gflow-cli 0.43.0__tar.gz → 0.44.0__tar.gz

gflow_cli-0.44.0/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "gflow-cli",
+  "interface": {
+    "displayName": "gflow-cli"
+  },
+  "plugins": [
+    {
+      "name": "gflow",
+      "source": {
+        "source": "local",
+        "path": "./"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

gflow_cli-0.44.0/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "gflow",
+  "version": "0.44.0",
+  "description": "Reusable development and operations workflows for gflow-cli",
+  "author": {
+    "name": "Flavio Oliva",
+    "url": "https://github.com/ffroliva"
+  },
+  "homepage": "https://github.com/ffroliva/gflow-cli",
+  "repository": "https://github.com/ffroliva/gflow-cli",
+  "license": "MIT",
+  "keywords": [
+    "gflow-cli",
+    "codex",
+    "google-flow"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "gflow-cli",
+    "shortDescription": "Develop, validate, review, and operate gflow-cli.",
+    "longDescription": "Project workflows for planning, validation, issue handling, reviews, releases, and Google Flow CLI operations.",
+    "developerName": "Flavio Oliva",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Interactive",
+      "Write"
+    ],
+    "websiteURL": "https://github.com/ffroliva/gflow-cli",
+    "defaultPrompt": [
+      "Show the current gflow-cli task with $gflow:status.",
+      "Run the gflow-cli quality gates with $gflow:check."
+    ]
+  }
+}

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/AGENTS.md

@@ -109,7 +109,21 @@ and must be resolvable by ANY agent via this file. Vendor directories hold thin
 only (`.claude/commands/gflow/*.md` are pointers into `skills/`); never put protocol
 content in a vendor directory.
 
-**Cursor / Aider / Codex / Antigravity (`agy`):** paste or include the relevant `SKILL.md` in your system context. Note: in the `agy` TUI prompt, custom slash commands (e.g. `/gflow:pr-council-review`) are blocked by the TUI's command parser. Type them as plain text without the leading slash (e.g. `gflow:pr-council-review`, `gflow:branch-review`, or `gflow:check`) to trigger the corresponding agent skill workflow.
+**Codex CLI / desktop app:** install the repo's skills-only plugin from the repository root,
+then start a new session:
+
+```powershell
+codex plugin marketplace add .
+codex plugin add gflow@gflow-cli
+```
+
+Invoke skills with Codex's `$` syntax, for example `$gflow:status`, `$gflow:check`, or
+`$gflow:pr-council-review`. Codex reserves slash commands for its own command surface; the
+Claude Code spelling `/gflow:*` is therefore intentionally not reproduced. The Codex IDE
+extension does not currently load plugins, so IDE-only users should include the relevant
+`skills/<name>/SKILL.md` directly.
+
+**Cursor / Aider / Antigravity (`agy`):** paste or include the relevant `SKILL.md` in your system context. Note: in the `agy` TUI prompt, custom slash commands (e.g. `/gflow:pr-council-review`) are blocked by the TUI's command parser. Type them as plain text without the leading slash (e.g. `gflow:pr-council-review`, `gflow:branch-review`, or `gflow:check`) to trigger the corresponding agent skill workflow.
 **Claude Code:** the `/gflow:` slash commands in `.claude/commands/gflow/` are auto-discovered when the project is open — no extra setup needed. To register a skill globally, copy the command file to `~/.claude/commands/`.
 **Custom agents:** fetch `skills/gflow-cli/SKILL.md` into your knowledge base before answering gflow questions.
 

