[antianqi]

What changes

Adds plugins/antianqi/jianying — a Windows-only MiniMax Code Plugin that grades video with a
pixel-for-pixel re-implementation of Jianying's own grading math, edits Jianying drafts through the
running application's local named pipe, and renders a finished film from a draft in one command.

Layer	Content
MCP verbs (9)	draft_open · draft_read · draft_patch (27 official behaviour operations) · draft_commit · render_frames · grade_apply · audio_mix · verify_diff · make_film (one command from a draft to a finished film) — mcp/server.mjs, stdio, 0 npm dependencies, one hand-written input schema per verb under mcp/tools/
Skills (7)	jianying-cut · jianying-draft-edit · jianying-review · jianying-talk-cut · jianying-pipeline (cross-chain orchestration) + two library Skills (jianying-verify, jianying-grade-chain) that only activate when referenced
Knowledge	references/ — chain API semantics, verification discipline, pitfalls, the official operation set, a machine-readable intent map (utterance → parameters) and a machine-readable pipeline profile set (four cross-chain routes)
Guardrails	scripts/ — the plugin's own MCP client, an environment self-check, five self-tests, a session-containment security probe, and the talk-cut planner/applier
Effect probes	draft_patch returns the changes it made and whether it believes the change took effect, and takes an optional expect that turns an acceptance into a verdict — because an official acceptance is not a change (see below)

Both runtime layouts ship in parallel: plugin.json + mcp.json (portable Agent Plugins 1.0, read by
mcode 0.3.x) and .claude-plugin/plugin.json (mcode 0.4.0+ manifest, with the seven Skill paths and the
stdio MCP server).

The grading math is re-implemented rather than delegated: the official exporter is blocked by -100007
(session mode) and -100015 (unauthorized host process), and its command tree is five days older than
the application build. The Plugin re-implements the 13 grading features to ≤ 1 LSB and states the
block in the README instead of working around it.

Security — the session-state path traversal (review finding, fixed)

The review on this PR found a path traversal in the session state, and it was real. The session id was
pasted into the state file name, session-${sid}.json, while the schema only required it to be a string.
A value such as x/../../../../tmp/canary was normalised by path.join into a path outside
PLUGIN_DATA: draft_read answered with the contents of that file, and draft_patch wrote a snapshot
there.

Three layers now stop it, in mcp/server.mjs:

1. Shape — a session id must be ve-session-<digits>, the form the server itself issues, so it can
   carry no separator and no ...
2. Containment — the joined path must lie strictly inside the state directory; a sibling whose name
   merely shares the prefix does not count as inside.
3. Symlink — the state directory is resolved before use, and a state file that is itself a symlink is
   refused, for reading and for writing.

One related exposure was found while fixing it: draft_read used to fall back to a read with no path,
which returned some default draft — so an invalid session id still produced a draft, which was both
an exposure and a false success. The fallback now uses the path the session itself recorded, and with
neither a path nor a session it reports that there is nothing to read. The regression that came with
that change was caught by the suite before it shipped: reading a session with no snapshot had gone
through the same fallback.

The proof, and the negative injection that shows the check bites

scripts/security-probe.mjs isolates PLUGIN_DATA, places a canary beside the state directory and
beside a sibling directory, then sends nine forms of session id (POSIX relative traversal, Windows
backslash traversal, POSIX absolute, Windows absolute, sibling-prefix, URL-encoded, NUL byte, bare ..,
dot-segment) to three verbs (draft_read, draft_patch, draft_commit). It asserts that each is
refused, that the canary marker never appears in a response, that no file appears outside the state
directory, and — the part that matters — that a well-formed id whose file does sit inside the state
directory is still read. Without that last case a probe that refused everything would look green.

	Result
Probe on the fixed head	30 PASS / 0 FAIL
Probe with the old implementation restored (three defences removed)	22 PASS / 8 FAIL, including the canary being read back (泄漏canary=true) and draft_commit reporting committed: true outside the directory
Probe after the file is restored	30 PASS / 0 FAIL

The probe is wired into test/jianying.test.mjs, so the windows CI job proves it on every push, and
into the Plugin self-test.

User value

A MiniMax Code user can grade a clip and export a 10-bit master without opening Jianying, can edit a
Jianying draft — add a clip, trim, split, change a segment's volume — while the application stays the only
execution platform and the only renderer, and can hand a draft to the Plugin and get a finished film back
with one command.

Example prompt

给这个视频调色出片，风格用暖一点的，输出到 out\cut\demo.mp4

Expected result

1. The environment self-check runs first and names any missing dependency.
2. grade_apply exports graded10.mp4 (direct point-wise path, recommended) and graded_lut.mp4
   (65³ LUT path), and returns a per-node effectiveness probe: every node in the spec must produce a
   non-zero MAD, and a zero node fails the verb instead of silently dropping that node.
3. The reply carries the whole-chain change amount and the output paths.
4. A follow-up "review this version" asks for a multi-dimension comparison (visibility / picture
   quality / loudness / timeline / draft integrity) and reports the smallest repair range, not a vague
   suggestion.

