Release 0.10.0

CLAUDE.md

@@ -41,7 +41,7 @@ python -m dw.test
 the seam, and the test or check that enforces it. Open it before grepping - it names the
 module, and that module's docstring holds the detail.
 
-- `dw.serve` runs every job in one persistent spawned worker (`dw/worker.py`, managed by
+- `dw.serve` runs every job in a persistent spawned worker (one per `--devices` card) (`dw/worker.py`, managed by
   `dw/worker_manager.py`) that keeps models cached between runs, so a change to engine
   code needs a server restart before a job sees it.
 - The packaged `dw/workflows/` is what a `builtin:` step names (resolved in
@@ -71,8 +71,9 @@ The guides in `docs/`, by topic:
 ### Claude Code plugin
 
 `.claude-plugin/marketplace.json` publishes the `dw` plugin in `plugins/dw/`: one
-composition skill per model family (`minimax-h3`, `minimax-music3`, `ltx-2.5`) that
-chooses a template for a request's shape and states the family's hard rules, plus
+composition skill per model family (`minimax-h3`, `minimax-music3`, `ltx-2.5`,
+`kandinsky-6`) that chooses a template for a request's shape and states the family's
+hard rules, plus
 cross-cutting composition skills (`script-to-video`, `series-episodes`) - shapes above
 the families that orchestrate the decision trees and cast consistency across multiple
 generations. Every skill the directory holds is named in `plugins/dw/README.md` and here,

docs/DEPENDENCIES.md

@@ -47,7 +47,7 @@ pyproject; install.ps1 installs it explicitly on Windows.
 
 ## Platform-Specific Dependencies
 
-**All platforms (core ML):** peft, transformers, accelerate, safetensors, controlnet_aux, sentencepiece, torchsde, torchao, optimum-quanto, gguf, kornia, ftfy, sdnq, spandrel, facexlib (spandrel + facexlib back the `upscale` and `restore_faces` tasks)
+**All platforms (core ML):** peft, transformers, accelerate, safetensors, controlnet_aux, sentencepiece, torchsde, torchao, optimum-quanto, gguf, kornia, ftfy, sdnq, spandrel, facexlib (spandrel + facexlib back the `upscale` and `restore_faces` tasks). On first use, `restore_faces` has facexlib download its face detection and parsing weights (about 110 MB) from facexlib's own GitHub releases into the facexlib package directory. It is the one model download that bypasses the Hugging Face cache, dw's download manager and the `plan.downloads_required` estimate.
 
 **All platforms (utilities):** fastapi, uvicorn (the `dw.serve` HTTP server and web UI), av, aiohttp, matplotlib, opencv-python-headless, concurrent-log-handler, qrcode, protobuf, imageio, imageio-ffmpeg, beautifulsoup4, soundfile, jsonschema, black, python-dotenv
 

docs/RECIPES_24GB.md

@@ -185,7 +185,8 @@ same seed: fur, branches and snow texture resolve where the upsample-only frame
 soft blur. About eight warm minutes, three and a half of them writing the full-size clip.
 The same refine on a clip dw did not make is
 [refine-clip.json](../workflows/templates/ltx2/refine-clip.json): the upsampler encodes
-the source itself, and the source's soundtrack is paired back on.
+the source itself, fitted to the working size first and restored to exactly twice the
+source's size and length after, and the source's soundtrack is paired back on.
 
 **Examples:** [text-to-video.json](../workflows/templates/ltx2/text-to-video.json) (t2v),
 [two-stage.json](../workflows/templates/ltx2/two-stage.json) (base -> latent upsample -> refine),

docs/RELEASING.md

@@ -7,6 +7,143 @@ notes from commits at tag time (see below). This section is a scratch pad
 for items a branch's author wants the next release note to name; clear it
 when a release ships.
 
