gflow-cli 0.48.0__tar.gz → 0.49.0__tar.gz

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.49.0] — 2026-08-03
+
+### Changed
+
+- **`gflow video i2v` accepts `--model omni-flash` again — start frame only,
+  and it unlocks `--duration 10` (#125).** The 2026-05-30 wire capture that
+  justified the blanket exclusion (Flow silently dropping frame refs and
+  billing the run as text-to-video) no longer reproduces: a 2026-08-03
+  route-aborted re-capture shows Flow routing omni + start frame to
+  `batchAsyncGenerateVideoStartImage` with the frame bound, and a live x1 10s
+  generation confirmed the output starts on the supplied frame. The END frame
+  stays gated for omni-flash (`--end-frame` exits 17 pre-spend — Flow lists
+  first+last as "coming soon"), and `chain` still rejects omni-flash
+  (single-clip proof does not cover N seeded links). New credit-free recon
+  spike: `scripts/dev/spike_omni_flash_i2v_ui_recon.py`.
+
+### Fixed
+
+- **An out-of-range Playwright silently wedged every video generation; the
+  dependency is now upper-bounded and the stall fails fast.** `uv tool install
+  <path>` ignores `uv.lock` and resolves from the `pyproject.toml` ranges, and
+  the `playwright>=1.45.0` range had no upper bound — so a local/tool install
+  could pick up a Playwright this project has never tested. Observed: an
+  install that resolved **1.62.0** against a project locked to **1.59.0** made
+  every `gflow video i2v` run hang **silently** right after the frame upload
+  (last log line `ui_automation_video.frame_attached`, browser alive, no error,
+  no timeout, indefinitely); reinstalling with the locked version fixed it on
+  the first try. Playwright ships the browser driver, so an untested minor is
+  an untested product — the constraint is now `>=1.59.0,<1.60.0` (patch
+  headroom, no untested minors), pinned by `tests/test_playwright_pin.py`.
+  Independently, the prompt-submission stage now runs under a named wall-clock
+  watchdog: on expiry the run aborts **pre-submit** with
+  `TransportTimeoutError`, a `stage_stalled` event and a debug screenshot taken
+  under its own short deadline, and the error names the stage, prints the
+  installed Playwright version against the supported range, and gives the
+  pinned reinstall command. Nothing is submitted, so no credit is spent — a
+  silent multi-minute hang is indistinguishable from slowness in an overnight
+  batch, which is what made this expensive to diagnose.
+- **A missing video output-count control now refuses before submit instead of
+  silently proceeding on Flow's default of x2 — which double-billed
+  `--count 1` runs (#404).** `_set_output_count` raises `UiSelectorDriftError`
+  (exit 23, debug screenshot) on a probe miss, matching the duration probe's
+  fail-fast contract (#288), and matches count-tab labels affix-agnostically
+  per digit (`xN` current / `Nx` legacy) so the next label rename degrades to
+  a fallback selector rather than an outage.
+
 ## [0.48.0] — 2026-08-02
 
 ### Added
@@ -2598,7 +2644,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.48.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.49.0...HEAD
+[0.49.0]: https://github.com/ffroliva/gflow-cli/compare/v0.48.0...v0.49.0
 [0.48.0]: https://github.com/ffroliva/gflow-cli/compare/v0.47.0...v0.48.0
 [0.47.0]: https://github.com/ffroliva/gflow-cli/compare/v0.46.1...v0.47.0
 [0.46.1]: https://github.com/ffroliva/gflow-cli/compare/v0.46.0...v0.46.1