Two more example prompts, for the parts that are not grading:

把这个草稿里的第一段音量调到 25%，改完落盘并确认生效

审一下这版，告诉我哪里要返修、返修后用什么证据确认

And the cross-chain one, which jianying-pipeline exists for:

把这个剪映草稿调暖一点，然后出成片

⇒ draft_open → make_film on the same copy → built-in acceptance (both streams present, duration
within one frame of the official timeline, loudness within 1 LUFS of the target). The routes are also
machine-readable in references/pipeline-profiles.json (4 routes, 18 steps), and the audit checks every
verb, argument and variable of it against the schemas.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name> — plugins/antianqi/jianying.
• plugin.json name matches the Plugin directory — jianying in both manifests.
• README.md includes a real example prompt and expected result.
• LICENSE and plugin.json declare an open-source license — Apache-2.0 in all three places.
• Required executables, accounts, paid services, and supported platforms are disclosed —
  Windows 10/11; ffmpeg 6.0, Python 3.9+, Node ≥ 22, Jianying 11.6 (running for the draft verbs);
  JYAI_HOME pointing at the toolchain; no account, no paid service, no API key.
• Network destinations and data handled by the plugin are disclosed — no network access, no
  credentials, no telemetry, no third-party services; the only socket is the local Windows named
  pipe of a running Jianying instance; drafts are read-only and every write happens on a copy with
  a per-file sha assertion that the real draft did not change.
• Session state cannot be used to read or write outside PLUGIN_DATA — see the security section:
  three independent layers plus a 30-case probe that is negative-injected.
• No credentials, private endpoints, hidden telemetry, installers, symlinks, or native binaries are
  included — 42 text files, no symlinks, no binaries, no scaffold placeholders.
• Every scaffold TODO has been replaced.
• npm run check passes.

Evidence

node scripts/validate.mjs

OK   plugin antianqi/jianying
Validated 30 hosted Plugins and all examples.

node --test test/jianying.test.mjs — 11 pass / 0 fail. The suite pins the things that fail
silently: every skills[] path in the v0.4 manifest resolves and its frontmatter name equals its
directory name (a mismatch is dropped by the runtime with no diagnostic), the stdio transport and its
portable working directory, all nine verb schemas, ${PLUGIN_ROOT} anchoring of script invocations, the
existence of every referenced file, the absence of a network client / credential literal / telemetry, the
absence of contributor machine paths, the README disclosures, and the session containment probe.

The Skill list is read from the directory rather than hard-coded, so adding a Skill cannot silently
desynchronise the manifest and the test.

Negative-injection audit of that test — eight defects injected one at a time, suite re-run, file
restored from a backup afterwards; each injection failed for the expected reason and the suite returned
to 11/11 after every restore:

Injected defect	Expected failure
frontmatter name != directory name	frontmatter name must equal its directory name
description over 1024 characters	description is 1285 chars (limit 1024)
hardcoded drive-letter path in a script	must not hardcode a drive letter path
fetch() in a script	must not make HTTP requests
README loses "expected result"	README must state the expected result
README loses the "no telemetry" disclosure	README must disclose telemetry behaviour
skills[] entry points at a missing file	deep-equal mismatch on the Skill path list
a Skill directory removed from skills[]	deep-equal mismatch on the Skill path list

Plugin self-tests (Windows, manual — the end-to-end ones need a live Jianying 11.6 and a real draft;
the paths are supplied through JYAI_DRAFT_LIB, and the suite prints an explicit SKIP when it is not set,
so it can never report a false green):

Self-test	Result
selftest-mcp.mjs	48 / 48
selftest-params.mjs	8 / 8
selftest-draft-edit.mjs	16 / 16
selftest-talk-cut.mjs	10 / 10
selftest-subtitle.mjs	4 / 4
selftest-audio-ai.mjs	8 / 8
security-probe.mjs	30 / 30
check-env.mjs	17 OK / 0 MISS

These carry their own negative injections: a synthetic noise frame set must be judged "not visible", a
synthetic large change must be judged "visible", a white background pushed to 255 must be reported as
newly clipped, an expect that says a field must not change must fail, a misspelled grading parameter
must be refused instead of baking an identity LUT, and a near-black source must be reported as
carrying no measurable information rather than as a node that did not take effect.

Mechanical audit of the whole Plugin — a sweep over the manifests, the schema to handler parameter
mapping, hard-coded paths, document references, Skill frontmatter, document to implementation
consistency, the intent map and the pipeline profiles: 0 issues (HIGH 0 / MED 0 / LOW 0). The audit
tool carries 28 negative injections of its own, so "0 issues" is known to be reachable only by a
correct Plugin, and the tool is known to report a false negative when it is wrong.

Two findings came out of that audit and are worth naming here, because both were invisible before:

• A misspelled parameter name in the grading spec was silently ignored and baked an identity LUT —
  the cube came out byte for byte identical to the cube of an empty spec, so the render succeeded and the
  acceptance passed while no grading happened at all. make_film now validates its grade against the
  grade_apply spec schema, and the baking step itself refuses unknown parameter names, so bypassing
  the schema is also covered.
• The intent map (utterance → parameters) was the only place a wrong operation could hide, because it
  lived in prose. It is now machine-readable, and the audit checks every parameter name against the
  schema and every operation against the official set. That check found an operation the draft-edit Skill
  offered, invokeBatch, which does not exist among the 199 official operations.

