# PRD — STRAIGHT INTO THE STORM / SAIL ST8
## OMC 2.8 Workflow Update: GROUND TRUTH / HURRICANE WINDOW

**Version:** 1.0  
**Date:** 2026-08-08  
**Project scope:** `sail-st8-v3`  
**Target workflow:** OMC 2.8 + Render Ledger + Replicate video generation  
**Primary implementation target:** `worlds/sail st8 into the storm/`  

---

## 1. Executive Summary

Update the existing OMC 2.8-compliant SAIL ST8 / Straight Into the Storm production workflow so that the new underwater **GROUND TRUTH / HURRICANE WINDOW** treatment can be generated as a governed trailer sequence using the **same six attached drone reference images as direct inputs to video generation**.

The key product change is not simply “add underwater shots.” The workflow must treat the probe as a continuity-critical production asset with protected visual identity, provenance, repeatable references, model-aware input routing, and explicit human evaluation.

The new sequence dramatizes a core story idea:

> Before an East Pacific hurricane reaches San Francisco, a municipal probe descends beneath the flooded waterfront to establish independent physical truth about the city’s hydraulic network. It discovers that the real underwater city has evolved far beyond Harbor Zero’s accepted model.

The workflow must preserve three kinds of truth separately:

1. **Accepted scene truth** — the existing protected SF2047 Blender scene and registered world geometry.
2. **Reference truth** — the six attached probe images, their hashes, and their approved identity properties.
3. **Narrative hypothesis** — the fictional underwater infrastructure, Gate 17 evolution, submerged service layer, and hurricane-window treatment.

Generated imagery must never be promoted into engineering evidence merely because it looks plausible.

---

## 2. Existing System Baseline

The implementation should extend the existing Render Ledger reference-packet architecture rather than create a parallel pipeline.

Current relevant capabilities already present in the repo:

- `ReferenceNeed`
- `ReferenceAsset`
- `GenerationAttempt`
- `EvaluationRecord`
- `WorkOrder`
- deterministic packet planning
- accepted/candidate authority separation
- SHA-256 fingerprinting
- model allowlists
- integer USD micro-unit cost accounting
- human review gating
- local Draft 2020-12 JSON Schema validation
- blocked downstream Blender work orders
- strict camelCase wire contract

Current generation logic already supports:

- still exploration with Seedream
- higher-fidelity refinement with FLUX
- selected-still animation with Seedance 2.0
- per-job cost reservations
- source asset hashes and rights classifications
- fixed shot-level motion prompts

This PRD modifies that motion path for the underwater probe sequence.

---

# 3. Problem Statement

The current motion workflow assumes:

`ReferenceNeed → generated still → selected still → Seedance image-to-video`

That is insufficient for the underwater sequence because the probe’s identity is defined by **multiple existing reference views**, not one newly generated still.

A generated start frame can accidentally redesign:

- probe proportions
- orange illuminated pressure housing
- cylinder placement
- cable topology
- outer black hard cases
- tray/frame geometry
- lift attachment points
- surface wear
- industrial, non-consumer character

If the animation stage receives only a generated still, the direct relationship to the approved source images is lost.

The result may remain aesthetically consistent while becoming the wrong machine.

The workflow must therefore support a second motion mode:

### `multiReferenceVideo`

where the original reference images are passed directly to the video generator on every shot.

---

# 4. Product Goal

Generate a coherent 20–35 second underwater trailer sequence in which the same probe descends through the drowned San Francisco waterfront while an East Pacific hurricane approaches, discovers mismatches between Harbor Zero’s accepted scene and physical reality, and reveals a submerged layer of accumulated civic adaptation.

The sequence must feel like a continuation of the existing probe-deployment cliffhanger, not a new vehicle or unrelated underwater aesthetic.

### North-star quality statement

> A viewer who sees any two probe shots should immediately believe they depict the same physical machine, built and handled by the same crew, during the same mission.

### North-star story statement

> The probe is not looking for the attacker. It is looking for where the model stopped matching the city.

