POST /v1/edit-projects/{projectId}:render was unauthenticated -- anyone could
trigger a render. It now requires an approved.flag in the project directory and
returns 409 otherwise (config video-clipping.editing.require-render-approval,
default true). This closes the "no check at all" hole; it is a basic presence gate,
not yet authenticated/digest-bound authorization (a remaining hardening item).
New SpringBootTest asserts 409 without approval; the delegation unit test disables
the gate. mvn verify 271/0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MPuJXQyAeWpFcTtcnxo1UN
- .github/workflows/ci.yml: build + test on every push/PR (JDK 21 + ffmpeg,
mvn -B verify, uploads surefire reports). Closes the "no CI" gap.
- README.md: honest overview of the local offline highlight pipeline, the R1-R9
cinematic quality rules, how to build/test/run, the local models and their
(non-commercial) licenses, constraints, and limitations. Explicitly states it is
a PoC, not production-hardened. Closes the "no README" gap.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MPuJXQyAeWpFcTtcnxo1UN
JSLMPR