Files
hyperframes/packages/producer/tests
Vance IngallsandClaude Fable 5 ec06f4bf89 feat(engine,producer): drawElement fast-capture default-on with runtime self-verification safety net (#1998)
* feat(engine,producer): drawElement fast-capture default-on with runtime self-verification safety net

Flip useDrawElement + worker-encode defaults on (HF_DE_BATCH default 4),
clamped in resolveConfig to hosts where drawElement can engage (macOS +
hardware-GPU browser) so page-side shader compositing is untouched
everywhere else; explicit env opt-in keeps attempt-and-gate semantics.

Safety net makes default-on safe: the compile/init gates catch predictable
incompatibility; this catches the intermittent residue no static analysis
can see (stale paints, dropped background images, transient blank frames).

- engine: captureDeVerificationFrames — K=4 (HF_DE_VERIFY) ground-truth
  screenshots at init, after gates + armStaticDedup, BEFORE canvas
  injection (post-injection screenshots show the canvas bitmap, not the
  DOM). Runs the video-injection hook per sample; double-captures so
  rAF-driven text counters settle (a single immediate screenshot captures
  stale text and false-positives). Skips png, <10 frames, implausible
  __hf.duration (infinite-repeat GSAP sentinel).
- producer: guardFrame on both worker-encode drains — rolling-median blank
  guard with retry-once at drain (byte-identical retry ⇒ deterministic dark
  frame, accepted; retry save/restores the static-dedup anchor) + ffmpeg
  PSNR self-verify vs ground truth (HF_DE_VERIFY_MIN_DB, default 32dB;
  natural agreement ≥45dB, damage ≤25dB). Breach dumps the frame pair to
  tmpdir and throws DrawElementVerificationError.
- orchestrator: one-shot retry — on verification error the whole render
  re-runs with forceScreenshot (slower, never wrong); telemetry flag
  deSelfVerifyFallback.
- tooling: de-canary-suite.sh (7-comp release gate with expected verdicts),
  de-gatecheck.sh (init-only corpus routing classifier), we-render.mjs.

Validated: canary suite 7/7; 611-comp routing sample 54% drawelement /
37.5% gated / 8.3% comp-defect; 12/12 risk-band renders clean on bare
defaults (48/48 verify samples); engine suite 888 passed; caught two real
intermittent damage classes in the wild (background-image drop, root-props
offset) that previously shipped silently.

Kill switches: PRODUCER_EXPERIMENTAL_FAST_CAPTURE=false,
HF_DE_WORKER_ENCODE=false, HF_DE_BATCH=0, HF_DE_VERIFY=0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(engine,producer): harden the drawElement self-verification net (max code-review findings)

15 confirmed findings from the adversarial review of the default-on flip;
the load-bearing five:

- Ground-truth capture no longer scrubs GSAP state: seek(0) + forced frame
  FIRST (lazy .from()/overlap tweens record start values on first seek —
  mid-timeline scrubs corrupted them for the whole render, and since DE
  frames and truth shared the corruption, PSNR passed on damaged output),
  then ascending even-spread fractions, page left at frame 0.
- Default-on drawElement is confined to the verified path: resolveConfig
  requires worker-encode (the drain that runs the net), the orchestrator
  disengages the default when the render takes the disk path or parallel
  capture (no drain verification there), and closes a drawElement-initialized
  probe session rather than letting the unverified path reuse it. Explicit
  PRODUCER_EXPERIMENTAL_FAST_CAPTURE=true keeps old attempt-and-gate behavior.
- Blank-frame retry can no longer splice wrong-frame pixels: recapture goes
  through recaptureDrawElementFrameForVerify — no static-dedup shortcut
  (lastEncodeResult runs ahead of the drain) and no "No cached paint record"
  screenshot fallback (post-injection that captures the canvas = the LAST
  drawn frame); any recapture failure falls back the whole render.
- Verify indices derive from the producer-resolved duration
  (CaptureOptions.compositionDurationSeconds) instead of raw __hf.duration,
  so samples always land inside the drained range.
- The platform clamp accepts "auto" GPU mode — the stock CLI resolves auto,
  and the literal-"hardware" clamp made default-on a no-op for the primary
  audience (masked in validation by explicitly-set env).