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/KNOWN_ISSUES.md

@@ -14,6 +14,38 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### An out-of-range Playwright silently wedges video generation
+
+- **Status:** Mitigated (v0.49.0 — upper-bounded dependency + fail-fast watchdog)
+- **Severity:** High (silent, multi-minute, indistinguishable from slowness) · **Affected:** any install that resolved a Playwright outside the tested range — most often `uv tool install <path>` from a local checkout
+
+`uv tool install <path>` **ignores `uv.lock`** and resolves from the
+`pyproject.toml` ranges, so a local/tool install could pick up a Playwright
+newer than anything this project has tested. Playwright ships the browser
+driver, so an untested minor is an untested product. Observed 2026-08-03: an
+install that resolved **1.62.0** against a project locked to **1.59.0** made
+every `gflow video i2v` run hang **silently** immediately after the frame
+upload — last log line `ui_automation_video.frame_attached`, browser alive, no
+error, no timeout, indefinitely. Reinstalling with the locked version fixed it
+on the first try.
+
+**Mitigation (two layers):**
+1. **Upper-bounded dependency.** `playwright>=1.59.0,<1.60.0` — an unpinned
+   install can no longer reach an untested minor. Raising it is a deliberate
+   act requiring a live-verified generation; offline tests and CI's
+   `resolve-drift` job (import-only) cannot see a driver-behaviour regression.
+2. **Fail-fast stage watchdog.** The prompt-submission stage runs under a named
+   wall-clock deadline. On expiry the run aborts **pre-submit** with
+   `TransportTimeoutError` (exit 8), a `stage_stalled` event, and a debug
+   screenshot — the error names the stage, prints your installed Playwright
+   version against the supported range, and gives the pinned reinstall command.
+   Nothing is submitted, so no credit is spent.
+
+**Workaround:** install from a local checkout with the lock carried explicitly —
+`uv tool install --force --with playwright==1.59.0 .` — and check what you have
+with `uv tool run --from gflow-cli python -c "import importlib.metadata as m; print(m.version('playwright'))"`.
+Installs from PyPI are unaffected.
+
 ### One-time Flow banner/modal can cover the composer on first load
 
 - **Status:** Open ([#369](https://github.com/ffroliva/gflow-cli/issues/369))
@@ -697,18 +729,21 @@ follow-up issue once samples are captured.
 - **Status:** Mitigated · **Severity:** Medium · **Affects:** `gflow video chain` (v0.12.0)
 
 Every chain link after the first is an image-to-video (I2V) generation seeded by
-the previous clip's last frame. The same silent-route defect that affects
+the previous clip's last frame. The silent-route defect historically observed on
 `gflow video i2v` ([issue #125](https://github.com/ffroliva/gflow-cli/issues/125))
-applies here: if the chosen model can't do i2v interpolation, Flow drops the
-seed frame and routes the request to the plain text-to-video endpoint
+applies here: a model/mode mismatch can make Flow drop the seed frame and route
+the request to the plain text-to-video endpoint
 (`batchAsyncGenerateVideoText`) — burning a credit for a text-only clip that
-breaks continuity, with no error from Flow.
+breaks continuity, with no error from Flow. (Observed live for omni-flash i2v
+on 2026-05-30; omni-flash *single-clip start-frame* i2v was re-verified working
+on the wire 2026-08-03 and re-enabled for `gflow video i2v`.)
 
 **Mitigation (two layers):**
-1. **Model pin.** `omni-flash` (the only model known to silently drop frames) is
-   removed from the chain `--model` choices, and the orchestrator rejects any
-   model whose `supports_i2v_interpolation()` is false **before any spend**
-   (`ModelModeIncompatibilityError`, exit 17).
+1. **Model pin.** `omni-flash` is removed from the chain `--model` choices and
+   rejected by the orchestrator **before any spend**
+   (`ModelModeIncompatibilityError`, exit 17): its single-clip start-frame i2v
+   is wire-verified, but N seeded links back-to-back has not been verified at
+   chain scale, so chains stay on the Veo 3.1 family.
 2. **Per-link wire-route abort.** For each seeded link the transport inspects the
    captured generate-response URL; if it observes `batchAsyncGenerateVideoText`
    for an i2v link it raises `WireFormatError` (logged

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.48.0
+Version: 0.49.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -43,7 +43,7 @@ Requires-Dist: fastapi>=0.115.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: mcp<3,>=2.0.0
 Requires-Dist: platformdirs>=4.0.0
-Requires-Dist: playwright>=1.45.0
+Requires-Dist: playwright<1.60.0,>=1.59.0
 Requires-Dist: pydantic-settings>=2.5.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: sse-starlette>=2.0.0
@@ -124,6 +124,14 @@ Outputs land under `$GFLOW_CLI_OUTPUT_DIR`, or you can route them to S3, MinIO,
 
 > **Why `--browser chrome`?** Google rejects Playwright's bundled Chromium. The CLI fails fast with a friendly error (`AuthBrowserRejectedError`, exit code 14) if you pick anything else.
 
+> **Installing from a local checkout?** `uv tool install <path>` **ignores `uv.lock`** and resolves dependencies from the `pyproject.toml` ranges, so it can hand you a Playwright build this project has never tested. Playwright ships the browser driver, and an untested minor can wedge a generation silently. Carry the locked version explicitly:
+>
+> ```bash
+> uv tool install --force --with playwright==1.59.0 .
+> ```
+>
+> Installing from PyPI (`uv tool install gflow-cli`) is unaffected — the published range is upper-bounded. Check what you actually have with `uv tool run --from gflow-cli python -c "import importlib.metadata as m; print(m.version('playwright'))"`.
+
 For the full 10-minute walkthrough with troubleshooting and multi-account setup, see **[USER_GUIDE: Journey 1](docs/USER_GUIDE.md#journey-1--first-time-setup-10-minutes)**.
 
