gflow-cli 0.70.0__tar.gz → 0.71.0__tar.gz

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.70.0",
+  "version": "0.71.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/.github/dependabot.yml

@@ -111,32 +111,6 @@ updates:
         applies-to: version-updates
         patterns: ["*"]
 
-  # npm — the PR-triage sandbox's pinned Claude Code CLI
-  # (scripts/autopilot/package-lock.json, installed via `npm ci` in
-  # Dockerfile.triage).
-  - package-ecosystem: "npm"
-    directory: "/scripts/autopilot"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "08:00"
-      timezone: "Europe/Lisbon"
-    open-pull-requests-limit: 2
-    labels:
-      - "dependencies"
-
-  # Docker — the digest-pinned node:20-slim base of Dockerfile.triage.
-  - package-ecosystem: "docker"
-    directory: "/scripts/autopilot"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "08:00"
-      timezone: "Europe/Lisbon"
-    open-pull-requests-limit: 2
-    labels:
-      - "dependencies"
-
   # uv — the hash-pinned MkDocs set for the Pages build
   # (website/requirements.txt, compiled from website/requirements.in).
   # "uv", NOT "pip", for the same reason as the root entry: the pip ecosystem

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/.github/workflows/pages.yml

@@ -59,4 +59,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/.github/workflows/release.yml

@@ -73,7 +73,7 @@ jobs:
         # Configure once at https://pypi.org/manage/account/publishing/
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           generate_release_notes: true
           files: dist/*

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/.gitignore

@@ -45,6 +45,15 @@ secrets.json
 .env.local
 .env.*.local
 
+# Runtime state written into this repo by tools run FROM this directory.
+# social-publisher's queue defaults to a RELATIVE path (its cli.py: SP_QUEUE_DB,
+# default "state/queue.sqlite"), so invoking it — or its MCP server — with this repo
+# as CWD silently creates state/queue.sqlite here. On 2026-09-07 that produced a
+# second, EMPTY queue that a dry-run then read and reported as "nothing pending",
+# while the real queue sat in social-publisher/state/. Untracked and unignored, it
+# was also one `git add -A` from being committed.
+state/
+
 # Generated outputs
 out/
 tmp/

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/AGENTS.md

@@ -62,7 +62,8 @@ If you can help unblock a pure HTTP transport (especially for video generation,
 ## Dev environment tips
 
 - `uv sync` then `uv run playwright install chromium`. No global Python install needed.
-- Copy `.env.template` to `.env.local`; never commit `.env.local`. It documents every env var.
+- Copy `.env.template` to **`.env`** — either in the directory you run `gflow` from (project-local) or at `$GFLOW_CLI_HOME/.env` (machine-wide); on conflict the CWD one wins. It documents every env var. Both are gitignored; never commit either.
+  **Not `.env.local` — nothing loads that file.** `config.py::_env_files()` returns exactly `(<home>/.env, .env)`, so `GFLOW_CLI_*` settings put in `.env.local` are silently ignored and `get_settings()` reports the default as though you had set nothing. Keeping a `.env.local` for credentials **you** read by hand (e.g. `SONAR_TOKEN`) is fine — it is only wrong as a home for gflow's own settings.
 - Output goes to `./tmp/` for scripts/tests or `$GFLOW_CLI_OUTPUT_DIR` for CLI outputs (defaults to `./out/`).
 - One-time auth: `gflow auth login --browser chrome` (recommended — a real-Chrome profile is what generation runs need; the default `--browser auto` can also pick the internal strategy, and generation later fails fast on profiles created with a non-chrome strategy).
 - Use `/gflow:status` to see the current task before starting work; `/gflow:known-issues` before touching auth or reCAPTCHA code paths.
@@ -105,7 +106,7 @@ the five other mirror axes), which no command here can check and no CI gate can
 
 - Type hints everywhere; `pyright` strict on `src/gflow_cli`.
 - Structured logging only (`structlog`) — **never** raw `print()` or `import logging` in `src/`.
-- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–36, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
+- Errors as RFC 9457 Problem Details with stable per-class exit codes (3–37, e.g. 11 is `ConfigurationError` — including `ProfileLockedError` for same-profile lease contention, 16 is the `DataStoreError` family, 19 `SceneConcatError`, 20 `FrameExtractionError`, 21 `ChainPartialError`, 22 `UpscaleUnavailableError`, 25 `FlowAgentUiError`, 28 `UiModeUnavailableError`, 29 `MentionIndexUnavailableError`, 30 `QueueSchemaError`, 37 `InsufficientCreditsError`). See `src/gflow_cli/errors.py::EXIT_CODE_MAP` for the complete mapping. Exit 33 is reserved outside that map: `gflow doctor` findings-present — a successful diagnosis, not an error class.
 - 100-char line length, `ruff` configured. Imports sorted by `ruff` (isort rules).
 - **YAGNI / least-code**: prefer the smallest change that works. No speculative abstractions (interface/factory with one implementation), no config or flags nobody sets, no dead constants/helpers, no reinventing the stdlib. Review carries this as its own lens — the **D14 over-engineering** dimension of [`pr-council-review`](skills/pr-council-review/SKILL.md) (baseline, always runs). Its rubric is portable; the `ponytail` plugin (see CONTRIBUTING) is an optional accelerant, not a dependency.
 - **MCP & CLI Schema Symmetry**: Any updates or additions to user-facing CLI command parameters (e.g., `gflow image t2i`, `gflow video`) must be mirrored in the corresponding MCP tool definitions. Never add option/argument fields to Click commands without updating the MCP server implementation. This symmetry is enforced programmatically in CI via `tests/mcp/test_cli_parity.py` (every CLI leaf command needs a mapped MCP tool or an explicit, reasoned exemption) plus the schema checks in `tests/mcp/test_server.py`.

