Gate Control

gate-control

This is the single authorization policy for every VideoStudio production line. Line skills own artifacts and production craft; they do not invent a second confirmation or recovery state machine.

Resolve the next operation from current facts—plan identity, artifact identity, narration materialization, paid-attempt facts, QA evidence, and explicit user authority—not from a monotonic stage rank. Preview/snapshot work may continue while required narration is missing; complete draft/final delivery may not. Stop the execution horizon at any operation whose returned evidence decides the next branch.

Gate-B identity is the normalized production-intent projection. Stable copy, timing, language, references, provider settings, and voice selection remain approval-bearing; execution-only fields such as produced paths/status and provider catalog display labels do not. Unknown plan fields remain signed so new semantics cannot bypass review.

Canonical review gates

The names below are internal protocol identifiers. In normal user-facing headings and decisions, use plain localized names instead:

Keep Gate A/B/C/D and HTML Preview for tool calls, stored state, and technical diagnostics only. Choose the production language from an explicit user request first, then the current UI/user language when known, otherwise English. Normalize Chinese to zh-CN, English to en, Japanese to ja, Portuguese to pt-BR, and unsupported languages to en; once submitted, keep that choice locked unless the user explicitly changes it.

Every gate shows the current artifact, a concise next-action/cost/QA note, one decision request, and then stops. A new turn, question, or unrelated message is not approval.

Decision values are approve and revise; keep free-text adjustments separate. Gate A locks the creative brief but does not authorize production, paid work, rendering, or final delivery.

Gate C is one batch-level decision. A pending or failed paid request is not reusable authority for another request: a user-requested retry needs a fresh Gate C and a new output path. Do not interleave per-shot confirmations.

Authority is not the same as recovery

• A Preview/Gate D revise authorizes editing the displayed artifact within the requested scope and any required non-billable restart of its visual-QA cycle.
• approve authorizes only the displayed artifact and next transition.
• Technical QA exhaustion is not a second user decision and must never create a new recovery form.
• Legacy visual_recovery_decision=new_visual_revision input remains consumable for old clients, but must not be emitted in a new task.
• An error that says authorization is required does not itself prove recovery availability; query durable status first.
• A malformed local payload, missing file, stale evidence, failed check, or write error is system work, not a creative decision. Repair it without creating a gate when approved intent is unchanged.

When production or rendering tools are explicitly unavailable, return a clearly unexecuted production package for an otherwise clear brief: assumptions, complete narration/script, timed storyboard, exact visible copy/captions, visual/audio and rights-safe asset plan, export target, preview checklist, and final playback/encoding QA. Do not claim files exist or withhold the package behind a direction form.

Required resolution

After a gate submission, a post-gate edit, a resumed turn with prior approval, or a visual-revision error:

1. Identify the locked line: compose, auto, generate, or edit.
2. Identify the reviewed artifact: composition for COMPOSE (and AUTO child compositions), otherwise production.
3. Classify revision scope:
   • visual_only: HTML/CSS/SVG/layout/motion/palette/assets; no approved wording, timing, language, narration, delivery, source mapping, role, or provider-setting change.
   • gate_b_payload: approved copy/casing/punctuation, timing, language, narration, delivery, source mapping, semantic roles, or signed provider intent.
   • unknown: inspect the requested files before asking a technical question.
4. Set recovery only from deterministic evidence: available, not_available, or unknown. This selects internal control flow, not a new form.
5. Run ovs gate transition and obey next_action, form, allowed_ops, and prohibited_ops.

Always invoke the resolver through the public ovs gate transition command (or the equivalent gate_transition MCP tool). Never execute a resolver by referencing an installed skill or Marketplace path directly. Pass only the decision field present in the current user submission. Never combine a current --decision with a cached --recovery-decision.

ovs gate transition \
  --line compose \
  --artifact composition \
  --gate gate_d \
  --decision revise \
  --scope visual_only \
  --recovery not_available

Pass --origin user|model|unknown for signed amendments, from the actual current user reply. Mixed user instructions plus additional model proposals use model. This pure resolver trusts caller-supplied facts; it does not verify chat history or record approvals. Optional evidence inputs are --error-code, --artifact-state, and --approval-status. --recovery-decision is backward-compatible input for an already-visible old form only. Use unknown when evidence is missing; never guess available.