fix(orch): apply auto-adjust overhead to advertised CapabilitiesPrices

[seanhanca]

Problem

GetCapabilitiesPrices advertises the un-adjusted base per-capability price, while priceInfo/PriceInfoForCaps bind the overhead-inclusive price (1 + 1/txCostMultiplier) into TicketParams/RecipientRandHash.

On the BYOC billed path the remote signer copies the advertised CapabilitiesPrices into the payment's ExpectedPrice. Because the orchestrator binds a price that includes the auto-adjust overhead but advertises one that does not, the two differ by 1/txCostMultiplier (~1%). When the orchestrator validates the ticket it recomputes recipientRand from ExpectedPrice, which no longer matches RecipientRandHash, so the payment is rejected with invalid recipientRand for ticket recipientRandHash (surfaced to the gateway as Could not parse payment).

Observed on byoc-staging-1 (livepeer/go-livepeer:feat-byoc-payment-fleet-2026-05), which runs with AutoAdjustPrice enabled.

Fix

Extract the overhead computation into a shared applyAutoAdjustOverhead helper and apply it in both:

• priceInfo (the bound price) — behavior unchanged (pure refactor), and
• GetCapabilitiesPrices (the advertised price) — now overhead-inclusive,

using the identical PriceToFixed/FixedToPrice rounding so advertised price == bound price. When AutoAdjustPrice is off (or no Recipient is configured), the base price is returned unchanged, matching priceInfo.

Test plan

• go test ./core/ -run 'TestGetCapabilitiesPrices|TestPriceInfo'
• Advertise check: grpcurl ... GetOrchestrator | jq .capabilitiesPrices equals the per-cap PriceInfoForCaps value.
• BYOC E2E: signer ExpectedPrice matches the orchestrator's bound ticket price; payment returns 200.

Made with Cursor

Summary by CodeRabbit

• New Features

  • Added asynchronous BYOC training with job submission, status tracking, cancellation, payment refresh, checkpoint recovery, and LoRA workflows.
  • Added billing event history with cost, balance, usage, status, and error details.
  • Added WHEP playback support for live BYOC streams.
  • Added SDK service, MCP tools, REST endpoints, workflow clients, and storyboard streaming support.
  • Added local and deployable end-to-end testing stacks.

• Bug Fixes

  • Improved usage-based charging, payment validation, signature verification, and capability pricing consistency.

• Documentation

  • Added architecture, SDK, deployment, streaming, testing, and provider-extension guides.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds BYOC training, billing, structured signing, capability pricing, WHEP/trickle streaming, SDK and MCP services, agent clients, deployment configurations, storyboard tooling, documentation, and E2E validation scripts.

Changes

BYOC orchestration and accounting

Layer / File(s)	Summary
Billing and asynchronous training byoc/*.go	Adds unit-based billing events, training-job persistence and lifecycle routes, checkpoint recovery, payment refresh, and gateway training proxies.
Structured signing and BYOC pricing byoc/types.go, byoc/utils.go, server/*.go, core/orchestrator.go	Adds deterministic job signatures, remote signing, BYOC-specific price resolution, overhead-adjusted prices, and related RPC coverage.

BYOC SDK, streaming, and E2E tooling

Layer / File(s)	Summary
SDK service and live streaming e2e-byoc-test/sdk-service/*, e2e-byoc-test/storyboard/*, byoc/byoc.go	Adds REST inference/training/enrichment/streaming endpoints, MPEG-TS/trickle transport, WHEP support, and browser playback controls.
Agent clients and MCP interfaces e2e-byoc-test/agent-client*.py, e2e-byoc-test/mcp-server/*, .mcp.json	Adds direct, SDK-backed, and HTTP-only clients, workflow planning, training commands, MCP tools, and an OpenAPI contract.
E2E deployment and validation e2e-byoc-test/*.sh, e2e-byoc-test/docker-compose*, e2e-byoc-test/test-*	Adds local and VM deployment stacks, setup commands, media/training test clients, and storyboard streaming validation.

