gflow-cli 0.62.1__tar.gz → 0.63.0__tar.gz

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.62.1",
+  "version": "0.63.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

gflow_cli-0.63.0/.github/FUNDING.yml

@@ -0,0 +1,2 @@
+# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+github: ffroliva

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/.github/workflows/scorecard.yml

@@ -47,6 +47,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: results.sarif

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/AGENTS.md

@@ -4,12 +4,47 @@
 
 Supported tools that auto-discover this file: Cursor, Codex, Aider, Antigravity (`agy`), Jules, Devin, Windsurf, Zed, Warp, opencode, RooCode, Amp, Junie, Phoenix, GitHub Copilot, VS Code, Factory, Augment, Semgrep, Kilo Code, UiPath. Claude Code reads [CLAUDE.md](CLAUDE.md), which cross-references this file.
 
+## Skill Routing — the default workflow, not a menu
+
+**The `/gflow:` skills ARE this project's development lifecycle.** They are not
+optional tooling you may reach for; they are how work is done here. If a row below
+matches your situation, load that skill **before acting** — before exploring the
+codebase, before answering, before editing. A skill loaded after the work is a skill
+that did not run.
+
+| If you are about to… | Load first | Non-negotiable because |
+|---|---|---|
+| Touch a GitHub issue | `/gflow:issue-assessment <N>` | Read-only triage precedes any fix; classification changes what "fixing" means |
+| Propose a transport, auth, selector, or schema change | `/gflow:predict <proposal>` | Five adversarial personas return GO / CAUTION / STOP before code exists |
+| Start a feature | `/gflow:scenario` → `/gflow:plan` | Edge cases before tasks; tasks before code |
+| Resume work / ask "where are we?" | `/gflow:status` | The current plan's next unchecked task is the answer, not your guess |
+| Commit **anything** | `/gflow:check` | It is the exact CI gate; skipping it is how a format failure shipped past an 8-agent council (PR #269) |
+| Open or review a PR | `/gflow:pr-council-review <N>` (or `/gflow:branch-review`) | Standing-authorized. Run it — do not ask permission first |
+| Claim a generation feature works | `/gflow:live-verify` | Offline-green is never done-done on a generation path |
+| Cut a release | `/gflow:release` | It hard-gates on changelog → check → live-verify → doc-review; each is a STOP |
+| Audit docs before shipping | `/gflow:doc-review` | Catches same-release errors a read-through cannot |
+| See a red SonarCloud check | `/gflow:sonar <N>` | The gate measures *new* code; the fix is rarely where you would look |
+| Touch auth or reCAPTCHA | `/gflow:known-issues` | Known-broken surfaces have documented workarounds; rediscovering them costs days |
+
+**Canonical bodies live in `skills/<name>/SKILL.md`** — plain Markdown, agent-agnostic
+by construction, so Codex / Cursor / Aider / `agy` read exactly what Claude Code reads.
+`.claude/commands/gflow/*.md` are thin Claude-Code wrappers that point at them.
+
+> **This table exists because routing by memory failed.** On 2026-09-01 an agent worked
+> a full session — recovering two interrupted sessions, merging five PRs — without ever
+> loading this file, because `CLAUDE.md` only *asked* it to. It reached step 10 of a
+> release before meeting the pipeline's own doc-review gate, and the required
+> `LIVE_VERIFICATION_v0.63.0.md` had not been written despite the feature having been
+> live-verified. `CLAUDE.md` now `@`-imports this file, so it is always in context. The
+> table is the other half: being loaded is useless if the mapping from situation to skill
+> is left to recall.
+
 ## Project at a glance
 
