fix(droid-control): preserve evidence across automation workflows

[factory-droid]

Description

What

Give droid-control one capability-based path from an automation request to verified evidence. terminal-use selects tuistory or true-input, browser-use operates agent-browser, and desktop-use operates Cua while honoring native-input constraints. The desktop skill is 80 lines, without copied manuals or a separate Cua skill prerequisite. The media path has independently passing coverage from 13 helper tests, including two real renders, and seven duration tests; this is not new live-GUI certification.

Composition of origin/master...2b8c15c, computed with diff-composition.py (additions plus deletions):

Share	Lines	Files	Scope	Reviewer action
43.1%	816	22	Capability/workflow guidance, license, and CI	Check routing and evidence ownership; prose here controls agent behavior.
28.7%	543	6	Media implementation, discovery, and metadata	Read input isolation and the shared playback timeline.
26.0%	493	2	Helper integration and duration tests	Check concurrent staging and actual encoded-output assertions.
2.2%	41	4	Diagram labels, test command, and staging ignore	Skim for consistency with the runtime contract.

Core breakdown: the render helper (221 changed lines) owns staging, input validation, fidelity, and duration probing. Showcase.tsx (270) and duration.ts (43) share playback timing and transition padding. .skillsrc (6), plugin metadata (2), and Root.tsx (1) connect discovery, versioning, and resolved defaults.

Why

Correct individual driver instructions are insufficient when commands can demand competing desktop workers, two recording.mp4 inputs overwrite one another, or rendering truncates the longer proof. A blocked observation also cannot honestly become an application PASS or FAIL.

How

The orchestrator selects a capability and owns delegation; executable names remain implementation details. Shared desktop input stays with one controller, while independent captures and renders can run separately. Each render owns isolated inputs, applies speed once, retains the longest clip, and holds shorter panels. Verification follows the resolved output contract and requires decoding plus observed proof frames.

Change Shape

Request + method constraints
  → terminal-use | browser-use | desktop-use
  → driver-owned interaction and capture
  → isolated render inputs + shared playback timeline, when video is requested
  → observed PASS / FAIL / BLOCKED evidence

Repro Recipe

With existing Remotion dependencies, browser, and ffmpeg installed, run from this branch:

REPO=$(git rev-parse --show-toplevel)
RUN=$(mktemp -d)
mkdir -p "$RUN/before" "$RUN/after"
ffmpeg -v error -f lavfi -i color=red:s=320x240:r=30:d=2 -c:v libx264 "$RUN/before/recording.mp4"
ffmpeg -v error -f lavfi -i color=blue:s=320x240:r=30:d=5 -c:v libx264 "$RUN/after/recording.mp4"
"$REPO/plugins/droid-control/scripts/render-showcase.sh" \
  --props-inline '{"layout":"side-by-side","labels":["BEFORE","AFTER"],"speed":2,"title":"Input isolation","subtitle":"Distinct same-named clips","preset":"minimal","keys":[],"effects":[]}' \
  --fidelity compact --output "$RUN/proof.mp4" \
  "$RUN/before/recording.mp4" "$RUN/after/recording.mp4"
ffprobe -v error -select_streams v:0 -show_entries stream=nb_frames,pix_fmt,color_space "$RUN/proof.mp4"
# Expect 300 frames, yuv420p, bt709. Open proof.mp4: red and blue remain distinct.

Related Issue

Closes CLI-2242.

Reviewer Guide

Review depth: Standard, with attention to media timing and input ownership.

1. Capability boundary: orchestrator → terminal-use, browser-use, desktop-use. Check native-input precedence, backend selection, and parent-owned desktop interaction.
2. Media boundary: scripts/render-showcase.sh → remotion/src/lib/duration.ts → remotion/src/compositions/Showcase.tsx. Check isolated paths, all-clip duration, exactly-once speed, and transition padding.
3. Evidence boundary: capture/compose/verify skills and command templates → helper/duration tests and scoped CI. Check that blocked work stays unobserved and encoded output meets the declared contract.

Plugin paths are relative to plugins/droid-control/; discovery and CI configuration are repository-root files.

Risk & Impact

• Skill names intentionally change: desktop-control → desktop-use, tuistory → terminal-use, and agent-browser → browser-use. External skill-name references must update; executable commands and backend identifiers do not change. There are no old-name aliases.
• Cast conversion no longer silently compresses idle time. Trim source recordings explicitly before calculating output-timeline overlay timestamps; free-text speedNote remains supported.
• Total duration includes the four-second title, frame-rounded playback, and 3.5-second outro. Shorter clips hold their final frame; held frames appear during the outro transition.
• Cancellation is process-group scoped. A signal sent only to the helper PID takes effect after its child exits.
• CI provisions ffmpeg, checksum-verified agg, and the Remotion browser. No runtime dependency was added; driver capabilities and user/host permissions still require live inspection.

Verification

Media verified @ 95af904, unchanged through 2b8c15c: independent 13/13 helper tests with zero skips, including two real renders; 7/7 duration tests and TypeScript checking on Node 22.19.0. Outputs decoded successfully as limited-range BT.709 yuv420p; an eight-playback-frame case rendered without transition failure and displayed its expected final state.

Naming/routing verified @ 2b8c15c: canonical directories/frontmatter, local links and anchors, discovery exclusions, terminal backend routing, and absence of stale skill references. Runtime files and executable command fences remain unchanged; desktop-use is 80 lines.

Regression coverage: same-basename and concurrent staging, scoped cleanup, fidelity selection, unsupported PNG input, finite speeds, longest-clip timing, cast pause preservation, and encoded-output checks. Negative controls reproduced the old failures.

Standard validators: scoped React/structural scans, Node 22 typecheck and tests, skill discovery, rename/link checks, shell syntax, and whitespace checks.

Not tested: a new live Cua recording or OS-permission flow. Synthetic media is not native-GUI certification. Render artifacts were inspected locally but are not attached.