---

# 5. Non-Goals

This phase does **not**:

- resolve who conducted the cyberattack;
- turn underwater generated imagery into factual engineering evidence;
- modify the protected accepted Blender scene automatically;
- replace the canonical six probe reference frames with generated approximations;
- redesign the probe;
- create a generic “Atlantis” or fantasy underwater city;
- portray Gate 17 as magical biological infrastructure;
- require the final hurricane dynamics to be engineering-grade CFD;
- generate final sound mix, VO, or score;
- make the city’s improvised infrastructure universally safe or morally pure.

---

# 6. Locked Narrative Treatment

## 6.1 Mission name

**GROUND TRUTH / HURRICANE WINDOW**

## 6.2 Mission objective

Physically verify the submerged hydraulic and utility network beneath the San Francisco waterfront before hurricane conditions make surface deployment and retrieval unsafe.

### Primary operational question

> Where can the water actually go?

### Secondary epistemic question

> Why does Harbor Zero no longer know?

## 6.3 Environmental clock

An East Pacific hurricane has recurved toward Northern California.

The sequence should show escalating but physically grounded conditions:

- long-period swell entering the Golden Gate;
- rapidly falling pressure;
- worsening surface recovery conditions;
- storm-driven surge interacting with existing bay level;
- rainfall and runoff loading the city from inside the Bay;
- increasing turbidity and suspended debris underwater;
- stronger currents around submerged openings and old infrastructure.

The exact hurricane category should remain unspecified in the trailer treatment unless later scientific review locks it.

## 6.4 Discovery

The official model predicts a critical hydraulic path as closed or absent.

The probe discovers:

- the registered Gate 17 configuration no longer exists;
- the opening has evolved through earthquake displacement, community repair, old municipal machinery, Jubilee interventions, improvised check valves, and marine growth;
- the submerged waterfront contains a functional service layer absent from the accepted scene;
- some “unregistered” infrastructure may be contributing to pressure equalization and resilience;
- closing unknown paths simply because they are unverified may itself create hydraulic harm.

## 6.5 Philosophical reveal

The city survived partly by becoming something nobody had permission to design.

The underwater city is not a hidden futuristic metropolis. It is accumulated infrastructure:

- foundation
- reef
- conduit
- maintenance corridor
- pressure relief
- sensor network
- repair history
- civic memory

---

# 7. OMC 2.8 Data-Model Update

Preserve all existing native OMC 2.8 envelopes. Add new production semantics only through existing supported `customData` extensions.

## 7.1 New NarrativeObject

### `sail-st8-v3:obj/ground-truth-probe`

**Entity type:** `NarrativeObject`  
**Narrative type:** `narrativeProp`

Required custom extension fields:

```json
{
  "extensionType": "systemOrPropBible",
  "classification": "surveyProbe",
  "missionRole": "independent physical ground-truth acquisition",
  "identityCritical": true,
  "allowedCapabilities": [
    "underwater imaging",
    "local sonar or range sensing",
    "pressure and flow observation",
    "physical geometry inspection",
    "local telemetry capture",
    "tethered or bounded communications"
  ],
  "prohibitedCapabilities": [
    "autonomous citywide control",
    "weapons",
    "magical omniscient scanning",
    "direct geopolitical attribution"
  ],
  "visualGuardrails": [
    "retain orange illuminated central housing",
    "retain black and dark-metal industrial modules",
    "retain exposed cable and hose routing",
    "retain rectangular lifting cradle",
    "retain rugged wet-service finish",
    "do not transform into sleek consumer submarine"
  ]
}
```

## 7.2 New NarrativeLocation

### `sail-st8-v3:loc/submerged-waterfront-service-layer`

Required traits:

- drowned Embarcadero / Financial District interface;
- recognizable structural remnants without relying on implausible intact streetscapes;
- submerged foundations, piles, service conduits, ferry infrastructure remnants;
- accumulated human repair;
- ecological colonization integrated with infrastructure but not magical;
- limited visibility and particulate water;
- active currents around constrictions;
- visual evidence of multiple repair eras.