 - Unofficial Python CLI for [Google Flow](https://labs.google/fx/tools/flow) — drives Veo (image-to-video, text-to-video) and Imagen (text-to-image) generations from the terminal by reverse-engineering Flow's private REST API at `aisandbox-pa.googleapis.com`.
 - Python 3.11+ · `uv`-managed · `hatchling` builds · Playwright Chromium transport · `pyright` strict · `ruff` · `pytest`.
-- Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `composition.py`, `config.py`, `errors.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
-- Command surface: `gflow auth`, `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain — no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow models`, `gflow run`, `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
+- Single-package modular monolith. Top-level modules under `src/gflow_cli/`: `api/`, `auth/`, `data/`, `mcp/`, `services/`, `tools/`, `ui/`, `worker/`, `browser_manager.py`, `cli.py`, `_cli_helpers.py`, `diagnostics.py`, `json_output.py`, `media.py`, `profile_lease.py`, `redaction.py`, `storage.py`, `winsec.py`, `cli_project.py`, `cli_character.py`, `cli_data.py`, `cli_image.py`, `cli_instructions.py`, `cli_models.py`, `cli_movie.py`, `cli_run.py`, `cli_scene.py`, `cli_tools.py`, `cli_video.py`, `chain.py`, `chain_manifest.py`, `cli_doctor.py`, `composition.py`, `config.py`, `errors.py`, `file_integrity.py`, `flow_selectors/`, `update_check.py`, `exceptions.py`, `image_batch.py`, `movie_manifest.py`, `observability.py`, `paths.py`, `profile_store.py`.
+- Command surface: `gflow auth`, `gflow image` (t2i/i2i/batch/upload/upscale), `gflow video` (t2v/i2v/r2v/chain/extend — `extend` continues an existing clip past Flow's 8s ceiling, server-seeded from the source so the join is continuous; no `batch` subcommand; the nonfunctional stub was removed, loop `gflow video t2v`/`i2v` from the shell for multi-clip runs), `gflow character` (create/list/show/rm/voices — reusable project-scoped Flow Character entities), `gflow scene` (create/show — Add Clip / Scenes, with `create --output` for credit-free server-side extended video), `gflow instructions` (persistent Agent-Mode brief cards — add/list/enable/disable/rm/apply/toggle-mode, credits-free, `--project` required), `gflow movie` (run/template — multi-scene manifest pipeline), `gflow tools` (list/show/run — prompt-rewriting tools, also `--tool` on generation commands), `gflow data` (catalog queries), `gflow doctor` (read-only pre-flight diagnostic, exit 33 = findings present), `gflow project`, `gflow models`, `gflow run`, `gflow mcp` (run/setup — stdio MCP server), and `gflow serve` (Streamable HTTP at `/mcp`; `--transport sse` is deprecated).
 - Works with any Google account that has Flow access. All generations bill against the user's own Google account.
 
 ## Headed-browser dependency (architectural reality)
@@ -58,7 +93,7 @@ Or invoke the wrapper: `/gflow:check`.
 
 - Type hints everywhere; `pyright` strict on `src/gflow_cli`.
 - Structured logging only (`structlog`) — **never** raw `print()` or `import logging` in `src/`.
-- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–31, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
+- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–35, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
 - 100-char line length, `ruff` configured. Imports sorted by `ruff` (isort rules).
 - **YAGNI / least-code**: prefer the smallest change that works. No speculative abstractions (interface/factory with one implementation), no config or flags nobody sets, no dead constants/helpers, no reinventing the stdlib. Review carries this as its own lens — the **D14 over-engineering** dimension of [`pr-council-review`](skills/pr-council-review/SKILL.md) (baseline, always runs). Its rubric is portable; the `ponytail` plugin (see CONTRIBUTING) is an optional accelerant, not a dependency.
 - **MCP & CLI Schema Symmetry**: Any updates or additions to user-facing CLI command parameters (e.g., `gflow image t2i`, `gflow video`) must be mirrored in the corresponding MCP tool definitions. Never add option/argument fields to Click commands without updating the MCP server implementation. This symmetry is enforced programmatically in CI via `tests/mcp/test_cli_parity.py` (every CLI leaf command needs a mapped MCP tool or an explicit, reasoned exemption) plus the schema checks in `tests/mcp/test_server.py`.
@@ -97,7 +132,7 @@ All AI agents and harnesses working on `gflow-cli` follow this standard 10-phase
 | 7. Pre-Commit Quality | `/gflow:check` | The Impeccable Routine (hygiene, ruff, pyright, pytest) | All green local checks |
 | 8. Live Verification | `/gflow:live-verify` | 5-layer proof against real Flow transport | `docs/LIVE_VERIFICATION_vX.Y.Z.md` |
 | 9. PR & Issue Close | `/gflow:issue-resolve <N>` | PR, SonarCloud 0-issue gate, merge to develop | Closed GitHub issue |
-| 10. Release Pipeline | `/gflow:release` | Version bump, signed tag (`git tag -s`), PyPI publish | Shipped release & back-merge |
+| 10. Release Pipeline | `/gflow:release` | Version bump, signed tag (`git tag -s`), PyPI publish. **Internally gates on `/gflow:changelog` → `/gflow:check` → `/gflow:live-verify` → `/gflow:doc-review`; a failure at any of them is a STOP, not a warning.** | Shipped release & back-merge |
 
