gflow-cli 0.48.0__tar.gz → 0.50.0__tar.gz

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/AGENTS.md

@@ -98,6 +98,23 @@ All AI agents and harnesses working on `gflow-cli` follow this standard 10-phase
 | 9. PR & Issue Close | `/gflow:issue-resolve <N>` | PR, SonarCloud 0-issue gate, merge to develop | Closed GitHub issue |
 | 10. Release Pipeline | `/gflow:release` | Version bump, signed tag (`git tag -s`), PyPI publish | Shipped release & back-merge |
 
+### Pipeline Continuation Mandate
+
+Every AI agent executing any phase of this pipeline MUST proactively state the completed phase result and explicitly recommend/announce the exact next sequential phase to the user. Never stop passively after a phase completes without identifying the next step.
+
+| Current Phase | Completed Artifact / Gate | Next Sequential Phase & Command |
+|---|---|---|
+| Phase 1: Triage | `issue_assessment_<N>.md` | ➔ Phase 2: Pre-Implementation (`/gflow:predict <proposal>`) |
+| Phase 2: Pre-Implementation | Verdict `GO` or `CAUTION` | ➔ Phase 3: BDD Scaffolding (`/gflow:scenario <feature>`) |
+| Phase 3: BDD Scaffolding | `Scenario:` blocks & test scaffold | ➔ Phase 4: Implementation Plan (`/gflow:plan <feature>`) |
+| Phase 4: Implementation Plan | `PLAN.md` created & approved | ➔ Phase 6: Task Execution (`/gflow:status`) |
+| Phase 6: Task Execution | All plan tasks checked | ➔ Phase 7: Pre-Commit Quality (`/gflow:check`) |
+| Phase 7: Pre-Commit Quality | All 7 quality gates green | ➔ Phase 5: Council Review (`/gflow:branch-review` or `/gflow:pr-council-review`) |
+| Phase 5: Council Review | Consensus 🟢 GREEN | ➔ Phase 8: Live Verification (`/gflow:live-verify`) or Phase 9 (`/gflow:issue-resolve <N>`) |
+| Phase 8: Live Verification | `LIVE_VERIFICATION_vX.Y.Z.md` | ➔ Phase 9: Issue Resolve & PR (`/gflow:issue-resolve <N>`) |
+| Phase 9: Issue Resolve & PR | PR open & SonarCloud 0-issue gate green | ➔ Phase 10: Release Pipeline (`/gflow:release`) |
+| Phase 10: Release Pipeline | Signed tag & PyPI published | ➔ Done (Release shipped & back-merged) |
+
 ## Skills reference (cross-tool)
 
 The `skills/` directory ships installable agent skill docs in plain Markdown with YAML frontmatter. Any agent can consume them directly:

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/CHANGELOG.md

@@ -7,6 +7,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.50.0] — 2026-08-04
+
+### Added
+
+- **Adopted MCP 2026-07-28 Tasks extension (SEP-2663) (#409).** Added `TasksExtension` subclass serving `tasks/get` and `tasks/cancel`. Generation tools (`gflow_generate_image`, `gflow_generate_video`) support non-blocking task handle responses (`wait=False`).
+- **Hardened CLI and MCP `-o`/`--output` path routing (#414, #415).** Custom output paths land generated assets at target locations with automatic parent directory creation, S3 cloud storage relative path preservation, and multi-count stem suffixes (`_1`, `_2`).
+
+### Fixed
+
+- **PR triage notification resilience (#428).** Fallback alerts via Telegram on missing credentials or auth failure.
+
+### Changed
+
+- **`gflow video i2v` accepts `--model omni-flash` again — start frame only,
+  and it unlocks `--duration 10` (#125).** The 2026-05-30 wire capture that
+  justified the blanket exclusion (Flow silently dropping frame refs and
+  billing the run as text-to-video) no longer reproduces: a 2026-08-03
+  route-aborted re-capture shows Flow routing omni + start frame to
+  `batchAsyncGenerateVideoStartImage` with the frame bound, and a live x1 10s
+  generation confirmed the output starts on the supplied frame. The END frame
+  stays gated for omni-flash (`--end-frame` exits 17 pre-spend — Flow lists
+  first+last as "coming soon"), and `chain` still rejects omni-flash
+  (single-clip proof does not cover N seeded links). New credit-free recon
+  spike: `scripts/dev/spike_omni_flash_i2v_ui_recon.py`.
+
+### Fixed
+
+- **An out-of-range Playwright silently wedged every video generation; the
+  dependency is now upper-bounded and the stall fails fast.** `uv tool install
+  <path>` ignores `uv.lock` and resolves from the `pyproject.toml` ranges, and
+  the `playwright>=1.45.0` range had no upper bound — so a local/tool install
+  could pick up a Playwright this project has never tested. Observed: an
+  install that resolved **1.62.0** against a project locked to **1.59.0** made
+  every `gflow video i2v` run hang **silently** right after the frame upload
+  (last log line `ui_automation_video.frame_attached`, browser alive, no error,
+  no timeout, indefinitely); reinstalling with the locked version fixed it on
+  the first try. Playwright ships the browser driver, so an untested minor is
+  an untested product — the constraint is now `>=1.59.0,<1.60.0` (patch
+  headroom, no untested minors), pinned by `tests/test_playwright_pin.py`.
+  Independently, the prompt-submission stage now runs under a named wall-clock
+  watchdog: on expiry the run aborts **pre-submit** with
+  `TransportTimeoutError`, a `stage_stalled` event and a debug screenshot taken
+  under its own short deadline, and the error names the stage, prints the
+  installed Playwright version against the supported range, and gives the
+  pinned reinstall command. Nothing is submitted, so no credit is spent — a
+  silent multi-minute hang is indistinguishable from slowness in an overnight
+  batch, which is what made this expensive to diagnose.
+- **A missing video output-count control now refuses before submit instead of
+  silently proceeding on Flow's default of x2 — which double-billed
+  `--count 1` runs (#404).** `_set_output_count` raises `UiSelectorDriftError`
+  (exit 23, debug screenshot) on a probe miss, matching the duration probe's
+  fail-fast contract (#288), and matches count-tab labels affix-agnostically
+  per digit (`xN` current / `Nx` legacy) so the next label rename degrades to
+  a fallback selector rather than an outage.
+
 ## [0.48.0] — 2026-08-02
 