Estimated code review effort: 5 (Critical) | ~120 minutes

Suggested reviewers: rickstaa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 61.62% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the stated fix: applying auto-adjust overhead to advertised CapabilitiesPrices.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/byoc-cap-price-overhead

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch fix/byoc-cap-price-overhead

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 9

Note

Due to the large number of review comments, Critical severity comments were prioritized as inline comments.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

server/remote_signer.go (1)

382-420: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Bind continuation state to the BYOC manifest.

State validation checks only the orchestrator address. A caller can reuse state containing another capability’s InitialPrice and balance while supplying a new manifest, producing mismatched payment tickets. Store the request type and manifest in the signed state and reject changes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/remote_signer.go` around lines 382 - 420, Update the remote payment
state creation and validation flow around stateID, manifestID, and
byocCapability to persist the request type and resolved manifest identifier in
the signed state. When continuing an existing state, reject any change to either
the request type or manifest with a bad-request response, alongside the existing
orchestrator validation; ensure newly created state records these values before
signing.

core/orchestrator.go (1)

275-336: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Canonicalize wire prices even when auto-adjustment is disabled.

The helper’s early return bypasses fixed-point/int64 conversion, but GetCapabilitiesPrices immediately calls Int64(), which truncates oversized components. Meanwhile PriceInfoForCaps canonicalizes them. Always run the final wire conversion after optionally applying overhead so advertised and bound prices remain identical in both modes.

Also applies to: 467-491

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@core/orchestrator.go` around lines 275 - 336, Update applyAutoAdjustOverhead
and the price construction in GetCapabilitiesPrices so every price undergoes the
same final fixed-point/int64 wire canonicalization, regardless of whether
overhead is enabled. Apply overhead conditionally, then normalize the resulting
value before populating net.PriceInfo, including both built-in capability paths
and the BYOC external-capability path, matching PriceInfoForCaps behavior.

🟡 Minor comments (6)

e2e-byoc-test/extend-training-capabilities.md-433-433 (1)

433-433: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Correct the charge-tick calculation.

Four hours is 14,400 seconds, but only 480 intervals of 30 seconds. Clarify whether billing accrues per second and is settled every 30 seconds, or whether each interval is one charge tick.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/extend-training-capabilities.md` at line 433, Correct the
charge-tick calculation in the orchestrator billing description: distinguish the
14,400 elapsed seconds from the 480 30-second billing intervals, and explicitly
state whether charges accrue per second with 30-second settlement or each
interval represents one charge tick.

e2e-byoc-test/fat-thin-nosdk-client-comp.md-99-120 (1)

99-120: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Do not claim that the SDK service maps provider parameters.

The service passes req.params through unchanged, so callers still need the provider’s expected field names unless another documented layer performs the mapping. Update the comparison or implement the mapping centrally.

Also applies to: 138-146

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/fat-thin-nosdk-client-comp.md` around lines 99 - 120, The
comparison in the “No TRAINER_PARAM_MAP” section incorrectly claims the SDK
Service maps provider parameters. Update it to state that req.params passes
through unchanged and callers must provide provider-specific field names, unless
a documented mapping layer is identified; apply the same correction to the
referenced comparison section.

e2e-byoc-test/storyboard/trickle_publisher.js-71-77 (1)

71-77: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Await deletion before resolving close().

The async method returns before the DELETE completes, preventing callers from detecting failed cleanup and allowing navigation to cancel it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/storyboard/trickle_publisher.js` around lines 71 - 77, Update
the async close function to await the DELETE request before resolving, while
preserving the existing nextController shutdown and error reporting. Ensure
DELETE failures propagate to callers instead of being only logged through an
unawaited catch.

e2e-byoc-test/test-scope-trickle.py-87-88 (1)

87-88: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reject non-positive FPS values.

--fps 0 crashes at 1.0 / args.fps, while negative values silently disable rate limiting.

Proposed fix

     args = parser.parse_args()
+    if args.fps <= 0:
+        parser.error("--fps must be greater than zero")

Also applies to: 123-123

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/test-scope-trickle.py` around lines 87 - 88, Validate the --fps
argument in the argument parser so only positive values are accepted, preventing
zero division and disabling rate limiting for negative values. Update the fps
configuration in the parser setup near --frames to use the existing
argument-validation mechanism or an equivalent positive-value validator, while
preserving the float type and default of 2.

e2e-byoc-test/DESIGN.md-119-131 (1)

119-131: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Update the obsolete SDK limitation.