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/CHANGELOG.md

@@ -7,6 +7,261 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.71.0] — 2026-09-07
+
+### Fixed
+
+- **`--format-prompt` could submit an EMPTY prompt and log it as success.** The
+  observed-rewrite gate compared `abs(len(current) - len(typed)) >= 16`, and `abs` accepts
+  change in either direction. Flow **clears** the composer before repopulating it, so a poll
+  landing in that window read `""`, `abs(0 - 19) = 19` passed the gate, and `_send_prompt`
+  called `_click_submit` on the very next line — submitting nothing, on a path that spends
+  image quota, while `ui_automation.prompt_formatted` logged `prompt_len_after=0`
+  (`prompt_hash=e3b0c442`, the SHA-256 of the empty string).
+
+  Silent, billed, and self-certifying: a user hitting it would see a charge, an empty
+  result, and a log line saying it worked. It is also the exact defect the same release
+  fixes — a success signal that fires on the **absence** of the thing it measures — rebuilt
+  inside its own fix.
+
+  The gate now requires **growth** (`len(current) >= len(typed) + MIN_DELTA`) rather than an
+  absolute delta, plus a settle check: two reads one poll-interval apart must agree, because
+  the single discrete swap measured live was sampled at 250 ms and a partial write between
+  samples was never ruled out. Found by an adversarial review of the fix, not by the fix's
+  own tests. ([#745](https://github.com/ffroliva/gflow-cli/issues/745))
+
+- **The entity guard recorded a cause that was wrong, and it is retracted.** The
+  `reference_entities` refusal in `_unported_form` said the submit *"never produces a
+  YhhmEf/eb1hJf/MZZa6b reply"*, cause unknown, undiagnosable without fixing
+  [#722](https://github.com/ffroliva/gflow-cli/issues/722). Reading the wire live shows
+  otherwise: `MZZa6b` **does** reply, with a null payload and an error slot, and the generation
+  is **accepted and queued** — Flow derives an `abra_r2v_8s` model key and renders it. What
+  fails is the observer: a null payload never names a media id, so `submit_and_observe`'s
+  `submitted` future never resolves and `SUBMIT_REPLY_BUDGET_S` (60 s) expires. That budget's
+  own comment records its calibration — *"the submit reply arrived 4.0–4.6 s after the click"* —
+  against an idle queue, while Flow allows **five concurrent generations** and throttles
+  per-minute throughput after heavy daily use. The run exits 9 `TransportTimeoutError` while the
+  video is still rendering. The guard **stays** (a timeout reported on a generation that is
+  actually running is worse for the user than an explicit refusal) but its reason is now
+  accurate and the fix is named beside it: on a null submit payload, fall through to the
+  `jwpduf`/`as29s` status poll. Two earlier comments on that guard, including one added in this
+  release, asserted the wrong cause.
+  ([#723](https://github.com/ffroliva/gflow-cli/issues/723),
+  [#742](https://github.com/ffroliva/gflow-cli/pull/742))
+- **`docs/CHARACTER.md` and `docs/CHARACTER_RECON.md` disagreed on the voice wire case, and one
+  was wrong.** CHARACTER.md called the Capitalized UI name canonical while flagging the question
+  UNVERIFIED; CHARACTER_RECON.md recorded `presetVoiceId: "gacrux"` and stated the preset id is
+  the lowercased name. A live run settles it: `sent='Charon' stored='Charon' identical=True`.
+  Both documents now also record that `personalityNotes` is **Agent-scoped** — Flow's own editor
+  says *"The Flow agent can use this information to help craft scenes with your character"* — so
+  it is not a control on the audio engine and should not be expected to steer a `t2v`/`r2v`
+  performance. ([#736](https://github.com/ffroliva/gflow-cli/pull/736))
+- **The "+ New project" CTA is found by structure again, not by English.** Its Tier-1 anchors
+  all targeted the `add_2` ligature. The migrated `flow.google.com` gallery renders **`add`**
+  under a `<mat-icon>` and renders `add_2` nowhere on that surface, so every structural entry
+  missed and the CTA was reached only by `button:has-text('New project')` — the localised-text
+  anti-pattern Tier 1 exists to avoid, and one that fails outright on a non-English migrated
+  profile. Tier 1 now leads with a class-only `add` anchor covering both carriers; measured on
+  the live gallery (control: 47 ligature nodes) it matches 1 where every previous entry
+  matched 0.
+
+  Also removed: `button:text-matches('^\+\s+\S+$', 'i')`. It is not a valid Playwright
+  selector and **raised on every evaluation** — observed twice against the live gallery — with
+  `except Exception: continue` swallowing it, so it had never matched anything on any host
+  while costing a round trip per attempt.
+
+  **This reverts the guard added moments earlier in the same release.** That guard raised
+  `FlowHostMigratedError` claiming the migrated host "renders no '+ New project' control gflow
+  can drive". It was an unproven negative, generalised from a sweep of two other surfaces to a