Parameter coverage — a sweep over the schemas listed twelve parameters that no test had
touched. Seven of the nine are now covered by selftest-params.mjs, which makes its own media (one
grey clip, two frame directories, two clips with a tone at different levels) so it depends on no user
asset, and whose criteria are deterministic: a file is present or not, a threshold moved or not, a
frame count within a bound or not. Two of them turned out to have conditions the name did not suggest:
noiseK only takes part in the criterion line when a noise directory is supplied, and maxFrames
shortens the film below the official timeline so the built-in acceptance refuses it — a truncated film
must not pass.

An official acceptance is not a change — draft_patch used to repeat what the official side said,
so an operation the official side accepted without touching the draft looked like a success. It now returns
the segment level differences it computed itself, says whether it believes the change took effect, and accepts
an optional expect that refuses the call when the expected field did not move. The measurements behind this:
Jianying writes eleven keys per segment to disk while the official edit returns fifty two, and comparing
those two puts dozens of shape fields into the difference — which is why the comparison now looks only at
fields present on both sides and reports the shape difference separately, and why the semantic criterion runs
two patches in one session so that both sides have the same shape.

Windows CI — .github/workflows/jianying-windows.yml runs only node --test test/jianying.test.mjs
on windows-latest, filtered to this Plugin's paths, so the session containment probe is proven on every
push. The repository's validate job stays on ubuntu-latest; this is the scoped Windows counterpart
that .github/workflows/ci.yml asks a non-tool-map Windows Plugin to add, rather than re-introducing a
repository-wide Windows job (that job was dropped in round-9 because it failed on files a PR does not own).

Known limits (stated in the README as well)

• Windows only. The draft verbs need Jianying 11.6 running; grading and export do not need the GUI.
• Structured grading fields (curves, HSL, colour wheels) cannot be written back into a Jianying preview —
  the official preview renderer itself does not read them (it handles intensity-style grading and geometry
  only), so grading is local export only. The curve parameters come from the Plugin's own interface, so
  the user does not have to save a graded draft in Jianying first.
• primaryWheel and the user pick key of hsl are not wired into the chain API form: they used to
  bake an identity LUT silently, and they now fail loudly.
• The official exporter stays unreachable, and the Plugin does not attempt to bypass the block.
• clear (8-level pyramid) is not wired into the chain.
• talk-cut does not do ASR: the official ASR lives in the agent runtime and is not reachable from a
  plugin, so it takes a user-supplied SRT and only decides which lines are filler, pauses or repeats.
• The official audio.add answers with accepted and a changed path, and the draft still holds no audio material at all — whether the file sits outside the draft or inside its own directory. The Plugin therefore reports the change as not verified instead of repeating the acceptance, and the audio parameters of make_film (beautify, targetLufs) remain without an end-to-end check.
• The draft library holds no draft with an audio track, so the two audio parameters of
  make_film (beautify, targetLufs) are the only ones still without an end-to-end check. Every
  draft in it is either video only or encrypted. That is a gap in the fixture rather than in the
  code, and it is recorded as such.

Standalone copy

The same Plugin is also published as a standalone repository whose root is the Plugin root, so it can
be installed from the local marketplace before this PR merges:

git clone https://github.com/antianqi/jianying-plugin.git ~/.minimax/plugins/jianying
mcode plugin list          # the local marketplace is a directory scan: jianying@local enabled

That repository carries the same Plugin files, an EVIDENCE.md with the measured numbers, and the same
test/jianying.test.mjs — the focused suite is layout-agnostic (it detects the Plugin root instead of
assuming the hosted plugins/<owner>/<name>/ path), so one file guards either layout.

---

Update since the last review — the orchestrator learns to wait for a human

The tenth verb, run_pipeline, previously refused script steps outright
("not wired into the orchestrator yet"), so the one route that must ask a human before it
cuts — talk-cut-then-render — could not run at all. It can now.

What the pipeline gained

Capability	How it behaves
Script steps	A step may be a script under scripts/. The keys of args are the command-line flags ("--srt": "$srt"), so the script receives what the profile says. true becomes a bare flag, false/null is not passed.
A human confirmation gate	A step marked "confirm": true stops the run after it completes and hands back the artifact, its sha, a preview and how many steps are still pending. The gate is declared explicitly ("artifact": "$planPath"); the orchestrator never guesses.
A two-phase resume	Progress is persisted to PLUGIN_DATA/pipelines/<token>/state.json, so the second phase survives an interrupted call. resume{token, confirm:true} continues it.

The gate is not a promise, it is enforced — and the self-test checks the enforcement, not the feel:

Assertion	Expected	Measured
First phase	stops at the gate, the remaining 3 steps never run	verdict=AWAIT_CONFIRM, gate.step=3, gate.pendingSteps=3
Resume without confirm	refused, nothing runs	verdict=REFUSED; the self-test asserts that talk-cut-apply.mjs was not among the executed steps
A token that does not exist	a named error (never a silent restart)	找不到流水线状态
Resume with confirm	runs to the end	verdict=PASS, and the cut step proves 2/2 ranges removed
The real draft	untouched throughout	identical sha before and after

Two bugs fell out of the work, and both made every verdict unreliable

1. Jianying recycles session ids. A brand-new session inherited the previous one's snapshot,
   so draft_read returned a different draft — once one left over from two days earlier. The
   symptom was a split that was accepted yet changed nothing. draft_open now drops the stale
   snapshot for a recycled id, and the session records the draft id so a mismatch is named.
2. The effect probe read its baseline from the encrypted draft file. It parsed nothing, decided
   "nothing changed" and reported changes=0 — while the segment really had been split in two.
   The probe now falls back to the official pipe.

