 480p (the default), 4-5s. About US$0.05 per take; enough to judge framing and movement. Ambient loops can stay on this model.
+2. **Final:** only after the draft is approved, promote it: `generate_video { promoteFrom: "<draft id>", model: "seedance", resolution: "1080p" }` renders `bytedance/seedance-2.0` at 1080p with the **same prompt, frames and seed** (about US$1.50 for 4s). Then re-extract frames and swap them into the build **with a cache-bust** (`?v=N`), or the browser serves the old ones. See `frontend/scroll-driven/frame-scrub.md`.
+
+To choose between models before drafting, `models: ["a", "b"]` runs the same request on 2-3 models with the cost of each. Any generation above US$2, over the project budget or with an unknown price returns `CONFIRMATION_REQUIRED` + `confirmToken`: get human approval, then repeat the same call with the token. `dryRun: true` only estimates.
 
 Never open at 1080p.
 
@@ -95,7 +105,11 @@ TECHNICAL: img2vid with image (start) + endImage (end). No audio. No watermark.
 
 ## Section 6: Async Contract
 
-`generate_video` and `generate_loop_video` return a `request_id` rather than a file. Poll with `get_video { requestId, outputPath? }`, which downloads the `.mp4` once the job reports COMPLETED. `list_videos { limit? }` reads local job history and spends no credits, which also makes it the safe health check for the MCP.
+`generate_video` and `generate_loop_video` wait up to `waitSeconds` (default 60) and, if the job is still running, return "⏳ generating" with the job id rather than a file. Poll with `get_video { ids? }` (several ids at once; no ids = every pending job), which downloads the `.mp4` once the job completes. **Never resend `generate_video` while a job is running**: an identical request within 15 minutes returns the same job, but a different one is billed again.
+
+`library { op: "pending" | "list" | "info" }` reads local history and spends no credits (it replaces the old `list_videos`). `usage { op: "balance" }` checks the OpenRouter key without spending credits, which makes it the safe health check for the MCP.
+
+Post-production runs locally with no cost through `media_tool` (ffmpeg): `scrub_frames` (frames + `frames.json`, each re-extraction creates a new `v{N}` folder, which doubles as the cache-bust), `poster` (static image for mobile), `flip` (hflip when the subject collides with the copy), `concat`, `compress` (web background) and `picker` (the side-by-side approval page for the gate).
 
 ---
 
@@ -104,15 +118,16 @@ TECHNICAL: img2vid with image (start) + endImage (end). No audio. No watermark.
 - [ ] Directional footage (start differs from end) for anything scroll-driven
 - [ ] Seamless loop used only for a self-playing ambient plane
 - [ ] Client renders animated, never AI-recreated
-- [ ] Faces cropped out of frame before img2vid
+- [ ] Faces cropped out of frame before img2vid; nothing sensitive in the frames (no ZDR)
+- [ ] Scrub footage generated on a model that respects `endImage` (Seedance 1.5 Pro / 2.0, never `seedance-2.0-mini`) and the last-frame QA came back ✅
 - [ ] Movement chosen from the scrub-friendly list, no orbits or returns
 - [ ] Prompt reserves a calm region for copy, subject opposite the text
-- [ ] Draft at 480p/4s approved before any 1080p render
+- [ ] Draft at 480p approved before any 1080p render, and the final made with `promoteFrom`
 - [ ] Frames re-extracted with a bumped cache-bust after the final render
 
