gate-control

# gate-control

This is the **single canonical policy** for VideoStudio gate decisions,
post-gate edits, and recovery across COMPOSE, AUTO, GENERATE, and EDIT. Line
Skills describe artifacts and production operations but never create a competing
authorization policy.

## Decision kernel — apply this before the detailed rules

Resolve every turn from the latest durable facts:

1. **Identify the current candidate and pending user decision.** A pending
   decision is status, not permission to ask again.
2. **Classify the dependency.** Only a genuine user decision about a creative or
   delivery choice, or a new billable attempt, is a user dependency. Missing
   files, stale locators, parameter-shape errors, interrupted operations,
   equivalent metadata changes, and QA failures with passes remaining are system
   work and do not justify stopping. An exhausted visual-QA cycle is a creative
   fork: show its evidence/options and wait.
3. **Choose one result-aware execution horizon.** Execute only operations whose
   preconditions are true. If one result decides the branch, stop the horizon at
   that operation, inspect it, and select the next operation in the same turn.
4. **Use exact interfaces.** In `calls`, keep the exact native operation token or
   named Skill/file operation. Do not add a `video_studio.` prefix, invent
   generic recovery/status, or replace an operation with prose. Include mandatory bindings such as AUTO child's
   `composition.approve_plan`, `plan_path`, and `segment_id`.
5. **End in exactly one place:** another immediately executable operation, one
   of the five stopping decisions with its current artifact, completed delivery,
   or an external uncertainty boundary with the current artifact and concrete
   options. Showing an artifact is not an ending except at those five stops.

### Direction-to-plan handoff

Keep the first two stops mechanically distinct:

- **Direction stop:** route and lock facts already settled by the brief, then
  show two or three concepts without writing a manifest, script, narration copy,
  or art direction. Use the exact localized name from the table below; in
  Chinese this is `制作方向确认`, never a renamed label.
- **COMPOSE plan stop after direction choice:** call `speech.capabilities`, write the canonical
  `project/composition/composition-manifest.json` from the chosen concept, then run the free `composition.check_narration_fit`; only after those concrete
  results present the one `制作方案确认` / `Production plan confirmation`.

## Stopping test

Before ending a turn on a user decision, all must be true:

- it is direction, production plan, paid generation, keyframe preview, or final
  video;
- that decision is not already pending;
- the exact complete review artifact exists now;
- every native prerequisite succeeded for that exact candidate;
- no call after the question depends on its future answer.

If any item is false, do not stop. A user question, stale reply, already-pending
decision, technical recovery, or conditional “ask after QA passes” never ends a
turn on the user. After a local visual mutation, no artifact exists until the
mutation plus required `composition.inspect` and `composition.snapshot` calls
succeed. In a planned trace, name those calls rather than emitting `calls:[]`.

An unknown external provider outcome is not recoverable by repeatedly calling a
status operation without query/reconcile capability. Preserve the transaction.
If the user explicitly requests a new billable attempt and current status already
contains a sufficient quote, the only dependency is one fresh Paid generation
confirmation. For COMPOSE narration, an exhausted retry episode stops automatic
requests but is not a permanent refusal: with no fresh user decision, show the
current artifact and the native one-request retry offer; when a new real user
turn explicitly approves that offer, call `composition.materialize_narration`
once with current-turn evidence. Never reuse an older turn or route narration
through Paid generation confirmation.

## No-runtime branch

When the current transport cannot execute production tools or render media, do not stop at the plan confirmation. Return the complete explicitly unexecuted production package:
assumptions, script/narration, timed storyboard, exact visible copy/captions,
visual/audio actions, provenance/fallback assets, export target, preview review,
and final QA. Do not claim media exists. Identify each source as user-supplied,
self-authored/generated, or third-party; third-party use needs source, license,
retrieval date, and a project ledger. Without licensed music, specify silence or
a future rights-safe search.

The active line Skill owns any line-specific additions to this package; do not
load another line's references on an ordinary runtime path.

## User-facing names and presentation boundary

`Gate A/B/C/D` and `*_decision` are internal. They may appear in diagnostics,
tests, and calls, but not normal user-facing headings, progress, or explanations.

| Internal protocol | Chinese UI | English UI |
| --- | --- | --- |
| Gate A | 制作方向确认 | Direction confirmation |
| Gate B | 制作方案确认 | Production plan confirmation |
| Gate C | 付费素材生成确认 | Paid generation confirmation |
| Preview Gate | 关键帧预览 | Keyframe preview |
| Narration retry | 旁白重试确认 | Narration retry confirmation |
| Gate D | 成片确认 | Final video confirmation |

Do not write hybrids such as “Gate B（制作方案确认）”. Describe the missing
action/artifact directly and keep error codes diagnostic. Never expose
`budget_exhausted`, “QA budget”, or retry counters. Explain that prior repair
strategies did not resolve the visible finding and present plain-language
options.

Every prose span outside a tool call is user-visible. At a successful keyframe
preview, lead with the current contact sheet/frames, say in one short sentence
that it is ready, then ask one question: name changes, or reply `继续` / `continue`
to start the draft. Passing checks and advisories stay silent. Do not e