# AutoShorts Dashboard concept-gated package generation and mobile approval

Use this when implementing or operating the user's AutoShorts/TrueTraceShorts Dashboard as the production control plane from idea to review, private YouTube upload, and website companion.

## Durable workflow shape

The safe creator flow is:

```text
Production Queue idea
→ Send to concept
→ APPROVE_PRODUCTION / concept_approved
→ Generate review package
→ Import prepared package into Review
→ Creator mobile/desktop review decision
→ hash-bound private YouTube UploadRequest
→ existing Jarvis uploader executes private upload
→ Website Companion payload/QA/commit gate, no public link leakage
```

## Generate review package bridge

Add a backend endpoint like:

```http
POST /api/agent/production/{item_id}/generate-review-package
```

Hard gates:

- If item is `locked_next`, proposing concept is allowed, but generation must return 409 with the concept/confirm command.
- If item is `concept_proposed`, generation returns 409 until approval.
- Only `concept_approved` may call `mark-started` and generate/import a package.
- The endpoint should write a package under `storage/incoming/<expected_package_id>/` with at least:
  - `video.mp4`
  - `manifest.json`
- Manifest must include passed quality gates for any package intended to reach active Review, because the importer should block prepared packages whose quality report is missing/failed.
- Import scan must attach the exact matching folder/package ID, not the last imported video.

## Workflow-preview vs final render

It is acceptable to add a cheap `workflow_preview` renderer for validating the control-plane edges, but label it explicitly and do not confuse it with final production.

Workflow preview proves:

- concept gate
- package write/import
- queue item becomes `in_review`
- review page can load media/drafts/quality report
- private UploadRequest can be approved
- website payload can be prepared without exposing private links

Final TrueTrace production still requires the established Director render standard: premium AI visuals, voice/caption alignment, Director Pass, QA frames/contact sheets, and hash-bound review package.

## Mobile approval requirement

For this user's on-the-road workflow, a desktop-responsive review page is not enough. Add a dedicated mobile cockpit:

```text
/mobile-review
/videos/:id/mobile-review
```

Expected mobile features:

- auto-pick first active review item when no ID is given;
- video-first 9:16 layout;
- sticky top header with status;
- sticky bottom actions: Reject, Request changes, Review OK;
- bottom-sheet reason form for reject/change;
- compact YouTube private-upload form with required checkboxes;
- TikTok manual export section with MP4 download/caption/hashtags;
- large touch targets and iOS safe-area padding.

## Tailnet preview pattern

When giving the user an iPhone test link before production deployment:

- Backend can stay on `127.0.0.1:<backend_port>`.
- Frontend should bind to `0.0.0.0:<frontend_port>` and proxy `/api` to the backend with `VITE_API_PROXY_TARGET`.
- Report direct Tailnet URL such as `http://<tailscale-ip>:<frontend-port>/mobile-review` unless Tailscale Serve HTTPS is actually configured.
- If `tailscale serve` is denied, say so and mention `sudo tailscale set --operator=$USER` / `sudo tailscale serve ...`; do not imply Serve works.

## Tests and smoke checks

Add/maintain tests for:

- `mark-started` blocked before concept approval.
- generate-review-package blocked before `concept_approved`.
- generated package imports, links to the right queue item, and becomes reviewable.
- full E2E dry-run: concept → package → review video → upload snapshot → approved private UploadRequest → dry-run existing uploader → website payload with `videoUrl: null` and `website_link_allowed: false`.

Run before reporting:

```bash
uv run pytest -q
npm run build
```

Then browser-smoke `/mobile-review` or the relevant review route and check console errors.

## Pitfalls

- Do not leave private YouTube IDs in public website HTML/JSON fields that render as visitor-facing buttons.
- Do not call a local phone browser's `localhost`; proxy through the Tailnet-exposed frontend.
- Do not allow a `Generate review package` button to bypass concept approval.
- Do not present a workflow-preview MP4 as a final public-ready Short.