 ## Examples

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/README.md

@@ -53,6 +53,14 @@ Outputs land under `$GFLOW_CLI_OUTPUT_DIR`, or you can route them to S3, MinIO,
 
 > **Why `--browser chrome`?** Google rejects Playwright's bundled Chromium. The CLI fails fast with a friendly error (`AuthBrowserRejectedError`, exit code 14) if you pick anything else.
 
+> **Installing from a local checkout?** `uv tool install <path>` **ignores `uv.lock`** and resolves dependencies from the `pyproject.toml` ranges, so it can hand you a Playwright build this project has never tested. Playwright ships the browser driver, and an untested minor can wedge a generation silently. Carry the locked version explicitly:
+>
+> ```bash
+> uv tool install --force --with playwright==1.59.0 .
+> ```
+>
+> Installing from PyPI (`uv tool install gflow-cli`) is unaffected — the published range is upper-bounded. Check what you actually have with `uv tool run --from gflow-cli python -c "import importlib.metadata as m; print(m.version('playwright'))"`.
+
 For the full 10-minute walkthrough with troubleshooting and multi-account setup, see **[USER_GUIDE: Journey 1](docs/USER_GUIDE.md#journey-1--first-time-setup-10-minutes)**.
 
 ## Examples

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/deploy/PR-TRIAGE-AUTOPILOT-OPS.md

@@ -10,7 +10,7 @@ The autopilot orchestrator (`scripts/autopilot/pr_triage_autopilot.py`) runs as
 
 | Variable | Scope | Purpose |
 |---|---|---|
-| `ANTHROPIC_API_KEY` | Autopilot orchestrator & sandbox | Mints the Claude agent tokens to execute the council review. |
+| `CLAUDE_CODE_OAUTH_TOKEN` | Autopilot orchestrator & sandbox | Claude **subscription** token from `claude setup-token`, valid **1 year**. This deployment has no `ANTHROPIC_API_KEY`. Passed into the container as an env var. **Not** `~/.claude/.credentials.json` — `setup-token` does not write that file. |
 | `GH_COMMENT_TOKEN` | Autopilot orchestrator (host) | The comment-only GitHub PAT used to post verdicts and reviews to `ffroliva/gflow-cli` PRs. |
 | `TELEGRAM_BOT_TOKEN` | Autopilot orchestrator (host) | Bot token to dispatch alert messages. |
 | `TELEGRAM_USER_ID` | Autopilot orchestrator (host) | The chat ID to receive triage alert messages. |
@@ -51,10 +51,30 @@ Ensure `iptables` is installed on the host VPS. If `iptables` permissions are wi
 Configure a cron job checking every hour on the hour under the `hermes` system user:
 
 ```cron
-0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; export ANTHROPIC_API_KEY="xxx" && export GH_COMMENT_TOKEN="xxx" && export TELEGRAM_BOT_TOKEN="xxx" && export TELEGRAM_USER_ID="xxx" && cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory >> /var/log/hermes/pr_triage.log 2>&1
+0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory >> /var/log/hermes/pr_triage.log 2>&1
 ```
 