Also: NaN-safe env parses (HF_DE_VERIFY / HF_DE_VERIFY_MIN_DB / HF_DE_BATCH);
video comps skip verification when the session has no frame injector (probe
sessions — black-video truth false-positived); psnr infrastructure failures
skip the sample instead of failing the render; boundary-saturated sample
indices are skipped; shader-transition comps prefer page-side compositing
over default drawElement and compile-gated comps get page-side compositing
restored; observability.clearFailure un-brands the recovered first streaming
attempt; canary suite exempts known-marginal "any" comps from the cross-path
PSNR gate; dead we-render options removed; clamp tests pin their env.

Validated: canary suite 7/7; auto-GPU bare render engages the full stack;
disk-path and worker-encode-off renders disengage default drawElement;
malformed HF_DE_VERIFY_MIN_DB still verifies at the default threshold;
engine suite 890 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(engine,producer): review fixes — PSC intent, verify-threshold clamp, fail-closed canaries

Addresses miguel-heygen's review on #1998:

- Page-side compositing restore preserves explicit caller intent (blocker):
  resolveConfig now records pageSideCompositingAutoDisabled only when IT
  turned page-side compositing off because drawElement was on; the
  compile-time drawElement gates restore page-side compositing only when
  that flag is set. An explicit enablePageSideCompositing:false from the
  programmatic API or HF_PAGE_SIDE_COMPOSITING=false stays off. Pinned by
  two config tests.
- HF_DE_VERIFY_MIN_DB clamped to [10, 60] with a warning on out-of-range
  values: below ~10dB the check passes severe damage; above ~60dB natural
  encoder differences force a screenshot fallback on every verified render.
- de-canary-suite.sh + de-gatecheck.sh run under set -euo pipefail with
  explicit `|| true` on expected-nonzero commands (render exits handled by
  the suite's own checks, grep no-match, kill/pkill/wait races) and a hard
  FAIL when the PSNR compare produces no value — release canaries fail
  closed. Full suite re-run green (7/7) under the new flags.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 16:29:30 -07:00
..
2026-04-27 18:16:09 -04:00

Producer regression test fixtures

Each subdirectory under this folder is a regression fixture for the HTML-to-video pipeline. The harness at packages/producer/src/regression-harness.ts walks every subdirectory, runs the composition, and PSNR-compares the rendered output against a checked-in golden baseline.

Fixture layout

<fixture-name>/
├── meta.json           # name, tags, PSNR threshold, renderConfig
├── src/
│   ├── index.html      # composition entry point
│   └── assets/...      # any locally-referenced media
└── output/
    ├── compiled.html   # golden compiled HTML (validated as a snapshot)
    └── output.mp4      # golden rendered video

meta.json is validated by validateMetadata in src/regression-harness.ts. The required fields are:

  • name (string), description (string), tags (string[])
  • minPsnr (number, dB)
  • maxFrameFailures (integer)
  • minAudioCorrelation (0..1), maxAudioLagWindows (integer ≥1)
  • renderConfig.fps (integer like 30 or a rational string like "30000/1001")

Optional renderConfig fields:

  • format"mp4" (default) or "webm"
  • workers — integer ≥ 1
  • hdr — boolean (default false)
  • variables — JSON object of render-time variable overrides
  • chunkSize — integer ≥ 1 (used by --mode=distributed-simulated)
  • maxParallelChunks — integer ≥ 1 (used by --mode=distributed-simulated)

Generating / updating a baseline

Always inside Docker. Host Chrome / FFmpeg versions drift across distros, so a baseline captured on the host won't match the bytes CI renders.

# From the repo root.
docker build -t hyperframes-producer:test -f Dockerfile.test .

# Generate a baseline (single fixture):
bun run --cwd packages/producer docker:test:update <fixture-name>

# Generate all baselines (rarely needed):
bun run --cwd packages/producer docker:test:update

The --update flag writes output/compiled.html and output/output.mp4 from the current render. Without --update, the harness compares against those baselines.

Running the harness locally

# Run every fixture (parallel, in-process mode — the default).
bun run --cwd packages/producer docker:test

# Run a single fixture:
bun run --cwd packages/producer docker:test font-variant-numeric

# Run sequentially (lower memory):
bun run --cwd packages/producer docker:test -- --sequential

Harness modes

--mode=<value> chooses which render path the harness exercises:

Mode What it calls Use for
in-process (default) executeRenderJob Day-to-day baselines. This is the same path the hyperframes render CLI takes, and it is what produced every existing output/output.mp4.
distributed-simulated plan()renderChunk() × N → assemble() from @hyperframes/producer/distributed Validates the distributed pipeline against the in-process baseline. No Temporal or Lambda involvement — the controller and chunk worker are both this process.