 ## Boundary: Runtime Generation Is Another Standard
 
-This standard is **authoring time**: a human driving the seedance MCP in a session, footage that ends
+This standard is **authoring time**: a human driving the morph-assets MCP in a session, footage that ends
 up committed as a page asset. When the **product itself** generates video at runtime — a .NET worker
 creating a paid task, polling an operation, downloading bytes into its own blob store — the standard
 is `ai-agents/media-video.md` (Veo via `Google.GenAI`, the HTTP-only providers, cost per second, the

package/framework/standards/frontend/nextjs/testing.md

@@ -116,8 +116,10 @@ happy path + one error path per component above is that budget applied to a comp
 - **Shared helpers by default.** Reuse the existing wrappers (`test/helpers.tsx`), MSW handlers and
   factories. Before writing a new one, look for it (`morph-spec graph explain <Name>`; fallback
   without a graph: `grep -rn`).
-- **TDD where it pays:** a bug gets its regression test first, and so does pure logic (formatters,
-  reducers, schema). Component and integration tests may come after the code.
+- **Order is free, proof is not the implementer's:** a bug gets a regression test, and pure logic
+  (formatters, reducers, schema) gets its tests, in whatever order the code comes out. The
+  implementer does not run red→green cycles nor mutate production code to watch a test fail; it
+  runs its own filter once before the report, and the Gate 3 mutation proof shows the test bites.
 
 ## Common Mistakes
 

package/framework/standards/integration/mcp/mcp-tools.md

@@ -80,37 +80,44 @@ const docs = await mcp__context7__query-docs({
 
 Fallback: WebSearch for component documentation, WebFetch for specific component API pages.
 
-### Gemini Image MCP — AI Image Generation
+### morph-assets MCP — AI Image and Video Generation
 
 > Available in: **UI/UX** (preview generation), **Implement** (production assets)
 
+One MCP for image, video and local post-production, all models through OpenRouter. Default image model `openai/gpt-image-2.5-flare`; default video model `bytedance/seedance-1-5-pro` (draft/loop), final `bytedance/seedance-2.0` 1080p via `promoteFrom`. `model` accepts any OpenRouter model by id or alias; `models: [...]` compares the same request across models.
+
 | Tool | Use Case | Example |
 |------|----------|---------|
-| `generate_image` | Create new image from text prompt | `mcp__gemini-image-mcp__generate_image({ prompt, aspectRatio, outputPath })` |
-| `edit_image` | Modify existing image | `mcp__gemini-image-mcp__edit_image({ imageSource, prompt })` |
-| `continue_editing` | Iterate on last generated/edited image | `mcp__gemini-image-mcp__continue_editing({ prompt })` |
-| `list_images` | Browse image generation history | `mcp__gemini-image-mcp__list_images({ type: "all" })` |
-| `get_image_info` | Get metadata about a specific image | `mcp__gemini-image-mcp__get_image_info({ imageId })` |
+| `generate_image` | Create new image from text prompt | `mcp__morph-assets__generate_image({ prompt, aspectRatio, outputPath })` |
+| `edit_image` | Modify existing image | `mcp__morph-assets__edit_image({ image, prompt, references })` |
+| `continue_editing` | Iterate on last generated/edited image | `mcp__morph-assets__continue_editing({ prompt })` |
+| `generate_video` / `generate_loop_video` | Directional footage (`image` + `endImage`) / ambient loop | `mcp__morph-assets__generate_video({ prompt, image, endImage })` |
+| `get_video` | Poll one or more video jobs (never resend `generate_video`) | `mcp__morph-assets__get_video({ ids })` |
+| `media_tool` | ffmpeg post-production: scrub frames, poster, concat, compress, approval picker | `mcp__morph-assets__media_tool({ op: "scrub_frames", input })` |
+| `library` | History and metadata (replaces `list_images` / `get_image_info` / `list_videos`) | `mcp__morph-assets__library({ op: "list" })` |
+| `list_models` / `usage` | Pick a model from the curation / spend and credit balance | `mcp__morph-assets__usage({ op: "balance" })` |
 