 ### Added
@@ -2598,7 +2653,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.48.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.50.0...HEAD
+[0.50.0]: https://github.com/ffroliva/gflow-cli/compare/v0.49.0...v0.50.0
+[0.49.0]: https://github.com/ffroliva/gflow-cli/compare/v0.48.0...v0.49.0
 [0.48.0]: https://github.com/ffroliva/gflow-cli/compare/v0.47.0...v0.48.0
 [0.47.0]: https://github.com/ffroliva/gflow-cli/compare/v0.46.1...v0.47.0
 [0.46.1]: https://github.com/ffroliva/gflow-cli/compare/v0.46.0...v0.46.1

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/KNOWN_ISSUES.md

@@ -14,6 +14,38 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### An out-of-range Playwright silently wedges video generation
+
+- **Status:** Mitigated (v0.49.0 — upper-bounded dependency + fail-fast watchdog)
+- **Severity:** High (silent, multi-minute, indistinguishable from slowness) · **Affected:** any install that resolved a Playwright outside the tested range — most often `uv tool install <path>` from a local checkout
+
+`uv tool install <path>` **ignores `uv.lock`** and resolves from the
+`pyproject.toml` ranges, so a local/tool install could pick up a Playwright
+newer than anything this project has tested. Playwright ships the browser
+driver, so an untested minor is an untested product. Observed 2026-08-03: an
+install that resolved **1.62.0** against a project locked to **1.59.0** made
+every `gflow video i2v` run hang **silently** immediately after the frame
+upload — last log line `ui_automation_video.frame_attached`, browser alive, no
+error, no timeout, indefinitely. Reinstalling with the locked version fixed it
+on the first try.
+
+**Mitigation (two layers):**
+1. **Upper-bounded dependency.** `playwright>=1.59.0,<1.60.0` — an unpinned
+   install can no longer reach an untested minor. Raising it is a deliberate
+   act requiring a live-verified generation; offline tests and CI's
+   `resolve-drift` job (import-only) cannot see a driver-behaviour regression.
+2. **Fail-fast stage watchdog.** The prompt-submission stage runs under a named
+   wall-clock deadline. On expiry the run aborts **pre-submit** with
+   `TransportTimeoutError` (exit 8), a `stage_stalled` event, and a debug
+   screenshot — the error names the stage, prints your installed Playwright
+   version against the supported range, and gives the pinned reinstall command.
+   Nothing is submitted, so no credit is spent.
+
+**Workaround:** install from a local checkout with the lock carried explicitly —
+`uv tool install --force --with playwright==1.59.0 .` — and check what you have
+with `uv tool run --from gflow-cli python -c "import importlib.metadata as m; print(m.version('playwright'))"`.
+Installs from PyPI are unaffected.
+
 ### One-time Flow banner/modal can cover the composer on first load
 
 - **Status:** Open ([#369](https://github.com/ffroliva/gflow-cli/issues/369))
@@ -697,18 +729,21 @@ follow-up issue once samples are captured.
 - **Status:** Mitigated · **Severity:** Medium · **Affects:** `gflow video chain` (v0.12.0)
 
 Every chain link after the first is an image-to-video (I2V) generation seeded by
-the previous clip's last frame. The same silent-route defect that affects
+the previous clip's last frame. The silent-route defect historically observed on
 `gflow video i2v` ([issue #125](https://github.com/ffroliva/gflow-cli/issues/125))
-applies here: if the chosen model can't do i2v interpolation, Flow drops the
-seed frame and routes the request to the plain text-to-video endpoint
+applies here: a model/mode mismatch can make Flow drop the seed frame and route
+the request to the plain text-to-video endpoint
 (`batchAsyncGenerateVideoText`) — burning a credit for a text-only clip that
-breaks continuity, with no error from Flow.
+breaks continuity, with no error from Flow. (Observed live for omni-flash i2v
+on 2026-05-30; omni-flash *single-clip start-frame* i2v was re-verified working
+on the wire 2026-08-03 and re-enabled for `gflow video i2v`.)
 