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.44.0] — 2026-07-26
+
+### Added
+
+- **Dual-Side Project Naming & Management (`gflow project`)** (#381). Added
+  `gflow project` subcommand group (`list`, `show`, `rename`, `create`),
+  `--project-name` / `--project-title` options across `gflow image` and `gflow video`
+  generation commands, prompt slugging for scratch projects, and dual-side title sync
+  updating Google Flow's tRPC server/UI and local SQLite catalog in lockstep.
+- **Namespaced Codex project skills.** The canonical workflows under `skills/`
+  now ship as a repo-local, skills-only Codex plugin. Register and install it
+  with `codex plugin marketplace add .` followed by
+  `codex plugin add gflow@gflow-cli`, then invoke workflows such as
+  `$gflow:status`, `$gflow:check`, and `$gflow:pr-council-review` in a new
+  Codex CLI or desktop-app session. Claude Code's `/gflow:*` commands and the
+  agent-agnostic skill files remain unchanged.
+- **`gflow data errors` — bounded retention + export for failed-operation
+  history** (#345). `gflow data errors export [--older-than AGE] [-o FILE]`
+  dumps failed operations as JSONL (unbounded, newest-first) for offline
+  archival — also closing the export path deferred from #341. `gflow data
+  errors prune --older-than AGE [--dry-run]` deletes failures older than AGE
+  (`90d` / `24h` / `30m`); `--older-than` is **required** and there is no
+  automatic/background pruning — deletion is always an explicit operator
+  action. Both honor `--profile` and the exit-16 `DataStoreError` convention.
+
+### Fixed
+
+- **`gflow character create` safely activates the current Create-Body
+  composer.** Flow can autosave the body triptych over the stored portrait
+  prompt when the mode switch has not settled (observed live 2026-07-25 on
+  0.43.0). Current Flow reuses one Slate editor and exposes Create Body through
+  the locale-independent `accessibility_new` icon beside the portrait image;
+  gflow now clicks that scoped mode control, requires a new generated-face
+  reference chip to mount, and verifies the shared editor owns focus **before
+  any clearing or typing**. Readback failures abort before submit. The older
+  `add_2`/second-box cohort remains supported through its count-rise gate.
+  Post-type isolation still aborts before the credited submit. Live DOM
+  evidence and the one-box failure were captured on 2026-07-26. Face-only
+  creates are unchanged.
+
+- **Profile-lock remediation message** now names the real cause and recovery.
+  `ProfileLockedError` (exit 11) previously told operators to "wait for it to
+  finish" — implying an unbounded wait — and to hunt for a `gflow`/Chrome
+  process. In practice a blocking lock is a kernel *advisory* lock held by a
+  **live** process (often a `python.exe` a `chrome.exe` scan misses); the OS
+  releases it the instant the holder dies, so a leftover lock *file* never
+  blocks acquisition. The message now points to the recorded owner PID
+  (surfaced locally since v0.43.0) and says to just retry when nothing is
+  running. The lock itself is unchanged — auto-reclaim was considered and
+  rejected as unsafe (an unlink→new-inode race could put two browsers on one
+  profile, the exact corruption the lease prevents). Refs #370.
+
 ## [0.43.0] — 2026-07-23
 
 ### Added
@@ -2332,7 +2384,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.43.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.44.0...HEAD
+[0.44.0]: https://github.com/ffroliva/gflow-cli/compare/v0.43.0...v0.44.0
 [0.43.0]: https://github.com/ffroliva/gflow-cli/compare/v0.42.0...v0.43.0
 [0.42.0]: https://github.com/ffroliva/gflow-cli/compare/v0.41.0...v0.42.0
 [0.41.0]: https://github.com/ffroliva/gflow-cli/compare/v0.40.0...v0.41.0

