short-drama-delivery-audit

# short-drama-delivery-audit

Internal machine-owned gate used immediately before `meta-short-drama`
publishes its final video. It does not call a model and never contacts a media
provider.

The helper parses the canonical `script.txt` to identify active shots and
their content durations. It then requires sanitized real-provider receipts
for the reference image, every active shot image, and every active shot video;
rejects placeholders, missing provider request/job IDs, and any runtime
fallback substitution; and uses `ffprobe` to confirm that shot MP4s and the
final MP4 are decodable and have the promised durations.

When Seedance rejects a shot under provider policy, its sidecar contains only
the bounded reason `provider_policy_rejected` and an allowlisted policy code.
The audit preserves those two fields, marks the shot not generated, and
reports `VIDEO_POLICY_REJECTED`; raw provider text, signed URLs, request IDs,
and secrets are discarded before this boundary.

The parent scheduler supplies one bounded disposition per paid step. The only
accepted values are `safe_no_submit`, `maybe_accepted`, and `receipt`. It also
supplies a separate bounded SHA-256 proof only when the exact bundled paid
subprocess emitted a sanitized receipt on this invocation and the emitted JSON
matched the resulting sidecar. A conclusive generated/policy receipt upgrades
the public asset disposition to `confirmed` only when that current-run proof
matches. The reserved runtime slots cannot be declared as plan steps.

When `safe_no_submit` accompanies a missing receipt and local fallback, the
audit preserves the degraded provenance but does not claim that the provider
may have billed the user. A `maybe_accepted`, `receipt`, missing, or malformed
disposition without a conclusive, current-run-proven receipt remains
fail-closed: the audit emits
`PAID_SUBMISSION_STATUS_UNKNOWN`, a sanitized asset-name list, and a static
instruction to check provider history before starting a replacement. Raw
fallback output, child failure text, and provider text never cross into the
verdict. A stale or forged workspace sidecar by itself is reported as
`RECEIPT_NOT_PROVEN_CURRENT_RUN` and can never become `confirmed`.

Receipt or media evidence for a shot absent from the canonical script is
reported as `UNEXPECTED_PAID_ASSET` and listed in `unexpected_paid_assets`.
An incomplete receipt for that unexpected asset also carries the same
fail-closed unknown-billing warning.

`OVERVIEW.DURATION_S` is story-content duration. The meta workflow adds a
fixed two-second title and two-second ending, so the expected final duration
is content duration plus four seconds. Small encoder timestamp differences are
tolerated, but a three-second final file cannot satisfy a seven-second expected
delivery.

## Inputs

- `with.run_dir`: runtime-owned short-drama output directory.
- `with.runtime.paid_submission_dispositions`: bounded JSON object produced by
  the parent scheduler under its reserved output key. It contains only static
  step IDs and fixed disposition values.
- `with.runtime.paid_submission_receipt_proofs`: bounded JSON object produced
  by the parent scheduler under a second reserved output key. It contains only
  static step IDs and canonical `sha256:<hex>` receipt digests from exact
  bundled subprocess output captured during this run.
- `with.runtime.fallback_outputs`: mapping of shot number to the corresponding
  fallback step output. A non-empty value proves that local substitution ran.

## Output

One JSON verdict with `status` (`verified`, `degraded`, or `blocked`),
`verified`, `media_provenance`, active shots, content/final durations,
whitelisted provider identifiers, per-asset `paid_submission_dispositions`,
`safe_no_submit_assets`, `may_have_been_billed`,
`paid_submission_status_unknown_assets`, `unexpected_paid_assets`,
`billing_guidance`, and bounded issue codes. Raw prompts, provider responses,
fallback output, signed URLs, and credentials are never emitted.