Kinocut

Execute an agent workflow job-spec and return a provenance receipt. Validates the spec first (fail-closed), then runs each allowlisted op (probe|trim|resize|convert|merge|add_text|composite_layers) SEQUENTIALLY in spec order via the backing engine functions. Intermediates are written to a per-run ``@work`` directory unique to this invocation and cleaned on success (kept on failure); final media lands at the declared ``@outputs`` paths. Batch variants: pass ``variant=<id>`` to render one declared variant (its overrides patch the shared steps/outputs, and the single ``@outputs`` path is auto-named with the variant id so N variants emit N distinct outputs); the receipt records ``workflow.variant``. Pass ``all_variants=True`` to render EVERY declared variant in turn and return a ``workflow_batch`` summary (one receipt per variant, each into its own ``@work`` dir); use ``save_receipt_dir`` to also write each variant's receipt to ``<dir>/<variant>.json``. ``variant`` and ``all_variants`` are mutually exclusive. Pass ``keep_intermediates=True`` to retain ``@work`` intermediates even on success (recorded as the ``keep-intermediates`` cleanup policy). Pass ``resume_receipt`` (a prior render receipt from a job that failed with its intermediates kept) to RESUME: the current spec_hash must equal the receipt's (else fail-closed ``resume_spec_mismatch``) AND, for a variant, the receipt's variant must match (else ``resume_variant_mismatch``); each step whose recorded status is ``completed`` AND whose recorded input hashes still match AND whose recorded output file still exists and re-hashes to the recorded hash is SKIPPED, and the first step failing any check plus everything after it re-runs. Returns a workflow receipt (``receipt_kind: "workflow"``) capturing tool + FFmpeg versions, the spec hash, per-source probes/hashes, per-step status with real sha256 hashes of every consumed input and produced output, the cleanup manifest, and the determinism-scope caveat. On the first f…

Validate an agent workflow job-spec without rendering any media. Runs the fail-closed structural validator over the JSON job-spec at ``spec_path``: op allowlist (probe|trim|resize|convert|merge|add_text|composite_layers), symbolic ``@ref`` resolution (@sources.<id>, @work/<name>, @outputs.<id>), backward-reference-only ordering (a step may reference @work outputs from strictly-earlier steps only), per-op param introspection, and workspace-confined path safety (absolute paths and ../ / symlink escapes fail closed). Returns a structured verdict (``{"valid": true, ...}``) on success. On any structural violation it fails closed with a specific error ``code`` (``invalid_workflow_spec``, ``unknown_workflow_ref``, ``unsupported_workflow_op``, ``unsafe_workflow_source``, ``invalid_workflow_params``). Args: spec_path: Absolute path to the workflow job-spec JSON file.

Write metadata tags to a video/audio file. Args: input_path: Absolute path to the input file. metadata: Dict of tag key-value pairs (e.g. {'title': 'My Video', 'artist': 'Me'}). output_path: Where to save the output. Auto-generated if omitted.