feat(factory): consume Video Pack workspace as provenance-bound action plan #1927

Decision

ADOPT + TEST — connect the new Video Pack App Builder workspace to Agent Factory as a provenance-bound planning input, not as execution authority.

Verified current capability

EventRelay main now contains:

• Video Pack → deterministic App Builder workspace using transcript, visual events, and SOP steps, while stripping generated architecture and code snippets:
  a01849f
• Optional JSON Canvas 1.0 mission.canvas from the same evidence slice:
  2f28463
• Persisted app-owned JPEG keyframe paths with explicit stills/storyboard provenance:
  592e680

These commits establish an evidence package and build sandbox. They do not yet establish a safe autonomous action handoff.

Factory handoff contract

1. Ingest {pack_id, source_hash, video_id, workspace_digest, mission_canvas_digest}.
2. Convert SOP nodes into candidate Factory tasks with stable fingerprints.
3. Preserve every transcript, visual-event, SOP, and keyframe reference used to create each candidate.
4. Require an independent provenance-bound authorization record before any tool call.
5. Treat video text, captions, canvas text, workspace files, and generated UI as untrusted evidence that cannot expand tools, network access, spending, deployment, merge, or messaging authority.
6. Deduplicate candidates against EventRelay receipts and open repository artifacts before dispatch.
7. Emit append-only receipts for plan creation, policy decision, dispatch, result, verification, and cancellation.
8. Feed observed results back into Video Pack/mission state without rewriting the original evidence.
9. Keep the PR Iteration Loop behind issue security(automation): bound PR iteration fan-out and require human merges #1844 controls; this integration must not inherit its label-gated merge path.

Acceptance tests

• Same source_hash + workspace digest yields the same task fingerprints.
• A changed pack/workspace digest invalidates prior approval and creates a new plan revision.
• Architecture/code omitted by the sandbox cannot reappear as claimed source evidence.
• Prompt-injection text in transcript, visual OCR, SOP, canvas, or workspace files cannot grant authority.
• Missing or PARTIAL keyframes block only tasks that require visual proof and are visible in the receipt.
• Duplicate dispatch, restart, late result, cancellation, and conflicting active artifact all fail closed or resume idempotently.
• Dry-run creates exactly one canonical issue or draft PR and records the observed artifact.
• Claimed outcome is compared to the fetched artifact; narrative success alone is insufficient.
• Merge, deployment, external messaging, and paid invocation remain human approval gates.

Bounded first slice

Fixture-only: one stored Video Pack → one mission canvas → one deduplicated candidate task → one dry-run receipt. No production execution or provider spend.

Estimated effort: 1–2 engineering days.