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/CONTRIBUTING.md

@@ -11,6 +11,22 @@ uv sync --extra dev
 uv run playwright install chromium
 ```
 
+### Codex project skills
+
+Codex CLI and the Codex desktop app can install the repository's canonical `skills/`
+workflows as the `gflow` plugin. From the repository root, run:
+
+```bash
+codex plugin marketplace add .
+codex plugin add gflow@gflow-cli
+```
+
+Start a new Codex session after installation, then invoke a workflow with `$gflow:<skill>`
+(for example, `$gflow:status`, `$gflow:check`, or `$gflow:pr-council-review`). Claude Code
+continues to use the equivalent `/gflow:*` commands. The Codex IDE extension does not
+currently load plugins; include the relevant `skills/<name>/SKILL.md` directly when using
+that surface.
+
 ## Test-driven development (mandatory)
 
 `gflow-cli` is built test-first. Every change must include tests, and CI rejects PRs that lower coverage.

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/KNOWN_ISSUES.md

@@ -31,22 +31,27 @@ targeted dismissal once the next occurrence is captured. **Workaround:**
 re-run the command; open the project once manually in Chrome to consume the
 banner.
 
-### Reported stale profile lock blocks acquisition (unreproduced)
-
-- **Status:** Open ([#370](https://github.com/ffroliva/gflow-cli/issues/370))
-- **Severity:** Medium (blocks the profile until resolved) · **Affected:** `ProfileLease` acquisition (exit 11)
-
-A user report of `ProfileLockedError` with no apparently-live owner. Not
-reproduced: in every observed case the kernel advisory lock was held by a
-real process (e.g. a pytest child that outlived its parent shell). The
-kernel lock is authoritative — a merely *stale metadata file* cannot block
-acquisition, and gflow will never auto-delete a lock file or kill a
-recorded PID based on metadata. Since v0.43.0, contention reports the
-recorded owner's PID and observed start time locally (lock-file metadata
-now starts at offset 1 so Windows contenders can read it while byte 0 is
-kernel-locked), and a metadata-only incident bundle is written before any
-Chrome launch. **Workaround:** find and close the owning process (the
-error's local output names its PID), or use a different `--profile`.
+### Profile lock reported as "held by another process" with no obvious owner
+
+- **Status:** Resolved ([#370](https://github.com/ffroliva/gflow-cli/issues/370)) · remediation message clarified
+- **Severity:** Low (by design; fails closed — never corrupts) · **Affected:** `ProfileLease` acquisition (exit 11)
+
+`ProfileLockedError` can surface when no `chrome.exe` / `gflow` process is
+obvious. This is **working as intended, not a stale-file bug.** The profile
+lock is a kernel *advisory* byte-range lock, which the OS releases the instant
+its holder dies — so a leftover lock *file* can never block acquisition. If
+`acquire` is blocked, a **live** process genuinely holds it, most often a
+`python.exe` (a prior gflow run, or a pytest child that outlived its shell)
+that a scan for `chrome.exe` misses. gflow deliberately never auto-deletes a
+lock file or kills a recorded PID from metadata: an unlink→new-inode race could
+put two browsers on one profile — the exact corruption the lease exists to
+prevent. Since v0.43.0 contention reports the recorded owner's PID and observed
+start time locally (metadata starts at offset 1 so Windows contenders can read
+it while byte 0 is kernel-locked), and the remediation message now names the
+live-owner reality and tells you to just retry when nothing is running.
+**Workaround:** close the process at the PID the error prints
+(`Get-Process -Id <pid>` / `ps -p <pid>`, then `Stop-Process -Id <pid>` /
+`kill <pid>`), or use a different `--profile`.
 
 ### Unexplained image-generation HTTP 400 (observed live 2026-07-22)
 

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.43.0
+Version: 0.44.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/RELEASE.md