Generalisation: when the baseline of a verdict cannot be read, find another way to read it — never
treat it as "there is no baseline".

The cut criterion was rewritten to be form-independent

The old criterion compared total durations of two different forms (the on-disk draft is compact,
the official answer is expanded) and was a false red. The runtime also shifts later segments left
when a segment is deleted, so "the range is no longer covered" was a false red as well. The new
criterion is: the duration total of that track decreased by exactly t1 - t0 µs — independent of
form, independent of shifting, grouped by track id (two video tracks share a type). In dry-run mode
the criterion cannot hold, which the script prints as its own negative control, and a failed verdict
now exits non-zero so the orchestrator reports a failed step instead of a successful one.

Measured on the fixture: 2200000..2600000 µs took the track from 3 000 000 to 2 600 000 µs, and
200000..900000 µs from 2 600 000 to 1 900 000 µs — 2/2 verified, with the real draft's sha
unchanged.

Also fixed: "cannot tell" must not look like "did not change"

The segment-level diff only carries the fields that changed, so "unchanged" and "not comparable"
were indistinguishable — expect:{segmentFieldUnchanged} was silently satisfied (a false green). The
Plugin now counts how many segments have the field on both sides and reports "cannot tell" as
a failure. After the fix the negative injection of selftest-draft-edit.mjs fails for the right
reason (不该变的 "volume" 字段却变了) instead of for a vague one.

Numbers

Suite	Result
scripts/selftest-mcp.mjs	56 / 56 (was 52; four new gate assertions)
scripts/selftest-draft-edit.mjs	17 / 17 (was 13/3 — the three failures predate this round and are fixed)
scripts/selftest-talk-cut.mjs	7 / 7
scripts/check-env.mjs	17 OK / 0 MISS (the schema count was hard-coded to 8 and has been failing since the tenth verb landed)
mechanical audit	0 findings (HIGH 0 / MED 0 / LOW 0)
audit self-test	32 / 32 (two new negative injections)
parameter coverage	10 / 10
intent routing	top-1 100% / top-3 100%
security probe	30 / 30
MCP semantics	14 / 14
focused suite / upstream validator	11 / 11 · 30 plugins green

The two self-test failures that predate this round are worth flagging: selftest-draft-edit.mjs
called draft_read with no target at all (it lost its argument when the scope parameter was
removed), and check-env.mjs asserted a hard-coded number of schemas. A red self-test that nobody
fixes is the same as no self-test.

---

Two more routes, and the enum drift that hid them

The orchestrator had exactly one script route (talk-cut-then-render), and two verbs —
audio_mix and render_frames — belonged to no route at all. Two more routes now exist,
and the schema turned out to be the reason nobody noticed.

The routes

Route	Steps	Measured
subtitle-then-render	draft_open → draft_read → add-subtitles.mjs → draft_commit → make_film	PASS · the subtitle script proves 2/2 cues land within ±1 frame (33333 µs) · film 3.000000 s
render-and-mix	draft_open → make_film → audio_mix	PASS · two streams, -14.00 LUFS (target -14) · mixed.mp4 measures -14.28 LUFS

subtitle-then-render is the second script step, so the script-step mechanism is not a
one-off patch for talk-cut. The subtitle script now follows the same rule as
talk-cut-apply: --sessionId reuses the orchestrator's session and leaves the commit to the
orchestrator — scripts only change; opening and committing belong to the orchestrator.

Products are handed from one step to the next

audio_mix needs the picture that make_film just produced, so a step can now declare what it
produces:

{ "verb": "make_film",
  "args": { "draft": "$dir", "outDir": "$outDir", "denoise": "auto" },
  "produces": { "$film": "film.mp4", "$mixed": "mixed.mp4" } },
{ "verb": "audio_mix", "args": { "draft": "$dir", "video": "$film", "out": "$mixed" } }

The blind spot: a hand-written enum nobody reconciled

Both new routes were added to pipeline-profiles.json. The audit stayed green, the file was
right — and calling the new route was rejected:

args.profile: "subtitle-then-render" 不在允许集合
[grade-and-render, edit-and-verify, edit-then-render, talk-cut-then-render]

The profile enum in run-pipeline.schema.json is hand-written and was never reconciled with
the route file — two sources of truth, each with its own opinion. The audit now reconciles them
in both directions, and a negative injection (㉜) proves it fires.

A weight function that contradicted its own comment

The two new test sentences were both mis-routed at first:

Sentence	Expected	Before
给这个视频加字幕再出片	subtitle-then-render	jianying-draft-edit (matched 加字幕, 字幕)
出片的时候把混音按草稿重做一遍	render-and-mix	jianying-cut (matched 出片)

The weight function said "longer keywords are more specific, so they weigh more" — and then
gave every keyword of three characters or more exactly the same weight. A sentence matching
"加字幕再出片" (6 characters) therefore lost to the generic skill entry that matched
"加字幕" (3) plus "字幕" (2). The weight now grows with length, and the classifier is back at
top-1 100% / top-3 100% over 33 sentences.

A comment says what the code means, not what the code does.