+  third that was never probed, and a live run disproved it in one click by creating a project
+  there. On a non-EN migrated profile it would have told the user that host has no such
+  control — false, and a dead end — when the real fix was to anchor on `add`.
+  ([#730](https://github.com/ffroliva/gflow-cli/issues/730))
+
+- **~~A migrated-host gallery no longer reports a missing control as selector drift.~~ REVERTED WITHIN THIS RELEASE — kept for the record, see the bullet above.** The guard described below shipped and was removed again before the tag, because a live run created a project on that very surface in one click. The net change in v0.71.0 is the one above: the CTA is anchored structurally on `add` instead of by English text. Nothing in the paragraph that follows is behaviour you will find in this release.
+  `NEW_PROJECT_SELECTORS` anchors on the `add_2` ligature. The migrated `flow.google.com`
+  frontend renders **`add`** and renders `add_2` **nowhere** — composer `add=1/add_2=0`,
+  editor `add=2/add_2=0`, measured with per-surface controls. That is a ligature *name*
+  drift, not the carrier split, so a `mat-icon` twin would not have helped. Reaching the
+  sweep there produced `Could not find 'New project' CTA on Flow gallery`, whose remediation
+  is "check for a newer release, then file a frontend bug" — unfixable by the reader, and
+  pointing at the wrong culprit, exactly as a credit shortfall once reported as frontend
+  drift. It now raises `FlowHostMigratedError` naming the host and the way forward
+  (`--project`, which every migrated path already requires). On labs a missing CTA is still
+  reported as drift, because there it genuinely is.
+
+  No production path reaches this today — `migrated_can_serve` refuses without a
+  `project_id`, `ensure_editor` navigates straight to the project URL, and `character create`
+  requires `--project`. The `add_2` drift is therefore harmless **because of those guards**,
+  which is precisely what a future port relaxes; the measured fact now sits beside the
+  constant so the next person to un-guard a path meets it.
+  ([#730](https://github.com/ffroliva/gflow-cli/issues/730),
+  [spike](docs/superpowers/spikes/2026-09-07-ligature-carrier-and-name-drift.md))
+
+- **Flow's own diagnostics were blind on the migrated host, and two selectors were broken behind
+  it.** `gflow`'s incident-bundle DOM dump queried `i.google-symbols, span.google-symbols`, and
+  `diagnostics.py`'s `STRUCTURAL_DOM_JS` queried `i.google-symbols` — so on `flow.google.com`,
+  where every Material Symbols ligature rides a `<mat-icon>`, **both reported zero ligatures**.
+  The instrument used to diagnose selector drift was blind to the host the drift lives on. That
+  is why [#727](https://github.com/ffroliva/gflow-cli/issues/727) and
+  [#731](https://github.com/ffroliva/gflow-cli/issues/731) stayed invisible, and why an incident
+  bundle from a migrated user named no ligatures at all. Both queries are now class-only.
+
+  Two selectors were broken behind that blindness. `SUBMIT_BUTTON_SELECTORS` was **working by
+  luck**: its two tag-qualified entries matched nothing on the migrated host and the submit only
+  landed because a third `has-text` entry matches the `<mat-icon>`'s *text* — observed live as
+  `prompt_submitted via="button:has-text('arrow_forward')"`, after paying two misses per submit.
+  `IMAGE_MODEL_PICKER_TRIGGER` had neither twin nor fallback, so its miss was total and silent:
+  the picker is best-effort, so generation simply proceeded on whatever model tier the editor
+  opened at. Both now anchor on the `google-symbols` **class**, which sits on the labs `<i>` and
+  the migrated `<mat-icon>` alike — verified against a real CSS engine, offline, in
+  `tests/api/transports/test_ligature_carrier.py`.
+
+  `SUBMIT_BUTTON_SELECTORS` also moves from `:text` to **`:text-is`**. `:text` is a substring
+  match and accepts `arrow_forward_ios`, a real Material Symbol; the `<i>` qualifier had been
+  containing that, and dropping it for the class-only carrier made the over-match reachable on
+  the submit path. The two-carrier fixture caught it as `matched 3 of 2` before it ran live.
+  ([#730](https://github.com/ffroliva/gflow-cli/issues/730),
+  [spike](docs/superpowers/spikes/2026-09-07-ligature-carrier-and-name-drift.md))
+
+- **`character create --format-prompt` works again — both halves of it.** The flag had two
+  independent faults, and fixing only the first would have left it just as useless. On the
+  migrated `flow.google.com` host
+  all three entries of `PROMPT_FORMAT_SELECTORS` missed, so the flag degraded to a no-op:
+  `ui_automation.format_button_not_found`, exit **0**, prompt submitted as
+  typed, and the image quota spent on a run whose requested prompt-engineering step never
+  happened. The button was never absent. Measured on 2026-09-07 with
+  `scripts/dev/spike_character_prompt_format.py` (`$0` — navigation, one free `createEntity`,