This section says BYOC SDK support is deferred, while this stack includes livepeer-gateway BYOC submission/training APIs and SDK-backed clients. Update the recommended paths so users are not directed away from the implemented SDK.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/DESIGN.md` around lines 119 - 131, Update the “Gap 3:
livepeer-python-gateway SDK Is LV2V-Focused” section in DESIGN.md to reflect the
implemented livepeer-gateway BYOC submission and training APIs and SDK-backed
clients. Remove the obsolete statement that BYOCClient support is deferred, and
revise the recommended BYOC testing paths to include the supported SDK while
retaining valid curl, Python, or direct HTTP options.

byoc/job_orchestrator.go-614-622 (1)

614-622: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Reject non-finite and out-of-range unit values before converting. ParseFloat accepts NaN, ±Inf, and values outside the int64 range; int64(math.Ceil(f)) collapses them to MinInt64, which then gets clamped to 1, so these requests are billed as 1 unit instead of falling back to seconds.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@byoc/job_orchestrator.go` around lines 614 - 622, Update the unit parsing
logic around ParseFloat in resolveUnits to reject non-finite values and values
whose ceiled result cannot be represented as int64 before converting. Preserve
the existing warning and defaultSeconds/"second" fallback for all invalid or
out-of-range headers, while retaining the minimum-one-unit clamp for valid
positive values.

🧹 Nitpick comments (1)

byoc/billing_event_test.go (1)

242-264: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Exercise billingEventRingBuffer.append() instead of duplicating it.

This test can pass even if the production eviction branch breaks. Append billingEventRingSize+1 events to a real buffer and assert that the oldest event was removed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@byoc/billing_event_test.go` around lines 242 - 264, Update
TestBillingEventRing_DropsOldestPastCap to call billingEventRingBuffer.append()
for each event instead of reproducing the eviction logic inline. Use a real
buffer with billingEventRingSize+1 events, then assert it retains
billingEventRingSize entries and the oldest event was removed while the newest
remains.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@byoc/training_gateway.go`:
- Around line 123-144: The request handler currently builds statusURL from
caller-controlled orch_url values, enabling SSRF. Replace direct query/header
usage with an orchestrator origin resolved from the trusted discovery result, or
validate it against the registered-orchestrator allowlist before constructing
the request in the status proxy flow around sendReqWithTimeout.

In `@e2e-byoc-test/agent-client-thin.py`:
- Around line 224-231: Update the video-generation branching around
resolve_capability and tool_generate_video to remove the undefined cap_lower
reference. Check the resolved capability and step text independently so the i2v
path remains available regardless of whether the step contains “lucy”, while
preserving the existing v2v and default branches.

In `@e2e-byoc-test/ARCHITECTURE-live-streaming.md`:
- Around line 303-317: Replace the exposed concrete orchestrator credential in
the architecture documentation with a non-sensitive placeholder for both
orchSecret and ORCH_SECRET, and ensure any deployment configuration using the
published value is rotated to a new secret.

In `@e2e-byoc-test/PLAN-highfps-scope-trickle.md`:
- Around line 41-42: Revoke and rotate the exposed fal credentials, then remove
all committed values: in e2e-byoc-test/PLAN-highfps-scope-trickle.md lines
41-42, replace the administrative and model keys with placeholders; in
e2e-byoc-test/deploy-stream-adapter.sh line 19, remove the credential default
and require FAL_KEY from secret storage; in
e2e-byoc-test/test-storyboard-playback.py line 27, delete the unused embedded
credential. Purge the revoked values from history where practical.

In `@e2e-byoc-test/sdk-service/app.py`:
- Around line 61-72: The public SDK service must not expose anonymous paid
operations without safeguards. In e2e-byoc-test/sdk-service/app.py lines 61-72,
add client authentication and authorization, enforce quotas or rate limits, and
replace wildcard CORS with an explicit allowed-origin policy around the FastAPI
app and CORSMiddleware configuration. In
e2e-byoc-test/fat-thin-nosdk-client-comp.md lines 182-188, qualify the safety
claim to state that provider credentials are hidden but safe public use also
requires these controls.