 **Mitigation (two layers):**
-1. **Model pin.** `omni-flash` (the only model known to silently drop frames) is
-   removed from the chain `--model` choices, and the orchestrator rejects any
-   model whose `supports_i2v_interpolation()` is false **before any spend**
-   (`ModelModeIncompatibilityError`, exit 17).
+1. **Model pin.** `omni-flash` is removed from the chain `--model` choices and
+   rejected by the orchestrator **before any spend**
+   (`ModelModeIncompatibilityError`, exit 17): its single-clip start-frame i2v
+   is wire-verified, but N seeded links back-to-back has not been verified at
+   chain scale, so chains stay on the Veo 3.1 family.
 2. **Per-link wire-route abort.** For each seeded link the transport inspects the
    captured generate-response URL; if it observes `batchAsyncGenerateVideoText`
    for an i2v link it raises `WireFormatError` (logged

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gflow-cli
-Version: 0.48.0
+Version: 0.50.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -43,7 +43,7 @@ Requires-Dist: fastapi>=0.115.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: mcp<3,>=2.0.0
 Requires-Dist: platformdirs>=4.0.0
-Requires-Dist: playwright>=1.45.0
+Requires-Dist: playwright<1.60.0,>=1.59.0
 Requires-Dist: pydantic-settings>=2.5.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: sse-starlette>=2.0.0
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.0; extra == 'dev'
+Requires-Dist: ruff==0.16.1; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'
@@ -124,6 +124,14 @@ Outputs land under `$GFLOW_CLI_OUTPUT_DIR`, or you can route them to S3, MinIO,
 
 > **Why `--browser chrome`?** Google rejects Playwright's bundled Chromium. The CLI fails fast with a friendly error (`AuthBrowserRejectedError`, exit code 14) if you pick anything else.
 
+> **Installing from a local checkout?** `uv tool install <path>` **ignores `uv.lock`** and resolves dependencies from the `pyproject.toml` ranges, so it can hand you a Playwright build this project has never tested. Playwright ships the browser driver, and an untested minor can wedge a generation silently. Carry the locked version explicitly:
+>
+> ```bash
+> uv tool install --force --with playwright==1.59.0 .
+> ```
+>
+> Installing from PyPI (`uv tool install gflow-cli`) is unaffected — the published range is upper-bounded. Check what you actually have with `uv tool run --from gflow-cli python -c "import importlib.metadata as m; print(m.version('playwright'))"`.
+
 For the full 10-minute walkthrough with troubleshooting and multi-account setup, see **[USER_GUIDE: Journey 1](docs/USER_GUIDE.md#journey-1--first-time-setup-10-minutes)**.
 
 ## Examples

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/README.md

@@ -53,6 +53,14 @@ Outputs land under `$GFLOW_CLI_OUTPUT_DIR`, or you can route them to S3, MinIO,
 
 > **Why `--browser chrome`?** Google rejects Playwright's bundled Chromium. The CLI fails fast with a friendly error (`AuthBrowserRejectedError`, exit code 14) if you pick anything else.
 
+> **Installing from a local checkout?** `uv tool install <path>` **ignores `uv.lock`** and resolves dependencies from the `pyproject.toml` ranges, so it can hand you a Playwright build this project has never tested. Playwright ships the browser driver, and an untested minor can wedge a generation silently. Carry the locked version explicitly:
+>
+> ```bash
+> uv tool install --force --with playwright==1.59.0 .
+> ```
+>
+> Installing from PyPI (`uv tool install gflow-cli`) is unaffected — the published range is upper-bounded. Check what you actually have with `uv tool run --from gflow-cli python -c "import importlib.metadata as m; print(m.version('playwright'))"`.
+
 For the full 10-minute walkthrough with troubleshooting and multi-account setup, see **[USER_GUIDE: Journey 1](docs/USER_GUIDE.md#journey-1--first-time-setup-10-minutes)**.
 
 ## Examples

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/deploy/PR-TRIAGE-AUTOPILOT-OPS.md

@@ -10,8 +10,8 @@ The autopilot orchestrator (`scripts/autopilot/pr_triage_autopilot.py`) runs as
 
