Pull request overview

Adds a new experimental demo-video skill to assemble ordered prototype frames/clips and per-segment narration WAVs into a single narrated MP4 using FFmpeg, and registers the skill across collections, plugins, and behavior evals.

Changes:

• Added the demo-video skill package (docs, Python assembler CLI, bash/PowerShell wrappers, examples, and tests including a fuzz harness).
• Registered demo-video in experimental and hve-core-all collections and regenerated plugin READMEs.
• Extended skill behavior conformance eval coverage with demo-video knowledge/tool-trigger/bleed-detection stimuli.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 6 comments.

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*

@auyidi1 if you don´t mind you can add the additional context from our chat yesterday to the readme as well. Thanks for this great skill

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 4 comments.

Thanks for the demo-video skill — the assembler/wrapper design is clean, the subprocess handling is injection-safe (list args, no shell=True, yaml.safe_load), and the repo Python-skill conventions (ruff/pytest/fuzz/uv.lock, dual wrappers, copyright headers) are all met. A few items I didn't see raised elsewhere on the PR:

• Blocking: the shipped examples/segments.yml uses ./examples/fixtures/... paths, but the assembler resolves relative paths against the manifest's own directory (examples/), so they expand to examples/examples/fixtures/... and don't match the fixture layout examples/README.md documents — the flagship example fails on first run. Changing the manifest paths to ./fixtures/... (and output: ./output/demo.mp4) fixes it; please verify end-to-end since the PR notes the smoke run was skipped.
• The npm run test:py 13 passed figure in the PR body isn't reproducible — the two discoverable pytest files contain 11 test functions; please re-run and update the count.
• tests/DemoVideoHelpers.Tests.ps1 doesn't mirror its system under test (Invoke-AssembleVideo.ps1); renaming to Invoke-AssembleVideo.Tests.ps1 matches the Pester convention.
• Minor: SKILL.md's Manifest Schema omits the top-level output/resolution/fps keys the code and example use; an empty-string narration skips the narration_wav fallback; and _validate_manifest returns the segments list redundantly.

Dependency Review — demo-video Skill

This PR introduces a new Python skill with the following dependencies. No existing workflow, devcontainer, or copilot-setup-steps.yml files are modified, so SHA-pinning and environment-sync checks are not applicable.

Dependencies Introduced

Safety Checks

All dependency safety checks passed. No action required from this review.

Generated by Dependabot PR Review for #2404 · 39.3 AIC · ⌖ 7.05 AIC · ⊞ 8.5K

Dependency Review — demo-video skill

Scope: pyproject.toml + uv.lock added under .github/skills/experimental/demo-video/

Dependencies introduced

Indirect lock-file entries (colorama, coverage, iniconfig, packaging, pluggy, pygments, tomli) are all MIT, BSD, or Apache-2.0 — all compatible with the project's MIT license.

Safety check results

• ✅ License compatibility — all dependencies (runtime and dev) carry MIT, BSD, or Apache-2.0 licenses, compatible with the project's MIT license.
• ✅ No duplication — pyyaml is the only runtime dependency; no existing repo-level dependency provides YAML parsing for this skill's use case.
• ✅ SHA/hash pinning — uv.lock pins every wheel and sdist by SHA-256 hash. No GitHub Actions references were modified in this PR.
• ✅ Environment synchronization — no changes to .devcontainer/ or copilot-setup-steps.yml; synchronization concern is N/A.
• ✅ Vulnerability posture — all packages are well-established, actively maintained, and carry no known vulnerability signals. atheris is correctly isolated in the fuzz dependency group (no macOS wheels) per repo convention.
• ✅ uv.lock committed — lock file is present alongside pyproject.toml, satisfying Dependabot resolution requirements.

All dependency safety checks passed. No findings require changes.

Generated by Dependabot PR Review for #2404 · 42.7 AIC · ⌖ 8.7 AIC · ⊞ 8.5K

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 3 comments.

Re-reviewing at 2f2d912 — the type/source enforcement, --fps validation, non-string-key handling, and tighter fuzz scope from the follow-up commits all look good and are covered by new tests. I'm not repeating the items already open on the PR (the examples/segments.yml path-doubling thread and the Pester filename / SKILL.md top-level-keys notes from @rezatnoMsirhC still apply and remain unresolved — the example still fails on first run). A few net-new items I didn't see raised elsewhere:

• Please verify (from the concat change): the final concat now uses -c copy (per the earlier suggestion) instead of re-encoding. With fractional per-segment durations and fixed-size AAC frames, stream-copy concat can drift A/V sync or leave gaps at segment seams that the previous re-encode masked. Since FFmpeg isn't in the dev container and the smoke run is still skipped, this primary output path is untested — please confirm the final MP4 stays in sync end-to-end, or keep a re-encode fallback for the concat step.
• Add a shipped-example regression test: a test that loads examples/segments.yml and asserts the resolved fixture paths match the README layout would guard the open path-doubling issue from recurring.
• PR body count: npm run test:py 13 passed isn't reproducible — there are now 14 discoverable test functions for this skill (12 in test_assemble_video.py + 2 in fuzz_harness.py). Please re-run and update the figure (or note it''s a repo-wide aggregate).
• Minor: an empty-string narration: still skips the narration_wav fallback (only None/absent falls back); and _validate_manifest returns the segments list a second time even though the config dict it returns already contains segments.

Also note the branch is currently BEHIND main and the four approvals predate the still-open 07-15 findings, so a fresh look after the fixes would be worthwhile.