--- path: /studio/isis/video-production-workflows surface: studio domain: isis auth: signed-in + Studio Isis AAA boundary; localhost E2E lane bypass for focused workspace automation source: apps/oshun/web/src/app/studio/isis/video-production-workflows/page.tsx status: walked last_walked: '2026-07-23 exact production BFF + Playwright desktop/mobile walk — hard production gate, exact/no-store catalog and validation contracts, valid and invalid results, adversarial rejection, pending/offline/auth states, responsive containment, 44-pixel controls, and applicable axe coverage passed; manual screen-reader and installed-PWA checks remain open' --- # Isis Video Production Workflows ## Purpose Request-local, non-authoritative preview that validates a caller-supplied workflow definition against the canonical `@isis/workflows` schema. Invalid definitions surface the real per-path schema errors; valid ones expose only a normalized header. This route does not register, execute, persist, govern, publish, or release a workflow or media artifact. ## Entry points - Embedded as the "Video Production Workflows Lane" inside `/studio/isis/ai-video` - Sibling quick-action card from `/studio/isis/topaz-enhancement` - Studio index (`/studio`) - Direct URL / bookmark (production Studio Isis boundary applies; focused workspace automation uses the localhost-only `?__oshunStudioIsisLaneE2E=1` lane bypass) ## Layout regions `page.tsx` mounts `ShellLayout active="studio"` and three panels (no breadcrumb panel). - **Workspace panel** (`data-isis-video-production-workflows-workspace`): - `

` "Isis Video Production Workflows Workspace" (`WorkspaceHeading`) - Summary paragraph (`data-isis-video-production-workflows-summary`) - The "Workflow definition (JSON)" form (`data-isis-vw-form`) listing the catalog `requiredFields`; exposes `data-isis-vw-form-state="idle|pending"` - Result block (`data-isis-vw-result`) with `data-isis-vw-verdict`, `data-isis-vw-header` (valid) or `data-isis-vw-errors` (invalid) - **Route map panel** (`data-isis-video-production-workflows-route-map`): `

` "Route Map" enumerating `STUDIO_ISIS_VIDEO_PRODUCTION_WORKFLOWS_ROUTE_MAP` with `data-isis-vw-route-map-count="5"` and one `data-isis-vw-route-map-entry` per contract path: one `mounted`, four `documented-contract`. - **Quick-actions panel** (`data-isis-vw-quick-actions`, `data-isis-vw-quick-action-count="2"`): `quickAction` links to `/studio/isis/topaz-enhancement` (`data-isis-vw-quick-action="topaz-enhancement"`) and "Back to Studio workspace index" → `/studio` (`data-isis-vw-quick-action="studio-index"`). ## States - [x] **Loading** — `data-isis-vw-loading` "Loading workflow validator…" - [x] **Unauthorized** — `data-isis-vw-unauthorized` (admin-scope fail-closed on 401/403) - [x] **Error** — `data-isis-vw-error` on the mount GET - [x] **Ready (form)** — workflow textarea + submit render; form and submit expose idle state. - [x] **Pending submit** — submit disabled with `data-isis-vw-submit-state="pending"`, `aria-disabled="true"`, and `aria-busy="true"` while the live BFF validate call is held. - [x] **Result** — `data-isis-vw-verdict` (valid → `data-isis-vw-header`, invalid → `data-isis-vw-errors` of `data-isis-vw-error-row`) or `data-isis-vw-validate-error` - [x] **Network-unreachable validate** — aborted validate POST renders `data-isis-vw-validate-error` "Could not reach the workflow service." - [x] **Anonymous/gated navigation** — unauthenticated direct navigation redirects to `/welcome?redirect=%2Fstudio%2Fisis%2Fvideo-production-workflows&signedOut=1` before the workspace renders; signed-in non-bypass navigation hard-blocks under the Studio Isis boundary. - [ ] **Standalone PWA** — installed-shell launch still needs a manual pass. ## Interactions ### Validate workflow (`data-isis-vw-form`) - [x] **Workflow definition (JSON)** — `data-isis-vw-workflow` textarea; client and server cap the request at 