@@ -85,13 +85,14 @@ python -m pip install --pre gflow-cli
    see the root-doc allowlist.)
 6. Update the version in:
    - `pyproject.toml`
+   - `.codex-plugin/plugin.json`
    - `src/gflow_cli/__init__.py`
    - any tests that assert the package version
 7. Move user-visible changes from `CHANGELOG.md` `[Unreleased]` into a dated
    release section.
 8. Commit the release prep:
    ```bash
-   git add pyproject.toml src/gflow_cli/__init__.py CHANGELOG.md tests docs
+   git add pyproject.toml .codex-plugin/plugin.json src/gflow_cli/__init__.py CHANGELOG.md tests docs
    git commit -m "chore(release): vX.Y.Z"
    ```
 9. Tag and push. **Must be a signed annotated tag** (`-s`) — `.github/workflows/release.yml` rejects unsigned or lightweight tags. Requires a GPG or SSH signing key registered with your GitHub account.

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/docs/CHARACTER.md

@@ -38,12 +38,22 @@ seeding the second step with the first:
 
 1. **Face (slot 0).** gflow submits your `--face-prompt` and Flow generates the **face** image. This becomes
    the character's first reference image.
-2. **Body (slot 1).** gflow clicks the editor's slot-add ("+") button, which **auto-attaches the just-generated
-   face image as the reference seed** for the new slot. gflow then submits its **own self-contained
+2. **Body (slot 1).** gflow activates the editor's Create-Body mode, which **auto-attaches the just-generated
+   face image as the reference seed**. gflow then submits its **own self-contained
    front/side/back triptych prompt** (it wraps your `--body-prompt` body/outfit description). Because the face
    is attached as the seed, a **single credited generation** produces all three body angles — front, side, and
    back — that match the face.
 
+   The character editor is a **two-mode surface** ("Portrait" / "Create Body"). Current Flow reuses one Slate
+   editor across both modes, so gflow anchors Create Body by the locale-independent `accessibility_new` icon
+   beside the portrait-image button and requires a new generated-face reference chip to mount before using the
+   shared box. Older cohorts that mount a second prompt box remain supported through a Slate-count-rise gate. In
+   both cases gflow verifies the selected
+   body box still owns focus **before clearing or typing**. If the structural mode signal or focus check fails,
+   the body step aborts before any autosaved prompt edit; post-type isolation failures abort before the credited
+   submit. This guards the race that corrupted a stored portrait prompt live on 2026-07-25/0.43.0. Re-run
+   `gflow character create` to retry; the saga reuses the entity and completed face slot (§4).
+
 The result: two generations (face + body-triptych), the body kept on-model by the face seed. Everything else —
 naming the character, setting the voice/personality, and saving — is free metadata (REST), not generation. See
 §4 for the full saga and §6.2 for the wire payload.
@@ -269,7 +279,7 @@ is **shipped** (see the table below).
 
 | Command | Maps to |
 |---|---|
-| `gflow character create --project <id> --name <name> --face-prompt … [--body-prompt …] [--voice <Name>] [--personality …] [--model nano2\|nanopro] [--profile …] [--locale en-US] [--json]` *(SHIPPED v0.12.0 — shipped option names; characters have NO aspect-ratio control)* | createEntity → gen face (slot 0) → commit_workflow → optional gen body (slot 1) → commit_workflow → patch_entity, via the persist-before-spend saga (§4). `--body-prompt` is a **body/outfit DESCRIPTION** — gflow wraps it in a self-contained **front/side/back triptych** instruction and seeds it with the generated face (auto-attached as the slot-add reference), so one body generation yields all three angles. Generated images are **downloaded** to storage; the result reports each slot's local path. |