-Sourcing `/opt/hermes/.env` first (`set -a` exports everything it defines) is what delivers the `RESEND_API_KEY` / `HERMES_NOTIFY_EMAIL_*` vars to the process so the email channel works; without it the run still succeeds but emails are silently disabled.
+Sourcing `/opt/hermes/.env` first (`set -a` exports everything it defines) is what delivers `GH_COMMENT_TOKEN`, `TELEGRAM_*`, and the `RESEND_API_KEY` / `HERMES_NOTIFY_EMAIL_*` vars to the process. Without it the email channel silently disables itself, and without `GH_COMMENT_TOKEN` the run exits 1.
+
+> **`.env` must stay bash-sourceable.** This line sources the file, so any value containing spaces or shell metacharacters has to be quoted in the SOPS store. systemd's `EnvironmentFile` parser is more permissive than bash and will not warn you: an unquoted `HERMES_NOTIFY_EMAIL_FROM=Hermes Ops <noreply@...>` broke exactly this line on 2026-08-02 (`<` is a redirect), silently dropping every variable defined after it. Fixed in hermes-ops by quoting the value.
+
+### Claude authentication (subscription token, no API key)
+
+The council review runs `claude -p` inside the sandbox, authenticated by `CLAUDE_CODE_OAUTH_TOKEN` — the subscription token minted by `claude setup-token`, **valid 1 year**. It is stored in hermes-ops `secrets/vps-prod.env.sops.yaml`, rendered into `/opt/hermes/.env`, and reaches the process because the cron line sources that file. The orchestrator checks it is set before building the image, so a missing token fails in a second rather than as an opaque 401 minutes into a container run.
+
+> **It is not `~/.claude/.credentials.json`.** `setup-token` does not write that file — verified on the ops VPS 2026-08-02, where it still held the expired 2026-07-16 interactive-login token after a successful mint. Reading the file would authenticate with a dead credential. The two are separate mechanisms.
+
+**Rotation — the one real operational dependency.** The token is a static bearer value with **no refresh pair**: it cannot self-renew, and nothing in the API surface reports its age. The previous interactive token 401'd silently for 16 days. Rotate before the 1-year mark:
+
+```bash
+sudo -u hermes -H claude setup-token          # prints the token ONCE
+# store it in hermes-ops secrets/vps-prod.env.sops.yaml as CLAUDE_CODE_OAUTH_TOKEN
+sudo -u hermes -H bash -c 'set -a; . /opt/hermes/.env; set +a; claude -p "say OK"'   # verify
+```
+
+The daily `ev-ops-health` Telegram digest carries the expiry countdown; treat that warning as the rotation trigger.
+
+**Accepted risk (operator, 2026-08-02):** the token grants inference on the whole subscription and is injected into a container that reviews untrusted external PRs. Its scope is `user:inference` only — narrower than the five scopes an interactive login carries — and the §3 egress firewall is the compensating control. Accepted because no API key exists for this account.
 
 ### Deploy mechanism (warning)
 

{gflow_cli-0.48.0/website → gflow_cli-0.49.0}/docs/CONFIGURATION.md

@@ -411,7 +411,7 @@ each link in turn, so total wallclock is the sum of all link waits).
 
 | Flag | Default | Notes |
 |---|---|---|
-| `--model` | `veo-lite` | `veo-lite` / `veo-fast` / `veo-quality` / `veo-lite-lp`. `omni-flash` is rejected — it can't seed i2v links (issue #125). |
+| `--model` | `veo-lite` | `veo-lite` / `veo-fast` / `veo-quality` / `veo-lite-lp`. `omni-flash` is rejected — its single-clip start-frame i2v is verified, chain-scale seeding is not (issue #125). |
 | `--max-links N` | unset | Cap link count; exit 11 (`ConfigurationError`) if the manifest has more. A spend guardrail. |
 | `-y` / `--yes` | off | Skip the pending video operation confirmation prompt. |
 | `--dry-run` | off | Print the pending video operation plan and submit nothing. |

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/docs/INDEX.md

@@ -135,7 +135,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)
 **"What was live-verified for the video-download feature (#29)?"** → [LIVE_VERIFICATION_video_download](LIVE_VERIFICATION_video_download.md)

gflow_cli-0.49.0/docs/LIVE_VERIFICATION_v0.49.0.md

@@ -0,0 +1,22 @@
+# Live Verification — v0.49.0
+
+- **Scope**: Re-enable `omni-flash` start-frame I2V video generation (#125), Playwright dependency upper-bound pin (`playwright>=1.59.0,<1.60.0`), submission stage watchdog timeout (`TransportTimeoutError`), and count-tab fail-closed selector logic (#404) via PR #424 (merged 2026-08-03).
+- **Date**: 2026-08-03
+- **Credits spent**: 1 video credit (live Omni Flash I2V generation on profile `ffroliva`).
+
+## Pre-tag gates
+
+- `/gflow:check`: hygiene + doc-links + PII + mirror-drift ✅, ruff check/format ✅, pyright 0 errors ✅, full suite 2902 passed / 5 skipped ✅.
+- `/gflow:doc-review`: mechanical pass ✅.
+- SonarCloud / GitHub Actions: 13/13 CI workflow checks passed on PR #424.
+
+## Evidence ledger (what is actually proven, and by what)
+
+| Layer | Evidence | Status |
+|---|---|---|
+| **0-Credit Wire Intercept** | `capture_i2v_intercept_submit.py --model omni-flash --start-only`: intercepted submit XHR pre-network, captured `https://aisandbox-pa.googleapis.com/v1/video:batchAsyncGenerateVideoStartImage` with `startImage: "5ea393ee"`, `endImage: null`, `refs: 0` | ✅ 0-credit wire |
+| **Live E2E Costed Run** | `gflow video i2v --initial-frame tmp/test.jpg "cinematic slow motion pan" --model omni-flash --profile ffroliva --out-dir tmp/out_live`: submitted successfully, status `MEDIA_GENERATION_STATUS_SUCCESSFUL`, saved `tmp/out_live/bc742f56-536b-4cc7-a456-1b6b7f9fd7f2.mp4` (1,219,129 bytes) | ✅ live costed |
+| **Playwright Pin Safeguard** | `pyproject.toml` constrained to `playwright>=1.59.0,<1.60.0`; tested in `tests/test_playwright_pin.py::test_playwright_pinned_range_upper_bounded` | ✅ offline |
+| **Submission Stage Watchdog** | `_run_stage` watchdog aborts pre-submit on Playwright CDP stall, emits `stage_stalled`, captures screenshot, names installed Playwright version; tested in `tests/api/transports/test_ui_automation_video.py` | ✅ offline |
+| **Count Tab Fail-Closed** | `_set_output_count` raises `UiSelectorDriftError` on probe miss, matches digit affixes (`xN`/`Nx`); tested in `tests/api/transports/test_ui_automation_video.py` | ✅ offline |
+| **Release tree healthy** | Full suite 2902 passed / 5 skipped; green full-suite CI on merged PR #424 | ✅ |