 | Variable | Scope | Purpose |
 |---|---|---|
-| `ANTHROPIC_API_KEY` | Autopilot orchestrator & sandbox | Mints the Claude agent tokens to execute the council review. |
-| `GH_COMMENT_TOKEN` | Autopilot orchestrator (host) | The comment-only GitHub PAT used to post verdicts and reviews to `ffroliva/gflow-cli` PRs. |
+| `CLAUDE_CODE_OAUTH_TOKEN` | Autopilot orchestrator & sandbox | Claude **subscription** token from `claude setup-token`, valid **1 year**. This deployment has no `ANTHROPIC_API_KEY`. Passed into the container as an env var. **Not** `~/.claude/.credentials.json` — `setup-token` does not write that file. |
+| `GH_COMMENT_TOKEN` | Autopilot orchestrator (host) | Fine-grained least-privilege GitHub PAT (scoped to `ffroliva/gflow-cli` with `pull_requests:write`) used to post verdicts and reviews to PRs. Stored encrypted in hermes-ops SOPS (`vps-prod.env.sops.yaml`) and rendered into `/opt/hermes/.env`. |
 | `TELEGRAM_BOT_TOKEN` | Autopilot orchestrator (host) | Bot token to dispatch alert messages. |
 | `TELEGRAM_USER_ID` | Autopilot orchestrator (host) | The chat ID to receive triage alert messages. |
 | `PR_TRIAGE_ENGINE` | Autopilot orchestrator (host), optional | Review engine selector. Default `council-claude`; any other value exits at startup (`council-multi-cli` is reserved backlog). |
@@ -51,10 +51,30 @@ Ensure `iptables` is installed on the host VPS. If `iptables` permissions are wi
 Configure a cron job checking every hour on the hour under the `hermes` system user:
 
 ```cron
-0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; export ANTHROPIC_API_KEY="xxx" && export GH_COMMENT_TOKEN="xxx" && export TELEGRAM_BOT_TOKEN="xxx" && export TELEGRAM_USER_ID="xxx" && cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory >> /var/log/hermes/pr_triage.log 2>&1
+0 * * * * set -a; . /opt/hermes/.env 2>/dev/null; set +a; cd /opt/gflow-cli && uv run python scripts/autopilot/pr_triage_autopilot.py --repo-dir /opt/gflow-cli --memory-dir /opt/experience-vault/projects/C--development-github-gflow-cli/memory >> /var/log/hermes/pr_triage.log 2>&1
 ```
 
-Sourcing `/opt/hermes/.env` first (`set -a` exports everything it defines) is what delivers the `RESEND_API_KEY` / `HERMES_NOTIFY_EMAIL_*` vars to the process so the email channel works; without it the run still succeeds but emails are silently disabled.
+Sourcing `/opt/hermes/.env` first (`set -a` exports everything it defines) is what delivers `GH_COMMENT_TOKEN`, `TELEGRAM_*`, and the `RESEND_API_KEY` / `HERMES_NOTIFY_EMAIL_*` vars to the process. Without it the email channel silently disables itself, and without `GH_COMMENT_TOKEN` the run exits 1.
+
+> **`.env` must stay bash-sourceable.** This line sources the file, so any value containing spaces or shell metacharacters has to be quoted in the SOPS store. systemd's `EnvironmentFile` parser is more permissive than bash and will not warn you: an unquoted `HERMES_NOTIFY_EMAIL_FROM=Hermes Ops <noreply@...>` broke exactly this line on 2026-08-02 (`<` is a redirect), silently dropping every variable defined after it. Fixed in hermes-ops by quoting the value.
+
+### Claude authentication (subscription token, no API key)
+
+The council review runs `claude -p` inside the sandbox, authenticated by `CLAUDE_CODE_OAUTH_TOKEN` — the subscription token minted by `claude setup-token`, **valid 1 year**. It is stored in hermes-ops `secrets/vps-prod.env.sops.yaml`, rendered into `/opt/hermes/.env`, and reaches the process because the cron line sources that file. The orchestrator checks it is set before building the image, so a missing token fails in a second rather than as an opaque 401 minutes into a container run.
+
+> **It is not `~/.claude/.credentials.json`.** `setup-token` does not write that file — verified on the ops VPS 2026-08-02, where it still held the expired 2026-07-16 interactive-login token after a successful mint. Reading the file would authenticate with a dead credential. The two are separate mechanisms.
+
+**Rotation — the one real operational dependency.** The token is a static bearer value with **no refresh pair**: it cannot self-renew, and nothing in the API surface reports its age. The previous interactive token 401'd silently for 16 days. Rotate before the 1-year mark:
+
+```bash
+sudo -u hermes -H claude setup-token          # prints the token ONCE
+# store it in hermes-ops secrets/vps-prod.env.sops.yaml as CLAUDE_CODE_OAUTH_TOKEN
+sudo -u hermes -H bash -c 'set -a; . /opt/hermes/.env; set +a; claude -p "say OK"'   # verify
+```
+
+The daily `ev-ops-health` Telegram digest carries the expiry countdown; treat that warning as the rotation trigger.
+
+**Accepted risk (operator, 2026-08-02):** the token grants inference on the whole subscription and is injected into a container that reviews untrusted external PRs. Its scope is `user:inference` only — narrower than the five scopes an interactive login carries — and the §3 egress firewall is the compensating control. Accepted because no API key exists for this account.
 