+| `gflow character create --project <id> --name <name> --face-prompt … [--body-prompt …] [--voice <Name>] [--personality …] [--model nano2\|nanopro] [--profile …] [--locale en-US] [--json]` *(SHIPPED v0.12.0 — shipped option names; characters have NO aspect-ratio control)* | createEntity → gen face (slot 0) → commit_workflow → optional gen body (slot 1) → commit_workflow → patch_entity, via the persist-before-spend saga (§4). `--body-prompt` is a **body/outfit DESCRIPTION** — gflow wraps it in a self-contained **front/side/back triptych** instruction and seeds it with the generated face (auto-attached as the body-mode reference), so one body generation yields all three angles. Generated images are **downloaded** to storage; the result reports each slot's local path. |
 | `gflow character list --project <id> [--json]` *(SHIPPED v0.12.0)* | projectInitialData → entities[CHARACTER] |
 | `gflow character show --project <id> (--id <entityId> \| --name <displayName>) [--json]` *(SHIPPED v0.12.0)* | projectInitialData (single); name collision → exit 11 with disambiguation hint |
 | `gflow character voices [--json]` *(SHIPPED v0.12.0)* | list the 29 preset voices (name / description / sample-url); language-agnostic discovery, mirrors `gflow models --json` |
@@ -403,7 +413,7 @@ Built by `routes.character_editor_url(locale, projectId, entityId)`. The **`/fx/
 without it Flow 404s (caught by spike T-A; the fix sourced the URL from `LABS_FX_BASE`). Navigating to this
 URL (not the new-project flow) is what makes Flow's JS set `entityContext` on the generation. Name / voice /
 personality are REST `PATCH flow/entities`. The only *new* generation selectors are the prompt/submit (already
-owned by gflow) and the slot-add.
+owned by gflow) and the body-mode activation/settle signals.
 
 | Purpose | Selector | Conf. |
 |---|---|---|
@@ -413,7 +423,7 @@ owned by gflow) and the slot-add.
 | Name field | `input[placeholder]` — localized placeholder; **do NOT rely on the text** (structural: it is the editor's lone placeholdered input) | **VERIFIED** |
 | Personality field | the panel `textarea` (localized placeholder) — **prefer REST PATCH** | **VERIFIED** |
 | Slot 0 image (face) | aria-label `"Imagem do personagem 1"` — **localized**, note only (do not load-bear on the text) | med (localized) |
-| **Slot-add (body / slot 1)** | `add_2` google-symbols ligature; the editor has **TWO** `add_2` buttons → slot-add is **`.nth(1)`** (`_CHARACTER_SLOT_ADD_SELECTOR = "button:has(i.google-symbols:text('add_2'))"`). The **first** `add_2` is the gallery "+ New project" CTA → positional disambiguation. ⚠️ confirm `.nth(1)` in the live body-gen e2e (Task 12). | **VERIFIED** (selector) / ⚠️ ordering |
+| **Body mode (slot 1)** | Current cohort: portrait-image sibling `button:has(img) + button:has(i.google-symbols:text-is('accessibility_new'))`; settle signal: a newly mounted generated-media card with an `img` and exact `cancel` icon. Legacy cohort fallback: icon-only `[role=button]` carrying exact `add_2`, followed by Slate-box count rise. No localized button text or positional index. | **VERIFIED** live 2026-07-26 |
 | Model picker (char editor) | `button[aria-haspopup='menu']:has(i.google-symbols:text-is('arrow_drop_down'))` *(normal editor uses `crop_16_9`)* | **VERIFIED** |
 | Voice picker | `voice_selection` google-symbols ligature | **VERIFIED** (ligature) |
 | Personagens nav (project) | `button:has(i.google-symbols:text-is('accessibility_new'))` (cards are `div[role=button]`; tag disambiguates) | high |
@@ -421,10 +431,10 @@ owned by gflow) and the slot-add.
 | Picker tab → Personagens | `[role=dialog] button[role=tab]:has(i.google-symbols:text-is('accessibility_new'))` | high |
 | **Picker "include in command"** | primary `button` in the dialog footer — **no ligature → structural anchor (last/primary dialog button)**; only appears *after* an option is selected | low ⚠️ |
 
-⚠️ **Documented risk (Task-12 e2e):** the slot-add `.nth(1)` ordering and the picker include button (no