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/docs/USAGE.md

@@ -489,15 +489,27 @@ All prompts in a batch share one Flow project. The editor is opened once and sta
 > current UI default), `--duration [4|6|8|10]` (10 requires `--model omni-flash`),
 > `--count INTEGER` (1–4; >1 multiplies credit cost), `--aspect [9:16|16:9]`,
 > `--profile NAME`, `--out-dir DIR` (default `tmp/`).
+> `--count` is enforced **fail-closed**: if Flow's count control cannot be
+> located (selector drift), the run refuses with exit 23 *before* submitting
+> instead of proceeding on Flow's sticky default (typically x2) and silently
+> changing what the run bills.
 > `t2v` and `i2v` (not `r2v`) additionally take `-o, --output PATH` (explicit file destination).
 > The mp4 lands at `<output_file>` or `<out-dir>/<media_id>.mp4`.
 >
-> **`i2v` is narrower (issue #125):** `omni-flash` does NOT support image-to-video
-> interpolation — Flow silently drops the start/end frames and produces a
-> text-only video — so it is **not** an accepted `--model` for `i2v`. The `i2v`
-> choices are `[veo-lite|veo-fast|veo-quality|veo-lite-lp]` and the **default is
-> `veo-lite`** (not Flow's UI default). `--duration` for `i2v` is `[4|6|8]` (10s
-> is omni-flash-only). `t2v` and `r2v` keep the full shared set above.
+> **`i2v` model rules (issue #125, re-verified 2026-08-03):** every model —
+> `omni-flash` included — supports **start-frame** i2v; the **default is
+> `veo-lite`** (not Flow's UI default). `--model omni-flash` unlocks
+> `--duration 10` for i2v. The **end frame is narrower**: `--end-frame`
+> (first+last interpolation) requires a Veo 3.1 model — Flow's official
+> support matrix lists first+last as "coming soon" for Omni Flash, and gflow
+> rejects that combination up front (exit 17).
+> History: omni-flash was excluded from i2v entirely after a 2026-05-30 wire
+> capture showed Flow silently dropping the frames and billing the run as
+> text-to-video. A 2026-08-03 route-aborted re-capture
+> (`scripts/dev/capture_i2v_intercept_submit.py --model omni-flash
+> --start-only`) proved Flow now routes omni + start frame to
+> `batchAsyncGenerateVideoStartImage` with the frame bound, and a live x1
+> 10s generation confirmed the output interpolates from the start frame.
 