+  DOM reads and typing; two control anchors, so a flat zero could not be mistaken for
+  absence): it renders as
+  `<flow-format-prompt-button>`, and the Angular frontend carries the unchanged
+  `personal_recommendations` ligature in **`<mat-icon>`** rather than `<i>` — the same carrier
+  split fixed for `add_2` / `arrow_drop_down` / `accessibility_new` in #703, which this constant
+  was not swept with. The EN `span:text-is('Format')` fallback missed too and is **deleted**
+  rather than translated: the button's own `aria-label` reads `"Formatar"` on a pt account, and
+  display labels are banned as anchors. The cascade now leads with the custom element and covers
+  both carriers. ([#727](https://github.com/ffroliva/gflow-cli/issues/727),
+  [spike](docs/superpowers/spikes/2026-09-07-character-format-button-anchor.md))
+
+- **`video t2v --reference-entity` no longer bills a clip that ignores the entity.** On the
+  migrated `flow.google.com` host the "character references are not ported" refusal lived inside
+  the r2v branch of the routing gate, so a t2v request returned from that gate before its
+  `reference_entities` were ever inspected — and nothing downstream attaches one there
+  (`attach_start_frame` is i2v-only, `attach_references` and the chip verification are r2v-only).
+  The run was submitted and **billed**, returning a plausible clip with an unbound face. That is
+  strictly worse than the exit 36 it was meant to give: a refusal is free and honest. The
+  sibling gate `migrated_can_serve` did refuse, but it only feeds `prefer_migrated`, and an
+  account Flow has already moved is routed by its URL without consulting it — so the refusal was
+  unreachable for exactly the accounts that needed it. The check is now mode-independent and
+  ahead of every early return. ([#716](https://github.com/ffroliva/gflow-cli/issues/716))
+- **A credit shortfall is no longer diagnosed as a moved frontend.** On the migrated
+  `flow.google.com` host, an account whose balance is short **for the model it asked for**
+  produced `UiSelectorDriftError` (exit 23) — *"A Flow editor UI element could not be
+  located — Google may have updated their frontend. Check for a newer gflow-cli release,
+  then file a bug"*. Flow does not **disable** the submit control, it **replaces** it:
+  `arrow_forward` disappears and a `prompt-warning-button` carrying
+  `aria-label='Insufficient credits warning'` takes its place, so the anchor's absence
+  tracks the credit state, not the frontend. Measured by A/B on 2026-09-07 —
+  `scripts/dev/spike_migrated_submit_anchor.py`, same probe and same code ~60 s apart,
+  two accounts rendering the mirror image of each other. The wallet was **not** empty:
+  it held **50** credits and the run asked for `--model veo-quality`, which costs **100**.
+  That distinction is the actionable half — "you have no credits" is a dead end for
+  someone holding 50, while "short for this model" has a remedy: pick a cheaper tier
+  (`veo-lite` is 10). Every path that gives up on the submit control now checks for the
+  warning before naming a culprit, and reports the new `InsufficientCreditsError`
+  (**exit 37**) instead. Genuine drift — a missing anchor with no warning beside it —
+  still reports 23. Beyond the wrong message, the old behaviour manufactured
+  frontend-drift bug reports that no code change could ever fix.
+
+### Changed
+
+- **`--format-prompt` now waits for the rewrite, and `ui_automation.prompt_formatted` means it
+  happened.** This is the second half of the #727 fix and the half that made the flag useful.
+  Flow rewrites **server-side** — a `batchexecute` round trip reaching the composer at ~5.4s
+  (measured, `denon82`) — while the old code waited `_jitter_ms(500)`, logged
+  `prompt_formatted` and returned; `_send_prompt` submits on the very next line. So the flag
+  shipped the prompt the user typed and discarded the rewrite on **every** run, with a success
+  event in the log and exit 0.
+
+  **The defect was never the duration. It was reporting a success we had not observed** — the
+  absence of a completion inside a window we chose, recorded as a completion. Same class as a
+  20s selector timeout read as "the feature is absent" and a bundle captured after teardown
+  read as "the DOM was gone". This one was the worst of the three because it failed toward
+  **success**: a premature green looks exactly like the feature working, so nobody investigates
+  a pass.
+
+  `format_character_prompt` now polls the bound composer until its text actually changes, and
+  returns `True` only then. The gate is the DOM, not the wire — the `batchexecute` response
+  arrives **4.2s before** the text settles, so awaiting it would reproduce the same early
+  submit. Comparing against the string gflow inserted is locale-invariant by construction, and
+  a **length delta** rather than `!=` keeps Slate's whitespace normalisation from re-reporting
+  the same false success. Telemetry carries lengths and a stable hash, never the prompt text:
+  Flow *elaborates* a terse description into a detailed physical one, so the rewrite is more
+  PII-dense than the input.
+
+  New events: `format_button_clicked` (the old semantics), `format_not_observed` (clicked, no
+  rewrite inside the budget — it does not claim Flow failed, since an unchanged box also covers
+  Flow declining or judging the prompt already formatted).
+
+  **Two user-visible consequences.** A create with `--format-prompt` takes a few seconds longer
+  for the rewrite itself, and — because the reshaped prompt is longer and more detailed — the
+  generation is materially slower: **406s vs a 210s control** on the same account and prompt,
+  live-verified 2026-09-07.
+  ([#727](https://github.com/ffroliva/gflow-cli/issues/727),
+  [spike](docs/superpowers/spikes/2026-09-07-format-click-is-not-a-format.md))
+
+- **Retracted a false "measured" claim about the migrated composer.** A code comment asserted, as
+  "measured, not assumed", that the migrated project composer "has no image-generation mode".
+  Falsified live on 2026-09-07: its settings overlay opens to six radiogroups / sixteen radios and
+  the first is `[imageImage, videocamVideo]`, present and hit-testable, with the VIDEO option
+  carrying `aria-checked`. This reproduced an enumeration already committed on 2026-09-04,
+  exactly, on a different account. That does **not** establish that `image` works there — nothing
+  was clicked on the mode axis and nothing was submitted — only that the claim it cannot is
+  unfounded. Stating it more strongly would repeat the defect being retracted. The guard stays
+  until the port lands, but it no longer tells anyone the host cannot do this. ([#692](https://github.com/ffroliva/gflow-cli/issues/692),
+  [spike](docs/superpowers/spikes/2026-09-07-migrated-composer-has-an-image-mode.md))
+- **A spike that cannot reach its surface now fails instead of concluding.**
+  `spike_migrated_image_capability.py` opened the settings overlay best-effort and swallowed the
+  exception, so it printed "the migrated composer looks VIDEO-ONLY" even when it had never opened
+  the panel — and that sentence became the retracted claim above. It now raises
+  `SpikeUnreachedError` and exits 3 with "This is a failed measurement, NOT evidence of absence".
+  Two features have now been declared absent by a probe that failed silently; the first was
+  `character create`, killed by a single 20 s selector timeout.
+
+### Added
+
+- **`gflow character create --voice` is now verified end to end.**
+  `tests/e2e/test_character_create_e2e.py::test_character_create_attaches_voice_and_personality`
+  drives a live create then reads the character back from Flow. Until it existed, a repo-wide
+  grep for `--voice` across `tests/e2e/` matched **nothing**: every voice test was a unit test
+  of the hardcoded `VOICES` constant, and the one that looked live parsed a fixture. A voice
+  that silently failed to attach was invisible to the whole suite while the command exited 0.
+  Personality is asserted hard, unlike the sibling UTF-8 test which guards it as
+  `if shown_personality:` and passes vacuously when the field is absent.
+  ([#736](https://github.com/ffroliva/gflow-cli/pull/736))
+- `scripts/dev/spike_entity_submit_rpcs.py` — attaches a character, submits, and logs **every**
+  `batchexecute` rpcid rather than only the three in `SUBMIT_RPCS`, plus the submit request's
+  model key. `scripts/dev/spike_project_media_status.py` — reads a project's generation state
+  read-only, `$0`, submitting nothing.
+  ([#741](https://github.com/ffroliva/gflow-cli/issues/741))
+- **`video-production` skill § 4b-bis — the whole recipe for a cast with VOICES.** A character
+  entity is the only thing that carries a voice; a plate carries face and wardrobe as pixels and
+  the engine invents a new voice per clip. Measured across three plate-bound takes of one
+  character: **88 / 103 / 118 Hz**, three different actors, against a **4.3 Hz** engine noise
+  floor on an identical prompt repeated three times. The skill said to prefer rung 1 and never
+  said what skipping it costs, so a production could reach a finished cut before anyone noticed
+  the cast had no voices.
+- `scripts/dev/spike_host_lane.py` — names a profile's lane (labs / migrated / **signed out**) in
+  one $0 run. It reports `SIGNED_OUT` as a distinct verdict and refuses to name a lane there,
+  because a signed-out profile is otherwise indistinguishable from a migrated one: with no
+  session, `labs.google/fx/…` renders its marketing shell and `flow.google.com/project/<id>`
+  redirects to `/about`. Read either in isolation and you conclude "this account was moved" from
+  a dead cookie.
+- `scripts/dev/spike_migrated_composer_mode_axis.py` — hard-error probe that opens the migrated
+  composer's settings overlay and enumerates its radiogroups.
+- `scripts/dev/spike_format_prompt_effect.py` — measures whether clicking Format actually
+  rewrites the prompt, and when. `$0`, never submits.
+
 ## [0.70.0] — 2026-09-06
 