 ### Pipeline Continuation Mandate
 

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.63.0] — 2026-09-01
+
+### Added
+
+- **`gflow video extend` — continue a clip past Flow's 8-second ceiling.** Veo's
+  extend route generates a new 8s segment seeded server-side from the source
+  clip, so motion and audio carry across the join instead of restarting from a
+  still (which is what `video chain` does, and why it needs a fade guard). Pass
+  one prompt per segment, or `--segments N` to reuse the last one:
+
+  ```bash
+  gflow video extend <media-id> "the wave recedes" --project <id>
+  gflow video extend <media-id> "drifts out to sea" --project <id> -n 4 -o long.mp4
+  ```
+
+  The result is a Flow Scene; `-o` renders it to a single mp4 through the
+  existing credit-free server-side concat.
+
+  > Known limitation, found in live verification: a segment carries ~7s of real
+  > content though Flow advertises and bills 8s, so each internal seam of a
+  > multi-segment render is preceded by ~1s of frozen frame and silence. Single
+  > segments are unaffected. Details and the open questions are in
+  > [KNOWN_ISSUES](KNOWN_ISSUES.md).
+
+  - **The model key is resolved per run, never hardcoded.** Flow's extend family
+    is tier-gated — `_ultra` variants are Advanced-only and read `UNAVAILABLE`
+    elsewhere — so the key comes from the account's own capability listing,
+    picking the cheapest orderable model exactly as Flow's own UI does. A pinned
+    key would 403 forever on the wrong tier.
+  - **Costs are shown before anything is submitted**, and a pre-flight balance
+    check refuses a run the balance cannot finish. `--dry-run` prints the plan
+    without opening a browser.
+  - **Serial by construction, and paced.** Segments submit one at a time with a
+    non-zero default jitter (`GFLOW_CLI_JITTER_RANGE`). A refusal aborts with
+    completed segments preserved and is never auto-retried.
+  - `1:1` is refused up front — Flow publishes no square extend model.
+
+### Fixed
+
+- **Ctrl+C during a billed run said nothing.** `run_with_handlers` exited 130
+  silently, so a user who interrupted a multi-segment run could not tell whether
+  anything had been charged or how to resume. It now reports credits spent,
+  segments completed and the resume handle. Fixed at the shared boundary, so
+  `video chain` and `movie run` gain it too.
+- **`sessionId` was not redacted.** `redact_metadata` covered `token` and
+  `recaptchaToken` but not `sessionId`, which the extend request carries. Not a
+  credential, but account-correlatable, and it would otherwise reach any logged
+  request body or diagnostics bundle verbatim.
+
+
+- **The offline test suite could `git checkout develop` in the developer's own
+  clone ([#605](https://github.com/ffroliva/gflow-cli/issues/605)).** git's
+  repository discovery walks *up* from `cwd`, and `--basetemp=tmp/pytest` puts
+  every `tmp_path` inside this repository, so an autopilot test whose temp `.git`
+  went missing had its `git checkout develop` silently resolved against the real
+  working tree — moving the developer off their branch mid-run (reflog-confirmed,
+  Windows-only, intermittent). Two independent guards now close it:
+  `scripts/autopilot/pr_triage_autopilot.py` pins every git call with
+  `--git-dir`/`--work-tree`, so a `repo_dir` that is not a repository fails loudly,
+  raising with git's own `fatal: not a git repository` text rather than
+  retargeting whatever clone encloses it (this also
+  hardens the VPS triage path against a mistyped `--repo-dir`), and
+  `tests/conftest.py` sets `GIT_CEILING_DIRECTORIES` to pytest's basetemp so no
+  test can walk out of its temp dir into this repo. What removed the temp `.git`
+  is still unexplained — it now surfaces as a plain "not a git repository" rather
+  than a silent branch switch.
+
 ## [0.62.1] — 2026-08-30
 
 ### Fixed
@@ -3448,7 +3515,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...HEAD
+[0.63.0]: https://github.com/ffroliva/gflow-cli/compare/v0.62.1...v0.63.0
 [0.62.1]: https://github.com/ffroliva/gflow-cli/compare/v0.62.0...v0.62.1
 [0.62.0]: https://github.com/ffroliva/gflow-cli/compare/v0.61.0...v0.62.0
 [0.61.0]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...v0.61.0

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/CLAUDE.md

@@ -6,11 +6,30 @@
 
 `gflow-cli` is an unofficial Python CLI that drives [Google Flow](https://labs.google/fx/tools/flow) (Veo image-to-video, Imagen text-to-image) from the terminal by reverse-engineering Flow's private REST API. See [README.md](README.md) for the user-facing overview.
 
+## System rules — loaded, not requested
+
+**[AGENTS.md](AGENTS.md) is imported below and is therefore already in context before
+you read this line.** It is the system rule for this project: the `/gflow:` skills are
+the default development lifecycle, and its Skill Routing table says which one to load
+for the situation in front of you. Follow it — it is not advisory, and "I hadn't read
+it yet" is not a reachable state.
+
+> **Why an import and not a bullet that says "read AGENTS.md".** That bullet is what
+> used to be here, and it failed exactly as written: an agent that skips it is not
+> corrected by anything, and no gate notices. A session on 2026-09-01 went straight
+> into work without it and reached step 10 of a release before discovering the
+> pipeline's own doc-review and live-verification gates. `@AGENTS.md` removes the
+> choice — the harness resolves the import and injects the file, with no agent
+> cooperation required. Never downgrade this back to prose.
+
+@AGENTS.md
+
 ## On every session start
 