 ## `gflow video t2v`
 
@@ -685,12 +697,13 @@ Options:
   --json                    Emit a machine-readable JSON result.
 ```
 
-> **`omni-flash` is rejected.** Only the Veo 3.1 family supports i2v
-> interpolation. `omni-flash` silently drops the seed frame and routes to
-> text-to-video (issue #125), which would break every seeded link, so it is not
-> an accepted `--model` for `chain`. The chain also aborts a link loudly (rather
-> than reporting a fake success) if a generation is observed routing to the
-> text-only endpoint — see [KNOWN_ISSUES](../KNOWN_ISSUES.md).
+> **`omni-flash` is rejected for chains.** Its single-clip start-frame i2v is
+> wire-verified (2026-08-03, issue #125), but a chain renders N seeded links
+> back-to-back and that has not been verified at chain scale — so `chain` stays
+> on the Veo 3.1 family pending a chain-scale verification. The chain also
+> aborts a link loudly (rather than reporting a fake success) if a generation
+> is observed routing to the text-only endpoint — see
+> [KNOWN_ISSUES](../KNOWN_ISSUES.md).
 
 ### JSONL manifest format
 
@@ -1305,7 +1318,7 @@ shell scripts can branch on the failure mode without parsing stderr.
 | `6`  | `NetworkError`        | Network failure persisted across 3 attempts      | Check connectivity                                         |
 | `7`  | `WireFormatError`     | Unexpected response shape — Flow API changed     | File a bug (do NOT include captured tokens or signed URLs) |
 | `8`  | `AuthMissingError`    | Required auth credential is absent from profile   | `gflow auth login --profile <name>`                        |
-| `9`  | `TransportTimeoutError` | Browser/API operation exceeded its timeout (incl. an i2v frame UUID not found in the media picker, #287) | Retry; raise the relevant timeout — or, for a frame-UUID miss, verify the UUID belongs to the `--project` passed |
+| `9`  | `TransportTimeoutError` | Browser/API operation exceeded its timeout (incl. an i2v frame UUID not found in the media picker, #287; or a wedged submission stage — the error names the stage and your Playwright version) | Retry; raise the relevant timeout — for a frame-UUID miss verify the UUID belongs to the `--project` passed; for a `stage_stalled` abort check your Playwright is in range (see [KNOWN_ISSUES](../KNOWN_ISSUES.md)) |
 | `10` | `WafRejectionError`   | Flow security layer rejected the request          | Change prompt/request and retry                            |
 | `11` | `ConfigurationError`  | Local configuration or browser mode is invalid — includes `ProfileLockedError` (same-profile lease contention: another `gflow`/daemon/MCP call already owns this profile) | Fix the option/env var shown in the error, or wait / use a different `--profile` for lease contention |
 | `12` | `AuthLoginTimeoutError` | Browser sign-in was not completed in time       | Re-run login or raise `GFLOW_CLI_AUTH_LOGIN_TIMEOUT`       |
@@ -1313,7 +1326,7 @@ shell scripts can branch on the failure mode without parsing stderr.
 | `14` | `AuthBrowserRejectedError` | Google rejected the login browser             | `gflow auth login --browser chrome`                        |
 | `15` | `BrowserSessionClosedError` | The automation browser window was closed mid-operation | Re-run; keep the browser window open until the command finishes |
 | `16` | `DataStoreError`      | Local database cannot be opened, a migration failed, or the DB schema is newer than the installed gflow-cli | See below                                  |
-| `17` | `ModelModeIncompatibilityError` | The chosen video model can't do the requested mode (e.g. `--model omni-flash` with an `i2v` start/end frame — issue #125) | Use `--model veo-lite` (or veo-fast / veo-quality / veo-lite-lp) for `i2v` |
+| `17` | `ModelModeIncompatibilityError` | The chosen video model can't do the requested mode (e.g. `--model omni-flash` with `--end-frame`, or `omni-flash` for `chain` — issue #125) | omni-flash does start-frame `i2v` only: drop `--end-frame`, or use a Veo 3.1 model (`veo-lite` / `veo-fast` / `veo-quality` / `veo-lite-lp`) for first+last and for `chain` |
 | `18` | `VideoModelSelectionError` | gflow could not select the requested video model in Flow's editor for an `i2v` run (model-picker option not found) | Usually transient — retry; if it persists, Flow's model-picker UI changed (report referencing #125) |
 | `19` | `SceneConcatError`    | Server-side scene render/concat failed (`gflow scene --output`) | Retry; the recorded compose survives, so re-render is safe |