## 7.3 New Technical Asset

### `sail-st8-v3:asset/technical/ground-truth-hurricane-window-treatment`

Must store:

- mission objective;
- hurricane window;
- Gate 17 uncertainty;
- submerged service-layer reveal;
- scientific/visual guardrails;
- narrative lines if approved later;
- story state: `locked-for-underwater-probe-sequence-v1`.

## 7.4 New Reference Manifest

### `sail-st8-v3:asset/reference-manifest/ground-truth-probe`

This is the authoritative mapping of the six source images to probe identity features and model usage.

Generated outputs must reference this manifest but may not replace it.

---

# 8. Probe Reference Asset Ingestion

Create a new project folder:

```text
assets/reference/ground_truth_probe_v01/
  00_surface_context/
  01_identity_wide/
  02_identity_close/
  03_interaction/
  manifest.json
  REFERENCE_BRIEF.md
```

## 8.1 Canonical source files

| Ref ID | Source file | SHA-256 | Size | Primary use |
|---|---|---|---|---|
| `probe-ref-01` | `1786191424726.jpeg` | `9771ddbdc8730212634c6b501d8b2c0db47f929ac400a25062cc09493a5482f1` | 1536×691 | lowered probe, silhouette, top routing |
| `probe-ref-02` | `1000008698.jpg` | `0126a72655caf7ae90573e693fb0ffd0d42227a54ea1f7cf97c3fed093ea9fea` | 1536×691 | crew scale, full side profile, lift frame |
| `probe-ref-03` | `1000008697.jpg` | `bbd0feb8714c4fe9edf59764fc51aa74c7ecaeb5f3039c0747cb186294e60295` | 1536×691 | near frontal/side identity, orange core proportion |
| `probe-ref-04` | `1000008696.jpg` | `d42028fe2e472165fd7e9de7b4913f930930d8041b1c9ddf5fa0787827514692` | 1536×691 | orange pressure housing, fitting detail, wet material |
| `probe-ref-05` | `1000008695.jpg` | `ee737150f6b1f5f3a363191ea7946c161ad93187114b49d6bd05abfbf38623c9` | 1536×691 | end-cylinder / clamp / gloved interaction detail |
| `probe-ref-06` | `1000008694.jpg` | `985c20629ae1a02fd05c6761950ec98a88a8cdf290706c0aed177fd3af708060` | 1536×691 | crew handling, top surface, cables, human scale |

### Rights classification

Default ingestion value unless manually changed:

`project-provided reference; rights status requires project confirmation`

Do not silently assert `licensed`.

## 8.2 Additional world reference

The generated underwater concept frame may be ingested separately as:

`underwater-world-ref-01`

SHA-256:

`7cbb3cfdd2c87c881df67f785b7d80e59a0042854db541da8ae7c6d898e6d254`

Classification:

`CREATIVE_REFERENCE_ONLY`

It may guide:

- water color;
- scale of submerged structure;
- amber probe lighting;
- marine colonization density;
- atmospheric depth.

It may **not** override probe identity or become geographic/engineering evidence.

---

# 9. Video Model Adapter Requirements

## 9.1 Current preferred model

`bytedance/seedance-2.0`

For the probe sequence, use Seedance in **multimodal reference mode**, not first-frame image-to-video mode.

### Required input behavior

```json
{
  "reference_images": [
    {"$source": "probe-ref-01"},
    {"$source": "probe-ref-02"},
    {"$source": "probe-ref-03"},
    {"$source": "probe-ref-04"},
    {"$source": "probe-ref-05"},
    {"$source": "probe-ref-06"},
    {"$source": "underwater-world-ref-01"},
    {"$source": "hero-primary"}
  ],
  "prompt": "...",
  "duration": 5,
  "resolution": "720p",
  "aspect_ratio": "21:9",
  "generate_audio": false
}
```

### Adapter invariant

When `reference_images` is non-empty:

- `image` MUST be null/absent;
- `last_frame_image` MUST be null/absent;
- the model adapter MUST validate the mutual-exclusion rule before submission;
- references MUST preserve deterministic ordering so `[Image1]` etc. remain stable across retries.