+### 0.10.0
+
+<!-- Drafted from v0.9.0..develop. Paste into the GitHub release body once the tag has published: gh release edit v0.10.0 --notes-file ... -->
+
+A large range: the server runs one worker per GPU, the task library grows
+by a dozen finishing, face, window and music-video commands, MiniMax H3
+gains held audio, guide clips and refinement, Kandinsky 6.0 is onboarded,
+and the task registry owns argument domains and coercion. One upgrade-order
+note: restart the server after `update_diffusers`, and Kandinsky 6 needs
+diffusers from git `main`.
+
+**Multi-GPU servers** (docs/WORKER_GUIDE.md, docs/SERVER.md)
+
+- `--devices` starts a persistent worker per card; a VRAM-aware dispatcher
+  with backfill and cache affinity routes each job, and a declared
+  `vram_estimate` is admitted against the pool's largest card (#675, #676,
+  #677, #685).
+- `get_health` and `get_memory` name the workers per card; `get_memory` and
+  `clear_memory` take a `device`; a job records its device ordinal and card
+  in `get_job`, `list_jobs` and the UI (#677, #678, #682, #777).
+- A cancel sent between dispatch and the worker's start lands, and a
+  cancelled queued job leaves no bookkeeping behind.
+- `get_memory` splits host RSS into anonymous and file-mapped pages (#709).
+
+**New tasks** (docs/TASKS.md)
+
+- Finishing: `grade` tonal controls, `sharpen`, `film_grain`, `apply_lut`
+  from a strictly parsed `.cube` (uploadable, listed as kind `lut`) or an
+  in-memory palette, with alpha kept through every one (#633, #634, #635,
+  #636, #775).
+- Faces: `crop_face_track` follows one face and records its track;
+  `paste_face_track` pastes a repaired crop back, feathered (#622, #623).
+- Long video: `window_video` and `join_windows` process a clip in
+  overlapping fixed-length windows, range-read with a uint8 join;
+  `fit_to_model` and `restore_to_source` take a clip to a model's grid and
+  back (#628, #629, #631, #632, #780).
+- Music video: `analyze_beats` (onset/DP tracking with anchor calibration),
+  `plan_cuts` (a cut list from lyrics and beats on the render grid),
+  `trim_video`, `separate_stems` (htdemucs) and `ingredients_grid` (#604,
+  #607, #625, #626, #627).
+- `check_script` compares a take's transcript to its expected lines,
+  shot-aware, discarding words heard over silence and Whisper repetition
+  loops; `templates/check-script` retires the by-eye check (#643, #644,
+  #645).
+- `transcribe_audio` resumes after a mid-clip stop and trims word bounds to
+  waveform energy; `attribute_voices` handles zero-length and split lines
+  (#617, #661, #672).
+
+**MiniMax H3**
+
+- `hold_audio` generates video to a held soundtrack; the music-video and
+  `match_audio` chains hold their track instead of referencing it (#618,
+  #619).
+- `guides`: clips held as condition rows on t2va/fl2va, with `"audio": true`
+  and guide continuity across chains; guides are charged in the VRAM
+  projection (#648, #649, #650, #779).
+- A refine schedule block with `refine_strength`, its sigma grid and VAE
+  chunk sizes pinned to diffusers (#620, #770). Width and height declare
+  their multiple-of-32 constraint (#789).
+- The dialogue-probe audit (docs/audit) refuted the five H3 dialogue rules
+  it tested (#640).
+
+**LTX-2.5**
+
+- `LTX2RefinePipeline` and `templates/ltx2/refine-in-place` with lem-tuned
+  strength ladders; `face-repair` and `restore-long` templates; both 2x
+  templates fit and restore (#624, #630, #632, #638, #639).
+
+**Kandinsky 6.0** (#663)
+
+- `templates/kandinsky6/` text-to-video, image-to-video and