256 KiB and 256 nodes - [x] **Validate workflow** — `data-isis-vw-submit` submit; POSTs to `/v1/admin/isis/video-production-workflows/validate` ### Route map - [x] **Mounted validator route** ×1 - [x] **Documented-contract-only route shapes** ×4 ### Quick-actions - [x] **Open Isis Topaz Enhancement workspace** → `/studio/isis/topaz-enhancement` - [x] **Back to Studio workspace index** → `/studio` ## Data & contracts - **Reads**: `GET /v1/admin/isis/video-production-workflows`, returning exactly `{generatedAt, canonicalNodeFormat, requiredFields, inputBounds, disposition}` - **Writes**: `POST /v1/admin/isis/video-production-workflows/validate` accepts exactly `{workflow}` and returns exactly `{ok, input, result, disposition}` on success - **Realtime**: None - **Bounds**: serialized workflow 2–262,144 UTF-8 bytes; 0–256 object-map nodes - **Disposition**: `request_local_non_authoritative_workflow_schema_validation_preview`; persistence `none`, retention `request_only`, caller-supplied definition, deterministic Isis schema validator, no registration/execution/provider, artifact, governance, release, or authoritative state - **Caching**: authenticated GET and POST responses are `no-store`; the client also uses `cache: 'no-store'` - **Validation**: the browser independently requires the exact catalog, bounds, disposition, normalized input summary, and valid/invalid result invariants; malformed, extra, incorrectly summarized, or authority-inflated success responses fail closed - **Auth**: admin-scoped fail-closed (401/403 → unauthorized state); route sits behind the signed-in + Studio Isis proxy boundary. The focused Playwright workspace path uses the localhost-only `?__oshunStudioIsisLaneE2E=1` bypass already established for Isis lane automation; the production direct route is separately asserted as hard-blocked for a signed-in non-AAA session. - **Component sources**: - `apps/oshun/web/src/components/studio/StudioIsisVideoProductionWorkflowsWorkspace.tsx` - `apps/oshun/web/src/components/studio/StudioIsisVideoProductionWorkflowsRouteMap.ts` ## Cross-references - Studio overview: [`../../studio-overview.md`](../../studio-overview.md) - Parent aggregator: [`studio-isis-ai-video.md`](./studio-isis-ai-video.md) - Sibling routes: - [`studio-isis-topaz-enhancement.md`](./studio-isis-topaz-enhancement.md) - [`studio-isis-video-generation.md`](./studio-isis-video-generation.md) - [`studio-isis-workflow-registry.md`](./studio-isis-workflow-registry.md) ## E2E coverage - `apps/oshun/web/e2e/studio-isis-video-production-workflows.spec.ts` uses the shared Playwright/axe fixture, blocks service workers for deterministic route forwarding, enters through the localhost-only lane bypass, and proxies the browser calls to the exact built production BFF with signed production JWTs, all 32 migrations, and isolated Redis. - Covered: production hard-block for signed-in direct navigation without the bypass; E2E lane navigation; catalog bearer forwarding; required-field hint; 44 px editor, submit, and quick-action affordances; all five route-map entries; both quick-actions; default valid workflow header; missing `workflow_info`/`output_spec` schema errors; invalid `schema_version` schema error; client malformed JSON/non-object rejection with zero POSTs; direct exact/no-store BFF 400; aborted validate POST; catalog loading and 503 error; non-admin fail-closed state; anonymous redirect-before-render; Pixel 7 containment and live result; shared axe gate. - Not covered by automation yet: live screen-reader pass, installed-PWA launch, and telemetry delivery for validator use. ## Open questions / known gaps - [ ] No workflow registration or durable version history - [ ] No workflow/provider execution or media artifact output - [ ] No governance record, approval, publication, or release authority - [ ] Manual live screen-reader, installed-PWA, and telemetry-delivery checks remain open