Internal machine-owned gate used immediately before meta-short-drama
publishes its final video. It does not call a model and never contacts a media
provider.
The helper parses the canonical script.txt to identify active shots and
their content durations. It then requires sanitized real-provider receipts
for the reference image, every active shot image, and every active shot video;
rejects placeholders, missing provider request/job IDs, and any runtime
fallback substitution; and uses ffprobe to confirm that shot MP4s and the
final MP4 are decodable and have the promised durations.
When Seedance rejects a shot under provider policy, its sidecar contains only
the bounded reason provider_policy_rejected and an allowlisted policy code.
The audit preserves those two fields, marks the shot not generated, and
reports VIDEO_POLICY_REJECTED; raw provider text, signed URLs, request IDs,
and secrets are discarded before this boundary.
The parent scheduler supplies one bounded disposition per paid step. The only
accepted values are safe_no_submit, maybe_accepted, and receipt. It also
supplies a separate bounded SHA-256 proof only when the exact bundled paid
subprocess emitted a sanitized receipt on this invocation and the emitted JSON
matched the resulting sidecar. A conclusive generated/policy receipt upgrades
the public asset disposition to confirmed only when that current-run proof
matches. The reserved runtime slots cannot be declared as plan steps.
When safe_no_submit accompanies a missing receipt and local fallback, the
audit preserves the degraded provenance but does not claim that the provider
may have billed the user. A maybe_accepted, receipt, missing, or malformed
disposition without a conclusive, current-run-proven receipt remains
fail-closed: the audit emits
PAID_SUBMISSION_STATUS_UNKNOWN, a sanitized asset-name list, and a static
instruction to check provider history before starting a replacement. Raw
fallback output, child failure text, and provider text never cross into the
verdict. A stale or forged workspace sidecar by itself is reported as
RECEIPT_NOT_PROVEN_CURRENT_RUN and can never become confirmed.
Receipt or media evidence for a shot absent from the canonical script is
reported as UNEXPECTED_PAID_ASSET and listed in unexpected_paid_assets.
An incomplete receipt for that unexpected asset also carries the same
fail-closed unknown-billing warning.
OVERVIEW.DURATION_S is story-content duration. The meta workflow adds a
fixed two-second title and two-second ending, so the expected final duration
is content duration plus four seconds. Small encoder timestamp differences are
tolerated, but a three-second final file cannot satisfy a seven-second expected
delivery.
Inputs
with.run_dir: runtime-owned short-drama output directory.with.runtime.paid_submission_dispositions: bounded JSON object produced by the parent scheduler under its reserved output key. It contains only static step IDs and fixed disposition values.with.runtime.paid_submission_receipt_proofs: bounded JSON object produced by the parent scheduler under a second reserved output key. It contains only static step IDs and canonicalsha256:<hex>receipt digests from exact bundled subprocess output captured during this run.with.runtime.fallback_outputs: mapping of shot number to the corresponding fallback step output. A non-empty value proves that local substitution ran.
Output
One JSON verdict with status (verified, degraded, or blocked),
verified, media_provenance, active shots, content/final durations,
whitelisted provider identifiers, per-asset paid_submission_dispositions,
safe_no_submit_assets, may_have_been_billed,
paid_submission_status_unknown_assets, unexpected_paid_assets,
billing_guidance, and bounded issue codes. Raw prompts, provider responses,
fallback output, signed URLs, and credentials are never emitted.