In `@e2e-byoc-test/storyboard/index.html`:
- Around line 4247-4257: Remove the hardcoded Authorization credential from the
browser-side update flow in the try block, and rotate/revoke the exposed key.
Route the scope-trickle update through the SDK/server service using a
server-held credential, or use the returned scoped liveControlUrl, while
preserving the existing prompt and session_id parameters.
- Around line 4111-4129: Fix PSI generation in TSMuxer by updating _pk() so the
adaptation-field length and bytes are written before the PSI pointer byte, with
payload placement and packet continuity preserved. Update _crc32() to use the
non-reflected MPEG-2 PSI CRC-32 algorithm required by PAT and PMT sections, and
keep _pat() and _pmt() using that corrected checksum.
- Around line 1427-1462: Replace dynamic innerHTML construction in createCard
and the referenced sections with createElement-based DOM assembly, assigning
untrusted titles, refIds, inference data, capability metadata, and training
values via textContent, value, or src as appropriate. Keep only fully static
markup in any remaining innerHTML, and ensure all user/service-controlled
attributes are set through DOM properties rather than interpolated HTML.

In `@e2e-byoc-test/test-byoc.sh`:
- Around line 23-24: Update the counter increments in log_pass and log_fail to
avoid post-increment expressions whose initial zero value returns failure under
set -e. Use an increment form that returns success while preserving the pass and
fail counter behavior.

---

Outside diff comments:
In `@core/orchestrator.go`:
- Around line 275-336: Update applyAutoAdjustOverhead and the price construction
in GetCapabilitiesPrices so every price undergoes the same final
fixed-point/int64 wire canonicalization, regardless of whether overhead is
enabled. Apply overhead conditionally, then normalize the resulting value before
populating net.PriceInfo, including both built-in capability paths and the BYOC
external-capability path, matching PriceInfoForCaps behavior.

In `@server/remote_signer.go`:
- Around line 382-420: Update the remote payment state creation and validation
flow around stateID, manifestID, and byocCapability to persist the request type
and resolved manifest identifier in the signed state. When continuing an
existing state, reject any change to either the request type or manifest with a
bad-request response, alongside the existing orchestrator validation; ensure
newly created state records these values before signing.

---

Major comments:
In @.mcp.json:
- Around line 4-7: Replace the hardcoded user-specific path in the MCP server
configuration’s command arguments with a repository-relative path or supported
workspace variable that resolves correctly from any checkout.

In `@byoc/byoc.go`:
- Around line 266-271: Update the checkpoint initialization branch in the
training-store setup so an error from NewTrainingJobStoreWithCheckpoint is
propagated to startup instead of logging a warning and assigning
NewTrainingJobStore. Preserve checkpoint persistence whenever
TRAINING_CHECKPOINT_DIR is configured, and ensure the surrounding startup flow
returns or surfaces the initialization error.
- Around line 213-224: Update the OutWriter readiness wait in the WHEP handling
block around stream.OutCond so it uses a real ten-second deadline and observes
request cancellation instead of relying on sync.Cond.Wait(). Replace or adapt
the condition-wait mechanism with a deadline-aware channel or timer-based
select, preserving immediate use of stream.OutWriter when it becomes available
and exiting when the timeout or request context is canceled.
- Around line 306-319: Require application-level authentication for the
administrative routes registered in byoc/byoc.go, including job listing/status
and BillingEventsHandler, rather than relying on an optional edge proxy. In
byoc/billing_event.go, authorize requests before returning sender or payment
metadata; in byoc/training.go, authorize job enumeration and restrict payer
metadata to the requesting user or other permitted principals. Apply the
existing authentication mechanism consistently across all three sites.

In `@byoc/job_orchestrator.go`:
- Around line 583-650: Resolve billable units only once in chargeForCompute and
reuse that value for both DebitFees and the audit cost calculation. Update the
debit helper and computeChargeWei flow so the resolved units are returned or
passed through rather than calling resolveUnits independently, preserving header
parsing and seconds fallback behavior.
- Around line 324-334: Close resp.Body before returning from both early-exit
paths in byoc/job_orchestrator.go: the 401 billing branch around lines 324-334
and the http.Flusher-unavailable branch around lines 420-423. Update the
surrounding job orchestration flow so each branch releases the response body
before return, while preserving the existing later body-close ownership path.