 ### Deploy mechanism (warning)
 

{gflow_cli-0.48.0/website → gflow_cli-0.50.0}/docs/CONFIGURATION.md

@@ -411,7 +411,7 @@ each link in turn, so total wallclock is the sum of all link waits).
 
 | Flag | Default | Notes |
 |---|---|---|
-| `--model` | `veo-lite` | `veo-lite` / `veo-fast` / `veo-quality` / `veo-lite-lp`. `omni-flash` is rejected — it can't seed i2v links (issue #125). |
+| `--model` | `veo-lite` | `veo-lite` / `veo-fast` / `veo-quality` / `veo-lite-lp`. `omni-flash` is rejected — its single-clip start-frame i2v is verified, chain-scale seeding is not (issue #125). |
 | `--max-links N` | unset | Cap link count; exit 11 (`ConfigurationError`) if the manifest has more. A spend guardrail. |
 | `-y` / `--yes` | off | Skip the pending video operation confirmation prompt. |
 | `--dry-run` | off | Print the pending video operation plan and submit nothing. |

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/docs/INDEX.md

@@ -135,7 +135,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)
 **"What was live-verified for the video-download feature (#29)?"** → [LIVE_VERIFICATION_video_download](LIVE_VERIFICATION_video_download.md)

gflow_cli-0.50.0/docs/LIVE_VERIFICATION_v0.49.0.md

@@ -0,0 +1,22 @@
+# Live Verification — v0.49.0
+
+- **Scope**: Re-enable `omni-flash` start-frame I2V video generation (#125), Playwright dependency upper-bound pin (`playwright>=1.59.0,<1.60.0`), submission stage watchdog timeout (`TransportTimeoutError`), and count-tab fail-closed selector logic (#404) via PR #424 (merged 2026-08-03).
+- **Date**: 2026-08-03
+- **Credits spent**: 1 video credit (live Omni Flash I2V generation on profile `ffroliva`).
+
+## Pre-tag gates
+
+- `/gflow:check`: hygiene + doc-links + PII + mirror-drift ✅, ruff check/format ✅, pyright 0 errors ✅, full suite 2902 passed / 5 skipped ✅.
+- `/gflow:doc-review`: mechanical pass ✅.
+- SonarCloud / GitHub Actions: 13/13 CI workflow checks passed on PR #424.
+
+## Evidence ledger (what is actually proven, and by what)
+
+| Layer | Evidence | Status |
+|---|---|---|
+| **0-Credit Wire Intercept** | `capture_i2v_intercept_submit.py --model omni-flash --start-only`: intercepted submit XHR pre-network, captured `https://aisandbox-pa.googleapis.com/v1/video:batchAsyncGenerateVideoStartImage` with `startImage: "5ea393ee"`, `endImage: null`, `refs: 0` | ✅ 0-credit wire |
+| **Live E2E Costed Run** | `gflow video i2v --initial-frame tmp/test.jpg "cinematic slow motion pan" --model omni-flash --profile ffroliva --out-dir tmp/out_live`: submitted successfully, status `MEDIA_GENERATION_STATUS_SUCCESSFUL`, saved `tmp/out_live/bc742f56-536b-4cc7-a456-1b6b7f9fd7f2.mp4` (1,219,129 bytes) | ✅ live costed |
+| **Playwright Pin Safeguard** | `pyproject.toml` constrained to `playwright>=1.59.0,<1.60.0`; tested in `tests/test_playwright_pin.py::test_playwright_pinned_range_upper_bounded` | ✅ offline |
+| **Submission Stage Watchdog** | `_run_stage` watchdog aborts pre-submit on Playwright CDP stall, emits `stage_stalled`, captures screenshot, names installed Playwright version; tested in `tests/api/transports/test_ui_automation_video.py` | ✅ offline |
+| **Count Tab Fail-Closed** | `_set_output_count` raises `UiSelectorDriftError` on probe miss, matches digit affixes (`xN`/`Nx`); tested in `tests/api/transports/test_ui_automation_video.py` | ✅ offline |
+| **Release tree healthy** | Full suite 2902 passed / 5 skipped; green full-suite CI on merged PR #424 | ✅ |

gflow_cli-0.50.0/docs/LIVE_VERIFICATION_v0.50.0.md

@@ -0,0 +1,21 @@
+# Live Verification — v0.50.0
+
+- **Scope**: Adopt MCP 2026-07-28 Tasks extension (SEP-2663) (`tasks/get`, `tasks/cancel`, non-blocking generation tool handles) (#409), CLI and MCP `-o`/`--output` path hardening (#414, #415), Telegram alert fallback for PR triage (#428) via PR #430, #431 (merged 2026-08-04).
+- **Date**: 2026-08-04
+- **Evidence artifact**: `tmp/live-verify/mcp-tasks.md`
+
+## Pre-tag gates
+
+- `/gflow:check`: hygiene + doc-links + PII + mirror-drift ✅, ruff check/format ✅, pyright 0 errors ✅, full test matrix passed ✅.
+- `/gflow:doc-review`: mechanical pass ✅.
+- SonarCloud / GitHub Actions: 14/14 CI workflow checks passed on PR #430 and PR #431.
+
+## Evidence ledger (what is actually proven, and by what)
+
+| Layer | Evidence | Status |
+|---|---|---|
+| **MCP Tasks Extension (SEP-2663)** | `scripts/dev/live_verify_mcp_tasks.py`: non-blocking `gflow_generate_image(wait=False)` returns instant task handle (`status="pending"`), `TasksExtension._handle_get_task` returns `status="working"`, `tasks/cancel` updates DB status to `failed` and returns `status="cancelled"` | ✅ live verified |
+| **5-Layer Evidence Ledger** | Evidence note generated at `tmp/live-verify/mcp-tasks.md` confirming 1 SQLite queue row, valid UUID task_id, SEP-2663 Pydantic schema compliance, structlog `task_enqueued` invariants | ✅ 5-layer proof |
+| **Output Path Hardening (-o / --output)** | Parent directory creation, relative subpath preservation, cloud-storage S3 URI mapping (`_storage_key_from_path`), multi-count stem suffixes (`_1`, `_2`), de-mocked tests in `tests/cli/test_predictable_output.py` and `tests/features/output_hardening.feature` | ✅ 100% test matrix |
+| **MCP Tool Explicit Output Path** | Parameter `output` supported on `gflow_generate_image` and `gflow_generate_video` MCP tools, tested in `tests/mcp/test_tools_wired.py` | ✅ offline |
+| **Release tree healthy** | Full test suite passed (118/118 tests green); SonarCloud 0-issue Quality Gate passed | ✅ |