## 9.2 Reference ordering contract

Every underwater shot uses the same first six image assignments:

- `[Image1]` probe broad side/top identity
- `[Image2]` probe + crew scale
- `[Image3]` full probe geometry
- `[Image4]` central amber housing detail
- `[Image5]` end fitting / clamp detail
- `[Image6]` crew interaction / top cable layout

World references begin only at `[Image7]`.

Prompts must refer to the probe collectively as:

> “the exact same survey probe shown in [Image1]–[Image6]”

## 9.3 Model fallback contract

If a selected video model cannot ingest six or more reference images:

1. do not silently drop references;
2. mark the model `REFERENCE_CAPABILITY_INSUFFICIENT` for direct generation;
3. optionally create a human-approved canonical probe keyframe using all six references;
4. only then route to image-to-video using that approved keyframe;
5. record this as a different generation class: `derivedIdentityVideo`.

Direct-reference generation remains preferred.

---

# 10. Aspect-Ratio and Editorial Contract

The trailer master remains **2.39:1**.

Because Seedance exposes 21:9 rather than exact 2.39:1:

- generate underwater shots at `21:9` where available;
- use deterministic center-safe crop to 2.39:1;
- protect probe body and mission-critical structure within 90% vertical and 92% horizontal title-safe region;
- never crop the probe’s front or rear module solely to improve composition;
- retain 8–12 frame editorial handles when the provider supports duration margin.

Do not revert the underwater sequence to the old 16:9-only behavior.

---

# 11. Underwater ReferenceNeed / Shot Plan

Create eight new `ReferenceNeed` records.

## NEED 01 — Surface threshold

**ID:** `need-sf2047-r25-001-probe-water-entry`

**Purpose:** bridge the existing deck shot into underwater mission space.

**Visual:** probe penetrates storm-dark bay water; surface agitation remains visible overhead.

**Hard gates:**

- exact probe identity;
- no redesign during submersion;
- no impossible explosive splash;
- cable/tether behavior remains plausible;
- no generic submarine transformation.

## NEED 02 — Descent through lost evidence

**ID:** `need-sf2047-r25-002-probe-descent-debris`

**Visual:** probe descends through turbidity, quake debris, old cable runs, displaced piles.

**Story function:** first separation between accepted model and physical reality.

**Prompt concept:**

> The probe from [Image1]–[Image6] descends slowly, amber central housing visible, through dark particulate water beneath the flooded San Francisco waterfront. Broken infrastructure is old enough to carry marine growth; recent storm-driven debris moves faster than fixed wreckage.

## NEED 03 — Drowned waterfront identity

**ID:** `need-sf2047-r25-003-drowned-embarcadero`

**Visual:** recognizable Port / Embarcadero remnants transition into underwater service space.

**Guardrail:** recognizable geography without pristine submerged streets or theme-park ruins.

## NEED 04 — First unregistered object

**ID:** `need-sf2047-r25-004-object-not-in-registry`

**Visual:** probe illuminates a functional repair or conduit absent from Harbor Zero.

**Story beat:** “OBJECT NOT FOUND IN REGISTRY.”

Text should be added in deterministic editorial post, not generated inside video.

## NEED 05 — Submerged service layer reveal

**ID:** `need-sf2047-r25-005-service-layer-wide`

**Visual:** the camera widens to reveal layered foundations, pumps, cables, repairs, reef growth, old municipal hardware and neighborhood modifications functioning together.

**Story function:** what looked like damage becomes adaptation.

**Hard gate:** no fantasy metropolis; infrastructure first.

## NEED 06 — Gate 17 mismatch

**ID:** `need-sf2047-r25-006-gate17-mismatch`

**Visual:** probe reaches coordinates where canonical Gate 17 should exist; geometry is visibly incompatible with the accepted model.

**Required reveal:** not “gate destroyed,” but “gate evolved into a different system.”

## NEED 07 — Hybrid hydraulic corridor

**ID:** `need-sf2047-r25-007-hybrid-equalization-path`

**Visual:** current or pressure movement through a mixed old/new corridor; biological colonization, old pumps, hand repairs and Jubilee modifications share one physical flow path.