Honest failure when there is nothing to mix

On a draft without an audio track, render-and-mix fails and says where it stopped
(nothing to mix) — which is correct, so the self-test asserts that: with an audio draft it
asserts success, without one it asserts the honest failure. "No audio track" is not a reason
to fail; pretending to succeed is.

Numbers

Suite	Result
scripts/selftest-mcp.mjs	58 / 58 (two new route cases)
mechanical audit	0 findings
audit self-test	33 / 33 (new negative injection for the enum drift)
intent routing	33 sentences · top-1 100% / top-3 100%
routes	6 routes / 26 steps / 3 script steps
the rest	parameter coverage 10/10 · security probe 30/30 · MCP semantics 14/14 · draft-edit 17/17 · talk-cut 7/7 · env check 17 OK/0 MISS · focused suite 11/11 · 30 plugins green

---

Reviewing one version, and "PASS" not meaning "everything was checked"

The pipeline still had no route for reviewing a single version — "审一下这版" (let me review this
cut) had to be done by hand — and verify_diff buried the dimensions it could not judge inside
checks, so a PASS read as "everything was checked".

What a single-version review can honestly judge

Dimension	Single version	Why
visibility	cannot be judged (reported skipped) — but it reports the noise floor	with no "before" there is no change to compare
picture	absolute values only, never a failure	pure white/black that was already in the footage is not a defect
audio	judged	this version's LUFS / true peak (absolute target −14 LUFS)
timeline	this version's structure only	tracks / segments / duration
draft_integrity	judged	the real draft's sha

That table was not designed — it was derived from the evidence boundary: only conclude on the
dimensions the tool actually covers.

"PASS" must not mean "everything was checked"

The result now carries undetermined (which dimensions were not judged, and why) and
verdictNote:

"有 1 个维度【未判定】（visibility） ⇒ 这不是"完整通过"；未测的维度要写成"待确认"，不能写成"正常""

The self-test caught a second, sneakier case: a video-only draft has no audio stream, so
ebur128 measures nothing and integratedLufs came back null — neither skipped nor
problematic, so it read as "loudness is fine". Now a dimension that was checked but could not be
measured also reports undeterminedReason and lands in undetermined.

The self-test assertion is accordingly: loudness must either be on target
(|LUFS + 14| ≤ 0.5) or appear in undetermined — neither means failure.

The seventh route: review-only

draft_open(copy) → draft_read → render_frames(this version) → render_frames(★same state again = noise floor)
→ make_film (its own duration/loudness assertions) → verify_diff (one-sided)

It is read-only: reviewing does not authorise editing, so the route opens a copy, measures and
never commits. Measured on the fixture:

Item	Measured
Noise floor	MAD = 0.0000206 on one run, 0 on another ⇒ the noise floor is itself non-deterministic ⇒ measure it every time
Picture	clipRatio = 0.00724 · verdict = "参考（未判定）"
Loudness	integratedLufs = −14 ✓
Timeline	3 segments · single: true
Not judged	visibility named in undetermined

A report-level defect found on the way

The orchestrator's step summary keeps a whitelist of fields — and verify_diff's verdict lives in
checks, so it was dropped: the route ran successfully and produced no review at all.
verify_diff now has its own compact summary (key numbers per dimension, per-frame detail
dropped so the report stays readable).

Numbers

Suite	Result
scripts/selftest-mcp.mjs	59 / 59 (one new single-version review case)
mechanical audit	0 findings
audit self-test	33 / 33
intent routing	34 sentences · top-1 100% / top-3 100%
route table	39 entries (32 skill + 7 routes)
routes	7 routes / 32 steps / 3 script steps
the rest	parameter coverage 10/10 · security probe 30/30 · MCP semantics 14/14 · draft-edit 17/17 · talk-cut 7/7 · env check 17 OK/0 MISS · focused suite 11/11

---

Comparing two versions, and a criterion that was written backwards

The orchestrator could review one version; the review skill's main workflow — before/after —
was still manual. The eighth route closes that.

setVars: one route, two drafts

Opening two drafts in one route meant the second draft_open overwrote $sessionId and
$dir, so the first draft's copy was lost. Two mechanisms, with different timings:

Mechanism	When	What it does
produces	before the step	the paths this step will produce (relative to $outDir) — so the step's own arguments can use them
setVars	after the step	captures what the step produced ($sessionId / $dir / $draftJson) under another name

Values may be a variable reference ("$dirBefore": "$dir") or a template ("$beforeOut": "$outDir/before").
The draft JSON files are now named per step (draft-<n>.json), so reading several drafts in one
route no longer overwrites them.

The audit now guards both: every setVars/produces target and every variable they reference must
be declared, and a produces path may not contain .. or be absolute.

The eighth route: review-compare

draft_open(before) → setVars($sidBefore/$dirBefore) → draft_read(before) → setVars($beforeDraftJson)
→ draft_open(after)  → setVars($sidAfter/$dirAfter)   → draft_read(after)  → setVars($afterDraftJson)
→ render_frames(before) → render_frames(after) → render_frames(★again = noise floor)
→ make_film(before) → make_film(after)
→ verify_diff(visibility + picture + audio + timeline + draft_integrity)

One comparison answers five questions: did the picture change (with the noise floor
calibrated), how much new clipping, what is each version's loudness, what the timeline
differs in, and whether the real draft was touched.