 Read `design-system.md` first to get the project colors and aesthetic direction. Keep edits short and targeted, and iterate with `continue_editing` one change at a time.
 
 ```javascript
-const image = await mcp__gemini-image-mcp__generate_image({
+const image = await mcp__morph-assets__generate_image({
   prompt: "A floating tablet showing a modern dashboard interface on a dark charcoal background with copper and gold accent lighting. Premium luxury aesthetic, photorealistic, cinematic lighting with warm rim light.",
   aspectRatio: "16:9",
   outputPath: "public/images/my-feature/hero-mockup.png"
 });
 
-await mcp__gemini-image-mcp__edit_image({
-  imageSource: "public/images/my-feature/hero-mockup.png",
+await mcp__morph-assets__edit_image({
+  image: "public/images/my-feature/hero-mockup.png",
   prompt: "Make the lighting warmer and add a subtle copper glow around the tablet edges."
 });
 
-await mcp__gemini-image-mcp__continue_editing({
+await mcp__morph-assets__continue_editing({
   prompt: "More contrast in the shadows."
 });
 ```
 
+Paid per generation: above US$2, over the project budget or with an unknown price the tool returns `CONFIRMATION_REQUIRED` + `confirmToken` (get human approval, then repeat the same call with the token); `dryRun: true` only estimates.
+
 Fallback: manual image creation, stock photos, or placeholder divs.
 
 **Use cases by phase:**
@@ -121,7 +128,7 @@ Fallback: manual image creation, stock photos, or placeholder divs.
 | Implement (7) | Generate production assets from assets.md specs | `generate_image` + `edit_image` |
 | Implement (7) | Iterate on generated images for quality | `continue_editing` |
 
-> **Standard:** See `frontend/design-system/ai-image-generation.md` for prompt engineering patterns, aspect ratio guide, and `assets.md` format.
+> **Standard:** See `frontend/design-system/ai-image-generation.md` for prompt engineering patterns, aspect ratio guide, and `assets.md` format, and `frontend/design-system/ai-video-generation.md` for directional footage and the video cost ladder.
 
 ---
 
@@ -271,7 +278,7 @@ PRs/issues: sempre `gh` CLI (Bash). Deployments fallback: `vercel` CLI.
 | Container ops | Docker CLI (`docker ps`, `docker logs`, `docker compose`) | — |
 | Cloud resources | Azure CLI (`az resource`, `az deployment`) | — |
 | Vercel deployments | Vercel MCP | Bash `vercel` CLI |
-| AI image generation | Gemini Image MCP | Manual creation or stock photos |
+| AI image and video generation | morph-assets MCP | Manual creation or stock photos |
 
 **Rule:** MCP tools provide structured data (JSON responses). Native tools require manual parsing. **Always prefer MCP when available** — fall back to native when not. **Exceptions:** Neon, Docker, Azure **and GitHub** always use their respective CLIs directly — never MCP (`gh` já retorna JSON estruturado via `--json`, sem Docker nem PAT em env var).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "8.40.0",
+  "version": "8.41.0",
   "description": "MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code",
   "keywords": [
     "claude-code",

package/src/commands/project/doctor.js

@@ -16,7 +16,7 @@ import {
   getInstalledCLIVersion
 } from '../../utils/version-checker.js';
 import { resetMorphSettings } from '../../utils/claude-settings-manager.js';
-import { checkMissingAgents, checkAgentsDrift, maxTurnsError, surfacesError } from '../../utils/agents-installer.js';
+import { checkMissingAgents, checkAgentsDrift, maxTurnsError, surfacesError, effortError } from '../../utils/agents-installer.js';
 import { getProjectTags } from '../../lib/stack-filter.js';
 import { auditGraph } from '../../lib/graph/graph-health.js';
 import { auditFeatureLifecycle } from '../../core/state/lifecycle-audit.js';
@@ -208,6 +208,14 @@ export function validateAgentsJson(agentsData) {
     ? { name: 'agents.json surfaces', status: 'error', msg: surfacesErrors.join(' | ') }
     : { name: 'agents.json surfaces', status: 'ok' });
 