 | `20` | `FrameExtractionError` | Could not extract the last frame for a video chain link | Check the source video downloaded intact; retry the link  |

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/docs/superpowers/specs/2026-06-29-issue-assessment-workflow-design.md

@@ -126,7 +126,7 @@ macOS, v0.22.0: `image t2i` launches a logged-out browser → 401 on `createProj
 
 Confirmed facts about the target runtime (`C:\development\github\hermes-ops`, deployed):
 
-- **VPS:** `89.167.1.15` (`cgserver01`), headless Hetzner Linux. SSH `deploy@89.167.1.15` (key-based). hermes-agent v0.16.0 as a systemd unit (`HERMES_HOME=/opt/hermes`); repo at `/opt/hermes-ops` (git-pull deploy: `git fetch && git reset --hard origin/main`).
+- **VPS:** the Compiled Growth ops host, headless Hetzner Linux (address and SSH user are in the private hermes-ops repo, not here — this repo is public). hermes-agent v0.16.0 as a systemd unit (`HERMES_HOME=/opt/hermes`); repo at `/opt/hermes-ops` (git-pull deploy: `git fetch && git reset --hard origin/main`).
 - **GitHub creds:** `GH_TOKEN` already provisioned in SOPS (`secrets/vps-prod.env.sops.yaml`), fine-grained PAT scoped to **gflow-cli `pull_requests:write + contents:write`**. Decrypted by `hermes.service` `ExecStartPre` to `/opt/hermes/.env` (600, owner `hermes`); `gh` reads it automatically.
 - **Knowledge (T1):** git-versioned markdown in `hermes-ops/knowledge/`; update = branch → human review → merge → VPS pulls.
 - **Triggers:** `hermes cron create "<expr>" "<prompt>" --skills … --deliver telegram` (v1); `hermes webhook subscribe --events … --skills … --deliver …` (v2, deferred).

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.48.0"
+version = "0.49.0"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -21,7 +21,21 @@ classifiers = [
 dependencies = [
     "click>=8.1.0",
     "httpx>=0.27.0",
-    "playwright>=1.45.0",
+    # Upper bound is mandatory, not cosmetic. playwright is not an ordinary
+    # library here: it ships the browser driver, and 100% of gflow's product
+    # surface is automation through it, so an untested playwright minor is an
+    # untested product. Observed 2026-08-03: an install that resolved 1.62.0
+    # (uv.lock pins 1.59.0, and `uv tool install <path>` ignores the lockfile)
+    # made every `video i2v` run hang SILENTLY right after the frame upload —
+    # browser alive, no error, no timeout; downgrading to 1.59.0 fixed it
+    # instantly. The floor is the version actually exercised by CI and the
+    # lockfile: >=1.45.0 was aspirational, nothing has ever been tested there.
+    # The range keeps 1.59.x patch headroom (so a CVE fix does not require a
+    # gflow release) while excluding untested minors; the patchright extra
+    # below pins exactly for the same reason. Raise this deliberately, after
+    # live-verifying a generation on the new minor — offline tests cannot see
+    # a driver-behaviour regression (`resolve-drift` in CI only smoke-imports).
+    "playwright>=1.59.0,<1.60.0",
     "rich>=13.7.0",
     "pydantic-settings>=2.5.0",
     "platformdirs>=4.0.0",

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/scripts/autopilot/Dockerfile.triage

@@ -21,8 +21,13 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | d
 # Install Claude Code CLI globally
 RUN npm install -g @anthropic-ai/claude-code
 
-# Create non-root user and set permissions
-RUN useradd -m -u 1000 nonroot
+# Create non-root user and set permissions.
+#
+# uid 1001, not 1000: node:20-slim already ships a `node` user at uid 1000, so
+# `useradd -m -u 1000 nonroot` fails with exit 4 (UID already in use) and the
+# image never builds. Found 2026-08-02 on the first real build attempt — which
+# is itself the evidence that this sandbox had never been run.
+RUN useradd -m -u 1001 nonroot
 
 # Copy and setup the entrypoint script
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh

{gflow_cli-0.48.0 → gflow_cli-0.49.0}/scripts/autopilot/pr_triage_autopilot.py

@@ -34,6 +34,40 @@ LOCK_FILE_PATH = "/tmp/pr_triage_autopilot.lock"
 SUPPORTED_ENGINES = ("council-claude",)
 DEFAULT_ENGINE = SUPPORTED_ENGINES[0]
 
+# Claude auth is the SUBSCRIPTION token minted by `claude setup-token`, read
+# from CLAUDE_CODE_OAUTH_TOKEN. This deployment has no ANTHROPIC_API_KEY
+# (operator decision, 2026-08-02).
+#
+# NOT ~/.claude/.credentials.json: `setup-token` does not write that file.
+# Verified on the ops VPS 2026-08-02 -- after a successful mint it still held the