Measured (before = the video-only fixture, after = the fixture with an audio track):

Item	Measured
Picture	FAIL (the change is not visible) — the two versions differ only in audio ⇒ the criterion is not always-true
Noise floor	MAD = 0.0000584 / 0.0000206 (different per run ⇒ the noise floor is itself non-deterministic)
Picture quality	clipDelta = 0
Loudness	before −14 LUFS (true peak −11.3 dBFS) · after −14 LUFS (true peak −13 dBFS)
Timeline	segment count Δ = 1

★ That FAIL is correct — the picture really did not change. A criterion that always said
"visible" would be the one to worry about; this one saying "not visible" is the evidence that it
can be trusted.

A criterion written backwards

The report contradicted itself: "integratedLufs": -14 next to "loudness is not normalised to
−14 LUFS". The check was Math.abs(c.integratedLufs) > 0.5 — comparing the loudness value
itself, so the absolute value of −14 (which is 14) tripped it and every properly normalised
track was reported as un-normalised. It now compares the deviation: |lufs − (−14)| > 0.5.

★ Such a bug does not turn the self-test red — it only adds a note — so it can only be found
by a human reading the report. Review conclusions still have to be read line by line. The same
round also named the case where the before version cannot be measured (no audio): that is now
reported as "cannot compare", not as "loudness did not change".

The reconciliation guard earned its keep

Adding review-compare without updating the schema enum made the audit report — immediately —
pipeline profile「review-compare」没有出现在 run-pipeline.schema.json 的 profile 枚举里 ⇒ 这条路线存在却调不动.
The guard added one commit earlier caught a real drift on its very next use.

Numbers

Suite	Result
scripts/selftest-mcp.mjs	60 / 60 (one new two-version comparison case)
mechanical audit	0 findings (incl. the new setVars/produces guards)
audit self-test	33 / 33
intent routing	35 sentences · top-1 100% / top-3 100%
route table	40 entries (32 skill + 8 routes)
routes	8 routes / 42 steps / 3 script steps
the rest	parameter coverage 10/10 · security probe 30/30 · MCP semantics 14/14 · draft-edit 17/17 · talk-cut 11/11 · env check 17 OK/0 MISS · focused suite 11/11

---

The last uncovered verb: curve-class grading

A tally showed that of the ten verbs, grade_apply was the only one no route used — and it
is the only path that can do curves, HSL and colour wheels (make_film --grade covers the
intensity nodes the official preview renderer happens to carry). So the requests that most need
the grading chain could not be served by the orchestrator at all.

The ninth route closes that:

draft_open(copy) → make_film(★no grading: picture + mix only) → grade_apply(our per-pixel chain)

Measured with adjustColor + logWheel:

Item	Measured
Per-node probe	adjustColor = 0.0136 · logWheel = 0.0124 — every node changes the picture on its own
Grade change	gradeChangeMad = 0.0260
Products	graded/graded10.mp4 (10-bit) · graded/graded_lut.mp4 · graded/grade-side-by-side.png

⇒ All ten verbs are now covered by a route.

capture: the third way to hand something forward

Mechanism	When	What it does
produces	before the step	declares the paths the step will produce (relative to $outDir)
capture	after the step	takes a value out of the response — the graded film's exact file name is only known there
setVars	after the step	aliases an existing variable / derives a template

capture refuses politely: if the response has no such field, it says so instead of quietly
storing undefined.

Two more report-layer gaps closed

grade_apply's verdict lives in probe and gradeChangeMad, verify_diff's in checks —
neither is on the orchestrator's summary whitelist, so the route "succeeded" while the report
showed nothing about whether the grading had happened. Both now have their own compact summary,
and the report gained a vars field: what this route actually produced, visible at a glance.

The same mistake twice, and a tool that must not go blind

Writing "note": "first half " + "second half" in a JSON file — JSON does not support that — made
the audit crash with a stack trace, so it reported nothing else. Second time (the first was an
intent-routes.json field). Two fixes: write the note as one string, and make the audit's JSON
parsing go through readJson() (17 places) so a broken file becomes one finding and the audit
keeps going.

A tool's failure mode is part of its design: a stack trace is blindness, a finding is still a
diagnosis.

---

From suggestions to verdicts: making "never guess" measurable

The classifier had always been honest about its role — "retrieval clues and candidate ranking;
the model still picks the chain" — but that left the gap between the third and the fourth tier
open: could the machine actually decide?

It can, and building it exposed something worse than the missing feature.

A discipline written in a comment, guarded by nothing

classify-intent.mjs has always said "never guess: when nothing matches, say so" — and the
confident: false branch has always been there. But nothing measured it.

The consequence is concrete: anyone who adds "看看" or "弄一下" to the keyword table turns the
classifier into a guesser, and nothing turns red. A discipline nobody guards is only a comment.

So the plugin now ships references/intent-refusal-set.json — 18 sentences with no clear
intent ("帮我看看这个", "你看着办", "老规矩", "整理一下", "能不能用"…), each with a why — and
the self-test asserts that not one of them may be judged as a chain (hard guesses must be 0).

Measured: 18 sentences, 0 hard guesses. The behaviour was already correct — it simply was
not being protected.