**Story function:** unknown infrastructure may be keeping the city alive.

## NEED 08 — The city below the city

**ID:** `need-sf2047-r25-008-underwater-city-reveal`

**Visual:** wide final probe view toward an extensive but grounded submerged support network.

**Story function:** triumphant transition into resilient sovereign San Francisco.

**Possible VO editorial line:**

> “We weren’t finding damage. We were finding twenty years of updates.”

Do not burn dialogue into provider-generated audio for this pass.

---

# 12. Prompt Assembly Contract

Every generated shot prompt is assembled from five ordered layers.

## Layer A — Identity lock

Always first.

Example:

> Use the exact same rugged municipal survey probe shown in [Image1] through [Image6]. Preserve its proportions, rectangular lifting cradle, central translucent amber/orange pressure housing, black cylindrical end modules, exposed cables and hoses, dark hard cases, brackets, clamps, wet industrial finish and non-consumer construction. Do not redesign, streamline, enlarge, miniaturize, recolor or replace the vehicle.

## Layer B — Mission state

Example:

> The probe is conducting GROUND TRUTH / HURRICANE WINDOW, an urgent independent physical survey before a recurving East Pacific hurricane makes surface operations impossible.

## Layer C — Shot-specific action

One action only per shot when possible.

## Layer D — World continuity

Always reinforce:

- flooded San Francisco waterfront 2047;
- submerged real-world infrastructure adapted over decades;
- hurricane-driven turbidity and current;
- not clean architectural visualization;
- not fantasy ruins;
- no neon cyberpunk.

## Layer E — negative constraints

Mandatory:

- no probe redesign;
- no extra probe vehicles unless scripted;
- no invented crew underwater;
- no weapons;
- no text or labels;
- no magic scanning beams;
- no luminous radioactive contamination;
- no impossible intact underwater Financial District;
- no giant sea creatures used as spectacle;
- no camera teleportation.

---

# 13. Render Ledger State Machine Changes

The current state machine remains authoritative.

Add `generationMode` enum values:

```text
textToImage
imageToImage
firstFrameVideo
multiReferenceVideo
referenceVideoEdit
derivedIdentityVideo
```

For this sequence, primary attempts must use:

`generationMode = multiReferenceVideo`

## 13.1 GenerationAttempt additions

Add fields:

```json
{
  "generationMode": "multiReferenceVideo",
  "referenceAssetIds": [
    "probe-ref-01",
    "probe-ref-02",
    "probe-ref-03",
    "probe-ref-04",
    "probe-ref-05",
    "probe-ref-06",
    "underwater-world-ref-01"
  ],
  "identityManifestRef": "sail-st8-v3:asset/reference-manifest/ground-truth-probe",
  "identityReferenceDigest": "<deterministic digest of ordered refs>",
  "narrativeTreatmentRef": "sail-st8-v3:asset/technical/ground-truth-hurricane-window-treatment",
  "outputAspectRatio": "21:9",
  "editorialMasterAspectRatio": "2.39:1"
}
```

## 13.2 Request fingerprint

The request fingerprint MUST include:

- prompt text;
- model + version;
- ordered reference asset hashes;
- duration;
- resolution;
- aspect ratio;
- audio flag;
- treatment version;
- shot ID.

Changing any reference image changes the request fingerprint.

---

# 14. Evaluation Requirements

No probe video is accepted on generic aesthetics alone.

## 14.1 Deterministic checks

Before human/vision evaluation:

- output exists and decodes;
- correct duration range;
- correct aspect ratio or approved crop path;
- no provider error;
- all required references were submitted;
- request digest matches ledger;
- cost is captured;
- input assets match pinned hashes;
- no accepted Blender scene mutation occurred.