In `@byoc/training_gateway.go`:
- Around line 43-48: Update the signing-failure branch in the gateway job
handler around gatewayJob.sign() to write an appropriate error response before
returning, rather than exiting with an implicit successful response. Preserve
the existing error logging and ensure the client receives a failure status and
message.

In `@byoc/training.go`:
- Around line 785-828: The polling loop around elapsed and pollTimeout must
measure the timeout with wall-clock time, not by incrementing elapsed by
pollInterval. Initialize a start time or deadline before the loop and use
time.Since(start) or deadline comparison in the loop condition, while preserving
the existing cancellation, billing, and polling behavior.
- Around line 623-636: Route all training job metering and lifecycle updates
through the training store API so each mutation writes a checkpoint: update the
cost and post-charge balance block at byoc/training.go lines 623-636, refreshed
payment balance at lines 588-595, adapter job ID and running transition at lines
720-729, and initial payment balance at lines 775-783. Reuse the store methods
that invoke writeCheckpointLocked() rather than mutating trainingStore.jobs
entries directly.
- Around line 278-292: The Update method in byoc/training.go (lines 278-292)
must validate the current-to-next status transition while holding s.mu and
reject every update once the job is completed or cancelled, preventing running
updates from overwriting terminal states. Add or update assertions in
byoc/training_store_test.go (lines 191-227) to verify concurrent running updates
cannot replace either terminal state, rather than only checking disk and memory
equality.
- Around line 868-879: Update the first-tick grace transition guarded by
seenInProgress so it only activates for explicit running or in-progress
statuses, excluding failed, cancelled, completed, submitted, and empty statuses.
Keep the billing timestamps and log behavior unchanged once a qualifying running
status is observed.
- Around line 129-181: Update sweepOnStartup and
NewTrainingJobStoreWithCheckpoint so each recovered in-flight job triggers the
documented I8 restart refund before startup recovery completes. Reuse the
existing refund mechanism and checkpointed CostPaidWei/sender data, and ensure
refund failures are surfaced rather than silently treating the sweep as
complete.
- Around line 481-482: Remove the direct
bso.orch.FreeExternalCapabilityCapacity(job.Capability) call from the
cancellation path in runTrainingJob(), relying on its existing deferred cleanup
so the reservation is released exactly once.

In `@byoc/types.go`:
- Line 322: Update FlattenBYOCJob and the corresponding verification path around
TimeoutSeconds to prevent values outside the uint32 payload range from being
accepted. Validate that the signed timeout is within the supported non-negative
uint32 bounds before encoding or verifying, returning an error for out-of-range
values; alternatively, consistently widen the encoded payload in both paths so
distinct timeout values cannot collide.

In `@e2e-byoc-test/agent-client-thin.py`:
- Around line 60-65: Update _sdk_get to catch HTTPError responses and normalize
them using the same behavior as _sdk_post, including the expected 404 response
from /train/{job_id}. Ensure status and capability commands receive the
normalized result instead of terminating with an uncaught traceback.

In `@e2e-byoc-test/agent-client.py`:
- Around line 39-41: Update the SSL context initialization around _ssl_ctx to
keep hostname and certificate verification enabled by default. Add an explicit
development configuration or custom CA bundle path for self-signed deployments,
and apply it only when that option is provided.
- Around line 512-519: The image capability fallback in agent-client.py lines
512-519 incorrectly filters capability names for “image”; update the fallback
used by resolve_cap to select the highest-ranked available entry from
IMAGE_QUALITY, while preserving the nano-banana preference. Apply the same
ranked IMAGE_QUALITY selection in agent-client-sdk.py lines 643-650, without
relying on capability-name text matching.
- Around line 635-700: Track failed steps separately from completed steps in the
execution loop around step_ready, execute_step, and the concurrent future
handling in e2e-byoc-test/agent-client.py:635-700; when a step fails or returns
no artifact, mark it failed and skip or fail all descendants instead of
satisfying their dependencies. Update the dependent execution logic in
e2e-byoc-test/agent-client-sdk.py:764-825 to require artifacts for every
prerequisite and prevent dependents from running when any required artifact is
absent.