Three possible outcomes

node scripts/classify-intent.mjs "<what the user said>" --decide

Outcome	Condition	What to do
Verdict	top score ≥ 2 and it leads the nearest different target by ≥ 1	follow decision.route / decision.skill
Refusal · no signal	top score < 2	judge by each Skill's description, or ask the user what they want done
Refusal · ambiguous	two different targets are within 1 point	show both candidates and let the user choose

A verdict is auditable: the matched words, the score and the margin are all in evidence.

One design point that had to be thought through

The first version measured the margin as top score − second score. "电影感" (jianying-cut,
7 points) and "导个片调个色" (also jianying-cut, 7 points) tie ⇒ margin 0 ⇒ refusal.

But those are two phrasings of the same answer, not two competitors. The margin is now
measured against the best candidate pointing at a different skill or route.

The threshold moved from 3 to 2

"撤销刚才那步" (matches "撤销", 2 points) and "红色太淡了，鲜亮点" (matches "鲜艳", 2 points) are
unambiguous, but one two-character keyword was not enough to clear the old threshold of 3.

It is now 2 — one specific two-character keyword opens the board. Measured: the refusal set still
has 0 hard guesses (none of those 18 sentences matches a specific keyword at all), and the
verdict rate went from 30/36 to 36/36.

One route also gained its real distinguishing feature ("混音按草稿", "按草稿重做") — that route
is the one that re-mixes according to the draft, so the words belong to it.

The refusal set is guarded too (audit 7o)

Check	Catches
must exist and have ≥ 10 sentences	a few sentences cannot guard a discipline
must not overlap the labelled test set	the same sentence cannot have and lack a clear intent
no route/skill id inside a refusal sentence	that is an intent signal ⇒ it belongs in the labelled set

Negative injection ㉝ (put a labelled sentence into the refusal set ⇒ must be reported) ⇒
audit self-test 34 / 34.

The calling convention changed with it

The pipeline skill now says: ask for a verdict first (--decide). Verdict ⇒ follow it (the
evidence is in the output). Refusal, no signal ⇒ judge by description or ask the user. Refusal,
ambiguous ⇒ show both candidates. And a verdict is only a starting point: if execution shows the
verdict does not match what the user said, stop and ask — do not run it anyway.

Numbers

Suite	Result
intent self-test	36 sentences · top-1 100% / top-3 100% · refusal set 18 sentences, 0 hard guesses · verdicts 36/36 (all correct)
scripts/selftest-mcp.mjs	61 / 61
mechanical audit	0 findings (incl. the new 7o)
audit self-test	34 / 34
route table	41 entries (32 skill + 9 route)
the rest	parameter coverage 10/10 · security probe 30/30 · MCP semantics 14/14 · draft-edit 17/17 · talk-cut 11/11 · env check 17 OK/0 MISS · focused suite 11/11

---

The verdict now says what to ask, and a failure that blamed the wrong thing

The verdict answered which chain to take. It did not answer how to fill the parameters or
what to ask the user for next — so the decision was still one step short of being actionable.

Every route declares its inputs

pipeline-profiles.json gained a structured inputs per route:

{ "name": "$srt", "kind": "path", "desc": "转写稿（SRT）", "required": true,
  "from": "user", "note": "★ 官方 ASR 拿不到 ⇒ 必须由用户提供，不许自己编" }

from ∈ {user, caller, derived, intent} — user (only the user can supply it), caller
(the caller supplies it), derived (the chain derives it), intent (it comes with the request).

Missing parameters are now named all at once, before anything runs

Before: the route failed at step 3 with one missing variable. Now run_pipeline pre-checks:

路线 "talk-cut-then-render" 还缺 2 个必需输入：
  · $srt（转写稿（SRT））—— ★ 必须由用户提供；★ 官方 ASR 拿不到 ⇒ 必须由用户提供，不许自己编
  · $outDir（成片输出目录）—— 由调用方给
⇒ 补齐后再跑；缺什么就问什么，不要拿默认值糊过去。

The verdict carries it

The user says	Verdict	Carried along
「调暖一点」	skill jianying-cut	the parameter itself: spec = {"adjustColor":{"temperature":0.15}}
「把口播剪了再出成片」	route talk-cut-then-render	ask the user for: $draft, $srt
「曲线调完再出片」	route grade-chain-then-render	ask the user for: $draft, $grade (a curve shape cannot be guessed)
「给这版审一遍」	route review-only	ask the user for: $draft

Audit 7p guards it: every route must declare inputs, every input must be a declared variable,
from must be one of those four, and a required input must actually be used by a step.

A failure that blamed the wrong thing

The whole end-to-end suite went red with
could not resolve the agent host parent pid (is JianyingPro running?) — while Jianying was
running (nine processes).

The real culprit was the WMI provider host (WmiPrvSE.exe): it had burned 704178 seconds
of CPU (≈8 days) since September, so every Get-CimInstance / tasklist call timed out and
the bridge could no longer resolve the VE runtime's pipe. The message blamed the app instead of
the query.

Fix
Timeout	20 s → 6 s (nobody should wait 20 s)
Diagnosis	the two failures are now reported separately; when Jianying runs but the VE runtime is missing it says "this is not the Plugin's fault — opening a draft in Jianying brings it back"
Fallback	enumerate the named pipes (the pipe name carries the pid) — but measured, the VE pipe is not enumerable, so it is only a fallback
Machine	killing the runaway WmiPrvSE.exe (the service respawns it) turned a 20 s timeout into a 550 ms answer

A message must point at the layer that actually broke. "The dependency timed out" is not "the
dependency isn't running".