 ### Fixed
@@ -4228,7 +4483,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.70.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.71.0...HEAD
+[0.71.0]: https://github.com/ffroliva/gflow-cli/compare/v0.70.0...v0.71.0
 [0.70.0]: https://github.com/ffroliva/gflow-cli/compare/v0.69.0...v0.70.0
 [0.69.0]: https://github.com/ffroliva/gflow-cli/compare/v0.68.0...v0.69.0
 [0.68.0]: https://github.com/ffroliva/gflow-cli/compare/v0.67.0...v0.68.0

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/KNOWN_ISSUES.md

@@ -16,9 +16,11 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ### Flow is migrating to `flow.google.com`; gflow drives the migrated frontend for t2v, i2v from a local start frame, and r2v from local reference files (rest of the matrix pending)
 
-- **Status:** Open (partially resolved) · **Severity:** High for everything except text-to-video, local-file image-to-video and local-file reference-to-video · **Affected:** on accounts the rollout has reached, `gflow video t2v`, `gflow video i2v --initial-frame <local file>` and `gflow video r2v --ref <local file>` now run on the migrated host (with `--project`); an end frame, a frame by UUID or `@Name`, references by `@Name` or `--reference-entity`, `image`, characters, scenes, extend, instructions and tools are not ported yet and still exit 36
+- **Status:** Open (partially resolved) · **Severity:** High for everything except text-to-video, local-file image-to-video and local-file reference-to-video · **Affected:** on accounts the rollout has reached, `gflow video t2v`, `gflow video i2v --initial-frame <local file>` and `gflow video r2v --ref <local file>` now run on the migrated host (with `--project`); an end frame, a frame by UUID or `@Name`, references by `@Name` or `--reference-entity`, `image`, scenes, extend, instructions and tools are not ported yet and still exit 36. **`character` is NOT in that list any more** — `character create` was verified working on the migrated host in v0.70.0 and `character list` was re-verified there on 2026-09-07. This line claimed otherwise for a day, which is the dangerous direction for a stale doc to be stale in: a migrated user reading it concludes a working feature is impossible. Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker's tiles carry no media id); `scenes`, `extend`, `instructions` and `tools` have never had a probe run against them at all, so read them as *unported by gflow*, never as *impossible on the host*
 - **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
 - **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
+- **`--reference-entity` was refused on `r2v` but not on `t2v`** ([#716](https://github.com/ffroliva/gflow-cli/issues/716), fixed in the unreleased line, post-v0.70.0): the "not ported, exit 36" refusal above sat inside the r2v branch of the routing gate, so a `t2v` request carrying a character entity returned from that gate without its entities ever being inspected — and nothing downstream attaches one on this host. The generation was **submitted and billed** with the entity silently dropped, returning a plausible clip of the wrong person. The check is now mode-independent and ahead of every early return. If you ran `gflow video t2v @Name …` or `--reference-entity` on a moved account before this fix, the identity in those clips was never bound.
+- **The migrated composer DOES have an image mode** ([#692](https://github.com/ffroliva/gflow-cli/issues/692)): a code comment claimed, as "measured, not assumed", that it has none. Falsified 2026-09-07 — its settings overlay carries a `mode` radiogroup of `[imageImage, videocamVideo]`, present and hit-testable. Nothing was clicked on that axis and nothing was submitted, so this does **not** establish that `image` works on a moved account; it establishes only that the claim it cannot is unfounded. Read the remaining exit 36 as *gflow does not drive this yet*, never as *the host cannot do it*; see [the spike](docs/superpowers/spikes/2026-09-07-migrated-composer-has-an-image-mode.md).
 - **Image commands on a moved account** ([#673](https://github.com/ffroliva/gflow-cli/issues/673), fixed in the unreleased line, post-v0.68.0): through v0.68.0 `image t2i` / `i2i` (and `upscale`, `extend`) died with exit 1 `RecaptchaError` within seconds, before any submit, instead of the exit 36 above, because the labs client minted the reCAPTCHA token on the `flow.google.com` project grid before any migration guard ran. The guard now runs at the mint. If you still see a `RecaptchaError` on a moved account right after `auth login`, that is the labs logged-out landing page from the [#644](https://github.com/ffroliva/gflow-cli/issues/644) cookie harvest, not this.
 
 Google is moving Flow off Labs onto its own origin. On a migrated page load,

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.70.0
+Version: 0.71.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues
@@ -58,7 +58,7 @@ Requires-Dist: numpy>=1.24; extra == 'dev'
 Requires-Dist: pyright>=1.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
-Requires-Dist: ruff==0.16.5; extra == 'dev'
+Requires-Dist: ruff==0.16.6; extra == 'dev'
 Provides-Extra: gcs
 Requires-Dist: gcsfs>=2024.2.0; extra == 'gcs'
 Requires-Dist: universal-pathlib>=0.2.5; extra == 'gcs'

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/docs/AGENT_GUIDE.md

@@ -16,7 +16,7 @@ These are non-negotiable. They override default agent behavior where conflicts e
 - **TDD before code.** Write a failing test, then the minimum production code to make it pass, then refactor. Coverage floor: 80% overall. See [CONTRIBUTING.md](../CONTRIBUTING.md).
 - **Documentation is first-class.** Any user-facing, operator-facing, architecture, configuration, workflow, or agent-rule change must update the matching docs, changelog/release note when relevant, and docs index if a new doc is added. If no docs change, record the reason in the PR/checklist. `scripts/ci/check_doc_links.py` must pass before merge.
 - **No raw `print()` or `import logging` in `src/`.** Structured logging via `structlog` only.
-- **No secrets in commits.** `.env.local` is gitignored; never commit it. `pre-commit` hooks run `detect-secrets` on staged content.
+- **No secrets in commits.** `.env`, `.env.local` and `$GFLOW_CLI_HOME/.env` are all gitignored; never commit any of them. Note gflow only READS `.env` (CWD and home) — see [CONFIGURATION.md](CONFIGURATION.md). `pre-commit` hooks run `detect-secrets` on staged content.
 - **No AI attribution in commit messages.** `Co-Authored-By:` trailers are fine when explicitly requested; auto-generated `🤖 Generated with…` footers are not.
 - **Branch naming.** `feature/`, `bugfix/`, `hotfix/`, `chore/`, `docs/`, `test/`, `release/`. Never `claude/` or unprefixed.
 - **Signed tags only.** Releases tag with `git tag -s vX.Y.Z`. CI rejects unsigned or lightweight tags.

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/docs/CHARACTER.md

@@ -262,12 +262,28 @@ token that drives the sample URL, so a canonical id round-trips to a playable sa
 `gflow character create --voice <Name>` validates the value **case-insensitively** (so `charon` and `Charon`
 both normalize to the canonical `Charon`) and sets `audioReferences[].presetVoiceId` via the entity PATCH.
 