--mode=distributed-simulated

bun run --cwd packages/producer docker:test -- --mode=distributed-simulated
bun run --cwd packages/producer docker:test font-variant-numeric -- --mode=distributed-simulated

The distributed pipeline cannot run every fixture. Fixtures that fail any of these gates are skipped with a clear log line (and counted as passing in the summary):

  • fps.den !== 1 — distributed mode is integer-fps only (no NTSC).
  • fps.num ∉ {24, 30, 60} — closed set per DistributedRenderConfig.
  • format === "webm"plan() refuses webm.
  • hdr === true — distributed mode is SDR-only at v1.

Both modes use the fixture's authored minPsnr as the per-test threshold — distributed must clear the same quality bar in-process clears against the same frozen baseline. (Internal contract: distributed vs in-process renders of the same fixture should clear 50 dB PSNR against each other within the same Docker image. Against the frozen committed baseline, neither mode reaches that consistently due to shared encoder/JPEG-capture jitter — that's why the fixture's authored threshold gates here, not the 50 dB contract value.) An absolute 10 dB pathology floor catches fully-black-output regressions when a fixture authors a permissive threshold. A distributed failure at the fixture's own threshold means the distributed pipeline has drifted — file an issue rather than relaxing the fixture.

--update is incompatible with --mode=distributed-simulated: the in-process renderer is the source of truth for baselines, and the distributed mode's job is to verify the contract against the same baseline.

Validating PR 4.1 (the harness mode itself)

The smallest fixtures (font-variant-numeric, many-cuts) are sufficient to verify the mode plumbing end to end:

docker build -t hyperframes-producer:test -f Dockerfile.test .

# In-process: existing behavior, unchanged.
bun run --cwd packages/producer docker:test font-variant-numeric
bun run --cwd packages/producer docker:test many-cuts

# Distributed-simulated: same baselines, distributed pipeline.
bun run --cwd packages/producer docker:test font-variant-numeric -- --mode=distributed-simulated
bun run --cwd packages/producer docker:test many-cuts -- --mode=distributed-simulated

Both modes must pass at each fixture's authored minPsnr against the existing baseline. If --mode=distributed-simulated fails where --mode=in-process passes, the distributed primitive has a regression — file an issue rather than relaxing the fixture's threshold.

Distributed-only fixtures

Fixtures under tests/distributed/<name>/ are authored specifically for the distributed pipeline. They follow the same meta.json schema as the top-level fixtures, but they always set chunkSize / maxParallelChunks so a plan() over the fixture produces N>1 chunks. Each fixture exercises one of:

  • per-format chunk-boundary correctness (mp4 H.264, mp4 H.265, ProRes, png-sequence)
  • per-adapter chunk-seam state preservation (GSAP, Anime.js, Three.js, Lottie, CSS, WAAPI)

Each distributed fixture covers one or more equivalence axes — see the meta.json description field for what a given fixture is locking in.

Fixture pattern (4.2 onward)

Each tests/distributed/<name>/ fixture has the same structure as a top-level fixture (meta.json + src/index.html + output/output.mp4). Differences worth knowing:

  • renderConfig.chunkSize is required — pick a value that yields N≥2 chunks for your fixture's frame count (e.g. 60 frames at chunkSize: 15 produces N=4). Without this the fixture renders in a single chunk and never exercises the seam.
  • The fixture's ID on the CLI is just <name> (no distributed/ prefix). bun run --cwd packages/producer docker:test mp4-h264-sdr works the same as for a top-level fixture.
  • The distributed tag is informational — it doesn't gate any tag-based filter today. Add it so the fixture is easy to find by tag.
  • The composition should stress state continuity across the chunk seams: an animation crossing a seam, a counter, a rotation. A fully-static composition would pass even if chunk-boundary state was broken.
  • Baselines must be generated inside Docker — see the section above. The baseline is rendered by the in-process renderer (the source of truth for golden output); --mode=distributed-simulated is validated against the same baseline.

Tags

Common tags values control which fixtures the default bun test invocation runs. --exclude-tags transparency (the default for bun test) skips webm/png-sequence alpha fixtures that need a working chrome-headless-shell alpha pipeline.