feat: publish asset-manifest v1 from alternative-song sidecars

[IAnMove]

Resultado

Siguiente writer de manifiesto: solo las sidecars de canciones alternativas (app/services/alternative_songs.py). PR único ramificado desde origin/main, no apilado.

• save_sidecar reutiliza publish_generation_sidecar sobre la ruta de media, no el .meta.json
• conserva params.alternative_songs y el resto de claves de galería
• si el sidecar ya es v1, conserva asset.id y origin.tool (series-assembly/director/studio no se reescriben)
• write_mounted_sidecar publica con tool=alternative-songs y workspace_id del argumento
• actor desconocido (unknown); no se inventa user ni workspace default
• las API keys no se persisten
• no toca _launch_runtime.py, WanGP, models, Director, Series, 3D, Rig, i18n ni asset_manifest.py

Verificación local

• pytest test_alternative_songs + test_asset_manifest + test_architecture_contracts: 35 passed
  • tests/test_alternative_songs.py: 13
  • tests/test_asset_manifest.py: 17
  • tests/test_architecture_contracts.py: 5
• scripts/architecture_contracts.py: OK
• scripts/verify_clean_repo.py: OK

Pendiente de CI. @cursor review sobre este HEAD.

---

Note

Medium Risk
Changes how gallery sidecars are persisted and attributed for alternative-song flows; mistakes could corrupt origin/tool or asset IDs, but scope is limited to alternative_songs.py with targeted tests.

Overview
Alternative-song gallery metadata no longer writes raw .meta.json with a local atomic dump; save_sidecar now routes through publish_generation_sidecar so sidecars get the v1 schema, redaction, and canonical origin fields while keeping legacy keys like params.alternative_songs.

Tool and workspace attribution are resolved carefully: an explicit tool argument wins; otherwise existing v1 origin.tool on disk or in the payload is kept (so series-assembly / director / studio are not overwritten). Director-only pipeline IDs leave tool unset so publish can attribute director. Workspace comes from workspace / workspace_id without defaulting to default.

write_mounted_sidecar now passes tool="alternative-songs" on save (including the follow-up save when result_kind is corrected).

New tests cover v1 publish roundtrip, stable asset.id, preserved series-assembly origin, mounted outputs with alternative-songs origin, secret stripping, and actor unknown (not invented user).

^{Reviewed by Cursor Bugbot for commit 097cc6b. Configure here.}

[IAnMove]

@cursor review

[github-actions]

PR Review — Loreframe Studio

Risk: low
Scope: 2 file(s); +175/-11; backend services

Automated review from scripts/analyze_pr.py. This is a heuristic pass (no LLM) so humans still own the merge decision.

Findings

• No heuristic issues. Still run the CI checklist below.

Changed files

• modified: app/services/alternative_songs.py, tests/test_alternative_songs.py

CONTRIBUTING checklist

• python scripts/verify_clean_repo.py
• python -m compileall -q app/services app/launch.py scripts
• cd ui && npm run build if the UI changed
• No weights, CivitAI sidecars, or generated guides
• Stays local-first (no required accounts / telemetry)

Posted by the repo PR review workflow. Re-runs on each push to the PR.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 097cc6b. Configure here.}