+  generate-and-upscale (Lite-distill + tiled SR, 24GB), the `kandinsky-6`
+  plugin skill. Needs diffusers from git `main` (`Kandinsky6*` is in no
+  release yet); not on Apple Silicon (the VAE decode keeps MPS memory per
+  tile).
+- `update_diffusers` / `POST /api/system/diffusers/update` now really
+  replaces a git install whose dev version string is unchanged; install.sh
+  and install.ps1 do the same. Restart the server after an update: admission
+  still checks class names against the server process's old import.
+- A completed model download on huggingface_hub 1.33 is no longer reported
+  `failed`.
+
+**Validation and the task registry**
+
+- `@register_command` declares a task's argument domains, choices, static
+  checks and media arguments; `whole_number` and `real_number` are the one
+  numeric coercion in `dw/tasks/`, so a value is refused at validate and at
+  run or at neither (#773, #774, #775).
+- Literal `ingredients_grid`, `select`, `film_grain`, `join_windows`,
+  `apply_lut`, `plan_cuts` and `check_script` arguments are refused at
+  validate at their argument path (#639, #646, #657, #785).
+- `validate_workflow` names an unpriced composition's children, and a
+  `per_entry` list's index fields no longer make its estimate unknown
+  (#655, #772).
+
+**Security**
+
+- Media and remote-encoder requests from a workflow are dialed at the
+  address the host policy checked (DNS rebinding closed), every redirect is
+  re-validated, a POST follows the same path as a GET, and the HuggingFace
+  token is dropped on a redirect that leaves the host or downgrades to
+  http (#683, #686, #690).
+- Untrusted (the default), a URL whose host does not resolve or is
+  percent-encoded is refused at validation rather than left to the fetch;
+  `--trust-workflows` keeps the old behaviour. A `file://` URL is refused as
+  a media location at validate and at the loader (#618).
+- A fetched body is capped at 1 GiB and a fetch at 10 minutes end to end;
+  a chunked upload is counted as it streams (#689). Use `upload_asset` for
+  larger media.
+- No response carries the server's absolute paths: job warnings, log lines
+  and phase details name an input by its `asset:` or `output:` reference,
+  `get_job` no longer returns a history row's `spec`, and the validate
+  plan's `output_dir` is gone - `plan.workspace` names the same place.
+
+**Fixes**
+
+- Chains: seams record their trim and realized crossfade, a saved
+  segment-backed video hands downstream its frames, a bare string for chain
+  prompts is refused, and the segment label clears on a failed run (#651,
+  #653, #660, #662, #667).
+- Shots: a `for_each` member's inner shot names are qualified, a cut inside
+  a shot drops the seam attributes that opened it, and a join that saves
+  nothing still names its shots (#670, #674, #680).
+- Audio: a shot consumed by `match_levels` draws no headroom warning,
+  `resample_waveform` returns exactly the rounded count, `video_frames`
+  keeps the source fps, and the music-video soundtrack is built from the
+  song pieces under each cut (#671, #673, #716, #788).
+- uint8 frames are no longer colour-inverted by `export_to_video` (#679);
+  `get_job_workflow` folds recorded arguments on an unrealized job (#647);
+  lazy diffusers type resolution is serialized across threads (#787).
+
+**Plugin**
+
+- `kandinsky-6` skill; `minimax-h3` gains `references/dialogue.md`, the
+  guides and music-video render rules; `series-episodes` takes an optional
+  look step (palette, `apply_lut`, `film_grain`) (#637, #642, #665, #762).
+
 ### 0.9.0
 