+  // 6: effort — same installer rule, same severity.
+  const effortErrors = agentEntries
+    .map(([id, data]) => effortError(id, data?.effort))
+    .filter(Boolean);
+  checks.push(effortErrors.length > 0
+    ? { name: 'agents.json effort', status: 'error', msg: effortErrors.join(' | ') }
+    : { name: 'agents.json effort', status: 'ok' });
+
   if (missingV5Fields.length > 0 && isV5) {
     const sample = missingV5Fields.slice(0, 3).join(', ');
     checks.push({

package/src/commands/project/worktree.js

@@ -35,7 +35,7 @@
  */
 
 import { execSync, execFileSync } from 'child_process';
-import { existsSync, mkdirSync, symlinkSync, readFileSync, writeFileSync, lstatSync, unlinkSync, rmdirSync, cpSync } from 'fs';
+import { existsSync, mkdirSync, symlinkSync, readFileSync, writeFileSync, lstatSync, unlinkSync, rmdirSync, cpSync, copyFileSync, readdirSync } from 'fs';
 import { join, resolve, dirname, basename } from 'path';
 import chalk from 'chalk';
 import { detectDefaultBranch } from '../../lib/git/default-branch.js';
@@ -612,6 +612,43 @@ export function buildTaskBranchName(name) {
   return `morph-task/${name}`;
 }
 
+const ROOT_ENV_FILE_RE = /^\.env(\..+)?$/;
+
+/**
+ * Copy the root's `.env` / `.env.*` into a new tree: a sub-agent that builds
+ * or runs the app needs the same secrets, and they are never committed. Only
+ * a REAL file (never a link — nothing in the tree may reach the root through
+ * one), only when the tree lacks it (never overwrite), and only when git
+ * IGNORES it there: an untracked-but-visible copy would dirty the tree, and
+ * `finish`/`worktree remove --if-clean` refuse a dirty tree. At teardown the
+ * copy is byte-identical to the root's, which `triageIgnoredPaths` classifies
+ * as REPLICABLE — deleted with nothing lost.
+ *
+ * @param {string} worktreePath
+ * @param {string} root
+ * @returns {string[]} names copied
+ */
+export function copyRootEnvFiles(worktreePath, root) {
+  let names;
+  try {
+    names = readdirSync(root).filter((n) => ROOT_ENV_FILE_RE.test(n));
+  } catch {
+    return [];
+  }
+  const copied = [];
+  for (const name of names) {
+    const dst = join(worktreePath, name);
+    try {
+      if (!lstatSync(join(root, name)).isFile()) continue;
+      try { lstatSync(dst); continue; } catch { /* absent — not even a dangling link */ }
+      execFileSync('git', ['check-ignore', '-q', '--', name], { cwd: worktreePath, stdio: 'pipe' });
+      copyFileSync(join(root, name), dst);
+      copied.push(name);
+    } catch { /* not ignored, unreadable or unwritable — leave it out */ }
+  }
+  return copied;
+}
+
 /**
  * Non-exiting core of `worktree provision` — the tree `claude -w`,
  * `EnterWorktree` and `Agent isolation:"worktree"` ask for when the name is
@@ -668,7 +705,11 @@ export async function runWorktreeProvision(name, options = {}) {
     execFileSync('git', ['worktree', 'add', worktreePath, branch], { cwd: root, stdio: 'pipe' });
 
     setupInfraLinks(worktreePath, root);
-    const envBlock = await allocateWorktreeEnv(worktreePath, root, `task/${name}`);
+    const envFiles = copyRootEnvFiles(worktreePath, root);
+    // A tree born from `morph/<f>` works FOR that feature: MORPH_FEATURE says
+    // so, while the port block stays the task's own (`task/<name>`).
+    const forFeature = String(options.base || '').match(/^morph\/(.+)$/)?.[1] ?? null;
+    const envBlock = await allocateWorktreeEnv(worktreePath, root, `task/${name}`, { morphFeature: forFeature });
     const materialized = await ensureLocalState(worktreePath);
     const graph = seedWorktreeGraph(worktreePath, root);
 