And a real-world replay of the recycled-session-id fix

Jianying restarted and its session counter began again at 2 — so draft_open was handed
ve-session-2 while a state file from an earlier session 2 was still on disk (exactly the
hazard fixed earlier). Measured: draft_read returned the correct draft (duration 3000000 ·
2 segments), not the previous session's leftovers.

Numbers

Suite	Result
intent self-test	top-1 100% / top-3 100% · refusal set 0 hard guesses · verdicts 36/36 · route verdicts 10/10 carry inputs + must-ask · 5/5 carry parameters
scripts/selftest-mcp.mjs	62 / 62 (new missing-parameter case)
mechanical audit	0 findings (incl. the new 7p)
audit self-test	34 / 34
the rest	parameter coverage 10/10 · security probe 30/30 · MCP semantics 14/14 · draft-edit 17/17 · talk-cut 11/11 · env check 17 OK/0 MISS · focused suite 11/11

[hetaoBackend]

Request changes for exact current head d726180bce3dedf083ab67693f7ab4a0038f2ab4.

The package/manifest checks and repository-owned exact-head Checks are positive, but the MCP server has a merge-blocking local file disclosure/path traversal:

1. Unvalidated sessionId escapes PLUGIN_DATA. plugins/antianqi/jianying/mcp/server.mjs:122-123,300-307 builds snapshot-${sid}.json with path.join() and accepts any schema-valid string. A reproducible isolated probe set PLUGIN_DATA=/tmp/pr72-state, created /tmp/pr72-canary.json, then called:

   draft_read({"sessionId":"x/../../../../tmp/pr72-canary"})

   The server returned the canary JSON with source: "session", because the normalized path became /tmp/pr72-canary.json. This is an arbitrary local JSON read outside the plugin state directory. The same unsanitized value reaches snapshotFile() during draft_patch (:346-356), so a successful edit response can also write a snapshot outside PLUGIN_DATA.

   Validate session IDs against the server-issued format and ownership (for example, the exact ve-session-<digits> value recorded by draft_open), reject separators/.., and enforce canonical containment for every state/snapshot read and write. Add negative tests for POSIX and Windows traversal, absolute paths, sibling-prefix paths, and symlinked state directories.

Do not merge until the boundary is fixed and the exact-head regression suite proves that session state cannot read or write outside PLUGIN_DATA. [code]smith = SKIPPED, if present, is not evidence.

[antianqi]

@hetaoBackend Thanks for the catch — the traversal was real, and it applied to the write path as well as the read path.

Fixed in b7d3059 (current head of feature/jianying-plugin).

Three layers in mcp/server.mjs

1. Shape — a session id must be ve-session-<digits>, the form draft_open itself issues, so it can carry no separator and no ...
2. Containment — the joined path must lie strictly inside the state directory; a sibling that merely shares the prefix is not inside.
3. Symlink — the state directory is resolved before use, and a state file that is itself a symlink is refused, for reads and for writes.

The check also runs at the verb entry points, and a missing id is reported differently from a malformed one.

Proof — plugins/antianqi/jianying/scripts/security-probe.mjs

It isolates PLUGIN_DATA, puts a canary beside the state directory and beside a sibling directory, and sends nine forms of session id (POSIX relative traversal, Windows backslash traversal, POSIX absolute, Windows absolute, sibling-prefix, URL-encoded, NUL byte, bare .., dot-segment) to three verbs. It asserts that each is refused, that the canary marker never appears in a response, that no file appears outside the state directory, and — the case that keeps the probe honest — that a well-formed id whose file does sit inside the state directory is still read. Without that last case a probe that refused everything would look green.

	result
probe on the fixed head	30 PASS / 0 FAIL
probe with the old implementation restored	22 PASS / 8 FAIL — including the canary being read back, and draft_commit reporting committed: true outside the directory
probe after the file is restored	30 PASS / 0 FAIL

The probe is wired into test/jianying.test.mjs, so the windows-latest job proves it on every push, and into the Plugin self-test (selftest-mcp.mjs).

One more exposure, found while fixing it

draft_read used to fall back to a read with no path, which returned some default draft — so an invalid session id still produced a draft. That was an exposure of its own and a false success. The fallback now uses the path the session itself recorded, and with neither a path nor a session it reports that there is nothing to read. The regression that came with that change was caught by the self-test before it shipped: reading a session with no snapshot had gone through the same fallback.

PR description updated — new title, a security section with the reproduction and the numbers above, and the current counts (9 verbs, 7 Skills, 41 files, self-test 46/46, focus suite 11/11, validator 30 green).

Happy to re-run anything, or to reshape the three layers if you would rather see a different shape.

[hetaoBackend]

Reviewed current exact head de15275. The sessionId path-traversal blocker is fixed: IDs are constrained to server-issued ve-session-, state/snapshot paths are contained under the real PLUGIN_DATA directory, and existing symlink files are rejected. The current package test passes 11/11, the traversal negative test is rejected, and all repository-owned exact-head checks are green.

[antianqi]

@hetaoBackend Thanks — approved and all checks green on de15275. Requesting a squash merge.