-ligature, localized text only) are positional/structural anchors that must be confirmed under a live non-EN
-locale. Slot 0's `"Imagem do personagem N"` aria-label is **localized** — used as a note, never as a
-load-bearing selector.
+⚠️ **Documented risk (Task-12 e2e):** the picker include button (no ligature, localized text only) remains a
+positional/structural anchor to confirm under a live non-EN locale. Body mode no longer uses the stale
+`.nth(1)` selector; its mode and settle icons are locale-independent. Slot 0's `"Imagem do personagem N"`
+aria-label is **localized** — used as a note, never as a load-bearing selector.
 
 Shared chrome already automated by gflow (reuse as-is): `add_2` (+/Criar add-media → opens picker),
 `arrow_forward` (submit), the Slate prompt box, model dropdown, `check`/Concluir.
@@ -472,7 +482,7 @@ table → test mapping):
 
 **Remaining LIVE-e2e-only (Task 12):** the live binding/recovery/UTF-8 e2e on denon82 — real
 `parentEntityId == entityId` against Flow's wire, mid-saga crash recovery against the real DB, and the
-slot-add `.nth(1)` + picker-include structural selectors under a non-EN locale.
+body-mode icon/reference settle signals + picker-include structural selectors under a non-EN locale.
 
 ## 13.1 Known issues
 

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/docs/DATA_LAYER.md

@@ -161,10 +161,12 @@ async worker (which mirrors its `generation_queue.error_json` failure into
   data-layer fault can never mask the generation error or change the exit code.
 - The character-create saga deliberately keeps its STARTED rows for resume —
   it is excluded from the failure funnel by design.
-- `failed` rows accumulate without an automatic cap in this release: `gflow
-  data prune` targets stale in-flight/completed entries, not failed-operation
-  history. Bounded retention and a dedicated export are tracked in
-  [#345](https://github.com/ffroliva/gflow-cli/issues/345).
+- `failed` rows have **no automatic cap** by design — there is no background
+  pruning. Use `gflow data errors prune --older-than <age>` for explicit
+  retention and `gflow data errors export` to archive history first (see
+  [`data errors`](#gflow-data-errors--bounded-retention--export-345) below,
+  [#345](https://github.com/ffroliva/gflow-cli/issues/345)). Note `gflow data
+  prune` is unrelated: it targets stale `local_files`, not failure history.
 
 ---
 
@@ -300,6 +302,39 @@ gflow data prune
 Only **local files** (where `storage_provider` is NULL) are scanned; cloud-stored
 assets are ignored to prevent accidental pruning of remote objects.
 
+### `gflow data errors` — bounded retention + export (#345)
+
+Maintain the failed-operation history (the `data list errors` funnel). Two
+subcommands, both explicit operator actions — there is **no automatic/background
+pruning**.
+
+```bash
+# Archive every failure as JSONL (unbounded; newest-first) before deleting
+gflow data errors export -o failures.jsonl
+
+# Archive only the slice you are about to prune
+gflow data errors export --older-than 90d -o old-failures.jsonl
+
+# Preview what a retention prune would delete (no changes)
+gflow data errors prune --older-than 90d --dry-run
+
+# Delete failures older than 90 days
+gflow data errors prune --older-than 90d
+```
+
+- `--older-than` takes an age like `90d` / `24h` / `30m` (`d` days, `h` hours,
+  `m` minutes; positive integers only). It is **required** on `prune` so
+  deletion is always a deliberate age choice; on `export` it is optional
+  (default: all failures).
+- `--profile NAME` scopes either command to one profile.
+- `export` writes JSONL to `-o/--output FILE`, or to stdout when omitted —
+  reusing the same serialization as `data list errors --json`.
+- Deletion errors map to **exit 16** (`DataStoreError`), consistent with the
+  rest of `gflow data`.
+
+Archive first if you need the failure history for offline WAF-cadence /
+reliability analysis — pruning is irreversible.
+
 ### `gflow data media <media_id>` — read a single asset
 