-> **Wire-case caveat (open):** a prior live run sent a **lowercase** id (`"charon"`) and Flow persisted it,
-> but whether Flow applies the voice from a lowercase id vs the Capitalized canonical form is **UNVERIFIED**.
-> gflow adopts the Capitalized form as canonical per the UI. The voice list is currently a **hardcoded
-> constant**; fetching the live list from Flow's voice API and confirming the `presetVoiceId` wire-case are
-> tracked in the [Backlog](#14-backlog--not-yet-implemented). A "create new voice" flow ("Criar nova voz")
-> exists in the UI but is **not yet implemented**.
+> **Wire-case: Capitalized round-trips — VERIFIED 2026-09-07.** A live e2e
+> (`tests/e2e/test_character_create_e2e.py::test_character_create_attaches_voice_and_personality`,
+> profile `ffroliva`) created a character with `--voice Charon` and read it back from Flow:
+> `sent='Charon' stored='Charon' identical=True`. The Capitalized canonical form is stored
+> unchanged, so `CHARACTER_RECON.md`'s older note that "the preset id is the lowercased name"
+> does **not** describe what the wire does today.
+>
+> **Still untested:** whether a *lowercase* id is also accepted (gflow never sends one — it
+> normalizes to Capitalized before the PATCH), and — separately and more importantly —
+> whether a bound voice is actually **applied to generated video audio**. Attachment to the
+> entity is proven; application at render time is not.
+>
+> **`personalityNotes` is Agent-scoped.** Flow's own character editor labels the field
+> "Character info (optional) — Describe how your character acts…" and states underneath:
+> *"The Flow agent can use this information to help craft scenes with your character."*
+> It is an input to Flow's **agent** when it writes scenes, not a control on the audio engine
+> and not a documented input to a direct composer generation. Do not expect it to steer
+> performance on a `video t2v` / `r2v` call — put the direction in the prompt instead.
+>
+> The voice list is currently a **hardcoded constant**; fetching the live list from Flow's
+> voice API is tracked in the [Backlog](#14-backlog--not-yet-implemented). A "create new voice"
+> flow ("Criar nova voz") exists in the UI but is **not yet implemented**.
 
 ## 8. CLI surface (shipped v0.12.0)
 
@@ -417,11 +433,21 @@ convenience later.
   - **Cost reality:** the feature is UI-automation-heavy (new character-editor + picker selectors), not the
     "mostly REST" earlier framing. Structural metadata is REST; the value-generating steps are UI.
 
-## 12. UI-automation selectors (Option B) — VERIFIED 2026-06-02
+## 12. UI-automation selectors (Option B)
 
 Language-agnostic (ligature/structural) selectors. Flow renders in the profile locale, so **never match on
-localized text** — use Material-Symbol ligatures (`i.google-symbols:text('<lig>')`) or structure. Rows marked
-**VERIFIED** are confirmed against the shipped `api/transports/ui_automation.py` + spike DOM dumps (denon82).
+localized text** — use Material-Symbol ligatures or structure.
+
+> **The ligature carrier differs by host.** `labs.google` renders ligatures in
+> `<i class="google-symbols">`; the migrated `flow.google.com` Angular frontend renders the SAME ligature in
+> `<mat-icon>` (which also carries the `google-symbols` class — the class was never the discriminator, the
+> tag is). A cascade anchored on one carrier returns a flat zero on the other host while the control is
+> fully visible — indistinguishable, from the driver's side, from the feature being gone. Tracked in #730.
+>
+> **Each row is dated against the code it was read from, and rows are re-derived from the shipped
+> constants rather than edited in place.** They previously carried an undated **VERIFIED** marker and went
+> stale at #703 without anyone noticing — a row marked verified that is not is worse than no row, because
+> it is what a reader trusts *instead of* reading the code (#731).
 
 **Editor URL (VERIFIED — `/fx/` prefix required).** After REST `createEntity`, the character-editor path is
 
@@ -437,16 +463,16 @@ owned by gflow) and the body-mode activation/settle signals.
 