{gflow_cli-0.48.0/website → gflow_cli-0.50.0}/docs/MCP.md

@@ -94,7 +94,7 @@ The server registers three protocol surfaces:
 * `gflow_instructions_toggle_mode(project, enabled, profile)`: Flips the brief-level master switch; cards are left untouched.
 * `gflow_instructions_apply(project, cards, profile)`: Declarative **full-sync** — REPLACES all cards with the given set (destructive; same entry shape as the CLI `instructions apply` file).
 
-CLI↔MCP parity is enforced programmatically: `tests/mcp/test_cli_parity.py` walks every CLI leaf command and fails when one has neither a mapped MCP tool nor an explicit exemption with a stated reason. Note the deliberate asymmetry: `gflow_generate_video` has **no** `instructions` param (unlike `gflow_generate_image`) because the video pipeline (`GenerateVideoRequest` / the worker) has no instructions support — agentic-video is a typed divergence, and a dead parameter would be silently dropped. Same reasoning: neither generate tool has an `output` param mirroring the CLI `-o`/`--output` flag (#411) — the MCP path runs through the worker queue, which does not carry an explicit destination yet, so the param would be a silent no-op; files land in the date-partitioned default layout and their paths are returned in the tool result's `files`.
+CLI↔MCP parity is enforced programmatically: `tests/mcp/test_cli_parity.py` walks every CLI leaf command and fails when one has neither a mapped MCP tool nor an explicit exemption with a stated reason. Note the deliberate asymmetry: `gflow_generate_video` has **no** `instructions` param (unlike `gflow_generate_image`) because the video pipeline (`GenerateVideoRequest` / the worker) has no instructions support — agentic-video is a typed divergence, and a dead parameter would be silently dropped. Both `gflow_generate_image` and `gflow_generate_video` support an `output` parameter mirroring the CLI `-o`/`--output` flag (#414, #415), decoding explicit output destinations in the worker daemon.
 
 ### Prompts (Orchestration templates)
 * `expand_prompt`: Helps the agent structure simple ideas into Google's official 5-component prompt formula (Subject + Action + Location + Composition + Style) before sending them to the generation tools.

{gflow_cli-0.48.0 → gflow_cli-0.50.0}/docs/USAGE.md

@@ -489,15 +489,27 @@ All prompts in a batch share one Flow project. The editor is opened once and sta
 > current UI default), `--duration [4|6|8|10]` (10 requires `--model omni-flash`),
 > `--count INTEGER` (1–4; >1 multiplies credit cost), `--aspect [9:16|16:9]`,
 > `--profile NAME`, `--out-dir DIR` (default `tmp/`).
+> `--count` is enforced **fail-closed**: if Flow's count control cannot be
+> located (selector drift), the run refuses with exit 23 *before* submitting
+> instead of proceeding on Flow's sticky default (typically x2) and silently
+> changing what the run bills.
 > `t2v` and `i2v` (not `r2v`) additionally take `-o, --output PATH` (explicit file destination).
 > The mp4 lands at `<output_file>` or `<out-dir>/<media_id>.mp4`.
 >
-> **`i2v` is narrower (issue #125):** `omni-flash` does NOT support image-to-video
-> interpolation — Flow silently drops the start/end frames and produces a
-> text-only video — so it is **not** an accepted `--model` for `i2v`. The `i2v`
-> choices are `[veo-lite|veo-fast|veo-quality|veo-lite-lp]` and the **default is
-> `veo-lite`** (not Flow's UI default). `--duration` for `i2v` is `[4|6|8]` (10s
-> is omni-flash-only). `t2v` and `r2v` keep the full shared set above.
+> **`i2v` model rules (issue #125, re-verified 2026-08-03):** every model —
+> `omni-flash` included — supports **start-frame** i2v; the **default is
+> `veo-lite`** (not Flow's UI default). `--model omni-flash` unlocks
+> `--duration 10` for i2v. The **end frame is narrower**: `--end-frame`
+> (first+last interpolation) requires a Veo 3.1 model — Flow's official
+> support matrix lists first+last as "coming soon" for Omni Flash, and gflow
+> rejects that combination up front (exit 17).
+> History: omni-flash was excluded from i2v entirely after a 2026-05-30 wire
+> capture showed Flow silently dropping the frames and billing the run as
+> text-to-video. A 2026-08-03 route-aborted re-capture
+> (`scripts/dev/capture_i2v_intercept_submit.py --model omni-flash
+> --start-only`) proved Flow now routes omni + start frame to
+> `batchAsyncGenerateVideoStartImage` with the frame bound, and a live x1
+> 10s generation confirmed the output interpolates from the start frame.
 