## 14.2 Probe Identity Score

New evaluator dimension:

`probeIdentityContinuity`

Sub-dimensions:

- overall length/height ratio;
- amber central housing proportion;
- module ordering;
- end-cylinder geometry;
- tray/cradle outline;
- visible cable routing family;
- black/amber material palette;
- industrial wear;
- scale relative to human references when visible.

### Minimum

`probeIdentityContinuity >= 0.88`

### Hard failures

- probe becomes a sleek submarine;
- central orange housing disappears;
- module order reverses without justified camera angle;
- additional wings/propellers dominate the silhouette;
- vehicle size changes radically;
- mechanical geometry visibly morphs during shot.

## 14.3 Underwater World Score

Dimensions:

- SF waterfront plausibility;
- infrastructure-first design;
- decade-scale accumulation;
- hydraulic legibility;
- hurricane-water behavior;
- old/new/ecological layering;
- absence of fantasy-ruin shorthand.

Minimum:

`underwaterWorldCoherence >= 0.80`

## 14.4 Story Utility Score

Every shot must answer one visual question.

Examples:

- Does this show the probe leaving trusted surface reality?
- Does this show the accepted model missing a physical object?
- Does this show damage becoming adaptation?
- Does this show Gate 17 as a changed system rather than simple wreckage?

Minimum:

`storyUtility >= 0.82`

## 14.5 Motion/physics gate

Mandatory multimodal review at video level, not sampled stills only.

Reject for:

- impossible probe inertia;
- cable motion inconsistent with current;
- fixed structures flowing like vegetation;
- currents moving all debris at identical speed;
- scale drift;
- geometry morph;
- impossible camera acceleration;
- obvious looping artifacts.

---

# 15. Human Review UX

Render Ledger review page should present each candidate with:

### Left column

- generated video
- scrubber
- frame-by-frame stepping

### Right column

- all six canonical probe reference images
- probe identity manifest
- current shot purpose
- current narrative treatment excerpt
- expected cost / actual cost

### Reviewer questions

1. Is this unmistakably the same probe?
2. Did any component morph during motion?
3. Does the underwater world feel like evolved civic infrastructure rather than fantasy?
4. Is the hurricane materially affecting the environment?
5. Does the shot advance the ground-truth discovery?
6. Would this shot cut directly after the existing surface deployment footage without breaking continuity?

Reviewer cannot approve without answering all six.

---

# 16. Economic Policy

Maintain current integer USD micro-unit accounting.

## First-cycle policy

For each `ReferenceNeed`:

1. generate one Seedance 2.0 reference-mode candidate;
2. evaluate identity + motion + story utility;
3. only generate a second candidate when a concrete repair hypothesis exists;
4. use Seedance Fast only for hypothesis testing, not automatic final promotion;
5. stop if identity continuity fails twice for the same shot and repair the prompt/reference strategy before spending further.

Do not brute-force ten stochastic variations to find one lucky probe.

### Sequence budget fields

Add:

- `plannedVideoSeconds`
- `costPerUsableSecond`
- `reviewMinutesPerUsableSecond`
- `rejectedForIdentityCount`
- `rejectedForMotionCount`
- `rejectedForWorldCount`

Render Ledger should report the cheapest model/configuration that produces an **approved second**, not merely a generated second.

---

# 17. Blender Relationship

The underwater probe sequence is creative-reference production and must remain separate from authoritative accepted-scene geometry unless explicitly promoted later.

### Rules

- no generated underwater video automatically edits `sf_waterfront_2047_accepted.blend`;
- any useful geometry discovery becomes a new `ReferenceNeed` or candidate Blender work order;
- accepted scene remains byte-identical through the generation phase;
- generated frames may inform a candidate underwater kit only after human promotion;
- any candidate Blender modification must preserve existing protected fingerprints.

The sequence can therefore reveal “the city outside the accepted model” narratively without corrupting the actual modeling authority model.

