# Generation plugin boundary: an executable source case

Recorded September 7, 2026, with Node 22.14.0 on macOS arm64.

This kit executes production modules from the article's actual reviewed commit:

https://github.com/MartinDelophy/ai-video-editor/tree/3684ec4063583c66c80e34e90c655a71d65dad1b

The source snapshot is deliberately historical. These observations describe that
commit, not an unverified claim about the current deployment or `main` branch.

## Run it

Extract the ZIP, open its `generation-plugin` directory, then run:

```sh
node verify.mjs
```

Node 22.14.0 or newer is recommended. There is no dependency installation, provider
account, API key, network access or model download. The included Node module loader
replaces only three presentation icon exports. The pinned production files are
unmodified. The verifier records input, output, assertion-group status and mocked
request bodies in `verification-report.json`. A rerun overwrites that report;
timestamps vary while the asserted behavior should remain the same.

## What actually ran

The fifteen recorded groups execute manifest validation, provider registry lookup,
the loopback URL parser, the media host, WebUI transport/normalization and ComfyUI
workflow substitution, output collection and interrupt request. They also check
all fourteen included upstream source/document/license hashes before running.

The harness draws a strict line around external boundaries:

| Boundary | What the verifier provides | What this cannot establish |
| --- | --- | --- |
| Image decoder | `createImageBitmap` accepts only the exact published PNG bytes, returns 1×1 and records `close`; all other bytes reject | Actual browser codec acceptance, color, image quality or supported formats |
| Video element | A controlled `error` event, zero dimensions and `NaN` duration | Real video decoding, autoplay, metadata timing or playback |
| Network | Every `fetch` is a recorded test double; unexpected calls fail | Provider availability, model output, CORS, authentication or remote cancellation |
| Object URLs | Instrumented strings and a revoke log | Browser memory consumption or eventual cleanup by the application |
| ComfyUI polling | Its 900 ms sleep runs on the next timer turn | Polling latency, long-running generation or the 15-minute timeout |
| Icons | Three no-op exports resolve via `boundary-loader.mjs` | React rendering, UI state or icon appearance |

The Puter adapter and React lifecycle hook are included for source review only.
They were not executed. No prompt was sent to Puter, ComfyUI or WebUI. No timeline
was rendered or edited. A passing assertion means the observed output matched the
recorded behavior; it does not mean every product invariant passed acceptance.

## Concrete cases and results

1. **Source fingerprints:** fourteen copied files match `source-manifest.json`.
2. **Manifest rules:** three IDs resolve; schema 2, invalid ID, runtime, auth and
   capability reject. The definition and capabilities array are frozen.
3. **Endpoint policy:** default loopback, localhost, IPv6 loopback and HTTPS
   loopback normalize. LAN IP, public host, localhost suffix spoof, FTP and a
   non-listed 127.0.0.2 address reject. Query/hash are removed from the accepted
   path case. This tests URL parsing, not redirects, DNS or CORS.
4. **MIME repair:** the PNG signature changes `application/octet-stream` to
   `image/png`; the controlled decoder returns 1×1.
5. **Image rejection:** empty bytes, HTML MIME and a decoder rejection all throw.
6. **Two outputs:** two image fixtures produce one `setUserAssets` call, reverse
   library ordering, selection of the last output and one notification.
7. **No outputs / URL only:** an empty list and a temporary URL without a Blob
   both reject before any asset commit.
8. **Mixed batch:** a valid image followed by empty bytes rejects without calling
   `setUserAssets`. One earlier object URL remains registered and is not revoked
   by this function. Application teardown may clean it later; that was not run.
9. **Unknown media type:** an output labelled `audio` but containing the known PNG
   fixture is imported as `image`; the host branches only on `type === "video"`.
10. **Video bypass:** the text in `invalid-video.txt`, labelled `video/mp4` and
    supplied with 640×360 dimensions, is committed as a video asset with duration
    zero. No video-element inspection occurs. This case does not depend on a
    decoder stub because the production branch bypasses that boundary entirely.
11. **Metadata failure:** a controlled video error resolves to duration 0 and
    1280×720, rather than rejecting. Its temporary inspection URL is revoked.
12. **Transport errors:** network failure gets the local-service/CORS message;
    HTTP 503 retains its status/detail; `AbortError` remains an abort.
13. **WebUI result:** a mocked response with two base64 images returns both;
    an empty response rejects, and img2img without an input rejects before fetch.
14. **ComfyUI result and cancel:** prompt/seed variables become string/number
    values, queued/running states occur, and both mocked image outputs return.
    `cancel()` resolves on HTTP 500 and on fetch failure, despite sending
    `POST /interrupt`. That return value cannot confirm remote interruption.
15. **Client abort:** a real AbortController reaches WebUI's mocked fetch; abort
    rejects the pending generate promise with `AbortError`. No claim is made that
    a remote server stopped work.

`inputs.json` contains the exact request objects, endpoints and PNG base64.
`fixture-one-pixel.png` is a synthetic 70-byte 1×1 RGBA PNG, with scanline bytes
`00 35 c8 d4 ff` (filter 0, R=53, G=200, B=212, alpha=255). It is a transport
fixture, not an AI image. `invalid-video.txt` intentionally contains no video.

## What the result changes in the article

The source supports separation of provider transport from the My assets commit.
It supports nonempty byte checks and an explicit image decoder boundary. It does
not support the blanket claim that every completed video was decoded successfully.
The video metadata fallback and the supplied-dimensions branch are counterexamples.

For a future implementation change, useful acceptance cases are: reject unknown
media types; validate videos despite supplied dimensions; reject metadata error
and timeout instead of defaulting to success; and revoke prepared URLs if a later
batch member fails. Cancellation language must describe a requested interrupt
separately from an acknowledged remote stop. These are proposed acceptance checks,
not claims that the production editor has been fixed by this article.

The development document also shows a target `normalizeError()` method and
injected host services. The three concrete adapters at this snapshot do not expose
`normalizeError()` and directly import shared helpers/use browser globals. This is
source organization, not a JavaScript security sandbox. The hook's cancellation
and supersession behavior remains source-reviewed, not browser-tested here.

## Provenance and reuse

`source-manifest.json` records full commit links and SHA-256 for the fourteen
upstream files. `public-source-check.json` records a separate download of `host.js`
from the full public commit URL and its byte-for-byte equality with the copy.
The other files were copied with `git show` from that same local immutable commit.
`asset-manifest.json` fingerprints the delivered kit's files, excluding itself,
the ZIP and `download-manifest.json` to avoid circular hashes. The download
manifest, supplied beside the ZIP, records its size and hash. After rerunning the
verifier, the report timestamp and therefore its delivered-file hash will change.

The included production code and development document retain the upstream MIT
license and copyright notice in `upstream/LICENSE`. The new harness, synthetic
fixtures and case documentation may also be reused under the included MIT terms.