 ```
@@ -507,7 +542,7 @@ Live tests (`@pytest.mark.live`) and E2E tests (`@pytest.mark.e2e`) are opt-in a
 - **`gflow data ls` / `gflow data show <operation_id>`** — richer browsing without leaving the terminal.
 - **Cost tracking** — once enough operation metadata is reliable, surface "credits spent this month" per profile / model / aspect.
 - **Postgres / Supabase adapter** — for users running gflow on shared workers or wanting cross-machine sync. The repository surface is already designed for this swap.
-- **`gflow data export`** — dump the catalog as JSON / Parquet for downstream analytics.
+- **`gflow data export`** (full catalog → JSON / Parquet) — the failed-operation slice shipped as `gflow data errors export` (JSONL, #345); a full-catalog / Parquet dump for downstream analytics is still open.
 
 These are tracked in [`PLAN.md`](../PLAN.md) under the data-layer phase backlog.
 

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/docs/INDEX.md

@@ -133,7 +133,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit** — real-editor recorder bundle 19/19 checks [structural DOM + host-category reduction + leak-scan clean on real traffic, honest `har_state`], real two-process contention → exit-11 metadata-only bundle with owner evidence and no reclaim, a real credit-free t2i proving no-incident-on-success, and the approved paid `veo-lite` T2V [S43] — HTTP-200 submission, `MEDIA_GENERATION_STATUS_SUCCESSFUL`, 2.3 MB `ftyp` mp4, catalog provenance, no incident bundle, lease re-acquirable — one lifecycle proven, availability soak explicitly NOT claimed). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)
 **"What was live-verified for the video-download feature (#29)?"** → [LIVE_VERIFICATION_video_download](LIVE_VERIFICATION_video_download.md)

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/docs/LIVE_VERIFICATION_v0.43.0.md

@@ -1,7 +1,8 @@
 # Live verification — v0.43.0 (private incident diagnostics)
 
-> Evidence for the design's §10.3 live matrix
-> (`docs/superpowers/specs/2026-07-22-private-incident-diagnostics-design.md`).
+> Evidence for the private incident diagnostics live matrix (the design spec was
+> consolidated into `docs/ARCHITECTURE.md`, `docs/SECURITY.md`, and
+> `docs/DEBUGGING.md` at the v0.43.0 release; original in git history).
 > Offline coverage (2,600+ tests incl. 43-scenario traceability) verifies
 > gflow-cli's own behavior; this document records what was proven against
 > **real Google Flow**. Harness:

gflow_cli-0.44.0/docs/LIVE_VERIFICATION_v0.44.0.md

@@ -0,0 +1,37 @@
+# Live Verification Evidence — v0.44.0
+
+> **Release:** `v0.44.0`  
+> **Date:** 2026-07-26  
+> **Primary Features Verified:** Dual-side project naming & management (`gflow project`), prompt slugging, HTTP 429 adaptive backoff / rate-limit recovery, and Playwright Chromium live transport integration.
+
+---
+
+## 1. Executive Summary & Verification Matrix
+
+| Feature / System | Scope | Execution Target | Evidence Ledger | Verdict |
+|---|---|---|---|---|
+| **Dual-Side Project Naming (#381)** | Project creation with `--project-name` & title rename propagation | Live Playwright Chromium + Google Flow tRPC API (`project.createProject` & `project.renameProject`) | `tests/e2e/test_project_naming_e2e.py::test_project_creation_and_rename_live_browser_e2e` (11.97s) | **GREEN** |
+| **Prompt Slugging (#381)** | Auto-deriving 40-char prompt slugs for scratch projects | Pure helper function `slugify_project_name` | `tests/cli/test_helpers.py` & `test_slugify_project_name_e2e` | **GREEN** |
+| **`gflow project` Subcommands (#381)** | `list`, `show`, `rename`, `create` subcommands | Click CLI runner & SQLite catalog repository | `tests/test_cli_project.py` (11/11 unit tests) | **GREEN** |
+| **HTTP 429 Rate Limit Recovery (#384)** | Adaptive backoff and `RateLimitError` handling | `FlowApiClient` transport error handler | Unit suite & `test_ui_automation.py` | **GREEN** |
+| **Codex Plugin Skills** | Repo-local `$gflow:*` skills | `.codex-plugin/plugin.json` | Manifest validation & CLI gates | **GREEN** |
+
+---
+
+## 2. Live Playwright Chromium Execution Transcript & Invariants
+
+```text
+tests/e2e/test_project_naming_e2e.py::test_slugify_project_name_e2e PASSED             [ 25%]
+tests/e2e/test_project_naming_e2e.py::test_project_creation_and_rename_dual_side_e2e PASSED [ 50%]
+tests/e2e/test_project_naming_e2e.py::test_project_cli_subcommands_e2e PASSED        [ 75%]
+tests/e2e/test_project_naming_e2e.py::test_project_creation_and_rename_live_browser_e2e PASSED [100%]
+
+============================= 4 passed in 11.97s ==============================
+```
+
+### 5-Layer Verification Ledger
+1. **File Count:** 4 files created/updated (`src/gflow_cli/cli_project.py`, `tests/test_cli_project.py`, `tests/e2e/test_project_naming_e2e.py`, `PLAN.md`).
+2. **Wire Protocol Invariant:** Live tRPC routes `https://labs.google/fx/api/trpc/project.createProject` and `project.renameProject` executed via Playwright Chromium page session.
+3. **Database Provenance:** SQLite catalog `projects` table updated in lockstep with `title` column and `repo.get_project()` read-back matching server state.
+4. **CLI Table / JSON Schema Parity:** `gflow project list` and `gflow project show` verified across Rich table rendering and machine-readable JSON envelopes.
+5. **Quality Gates:** 100% green across `check_repo_hygiene.py`, `check_doc_links.py`, `check_website_docs_pii.py`, `ruff check`, `ruff format`, `pyright src`, and test suite.