-1. Read **[AGENTS.md](AGENTS.md)** — universal rules every agent must follow.
-2. Read **[docs/INDEX.md](docs/INDEX.md)** — routing layer for all project docs and commands.
-3. Pull deeper context on demand:
+1. Read **[docs/INDEX.md](docs/INDEX.md)** — routing layer for all project docs and
+   commands. Deliberately *not* imported: at 36 KB it is a lookup table, not a rule set,
+   and AGENTS.md points into it. Read it when you need to find a doc.
+2. Pull deeper context on demand:
    - Current task / where we left off → `/gflow:status`
    - Starting a new feature → `/gflow:predict` → `/gflow:scenario` → `/gflow:plan <feature>`
    - Touching auth or reCAPTCHA → `/gflow:known-issues`
@@ -20,8 +39,15 @@
 
 ## Claude-Code-specific
 
-- Slash commands live under `.claude/commands/gflow/` (all prefixed `/gflow:`).
-- Skills under `skills/` are auto-discoverable; `gflow-cli` ships its own at [`skills/gflow-cli/SKILL.md`](skills/gflow-cli/SKILL.md).
+- Slash commands live under `.claude/commands/gflow/` (all prefixed `/gflow:`). **These
+  are the invocable surface** — they appear in the session's skill list and may be called
+  with the `Skill` tool as `gflow:<name>`.
+- **`skills/<name>/SKILL.md` are the canonical bodies, and are NOT `Skill`-tool-invocable.**
+  They are plain Markdown, agent-agnostic on purpose so Codex/Cursor/Aider can read the
+  same file. `Skill(skill="release")` fails with `Unknown skill: release`; each wrapper in
+  `.claude/commands/gflow/` says to read its `skills/<name>/SKILL.md` directly, and that is
+  the supported path. (This bullet previously claimed they were "auto-discoverable", which
+  is false and sends agents into a failing tool call.)
 - Auto-memory at `~/.claude/projects/C--development-github-gflow-cli/memory/MEMORY.md` carries cross-session feedback and project state.
 - **Worktrees:** the native `EnterWorktree` tool branches from `origin/main` (the default branch). Feature work integrates via `develop` — after entering a fresh worktree, immediately `git switch -c <type>/<name> origin/develop` and delete the auto-created `worktree-*` branch. On Windows, worktree removal can fail on a file lock (the worktree's `.venv`); `git worktree prune` + manual delete later is fine.
 

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/KNOWN_ISSUES.md

@@ -14,6 +14,58 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ## Open
 
+### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second
+
+- **Status:** Open · **Severity:** Medium (audible/visible on every internal seam of a chained extend) · **Affected:** `gflow video extend -n >1` with `-o`, and any scene mixing extend segments
+- **Discovered:** 2026-09-01, by live verification of the extend feature. Offline tests could not have found it.
+
+**What happens.** `gflow video extend ... -n 2 -o out.mp4` produces a file whose
+audio drops to digital silence (−91 dB) for exactly one second before each
+internal seam, over a **frozen video frame**. The seam itself is clean; the dead
+second sits immediately before it.
+
+**Measured.** In a 3-clip render (original + 2 extensions), per-second mean volume:
+
+```
+ 7s -28.8   8s -26.4      <- original -> extension seam: continuous
+14s -29.1  15s -75.1  16s -33.9   <- extension -> extension seam: 1s dropout
+```
+
+Finer slices put the silence at 15.00–15.99s exactly. Reproduced independently on
+a second render made days earlier from different prompts (14s −22.4, **15s −70.1**,
+16s −23.9), so it is systematic, not a one-off.
+
+**Root cause.** The extension media is **7.000000 seconds** — both video and audio
+streams, confirmed by `ffprobe` on the downloaded clip. But:
+
+- the capability listing advertises `videoLengthSeconds: 8` for
+  `veo_3_1_extension_lite`, and
+- `getSceneWorkflows` reports `total_duration=8.0`, `end=8.0` for that clip.
+
+`ConcatInput` passes those metadata values through verbatim, so Flow's
+server-side concat stretches a 7s clip into an 8s slot by holding the last frame
+and muting. The final segment escapes it only because the render ends before its
+padding (23.02s for 3 clips, not 24s).
+
+**Why it matters more than it looks.** A freeze-hold is the specific failure the
+Compiled Growth parable runbook forbids — *"NEVER pad by freeze-holding a frame —
+reads as 'video stuck'"* — and that pipeline is the named consumer for extend.
+An N-segment chain has N−1 of these.
+
+**Not yet established** (do not fix on a guess):
+
+- whether 7.0s is constant across extend models, aspects and tiers, or specific
+  to `veo_3_1_extension_lite`;
+- whether Flow's own UI renders the same padding (i.e. whether this is our
+  concat inputs or Flow's behaviour end-to-end);
+- whether any API field reports the real media duration, which is what a clean
+  fix needs — clamping `ConcatInput.end` to a hardcoded 7.0 would be a guess
+  dressed as a fix.
+
+**Workaround today.** Render without `-o` and trim in post, or accept the
+freeze-hold. Single-segment extends are unaffected.
+
+
 ### An out-of-range Playwright silently wedges video generation
 