 <!-- Drafted from v0.8.0..dd74e17b (develop). Paste into the GitHub release body once the tag has published: gh release edit v0.9.0 --notes-file ... -->

docs/SECURITY.md

@@ -143,7 +143,20 @@ One policy now answers all of it, untrusted:
   rather than one of them three seconds into a queued job (#124). The remedy
   for a file outside is to put it in the asset library and use an `asset:`
   reference. Containment is checked **before** existence, so the refusal
-  cannot be used as a file-existence oracle.
+  cannot be used as a file-existence oracle. Validation finds a path by its
+  argument's name (`image`, `*_video`, `location`, ...); a task argument
+  that reads a file under a generic name, like `join_windows`' `source`, is
+  declared on its registration (`@register_command(media_arguments=...)`,
+  read through `TASK_MEDIA_ARGUMENTS`, #692) so it is refused at the same moment
+  (#630), as are the finishing tasks' `media`, `apply_lut`'s `lut` (#635),
+  and the face-track and fit tasks' `clip`, `repaired`, `track` and `fit`
+  (#773). `lut`, `track` and `fit` are only ever read from a file on the
+  server, so an http(s) URL there is refused as a URL
+  (`LOCAL_ONLY_TASK_ARGUMENTS`).
+- **A URL with any other scheme** (`file://`, `s3://`, ...) is refused at
+  validation and at the loader, whatever the trust posture. No loader opens
+  one, but as a relative path it joined onto the workflow directory and
+  passed containment, so validation called it clean (#618).
 - **A glob** is contained the same way, on the fixed directory its pattern
   starts from, and every match is re-checked on its real path so a symlink
   cannot carry the expansion out.
@@ -155,17 +168,33 @@ One policy now answers all of it, untrusted:
   **Tailscale's tailnet range** (and Alibaba's metadata address): a workflow
   that fetches media from another machine on your tailnet is refused unless
   it runs under `--trust-workflows`.
-- **Every redirect is re-checked.** A media fetch (`safe_get`) never lets the
+- **Every redirect is re-checked.** A media fetch (`safe_get` in `dw/outbound.py`) never lets the
   HTTP client follow a redirect on its own: it follows at most 5 hops
   (`MAX_MEDIA_REDIRECTS`), and each `Location` passes the same scheme and
   host policy before it is dialed. A public URL answering `302` to
   `http://127.0.0.1:8765/api/server` is refused with the target named, and
   nothing is fetched from it. Images are decoded from the fetched bytes and
   still go through diffusers' `load_image`, so EXIF orientation and RGB
-  conversion are unchanged.
+  conversion are unchanged. Each hop's host is resolved once, by the policy,
+  and dialed at the address it checked - so a name that answers differently
+  to the lookup and the connect (DNS rebinding) reaches only what was
+  checked - and refused when it does not resolve or is percent-encoded (the
+  host is read with the HTTP client's own parser, so `127%2e0%2e0%2e1` is
+  127.0.0.1 to the policy too). An untrusted fetch ignores proxy and
+  `~/.netrc` settings from the environment. The body is capped at
+  `MAX_MEDIA_BYTES` (1 GiB) and the whole fetch at `MEDIA_TOTAL_TIMEOUT`
+  (600 s) - the connection is closed at the deadline, so a server
+  trickling its response headers or its body cannot hold the worker; a 303 (or a
+  301/302 to a POST) is followed as a GET, as requests itself does; and
+  `remote_text_encoder` POSTs through the same path with a timeout. Two limits
+  to know: a trusted run behind a SOCKS proxy is not deadline-bounded (SOCKS
+  brings its own connection classes), and the TLS handshake is bounded by the
+  per-operation timeout only.
 - **`remote_text_encoder.url`** is https-only, and the HuggingFace token is
   attached only for `huggingface.co`, `huggingface.cloud` and `hf.space`. An
   endpoint elsewhere is still reachable; it just does not get the credential.
+  A redirect that leaves the host, or drops from https to http, is followed
+  without the token.
 - **`model_name`** must be a Hub repo id or a path inside a root - the same
   shape check `download_model` has always applied to `repo_id`. A URL is
   neither, and is refused as such rather than resolving into the workflow's
@@ -269,5 +298,5 @@ SecurityError
 ## Testing
 
 ```bash
-pytest tests/test_security.py tests/test_locations.py tests/test_workflow_trust.py -v
+pytest tests/test_security.py tests/test_locations.py tests/test_outbound.py tests/test_workflow_trust.py -v
 ```