From 199af9213c629efbc69c2b73f452519afe5c531f Mon Sep 17 00:00:00 2001 From: Kristian Myram Date: Fri, 30 Oct 2026 02:10:36 +0100 Subject: [PATCH] #1743: use existing CI and consolidate render source documentation --- .../workflows/render-source-protection.yml | 36 ------------------- docs/agents.md | 2 +- docs/file-format-parity.md | 32 +++++++++++++++++ docs/render-source-protection.md | 30 ---------------- 4 files changed, 33 insertions(+), 67 deletions(-) delete mode 100644 .github/workflows/render-source-protection.yml delete mode 100644 docs/render-source-protection.md diff --git a/.github/workflows/render-source-protection.yml b/.github/workflows/render-source-protection.yml deleted file mode 100644 index 4bb44c8bf..000000000 --- a/.github/workflows/render-source-protection.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Render source protection - -on: - pull_request: - paths: - - .github/workflows/render-source-protection.yml - - Cargo.toml - - Cargo.lock - - crates/engine/** - - crates/project/src/render_queue.rs - workflow_dispatch: - -permissions: - contents: read - -jobs: - regression: - name: Source guard (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - timeout-minutes: 30 - strategy: - fail-fast: false - matrix: - os: [ubuntu-latest, windows-latest] - env: - CARGO_PROFILE_DEV_DEBUG: 0 - CARGO_PROFILE_TEST_DEBUG: 0 - CARGO_INCREMENTAL: 0 - steps: - - uses: actions/checkout@v4 - with: - persist-credentials: false - - uses: dtolnay/rust-toolchain@1.95.0 - - run: cargo test --locked -p effectcraft-engine --lib output_guard::tests - - run: cargo test --locked -p effectcraft-engine --lib tests::render_overwrite - - run: cargo test --locked -p effectcraft-project render_queue::tests diff --git a/docs/agents.md b/docs/agents.md index 1781c7163..9672d9c42 100644 --- a/docs/agents.md +++ b/docs/agents.md @@ -5,7 +5,7 @@ panel gestures, the CLI, the control channel and MCP all go through the same com user can do, an agent can do too. There are three ways in: Render-queue outputs cannot replace footage, proxies or the project file. See -[render source protection](render-source-protection.md) for aliases, default names and sequence +[render source protection](file-format-parity.md#render-source-protection) for aliases, default names and sequence limits. This guard does not change ordinary-file overwrite defaults or add another confirmation API. | Interface | Best for | Needs a window | diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md index 9e2249e9b..19447ae3d 100644 --- a/docs/file-format-parity.md +++ b/docs/file-format-parity.md @@ -105,6 +105,37 @@ single-file video (Animation / PNG codecs), DPX / Targa / Photoshop sequences, M encoders ([hardware-parity.md](hardware-parity.md)), and rendering safely over an existing file (#325). +### Render source protection + +The render queue refuses an output that would replace footage, an attached proxy, or the +project file. It checks every output module and segment before dispatching the item. A refused +item is marked Failed with its reason; other valid queued items can still render. Render logs +are checked too. No render parameter overrides this protection. + +Checks compare normalized paths and native file identities, so an existing symbolic link, +hard link, junction or Windows short name cannot disguise a source as another output file. +Source identities are indexed once per check and matching identities are verified. The index +does not keep file handles open for the lifetime of a long sequence. + +Default output names move aside when they would replace a protected file. This also applies to +Create Proxy: recreating a proxy chooses a new default name and attaches the new proxy, leaving +the previous proxy file intact. An explicit output path is kept as entered and refused if it +would replace a protected file. + +After Pre-render imports its result, that file is footage too. Re-queueing the same item +with the same output is refused; run Pre-render again for a fresh default output, or choose +another Output To. An item's `last_output` is not permission to replace imported footage. + +Image-sequence checks inspect existing frames in the requested range. Skip Existing Files leaves +existing frames alone. If a frame number appears in a folder name, the checker probes each +frame separately and refuses ranges over 100,000 frames instead of silently checking a prefix. +Choose a fixed output folder or a shorter range for those exports. + +This guard does not introduce an overwrite flag, confirmation dialog, or changed replacement +defaults for the CLI, scripts or MCP. Replacement consent and staging ordinary output files +belong to the exporter. The source check runs before export; filesystem changes between that +check and a write still require exporter-side revalidation. + ## Estimate **≈ 130–230 h**: `.aep` / `.aepx` import 80–160 h (after the owner decision), wiring TGA / DPX / @@ -115,5 +146,6 @@ relinking 6–12 h, `.mogrt`-compatible templates 15–30 h (partly parallel wit | Date | Change | Summary | |---|---|---| +| 2026-10-30 | minor | Render-queue source-protection behavior and limits consolidated here from the standalone page | | 2026-10-12 | minor | #324 and #514 marked closed; open `.aep` PRs #251 and #860 noted | | 2026-10-10 | major | First file format parity document, from the After Effects 26.5 bundle and this repository's import/export registries | diff --git a/docs/render-source-protection.md b/docs/render-source-protection.md deleted file mode 100644 index cf15f6797..000000000 --- a/docs/render-source-protection.md +++ /dev/null @@ -1,30 +0,0 @@ -# Render source protection - -The render queue refuses an output that would replace footage, an attached proxy, or the -project file. It checks every output module and segment before dispatching the item. A refused -item is marked Failed with its reason; other valid queued items can still render. Render logs -are checked too. No render parameter overrides this protection. - -Checks compare normalized paths and native file identities, so an existing symbolic link, -hard link, junction or Windows short name cannot disguise a source as another output file. -Source identities are indexed once per check and matching identities are verified. The index -does not keep file handles open for the lifetime of a long sequence. - -Default output names move aside when they would replace a protected file. This also applies to -Create Proxy: recreating a proxy chooses a new default name and attaches the new proxy, leaving -the previous proxy file intact. An explicit output path is kept as entered and refused if it -would replace a protected file. - -After Pre-render imports its result, that file is footage too. Re-queueing the same item -with the same output is refused; run Pre-render again for a fresh default output, or choose -another Output To. An item's `last_output` is not permission to replace imported footage. - -Image-sequence checks inspect existing frames in the requested range. Skip Existing Files leaves -existing frames alone. If a frame number appears in a folder name, the checker probes each -frame separately and refuses ranges over 100,000 frames instead of silently checking a prefix. -Choose a fixed output folder or a shorter range for those exports. - -This guard does not introduce an overwrite flag, confirmation dialog, or changed replacement -defaults for the CLI, scripts or MCP. Replacement consent and staging ordinary output files -belong to the exporter. The source check runs before export; filesystem changes between that -check and a write still require exporter-side revalidation.