 - **Status:** Mitigated (v0.49.0 — upper-bounded dependency + fail-fast watchdog)

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.62.1
+Version: 0.63.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.4; extra == 'dev'
+Requires-Dist: ruff==0.16.5; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'
@@ -83,6 +83,7 @@ Description-Content-Type: text/markdown
 [![Type checked: pyright](https://img.shields.io/badge/type%20checked-pyright-blue.svg)](https://github.com/microsoft/pyright)
 [![Tests: TDD](https://img.shields.io/badge/tests-TDD-brightgreen.svg)](CONTRIBUTING.md)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ffroliva_gflow-cli)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
 
 > ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
@@ -97,7 +98,7 @@ Description-Content-Type: text/markdown
 
 You have a Google account with Flow access, you have Veo credits, and you run real batch work. gflow-cli gives you:
 
-- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today.
+- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today, and `gflow video extend` continues an existing clip past Flow's 8s ceiling.
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
@@ -199,7 +200,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 ## Project status
 
-**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` HTTP-SSE) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
+**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain, extend) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` Streamable HTTP) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
 
 Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project is heading: [ROADMAP.md](ROADMAP.md).
 
@@ -226,4 +227,11 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 [![GitHub repo size](https://img.shields.io/github/repo-size/ffroliva/gflow-cli?cacheSeconds=3600)](https://github.com/ffroliva/gflow-cli)
 [![PyPI downloads](https://static.pepy.tech/badge/gflow-cli/month)](https://pepy.tech/project/gflow-cli)
 
+### Star history
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+</picture>
+
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/PLAN.md

@@ -716,7 +716,7 @@ Today the CLI writes media to `$GFLOW_CLI_OUTPUT_DIR` on the local filesystem. P
 | 11 | LF-only line endings via `.gitattributes` | Single repo source of truth; cross-platform contributors don't think about it |
 | 12 | `Provider` indirection (legacy `providers/`) removed | Superseded by `api.FlowApiClient`. Re-introduce when we add `OfficialVeoProvider` (planned v0.5+) |
 | 13 | CDP attach / stealth-engine alternatives deferred; **current stealth fix confirmed sufficient 2026-07-09** | Gate met: a 20-gen live baseline through the default stealth stack showed a **0.0% WAF 403 rate**, so the "confirm insufficient before implementing" bar is unmet — CDP-Attach and the Camoufox engine stay parked (Camoufox roadmap closed at Phase 2). Evidence: [superpowers/spikes/2026-07-09-camoufox-waf-403.md](superpowers/spikes/2026-07-09-camoufox-waf-403.md). |
-| 14 | HTTP status path (`get_video_status`) retired alongside `generate_video` | It is the same 401-dead path and would collide with the new `api/video.py:VideoStatus` value object — retiring both together keeps the domain clean. |
+| 14 | HTTP status path (`get_video_status`) retired alongside `generate_video` | It is the same 401-dead path and would collide with the new `api/video.py:VideoStatus` value object — retiring both together keeps the domain clean. **Scope note 2026-08-31:** "401-dead" was measured on `batchAsyncGenerateVideoText` in 2026-05 and has NOT been re-tested. It is not a property of `/v1/video:*` as a family — `batchAsyncGenerateVideoExtendVideo` returned **200** from our own transport with our own minted token on 2026-08-31 ([spike](docs/superpowers/spikes/2026-08-31-veo-extend-route-recon.md)). Do not cite this ADR as evidence that a direct-wire video route cannot work; re-measure the specific route. |
 
 ---
 

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/README.md

@@ -12,6 +12,7 @@
 [![Type checked: pyright](https://img.shields.io/badge/type%20checked-pyright-blue.svg)](https://github.com/microsoft/pyright)
 [![Tests: TDD](https://img.shields.io/badge/tests-TDD-brightgreen.svg)](CONTRIBUTING.md)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ffroliva_gflow-cli)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ffroliva_gflow-cli&metric=coverage)](https://sonarcloud.io/component_measures?id=ffroliva_gflow-cli&metric=coverage)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ffroliva/gflow-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/ffroliva/gflow-cli)
 
 > ⚠️ **Read this before you install.** gflow-cli is **unofficial, alpha, and reverse-engineered — not affiliated with Google**. It drives a headed browser on *your own* Google Flow session, so treat it as your own account risk: automation is subject to Google's ToS, and endpoints or UI can change without notice. It works with **any Google account** that has Flow access, and every generation bills against your account's Flow credit allowance. Read the full [DISCLAIMER](DISCLAIMER.md).
@@ -26,7 +27,7 @@
 
 You have a Google account with Flow access, you have Veo credits, and you run real batch work. gflow-cli gives you:
 
-- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today.
+- **Batch generation.** Loop prompts straight from the shell: `for p in $(cat prompts.txt); do gflow image t2i "$p"; done`. Image batching plus `gflow video t2v` / `i2v` / `r2v` all ship today, and `gflow video extend` continues an existing clip past Flow's 8s ceiling.
 - **Consistent subjects.** `gflow character create` mints a Flow Character (face and body reference) so the same person appears from one generation to the next.
 - **Prompt tools.** `--tool creative-director` rewrites a terse prompt into a vivid one (Google's 5-component formula) before generating — on any command. Bring your own with [My Tools](docs/TOOLS.md).
 - **Pipelines.** Wire Veo into your content automation, AI-video stack, or batch experiments.
@@ -128,7 +129,7 @@ gflow CLI  →  Provider (interchangeable)  →  Flow (ui_automation) / Mock (te
 
 ## Project status
 
-**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` HTTP-SSE) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
+**Alpha.** Image (t2i, i2i, upload, upscale, batch) and video (t2v, i2v, r2v, chain, extend) run end-to-end on `ui_automation`, with a 5-model Veo picker plus `--duration` and `--count`. Beyond single generations: `gflow movie` renders multi-scene manifests, `gflow instructions` manages persistent Agent-Mode brief cards (credits-free), `gflow character` handles reusable subjects, `gflow scene` does credit-free server-side stitching, `--tool` applies prompt-rewriting tools, and an MCP server (`gflow mcp run` stdio / `gflow serve` Streamable HTTP) exposes the core surface to AI agents with a CI-enforced CLI↔MCP parity contract.
 
 Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project is heading: [ROADMAP.md](ROADMAP.md).
 
@@ -155,4 +156,11 @@ Full milestone history lives in [CHANGELOG.md](CHANGELOG.md). Where the project
 [![GitHub repo size](https://img.shields.io/github/repo-size/ffroliva/gflow-cli?cacheSeconds=3600)](https://github.com/ffroliva/gflow-cli)
 [![PyPI downloads](https://static.pepy.tech/badge/gflow-cli/month)](https://pepy.tech/project/gflow-cli)
 
+### Star history
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&theme=dark&legend=top-left" />
+  <img alt="Star history chart for ffroliva/gflow-cli" src="https://api.star-history.com/chart?repos=ffroliva/gflow-cli&type=date&legend=top-left" />
+</picture>
+
 If `gflow-cli` saves you time, please ⭐ the repo. It is the cheapest way to support the project.

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/docs/CHARACTER.md

@@ -209,7 +209,9 @@ sequenceDiagram
 > bounds: (1) gflow's `generate_image` clicks "new project" + omits `entityContext` → workflow lands in the
 > wrong project (`flowWorkflows` PATCH 404'd); (2) a self-assembled direct POST with our own minted reCAPTCHA
 > token → **HTTP 403** (the reCAPTCHA wall — [[rest-path-capability-matrix]]; body shape matched the real HAR,
-> only the token differed). **Decision (§11): drive generation through the character editor UI** (existing
+> only the token differed). **Scope note (2026-08-31): this 403 is specific to `batchGenerateImages`, not to
+> generation in general** — see §"the wall is route-specific" below. **Decision (§11): drive generation
+> through the character editor UI** (existing
 > project → Personagens → new character → generate) so Flow's JS sets `entityContext` + passes the WAF, and
 > gflow passive-captures `media[]`/`workflows[]`. The structural ops below stay direct-REST.
 
@@ -377,9 +379,27 @@ convenience later.
   self-assembled `batchGenerateImages` POST returned **HTTP 403** (createEntity ✅, reCAPTCHA mint ✅). Our
   request body shape matched the real successful HAR exactly; the only difference is the reCAPTCHA token —
   a `TokenMinter` token scores too low / wrong-context vs Flow's native page-JS token. This confirms
-  [[rest-path-capability-matrix]]: **generation is never browser-free; Bearer fixed the 401, not the reCAPTCHA
-  wall.** No credit spent (403 before generation). **A retry won't help** — the token can't be made WAF-valid
-  outside Flow's own JS.
+  [[rest-path-capability-matrix]]: ~~**generation is never browser-free**~~ — see the scope correction below;
+  **Bearer fixed the 401, not the reCAPTCHA wall.** No credit spent (403 before generation). **A retry won't
+  help** — for *this route*, the token can't be made WAF-valid outside Flow's own JS.
+
+> #### ⚠️ Scope correction (2026-08-31) — the wall is route-specific, not universal
+>
+> "Generation is never browser-free" was generalised from a single 403 on `batchGenerateImages`. It is not
+> true of every generative route, and reading it as a blanket rule has already cost real time — during the
+> Veo-extend predict council it was cited as a blocking precedent against a path that then worked on the
+> first try.
+>
+> | Route | Self-assembled POST + our minted token | Date |
+> |---|---|---|
+> | `batchGenerateImages` | **403** | 2026-06-02 |
+> | `upsampleImage` | **200** (shipped, live) | — |
+> | `batchAsyncGenerateVideoExtendVideo` | **200** | 2026-08-31 |
+>
+> Two of three generative routes accept a `TokenMinter` token. Treat the wall as a **per-route measurement**,
+> never an inherited assumption — and re-measure before citing it. The `batchGenerateImages` 403 has not been
+> re-tested since 2026-06-02 and may itself be stale.
+> Evidence: [superpowers/spikes/2026-08-31-veo-extend-route-recon.md](superpowers/spikes/2026-08-31-veo-extend-route-recon.md).
 - **✅ Decision = Option B (UI-driven generation; structural ops stay REST).** Generation (character image
   create AND video reuse) **must** ride Flow's native UI so Flow's JS issues the WAF-valid request, which
   gflow passive-captures — identical mechanism to the existing `generate_image`/`generate_video`. Revised