+# expired 2026-07-16 interactive-login token. Reading the file would silently
+# authenticate with a dead credential.
+#
+# The token is a static 1-year bearer value with no refresh pair, so there is
+# nothing to validate locally beyond presence: no expiry is encoded in it. That
+# makes the rotation reminder (hermes-ops ev-ops-health digest) the only thing
+# standing between a lapse and a silent outage -- the 2026-07-16 token 401'd for
+# 16 days with nothing reporting it.
+CLAUDE_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN"
+
+
+def check_claude_auth() -> str | None:
+    """Return an error string when Claude auth is unusable, else None.
+
+    Checked on the HOST before building the image and starting a container: a
+    missing token otherwise surfaces as an opaque 401 several minutes into a
+    sandboxed run.
+    """
+    if not os.environ.get(CLAUDE_TOKEN_ENV):
+        return (
+            f"{CLAUDE_TOKEN_ENV} is not set. Mint one with "
+            "`sudo -u hermes -H claude setup-token` (valid 1 year) and store it in "
+            "hermes-ops secrets/vps-prod.env.sops.yaml. The cron line sources "
+            "/opt/hermes/.env, which is where it must appear."
+        )
+    return None
+
+
 # Verdict allowlist: container stdout is untrusted, so anything outside this
 # set is treated as unparseable (None) rather than interpolated downstream.
 VALID_VERDICTS = ("GREEN", "YELLOW", "RED")
@@ -219,9 +253,7 @@ def restore_repo_branch(repo_dir: Path) -> None:
     subprocess.run(["git", "checkout", "develop"], cwd=repo_dir, capture_output=True, check=True)
 
 
-def run_docker_sandbox(
-    pr_num: int, repo_dir: Path, memory_dir: Path, anthropic_key: str, gh_token: str
-) -> str:
+def run_docker_sandbox(pr_num: int, repo_dir: Path, memory_dir: Path, gh_token: str) -> str:
     """Invoke the run_sandboxed_review.sh wrapper script and capture its stdout."""
     script_path = repo_dir / "scripts" / "autopilot" / "run_sandboxed_review.sh"
 
@@ -236,8 +268,6 @@ def run_docker_sandbox(
         str(memory_dir),
         "--token",
         gh_token,
-        "--key",
-        anthropic_key,
     ]
 
     logger.info("Running sandboxed Docker review", pr=pr_num)
@@ -282,12 +312,11 @@ def run_review(
     pr_num: int,
     repo_dir: Path,
     memory_dir: Path,
-    anthropic_key: str,
     gh_token: str,
 ) -> str:
     """Run the configured review engine and return its stdout."""
     if engine == "council-claude":
-        return run_docker_sandbox(pr_num, repo_dir, memory_dir, anthropic_key, gh_token)
+        return run_docker_sandbox(pr_num, repo_dir, memory_dir, gh_token)
     raise NotImplementedError(f"engine {engine!r} is reserved but not implemented")
 
 
@@ -296,7 +325,6 @@ def run_triage_cycle(
     repo_dir: Path,
     memory_dir: Path,
     ledger_path: Path,
-    anthropic_key: str,
     gh_token: str,
     engine: str = DEFAULT_ENGINE,
 ) -> None:
@@ -439,7 +467,7 @@ def run_triage_cycle(
                 continue
 
             # Run Stage 1 Pre-eval & Full sandboxed review
-            output = run_review(engine, pr_num, repo_dir, memory_dir, anthropic_key, gh_token)
+            output = run_review(engine, pr_num, repo_dir, memory_dir, gh_token)
 
             # Parse verdict & MUST-FIX count
             parsed_verdict, must_fixes = parse_summary_verdict(output)
@@ -539,11 +567,14 @@ def main(argv: list[str] | None = None) -> int:
     args = ap.parse_args(argv)
 
     # Validate required credentials
-    anthropic_key = os.environ.get("ANTHROPIC_API_KEY")
     gh_token = os.environ.get("GH_COMMENT_TOKEN") or os.environ.get("GITHUB_TOKEN")
+    if not gh_token:
+        logger.error("Missing credentials. Requires GH_COMMENT_TOKEN.")
+        return 1
 
-    if not anthropic_key or not gh_token:
-        logger.error("Missing credentials. Requires ANTHROPIC_API_KEY and GH_COMMENT_TOKEN.")
+    auth_error = check_claude_auth()
+    if auth_error:
+        logger.error("Claude authentication unusable", reason=auth_error)
         return 1
 
     engine = resolve_engine()
@@ -561,9 +592,7 @@ def main(argv: list[str] | None = None) -> int:
         return 0
 
     logger.info("PR-Triage Autopilot iteration started", repo=args.repo, engine=engine)
-    run_triage_cycle(
-        args.repo, repo_dir, memory_dir, ledger_path, anthropic_key, gh_token, engine=engine
-    )
+    run_triage_cycle(args.repo, repo_dir, memory_dir, ledger_path, gh_token, engine=engine)
     logger.info("PR-Triage Autopilot iteration completed")
     return 0