 | Purpose | Selector | Conf. |
 |---|---|---|
-| Editor-ready anchor | the prompt textbox becoming visible: `div[role=textbox][data-slate-editor='true']` (`_CHARACTER_EDITOR_READY_SELECTOR`) | **VERIFIED** |
-| Prompt box (char editor) | `div[role=textbox][data-slate-editor='true']` (== `PROMPT_INPUT_SELECTORS[0]`) | **VERIFIED** |
-| Generate / submit | `arrow_forward` google-symbols button: `button:has(i.google-symbols:text('arrow_forward'))` (== `SUBMIT_BUTTON_SELECTORS`) | **VERIFIED** |
+| Editor-ready anchor | `div[role="textbox"][data-slate-editor="true"], div.ProseMirror[contenteditable="true"]` (`_CHARACTER_EDITOR_READY_SELECTOR`) — **both frontends**: labs mounts Slate, `flow.google.com` mounts ProseMirror. Asking only for Slate reported 0 boxes on a migrated editor whose box was visible the whole time. | read from code 2026-09-07 |
+| Prompt box (char editor) | the `PROMPT_INPUT_SELECTORS` cascade, **not** its first entry. `[0]` is the Slate anchor; on the migrated host it misses and `[1]` `div[contenteditable="true"]` is what matches (observed live 2026-09-07, `ui_automation.prompt_input_found`). | read from code + live 2026-09-07 |
+| Generate / submit | `SUBMIT_BUTTON_SELECTORS` — `button:has(i.google-symbols:text('arrow_forward'))`, then `button:has(i:text(…))`, then `button:has-text('arrow_forward')`. ⚠️ **Single-carrier**: on the migrated host both `<i>` entries miss and only the third (which matches the `<mat-icon>`'s text) fires — observed live 2026-09-07, `prompt_submitted via="button:has-text('arrow_forward')"`. Working by luck, not by design; tracked in #730. | read from code + live 2026-09-07 |
 | Name field | `input[placeholder]` — localized placeholder; **do NOT rely on the text** (structural: it is the editor's lone placeholdered input) | **VERIFIED** |
 | Personality field | the panel `textarea` (localized placeholder) — **prefer REST PATCH** | **VERIFIED** |
 | Slot 0 image (face) | aria-label `"Imagem do personagem 1"` — **localized**, note only (do not load-bear on the text) | med (localized) |
-| **Body mode (slot 1)** | Current cohort: portrait-image sibling `button:has(img) + button:has(i.google-symbols:text-is('accessibility_new'))`; settle signal: a newly mounted generated-media card with an `img` and exact `cancel` icon. Legacy cohort fallback: icon-only `[role=button]` carrying exact `add_2`, followed by Slate-box count rise. No localized button text or positional index. | **VERIFIED** live 2026-07-26 |
-| Model picker (char editor) | `button[aria-haspopup='menu']:has(i.google-symbols:text-is('arrow_drop_down'))` *(normal editor uses `crop_16_9`)* | **VERIFIED** |
+| **Body mode (slot 1)** | `_CHARACTER_BODY_MODE_SELECTOR` = `button:has(img) + button:has(i.google-symbols:text-is('accessibility_new'))` **or** `flow-slot-chip-button:has(mat-icon:text-is('accessibility_new')) button` — the second alternative is the migrated host's custom element and was added in #703; the row omitted it until #731. Settle signal: a newly mounted generated-media card with an `img` and exact `cancel` icon. The chip ships `disabled` until a portrait exists. | read from code 2026-09-07; behaviour live 2026-07-26 |
+| Model picker (char editor) | `_CHARACTER_MODEL_PICKER_TRIGGER_SELECTORS` — `arrow_drop_down` under **either** carrier, on `button` **and** `[role='button']` (4 entries). The row previously showed an `aria-haspopup='menu'` variant that appears in none of them. Omitting the `mat-icon` entries logged `model-picker trigger not found` on the migrated host and generated on whatever tier the editor opened at (live 2026-09-06). | read from code 2026-09-07 |
 | Voice picker | `voice_selection` google-symbols ligature | **VERIFIED** (ligature) |
-| Personagens nav (project) | `button:has(i.google-symbols:text-is('accessibility_new'))` (cards are `div[role=button]`; tag disambiguates) | high |
+| Personagens nav (project) | `button:has(i.google-symbols:text-is('accessibility_new'))` (cards are `div[role=button]`; tag disambiguates). ⚠️ single-carrier — see #730. | high (unre-verified) |
 | Delete character (rm, v2) | `button:has(i.google-symbols:text-is('delete'))` | high |
 | Picker tab → Personagens | `[role=dialog] button[role=tab]:has(i.google-symbols:text-is('accessibility_new'))` | high |
 | **Picker "include in command"** | primary `button` in the dialog footer — **no ligature → structural anchor (last/primary dialog button)**; only appears *after* an option is selected | low ⚠️ |

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/docs/CHARACTER_RECON.md

@@ -28,8 +28,13 @@ entity {
     entityType: "CHARACTER"
     displayName                  # "Denidra" (default "Untitled Character")
     characterInfo {
-      personalityNotes           # free text — guides actions when not specified in a prompt
-      audioReferences: [ { presetVoiceId: "gacrux" } ]      # voice; preset id is lowercased name
+      personalityNotes           # free text — Flow's editor says the AGENT uses it to craft
+                                 # scenes; NOT a documented input to a composer generation
+      audioReferences: [ { presetVoiceId: "Charon" } ]      # voice; Capitalized id round-trips
+                                 # unchanged (e2e-verified 2026-09-07: sent 'Charon', stored
+                                 # 'Charon'). The earlier "lowercased name" note above this
+                                 # line came from one capture and does NOT hold today; see
+                                 # CHARACTER.md § 7.
       imageReferences: [ { workflowId }, { workflowId } ]   # face + body (point to WORKFLOWS, not media)
     }
   }

{gflow_cli-0.70.0 → gflow_cli-0.71.0}/docs/GITHUB.md

@@ -38,8 +38,10 @@ This workflow must not checkout the PR branch, install dependencies, run tests,
 
 ### PR-Triage Autopilot (VPS Sandbox)
 
-To automate deeper verification, an hourly `hermes-ops` cron job runs on the host VPS to triage eligible external PRs. 
-- It uses the deterministic **Stage 0 pre-filter** (`pr_triage_gate.py`) to confirm eligibility.
+> **Moved out of this repo in v0.71.0.** The runner is hosted privately; `scripts/autopilot/`, `eval/pr_triage_*` and `pr_triage_gate.py` are no longer here. The design notes below are kept as history — do not go looking for the scripts.
+
+An hourly `hermes-ops` cron job triaged eligible external PRs on the host VPS.
+- It used the deterministic **Stage 0 pre-filter** (`pr_triage_gate.py`) to confirm eligibility.
 - It fetches the PR branch and runs the full `/gflow:pr-council-review` inside an **ephemeral, non-root, read-only Docker container sandbox** (with restricted network egress and no write credentials).
 - The host orchestrator posts the review comment to the PR and alerts the maintainer via Telegram.
 - For design details, see [2026-07-04-pr-triage-autopilot-design.md](superpowers/specs/2026-07-04-pr-triage-autopilot-design.md) and the implementation plan [PLAN.md](superpowers/plans/2026-07-08-pr-triage-autopilot/PLAN.md).