{gflow_cli-0.62.1 → gflow_cli-0.63.0}/docs/INDEX.md

@@ -95,6 +95,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"How do I feed gflow outputs into ffmpeg / a pipeline?"** → [USER_GUIDE § Journey 11](USER_GUIDE.md#journey-11--wiring-gflow-outputs-into-a-downstream-pipeline)
 **"How do I chain clips into one continuous video (initial-frame I2V)?"** → [USAGE § `gflow video chain`](USAGE.md#gflow-video-chain)
 **"How do I stitch existing clips into one extended .mp4 (credit-free, no ffmpeg)?"** → [USAGE § `gflow scene`](USAGE.md#gflow-scene)
+**"How do I make one clip longer than Flow's 8-second cap?"** → [USAGE § `gflow video extend`](USAGE.md#gflow-video-extend) (costs credits per segment; a segment carries ~7s of content though Flow bills 8s — see [KNOWN_ISSUES](../KNOWN_ISSUES.md))
 **"How do I create a reusable character (face + body) I can reuse across generations?"** → [USAGE § `gflow character`](USAGE.md#gflow-character) · design: [CHARACTER](CHARACTER.md)
 **"Should I use an `@mention`, `--reference-entity`, or `--ref` to tag an asset?"** → [REFERENCE_STRATEGIES](REFERENCE_STRATEGIES.md) — saved named identity → `@Name`/`--reference-entity`; one-off image → `--ref`
 **"How does Flow's media library / picker actually behave (names, tabs, scrolling, listing)?"** → [MEDIA_LIBRARY](MEDIA_LIBRARY.md) — identity = UUID, names are async AI captions; grid is virtualized; full pitfall table
@@ -154,7 +155,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)