{gflow_cli-0.43.0 → gflow_cli-0.44.0}/docs/PROJECT_STATUS.md

@@ -4,9 +4,9 @@
 
 ## Current release
 
-**v0.43.0 — alpha.** **Private incident diagnostics (#369/#370/#174/#183).** Relevant operational failures — Flow app crashes, agentic-cohort / UI-mode errors, selector drift, transport timeouts, WAF/network/wire-format errors, profile-lock contention, unexpected exceptions — now automatically write a bounded, **private** incident bundle under `<GFLOW_CLI_HOME>/incidents/` (`GFLOW_CLI_INCIDENT_CAPTURE`, default **on**): an allowlisted `manifest.json`, structural `ui.json`, `network.json` / `browser.json` ring journals (host categories / canonical routes / status codes / lengths only — never prompts, tokens, cookies, bodies, or signed URLs), and a `sensitive/screenshot.png` for UI-state failures. Nothing is ever uploaded — remote MCP / HTTP / worker error envelopes carry only an opaque `{id, capture_status}` while the local CLI prints the bundle path; retention is bounded (50 bundles / 250 MiB) and validates ownership before pruning. Also: profile-lock owner evidence (offset-1 versioned lease metadata — PID + observed start time, per-command HMAC identities, no reclaim/kill), retryable-parity for `FlowAppError` / `FlowAgentUiError` across CLI-JSON / MCP / worker via one shared `errors.is_retryable()`, clean-fail on Flow's media-library / agentic cohort (`FlowAgentUiError`) and web-app crashes (`FlowAppError` exit 31), an experimental-transport self-lockout guard, and a `website/docs/` PII-leak CI gate. 2689 tests pass; live-verified against real Flow (real-editor recorder bundle 19/19 checks, real two-process contention → owner-evidence bundle, and an approved paid `veo-lite` T2V, all credit-accounted). See [LIVE_VERIFICATION_v0.43.0.md](LIVE_VERIFICATION_v0.43.0.md).
+**v0.44.0 — alpha.** **Dual-side project naming & management (#381).** Feature set includes `gflow project` subcommand family (`list`, `show`, `rename`, `create`), `--project-name` / `--project-title` options across `gflow image` (`t2i`, `i2i`) and `gflow video` (`t2v`, `i2v`, `r2v`) generation commands, prompt slugging for scratch projects, dual-side title sync updating Google Flow's tRPC server/UI and local SQLite catalog in lockstep, HTTP 429 adaptive backoff / `RateLimitError` recovery (#384), character body prompt composer fixes (#378), and a repo-local Codex plugin (`$gflow:*` skills). Verified via full test suite and live Playwright Chromium E2E transport test. See [LIVE_VERIFICATION_v0.44.0.md](LIVE_VERIFICATION_v0.44.0.md).
 
-**Develop (unreleased, post-v0.43.0):** *(empty — develop is the staging branch for the next release).*
+**Develop (unreleased, post-v0.44.0):** *(empty — develop is the staging branch for the next release).*
 
 <details><summary>v0.42.0 — content-safety classification + Antigravity coding agent (#359/#360/#361)</summary>