feat: publish asset-manifest v1 from Director H3 join sidecars

[IAnMove]

Resultado

Siguiente writer de manifiesto: solo el sidecar de ensamblado secuencial Director MiniMax H3 (_run_minimax_h3_story_video → _write_director_assembly_sidecar). PR único de writer para Director-join, ramificado desde origin/main, no apilado.

• reutiliza publish_generation_sidecar
• conserva las claves del sidecar (params con director_pipeline_id, generation_mode, result_kind, created_at)
• origin.tool = director; origin.actor = unknown (no se pasa ni se inventa actor)
• workspace_id sale del argumento workspace de _run_minimax_h3_story_video; no se inventa workspace
• persist_pipeline_output_timing sigue usando json.dump (muta un sidecar existente)
• no toca _launch_runtime.py, WanGP, models, Recast/Repaint/Outpaint, Tools, MiniMax image, Series assembly, 3D, Rig, useStore.ts ni asset_manifest.py

Verificación local

• pytest test_director_pipeline_timing + test_asset_manifest + test_architecture_contracts: 30 passed
• architecture_contracts.py: OK
• verify_clean_repo.py: OK

Pendiente de CI. @cursor review sobre este HEAD.

---

Note

Medium Risk
Changes persisted metadata for assembled Director deliverables; behavior is covered by tests and legacy top-level keys are retained, but any consumer assuming only the old unstructured sidecar shape could be affected.

Overview
Director sequential MiniMax H3 join no longer writes assembly metadata with a raw json.dump to .meta.json. It now goes through _write_director_assembly_sidecar, which calls publish_generation_sidecar with tool="director" and the pipeline workspace id.

The sidecar payload (params, generation_mode, result_kind, created_at, etc.) is still present for gallery-style readers, but the on-disk file is a canonical asset-manifest v1 document (schema, origin, execution, stable asset.id on re-publish for the same output path). Sensitive fields like api_key are not written to the published manifest.

persist_pipeline_output_timing and other timing sidecar updates are unchanged (still direct JSON mutation). A new test in test_director_pipeline_timing.py locks in schema, origin/execution fields, secret stripping, and asset id stability.

^{Reviewed by Cursor Bugbot for commit ccd6505. Configure here.}

[IAnMove]

@cursor review

[github-actions]

PR Review — Loreframe Studio

Risk: low
Scope: 2 file(s); +72/-2; backend services

Automated review from scripts/analyze_pr.py. This is a heuristic pass (no LLM) so humans still own the merge decision.

Findings

• No heuristic issues. Still run the CI checklist below.

Changed files

• modified: app/services/director_pipeline.py, tests/test_director_pipeline_timing.py

CONTRIBUTING checklist

• python scripts/verify_clean_repo.py
• python -m compileall -q app/services app/launch.py scripts
• cd ui && npm run build if the UI changed
• No weights, CivitAI sidecars, or generated guides
• Stays local-first (no required accounts / telemetry)

Posted by the repo PR review workflow. Re-runs on each push to the PR.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ccd6505. Configure here.}