gflow_cli-0.63.0/docs/LIVE_VERIFICATION_v0.63.0.md

@@ -0,0 +1,130 @@
+# Live verification — v0.63.0
+
+Every claim below was **observed**. Claims that could not be observed are stated
+as such in §5, not omitted.
+
+## Environment
+
+| | |
+|---|---|
+| Date | 2026-09-01 |
+| Profile | `ffroliva` (locale `en`) |
+| Code under test | `feat/video-extend` @ the branch that became `5bd1476` on `develop` |
+| Surface | `gflow video extend` — the one new user-facing command in this release |
+| Source clip | `b9458021-fc2d-4d95-ab53-cf844c6f1079` (landscape) |
+| Veo credits spent | **20** (2 segments × 10). Model resolution, the capability listing read, scene creation and the final concat were all free. |
+
+## 1. The command chains extends and bills what it said it would
+
+```
+gflow video extend b9458021-fc2d-4d95-ab53-cf844c6f1079 "..." "..." -n 2 --aspect 16:9 -o live_extend.mp4
+```
+
+The pre-flight plan, printed before anything was submitted:
+
+```
+model       : veo_3_1_extension_lite (20 credits total, balance 875)
+```
+
+and the resolver's own record of how it got there:
+
+```json
+{"model_key": "veo_3_1_extension_lite", "service_tier": "SERVICE_TIER_INTERMEDIATE",
+ "unit_cost": 10, "candidate_count": 99, "event": "extend_model_resolved",
+ "cli_command": "video extend"}
+```
+
+`candidate_count: 99` is the load-bearing number: the key was **resolved from the
+live capability listing**, not hardcoded. The account's own tier
+(`SERVICE_TIER_INTERMEDIATE`) selected an orderable key, which is what prevents
+the tier-403 rather than classifying it afterwards.
+
+Final line: `Extended — 2/2 segment(s), 20 credits`. Plan cost and actual spend
+agree.
+
+## 2. Chaining is tail-only — the property the whole feature rests on
+
+This is the claim that separates `extend` from `chain`, and it is the one a mock
+cannot establish. Both submissions, verbatim:
+
+```json
+{"segment": 1, "of": 2, "media_id": "0c9364f3-9c2e-4369-8e4a-28eace534ce3",
+ "source_media_id": "b9458021-fc2d-4d95-ab53-cf844c6f1079",
+ "model_key": "veo_3_1_extension_lite"}
+
+{"segment": 2, "of": 2, "media_id": "648f9291-bae5-4a03-bbe1-82a113e30881",
+ "source_media_id": "0c9364f3-9c2e-4369-8e4a-28eace534ce3",
+ "model_key": "veo_3_1_extension_lite"}
+```
+
+Segment 2's `source_media_id` **is segment 1's `media_id`**. The chain advances
+from the tail it just produced, not from the original clip. Had the orchestrator
+re-seeded from the source, both lines would name `b9458021…` and the output
+would have been two divergent 8-second continuations of the same moment rather
+than one continuous 23-second shot.
+
+## 3. Ledger
+
+| Layer | Observed |
+|---|---|
+| File count | 1 rendered mp4 from 3 scene clips (original + 2 extensions) |
+| Magic bytes | h264 + aac in an mp4 container, read back by `ffprobe` |
+| Dimensions / shape | **23.02s · 1280×720 · 24fps** — landscape preserved end to end |
+| Structlog invariants | `extend_model_resolved` (×2, once per segment) → `extend_segment_started` segment 1 → segment 2 with the chained `source_media_id` → completion at `2/2`, `credits_spent=20` |
+| User-confirmable artifact | `live_extend.mp4` — a single continuous clip that plays past Flow's 8-second ceiling, which is the entire user-facing promise of the release |
+
+## 4. The verification earned its keep — it found a defect the suite could not
+
+The offline suite passes on this feature and is structurally incapable of seeing
+this: **an extend segment carries 7.000000 seconds of content, not the 8 Flow
+advertises and bills.**
+
+Per-second mean volume across the 3-clip render:
+
+```
+ 7s -28.8   8s -26.4                <- original -> extension seam: continuous
+14s -29.1  15s -75.1  16s -33.9     <- extension -> extension seam: 1s dropout
+```
+
+Finer slices place the silence at 15.00–15.99s exactly, over a **frozen video
+frame**. Reproduced independently on a second render made days earlier from
+different prompts (14s −22.4, **15s −70.1**, 16s −23.9), so it is systematic.
+
+The cause is a metadata disagreement, not a rendering bug: the capability listing
+advertises `videoLengthSeconds: 8` and `getSceneWorkflows` reports
+`total_duration=8.0` for a clip whose streams `ffprobe` measures at 7.000000s.
+`ConcatInput` passes those values through verbatim, so Flow's server-side concat
+stretches a 7s clip into an 8s slot by holding the last frame and muting. An
+N-segment chain has N−1 of these; the final segment escapes only because the
+render ends before its padding (23.02s for 3 clips, not 24s).
+
+**Filed, not guessed at.** It is in [KNOWN_ISSUES.md](../KNOWN_ISSUES.md) with the
+three questions that must be answered before any clamp is written — whether 7.0s
+holds across models, aspects and tiers; whether Flow's own UI pads identically;
+and whether any API field reports true duration. `USAGE.md`, the CLI `--help` and
+`CHANGELOG.md` all say ~7s rather than 8s as a result. Three of the four deferred
+code-review findings block on this same question, deliberately.
+
+## 5. Recorded as NOT verified
+
+- **Portrait (`--aspect 9:16`).** The live run was 16:9. `veo_3_1_extension_lite`
+  advertises `LANDSCAPE,PORTRAIT` at the same 10 credits, and the resolver reads
+  the aspect from the listing, but no portrait extend has been submitted.
+- **`--aspect` against a mismatched source.** Not validated by the code, and hit
+  during this very run (landscape source, 9:16 default). Deferred deliberately —
+  the fix needs the source clip's real aspect, which needs either a media probe
+  or a listing field not yet confirmed to exist. Guessing there is precisely how
+  the 7s defect reached users upstream.
+- **Chains longer than 2 segments.** `-n` accepts up to 30; only `-n 2` was run.
+  Pacing, the per-segment interrupt context and the credit pre-flight are all
+  exercised at n=2, but a long chain's cumulative per-profile load is not.
+- **`--resume-from` against a live partial scene.** The resume arithmetic
+  (append at `last position + 1`, seed from the scene's real tail) is covered
+  offline against a fake scene; no interrupted live run has been resumed.
+- **The insufficient-credits refusal, live.** Verified offline only — the account
+  had enough balance, so the pre-flight never fired against Flow.
+- **Ctrl+C mid-run, live.** The per-segment interrupt context is unit-tested; no
+  live run was interrupted.
+- **`OperationKind.EXTEND` rows.** Asset rows land; the operation row is not
+  written yet, so `gflow data` shows the media but not the operation. Deferred
+  with reasons.