 ## `gflow video t2v`
 
@@ -685,12 +697,13 @@ Options:
   --json                    Emit a machine-readable JSON result.
 ```
 
-> **`omni-flash` is rejected.** Only the Veo 3.1 family supports i2v
-> interpolation. `omni-flash` silently drops the seed frame and routes to
-> text-to-video (issue #125), which would break every seeded link, so it is not
-> an accepted `--model` for `chain`. The chain also aborts a link loudly (rather
-> than reporting a fake success) if a generation is observed routing to the
-> text-only endpoint — see [KNOWN_ISSUES](../KNOWN_ISSUES.md).
+> **`omni-flash` is rejected for chains.** Its single-clip start-frame i2v is
+> wire-verified (2026-08-03, issue #125), but a chain renders N seeded links
+> back-to-back and that has not been verified at chain scale — so `chain` stays
+> on the Veo 3.1 family pending a chain-scale verification. The chain also
+> aborts a link loudly (rather than reporting a fake success) if a generation
+> is observed routing to the text-only endpoint — see
+> [KNOWN_ISSUES](../KNOWN_ISSUES.md).
 
 ### JSONL manifest format
 
@@ -1305,7 +1318,7 @@ shell scripts can branch on the failure mode without parsing stderr.
 | `6`  | `NetworkError`        | Network failure persisted across 3 attempts      | Check connectivity                                         |
 | `7`  | `WireFormatError`     | Unexpected response shape — Flow API changed     | File a bug (do NOT include captured tokens or signed URLs) |
 | `8`  | `AuthMissingError`    | Required auth credential is absent from profile   | `gflow auth login --profile <name>`                        |
-| `9`  | `TransportTimeoutError` | Browser/API operation exceeded its timeout (incl. an i2v frame UUID not found in the media picker, #287) | Retry; raise the relevant timeout — or, for a frame-UUID miss, verify the UUID belongs to the `--project` passed |
+| `9`  | `TransportTimeoutError` | Browser/API operation exceeded its timeout (incl. an i2v frame UUID not found in the media picker, #287; or a wedged submission stage — the error names the stage and your Playwright version) | Retry; raise the relevant timeout — for a frame-UUID miss verify the UUID belongs to the `--project` passed; for a `stage_stalled` abort check your Playwright is in range (see [KNOWN_ISSUES](../KNOWN_ISSUES.md)) |
 | `10` | `WafRejectionError`   | Flow security layer rejected the request          | Change prompt/request and retry                            |
 | `11` | `ConfigurationError`  | Local configuration or browser mode is invalid — includes `ProfileLockedError` (same-profile lease contention: another `gflow`/daemon/MCP call already owns this profile) | Fix the option/env var shown in the error, or wait / use a different `--profile` for lease contention |
 | `12` | `AuthLoginTimeoutError` | Browser sign-in was not completed in time       | Re-run login or raise `GFLOW_CLI_AUTH_LOGIN_TIMEOUT`       |
@@ -1313,7 +1326,7 @@ shell scripts can branch on the failure mode without parsing stderr.
 | `14` | `AuthBrowserRejectedError` | Google rejected the login browser             | `gflow auth login --browser chrome`                        |
 | `15` | `BrowserSessionClosedError` | The automation browser window was closed mid-operation | Re-run; keep the browser window open until the command finishes |
 | `16` | `DataStoreError`      | Local database cannot be opened, a migration failed, or the DB schema is newer than the installed gflow-cli | See below                                  |
-| `17` | `ModelModeIncompatibilityError` | The chosen video model can't do the requested mode (e.g. `--model omni-flash` with an `i2v` start/end frame — issue #125) | Use `--model veo-lite` (or veo-fast / veo-quality / veo-lite-lp) for `i2v` |
+| `17` | `ModelModeIncompatibilityError` | The chosen video model can't do the requested mode (e.g. `--model omni-flash` with `--end-frame`, or `omni-flash` for `chain` — issue #125) | omni-flash does start-frame `i2v` only: drop `--end-frame`, or use a Veo 3.1 model (`veo-lite` / `veo-fast` / `veo-quality` / `veo-lite-lp`) for first+last and for `chain` |
 | `18` | `VideoModelSelectionError` | gflow could not select the requested video model in Flow's editor for an `i2v` run (model-picker option not found) | Usually transient — retry; if it persists, Flow's model-picker UI changed (report referencing #125) |
 | `19` | `SceneConcatError`    | Server-side scene render/concat failed (`gflow scene --output`) | Retry; the recorded compose survives, so re-render is safe |
 | `20` | `FrameExtractionError` | Could not extract the last frame for a video chain link | Check the source video downloaded intact; retry the link  |

{gflow_cli-0.48.0/website → gflow_cli-0.50.0}/docs/USER_GUIDE.md

@@ -464,24 +464,25 @@ A `--dry-run` flag that validates prompts + estimates cost without making any pa
 
 You want to feed `gflow-cli`'s output into `ffmpeg`, a CMS, or another automation step.
 
-### 11.1 The deterministic output layout
+### 11.1 Explicit output path with `-o` / `--output`
 
-Both default outputs and `--out` flags produce **predictable paths**:
+Pass `-o` / `--output` to land the generated file directly at a custom destination:
 
-```text
-$GFLOW_CLI_OUTPUT_DIR/
-├── videos/
-│   └── <YYYY-MM-DD>/
-│       └── <media_uuid>.mp4
-└── images/
-    └── <YYYY-MM-DD>/
-        └── <media_uuid>_<n>.png        # _1 / _2 / _3 / _4 for -n>1
+```bash
+# Save directly to a specific file (auto-creates parent directories)
+gflow image t2i "cinematic hero scene" -o ./assets/hero.png
+gflow video t2v "sunset over ocean" -o ./render/clip.mp4
+
+# Multi-count generations automatically receive _1, _2 stem suffixes
+gflow image t2i "concept art" -n 2 -o ./concepts/art.png
+# → ./concepts/art_1.png and ./concepts/art_2.png
 ```
 