---

# 18. Required Repo Changes

## P0 — Schema and ingest

Modify:

- `reference_packet/schemas/reference-asset.schema.json`
- `reference_packet/schemas/generation-attempt.schema.json`
- `reference_packet/schemas/reference-need.schema.json`
- `reference_packet/schemas/work-order.schema.json`
- `reference_packet/canonical.py`
- `reference_packet/validation.py`
- `reference_packet/cost.py`

Add support for:

- `generationMode`
- ordered `referenceAssetIds`
- identity manifest references
- reference digest
- exact aspect-ratio/crop metadata

## P1 — Probe ingest fixture

Add:

```text
render_ledger/fixtures/sf2047_ground_truth_probe/
  planner_request.json
  entity_registry.json
  treatment.json
  probe_reference_manifest.json
  model_profiles.json
  protected_policy.json
```

Copy the six canonical source images into the governed reference directory.

Verify all six hashes at ingest and at generation time.

## P2 — Seedance adapter

Update generation runner so `multiReferenceVideo` emits:

```python
input={
    "reference_images": [...ordered refs...],
    "prompt": prompt,
    "duration": duration,
    "resolution": resolution,
    "aspect_ratio": "21:9",
    "generate_audio": False,
}
```

The adapter MUST reject simultaneous `image` and `reference_images` before calling the provider.

## P3 — Evaluator

Add video-level evaluator package:

- probe identity comparison;
- mechanical morph detection;
- underwater world rubric;
- story-utility rubric;
- hurricane physicality rubric.

Sampling stills is allowed as an auxiliary diagnostic but cannot be the sole motion evaluation.

## P4 — Human review

Expose side-by-side canonical references and video in Render Ledger.

## P5 — Trailer integration

Export:

- approved MP4;
- 2.39 crop proxy;
- shot-level edit handles;
- OMC/ledger sidecar JSON;
- source-reference digest;
- provider prediction ID;
- provider/model version;
- actual cost;
- approval record.

---

# 19. Acceptance Criteria

The phase is complete only when all of the following are true.

## Data / provenance

- [ ] all six source images exist in governed storage;
- [ ] their SHA-256 values match this PRD;
- [ ] every underwater `GenerationAttempt` records all six probe reference IDs;
- [ ] references are submitted in deterministic order;
- [ ] rights status is explicit;
- [ ] generated imagery remains `CREATIVE_REFERENCE_ONLY` until promoted.

## OMC / schema

- [ ] new probe object validates under OMC 2.8 envelope;
- [ ] treatment/reference data lives in supported `customData` extension;
- [ ] strict camelCase wire contract preserved;
- [ ] no unresolved cross-reference exists;
- [ ] local JSON Schema suite passes;
- [ ] external OMC validator pass is recorded before release if available.

## Generation

- [ ] all eight underwater needs have a valid planned work order;
- [ ] direct-reference Seedance jobs use `reference_images`, not `image`;
- [ ] no job sends both modes simultaneously;
- [ ] underwater aspect ratio is 21:9 or explicitly documented fallback;
- [ ] final crop is safe for 2.39:1.

## Quality

- [ ] probe identity score >= 0.88 on every promoted shot;
- [ ] underwater world score >= 0.80;
- [ ] story utility >= 0.82;
- [ ] zero identity hard failures;
- [ ] zero uncontrolled geometry morph hard failures;
- [ ] human reviewer approves continuity with existing surface sequence.

## Economics

- [ ] actual provider cost captured per attempt;
- [ ] cost per approved second reported;
- [ ] rejected attempts classified by failure type;
- [ ] no second candidate generated without logged repair hypothesis after first-pass failure.

## Authority protection

- [ ] accepted Blender file opening and closing SHA-256 match;
- [ ] no automatic Blender promotion occurs;
- [ ] generated underwater geometry is never mislabeled as authoritative existing city geometry.

---

# 20. Test Cases

## T01 — Exact reference pinning

Change one byte in `1000008696.jpg`.

Expected: generation plan validation fails before provider submission.

## T02 — Illegal mixed Seedance mode

Provide both `image` and `reference_images`.

Expected: local adapter fails with `MUTUALLY_EXCLUSIVE_VIDEO_INPUT_MODES`.

## T03 — Missing reference

Remove `probe-ref-05`.

Expected: job blocked with `IDENTITY_REFERENCE_SET_INCOMPLETE`.

