[witbrock]

Merge decision: ready — the avatar editor gains private photo upload/drop, local face framing with manual correction, and a photo-conditioned generation request with explicit preview/apply.

User outcome

JVNAUTOSCI-2749: create a good-looking avatar from a photo in the existing profile editor. The baseline only centres uploads and generates from text.

Material changes

• Preserve uploaded originals in the existing owner-private image store; suggest an EXIF-aware square crop using OpenCV's bundled frontal-face detector. No-face, multiple-face and detector-failure cases retain manual zoom/position controls.
• Carry validated oriented crop coordinates through the existing self-only, scoped publication service. Publish only its metadata-free 256px derivative.
• Pass an access-checked source photo to the existing OpenAI client using images.edit, retaining gpt-image-1.5, a single request and no automatic retry. Record private source provenance. The UI explains provider delivery/cost and requires Use avatar; provider failure retains the source and never becomes text-only generation.
• Add the headless OpenCV dependency through PDM; no schema, credential or infrastructure changes.

Evidence

• 42 passing targeted backend tests covering avatars and conversation images: real single/no/multiple-face detection, EXIF orientation, manual crop publication, metadata removal, private source preservation, foreign-source denial before provider invocation, image-edit pixel input/provenance, and HTTP forwarding/errors.
• Four existing participant-profile frontend tests pass; changed JS static lint and affected Python Ruff checks pass; pdm lock --check and git diff --check pass.
• Real editor and CSS in Playwright at 1440px and 360px: picker, drop, manual correction, oriented defaults, photo-reference request, explicit apply, return-to-source and recoverable provider failure; no horizontal dialog overflow. Fixtures are produced by the real detector. Browser APIs/storage/provider are stubbed, without real-user writes or provider calls.
• Reproduce browser checks with PYTHONPATH=. pdm run python tests/browser/avatarFixtures.py DIR, then PLAYWRIGHT_BROWSERS_PATH=/tmp/von-playwright node tests/browser/avatarEditor.cjs DIR.

Ship boundary

• Minimum criteria: working picker/drop and adjustable face framing; orientation/source preservation; source-conditioned image-edit transport with intentional application; existing self/scope boundary retained.
• Stop shipment for wrong-user publication, source loss, unintended photo disclosure or broken ordinary upload. Targeted evidence shows none.
• Limitations: no live paid generation or public OAuth check. The retained authenticated host fixture is stopped at port 5010 and historically bound to another checkout; its documented adapter also disables generation. The worker has no prepared authorised provider/browser test route. Generated preview/apply UI is fixture evidence, and provider-boundary tests inspect actual image bytes passed to a stub. Detector defaults are fallible, with manual recovery.
• Jira connector read failed with oauth_token_invalid_grant; assignment text supplied the task scope. The controller owns Von reports/state.
• No identity recognition, biometric enrolment, training, Sol model, broad avatar redesign or changes to unrelated services. Public deployment is requested only by the worker's structured result after verifying the merged origin/main SHA; this PR does not claim deployment has happened.