@@ -681,6 +722,8 @@ export async function runWorktreeProvision(name, options = {}) {
       branchedFrom,
       kind: 'task-isolation',
       name,
+      ...(forFeature ? { feature: forFeature } : {}),
+      ...(envFiles.length ? { envFiles } : {}),
       materialized: materialized.materialized,
       ...(envBlock ? { env: { base: envBlock.base, range: envBlock.range } } : {}),
       ...(graph.seeded ? { graph: 'seeded' } : {}),
@@ -797,12 +840,25 @@ export function envKeyForWorktree(worktreePath, root) {
  * Shared by `setup` (feature key), `provision` (task key) and `link --all`
  * (regeneration), so the manifest has exactly one writer.
  *
+ * `morphFeature` (task trees born from `morph/<f>`) only renames the
+ * `MORPH_FEATURE` line. Left undefined — the `link --all` regeneration, which
+ * derives the key from the branch and cannot see the base — the value the
+ * file already carries is kept, so a repair never forgets the feature.
+ *
  * @param {string} worktreePath
  * @param {string} root - primary root
  * @param {string} envKey - `<feature>` or `task/<name>`
+ * @param {{ morphFeature?: string|null }} [opts]
  * @returns {Promise<{ index: number, base: number, range: [number, number] }|null>}
  */
-export async function allocateWorktreeEnv(worktreePath, root, envKey) {
+export async function allocateWorktreeEnv(worktreePath, root, envKey, { morphFeature } = {}) {
+  const envPath = join(worktreePath, '.morph', 'worktree.env');
+  if (morphFeature === undefined && envKey.startsWith('task/')) {
+    try {
+      const kept = readFileSync(envPath, 'utf8').match(/^MORPH_FEATURE=(.+)$/m)?.[1]?.trim();
+      morphFeature = kept && kept !== envKey ? kept : null;
+    } catch { morphFeature = null; }
+  }
   try {
     const { allocateEnvBlock, resolveFleetConfig, buildEnvFileContent } =
       await import('../../lib/worktree/env-allocator.js');
@@ -816,7 +872,7 @@ export async function allocateWorktreeEnv(worktreePath, root, envKey) {
       stack = cfg?.project?.stack || '';
     } catch { /* fail-open — stackless env still carries PORT */ }
     mkdirSync(join(worktreePath, '.morph'), { recursive: true });
-    writeFileSync(join(worktreePath, '.morph', 'worktree.env'), buildEnvFileContent(envKey, block, stack), 'utf8');
+    writeFileSync(envPath, buildEnvFileContent(envKey, block, stack, { morphFeature }), 'utf8');
     excludeWorktreePaths(root, [join('.morph', 'worktree.env')]);
     return block;
   } catch {

package/src/commands/state/gate-check.js

@@ -9,6 +9,7 @@ import { persistGateDecision, VALID_GATES, readTrustFromConfig } from './gate-de
 import { minimatch } from 'minimatch';
 import { detectDefaultBranch, getHeadSha, getDiffStat, changedPathsAgainst } from '../../lib/git/default-branch.js';
 import { readMorphConfig } from '../../lib/tasks/test-runner.js';
+import { oversizedTasks } from '../../lib/tasks/tasks-json-parser.js';
 import { assertOwnerTree, ownerTreeRefusalLines } from '../../lib/worktree/feature-truth.js';
 
 /**
@@ -196,6 +197,10 @@ function collectSignals(featureName, feature, cwd, gateName) {
     designSystemDivergence: false,
   };
 
+  // Fato de disco, fora de OVERRIDABLE_SIGNAL_KEYS: task que não cabe num
+  // dispatch se fatia no plano, não depois de um sub-agent bater no teto.
+  if (gateName === 'plan') signals.oversizedTasks = oversizedTasks({ tasks });
+
   // Só onde o checklist decide algo: no fecho do design e no ship. Fato de
   // disco, fora de OVERRIDABLE_SIGNAL_KEYS como `mutationProof`.
   if (gateName === 'uiux' || gateName === 'review') {