## T04 — Probe redesign

Generated candidate transforms probe into streamlined mini-sub.

Expected: identity hard fail; no promotion regardless of aesthetic score.

## T05 — Beautiful fantasy city

Output contains glowing Atlantis-like buildings with little infrastructure logic.

Expected: underwater-world failure despite strong aesthetic score.

## T06 — Correct identity, useless story

Probe swims through generic dark water without revealing any model mismatch.

Expected: story utility failure.

## T07 — Cost runaway

First two candidates fail identity for same need.

Expected: adaptive policy blocks additional generation until prompt/reference repair is human-approved.

## T08 — Accepted scene mutation

Any generation-stage command writes to accepted `.blend`.

Expected: hard workflow failure and rollback.

---

# 21. Suggested First Implementation Slice

Do **not** build all eight shots first.

Implement three proof shots end-to-end:

1. `r25-002-probe-descent-debris`
2. `r25-005-service-layer-wide`
3. `r25-006-gate17-mismatch`

These test the three hardest requirements:

- probe continuity through motion;
- underwater worldbuilding;
- narrative legibility of “accepted model vs physical city.”

### Phase-1 success metric

At least 2 of 3 proof shots achieve:

- probe identity >= 0.88;
- story utility >= 0.82;
- no hard motion failure;
- human approval for trailer continuity;
- no more than two paid generation attempts per need.

Only then authorize the remaining five needs.

---

# 22. Example Planned Work Order

```json
{
  "schemaVersion": "sf2047-video-work-order/1.0.0",
  "workOrderId": "work-order__sf2047__r25__ground-truth__002",
  "needId": "need-sf2047-r25-002-probe-descent-debris",
  "status": "PLANNED",
  "classification": "CREATIVE_REFERENCE_ONLY",
  "generationMode": "multiReferenceVideo",
  "identityManifestRef": "sail-st8-v3:asset/reference-manifest/ground-truth-probe",
  "narrativeTreatmentRef": "sail-st8-v3:asset/technical/ground-truth-hurricane-window-treatment",
  "modelId": "bytedance/seedance-2.0",
  "input": {
    "reference_images": [
      {"$source": "probe-ref-01"},
      {"$source": "probe-ref-02"},
      {"$source": "probe-ref-03"},
      {"$source": "probe-ref-04"},
      {"$source": "probe-ref-05"},
      {"$source": "probe-ref-06"},
      {"$source": "underwater-world-ref-01"}
    ],
    "prompt": "Use the exact same rugged municipal survey probe shown in [Image1] through [Image6]. Preserve its rectangular lifting cradle, central translucent amber pressure housing, black cylindrical end modules, exposed cable topology and wet industrial finish. The probe descends beneath the flooded San Francisco waterfront during the final surface-operation window before an East Pacific hurricane. It moves slowly through dark particulate bay water, earthquake-displaced pilings, old municipal cable runs and storm-driven debris. Fixed infrastructure carries years of marine growth while recent debris moves with the current. The probe's amber light reveals physical geometry that does not cleanly match the accepted Harbor Zero model. Documentary physical realism, restrained camera drift, infrastructure first. No redesign of the probe, no sleek submarine, no fantasy Atlantis, no labels or text, no glowing radiation, no weapons, no giant creatures, no cuts.",
    "duration": 5,
    "resolution": "720p",
    "aspect_ratio": "21:9",
    "generate_audio": false
  },
  "promotionThresholds": {
    "probeIdentityContinuity": 0.88,
    "underwaterWorldCoherence": 0.80,
    "storyUtility": 0.82,
    "maximumHardFailures": 0
  }
}
```

---

# 23. Final Product Principle

The workflow should embody the same idea as the story.

The project has an **accepted model**, but the accepted model cannot erase evidence that reality has changed.

The six source images are therefore not “inspiration.” They are evidence of what the probe is.

Generated outputs may interpret the underwater city.

They may not reinterpret the probe without permission.

> **The model may invent the world around the machine. It may not invent a different machine.**