-`<media_uuid>` is the asset UUID returned by Flow — globally unique. Same UUID across the operation poll response and the on-disk filename.
+Silent overwrite semantics: `-o` overwrites any existing file at the target path. Extension correction: if `-o asset.jpg` receives a PNG payload, `gflow` corrects the output key extension appropriately.
+
+### 11.2 The deterministic default layout
 
-When you pass `--out ./images/` for image commands or `--out-dir ./videos/`
-for video commands, `gflow-cli` writes there instead.
+When `-o` is omitted, default outputs and `--out-dir` flags produce **predictable paths**:
 
 If `GFLOW_CLI_STORAGE_URI` is set, generated asset bytes go to the configured
 bucket prefix instead of local disk. Use [Journey 15](#journey-15--sending-generated-assets-to-s3-minio-or-gcs)

gflow_cli-0.50.0/docs/superpowers/plans/2026-08-04-mcp-tasks/PLAN.md

@@ -0,0 +1,31 @@
+# Implementation Plan: MCP Tasks Extension (SEP-2663) for #409
+
+**Goal:** Implement the MCP 2026-07-28 Tasks extension (`tasks/get`, `tasks/cancel`) over the SQLite `generation_queue`, refactor MCP generation tools to return non-blocking task handles with optional blocking fallback, and wire `FlowWorker` into `gflow serve`.
+
+---
+
+## Tasks
+
+- [ ] **Task 1: Implement `TasksExtension` Subclass**
+  - **File:** `src/gflow_cli/mcp/tasks_extension.py`
+  - **Details:** Subclass `mcp.server.extension.Extension`. Implement `tasks/get` (fetches `QueueTask` via `QueueRepository` and maps status) and `tasks/cancel` (updates task status to `failed` and releases `ProfileLease`).
+
+- [ ] **Task 2: Update MCP Generation Tools to Return Task Handles**
+  - **File:** `src/gflow_cli/mcp/tools.py`
+  - **Details:** Update `gflow_generate_image` and `gflow_generate_video` to add `wait: bool = False`. Default to enqueuing task and returning `{ "task_id": ..., "status": "pending" }`. Retain blocking path when `wait=True`.
+
+- [ ] **Task 3: Wire `FlowWorker` into `gflow serve` Server Loop**
+  - **Files:** `src/gflow_cli/mcp/server.py`, `src/gflow_cli/cli.py`
+  - **Details:** Connect `FlowWorker` background queue processor to start during `gflow serve` startup so enqueued tasks are claimed and executed.
+
+- [ ] **Task 4: Register `TasksExtension` on `MCPServer`**
+  - **File:** `src/gflow_cli/mcp/server.py`
+  - **Details:** Register `TasksExtension` instance on `MCPServer`.
+
+- [ ] **Task 5: Comprehensive Unit & Parity Tests**
+  - **Files:** `tests/mcp/test_tasks_extension.py`, `tests/mcp/test_cli_parity.py`, `tests/features/test_mcp_tasks_steps.py`
+  - **Details:** Unit tests for `tasks/get`, `tasks/cancel`, non-blocking enqueue, and CLI-MCP parity validation.
+
+- [ ] **Task 6: Impeccable Routine Quality Gates & Documentation**
+  - **Files:** `docs/MCP.md`, `website/docs/MCP.md`
+  - **Details:** Run `/gflow:check` (hygiene, ruff, pyright, pytest) and document MCP Tasks extension usage in user guides.