In `@e2e-byoc-test/deploy-stream-adapter.sh`:
- Around line 33-48: Update the remote execution around the quoted REMOTE_EOF
heredoc to explicitly forward the local FAL_KEY and ORCH_SECRET values into the
remote shell. Ensure the export statements in the remote adapter startup use
those transferred secrets rather than relying on local expansion or the fallback
secret, while preserving secure handling of the credentials.
- Around line 36-37: Update the dependency installation command in the
deployment script to remove the unconditional success fallback, so pip3 failures
terminate the deployment while preserving the command’s diagnostic output for
troubleshooting.
- Around line 22-29: Make ADAPTER_SRC portable in the deployment script by using
an externally supplied environment value when present, or deriving the source
directory relative to deploy-stream-adapter.sh as the fallback. Keep the
existing rsync behavior and destination unchanged.

In `@e2e-byoc-test/deploy-vm.sh`:
- Around line 24-28: Update deploy-vm.sh to conditionally enable Replicate and
RunPod proxy/adapter services based on non-empty REPLICATE_KEY and RUNPOD_KEY
values, using the corresponding key-specific Docker Compose profiles. Ensure the
same profile gating is applied throughout the service startup logic covered by
the referenced range, while preserving unconditional startup for providers with
available required keys.
- Around line 9-28: Update deploy-vm.sh to stop accepting FAL_KEY, GEMINI_KEY,
REPLICATE_KEY, and RUNPOD_KEY as positional arguments; read them from
environment variables or hidden prompts instead. Preserve VM_IP as the
positional argument, and ensure the generated remote .env file is created with
permissions 600.

In `@e2e-byoc-test/docker-compose.fal.yaml`:
- Around line 17-20: Replace the floating latest orchestrator image in
e2e-byoc-test/docker-compose.fal.yaml:17-20 by building the local branch or
pinning the image to the reviewed commit. Update
e2e-byoc-test/deploy-vm.sh:47-50 to deploy the immutable digest produced from
that same reviewed commit, ensuring both paths run the intended code.

In `@e2e-byoc-test/docker-compose.yaml`:
- Line 153: Update the ORCH_URL value in the Docker Compose configuration to use
the orchestrator’s HTTPS scheme on port 8935, matching the other clients and
deployments. Also update the corresponding orchestrator URLs in the setup.sh
registration flows to HTTPS while preserving the existing host and port.

In `@e2e-byoc-test/fat-thin-nosdk-client-comp.md`:
- Around line 182-188: Update the “Credentials stay server-side” section to
remove the claim that distributing thin clients to untrusted environments is
safe while the service is anonymous. Document that authentication and usage
quotas must be implemented before making that claim, while preserving the
statement that provider credentials remain server-side.

In `@e2e-byoc-test/mcp-server/openapi.yaml`:
- Around line 9-14: Separate the OpenAPI server definitions for adapter/SDK and
orchestrator operations instead of assigning all paths to the orchestrator URL.
Update the /capabilities and related adapter/SDK endpoints to use the SDK
service, while keeping /process/request/{capability} on the orchestrator, using
operation-level servers or separate server declarations as appropriate.

In `@e2e-byoc-test/mcp-server/server-sdk.py`:
- Around line 52-58: Harden the shared media-download flow used by
_download_file in e2e-byoc-test/mcp-server/server-sdk.py (lines 52-58) by
enforcing an allowlisted URL scheme, rejecting resolved local/private/internal
addresses, limiting redirects, and enforcing a maximum response size before
writing the file. Apply the same centralized URL-validation policy to the
direct-orchestrator download path in e2e-byoc-test/mcp-server/server.py (lines
73-79), reusing the shared validator rather than implementing separate checks.

In `@e2e-byoc-test/sdk-service/app.py`:
- Around line 56-59: Replace the insecure SSL context in
e2e-byoc-test/sdk-service/app.py lines 56-59 with configuration that trusts the
deployment CA or pins the expected orchestrator certificate while retaining
hostname validation. Apply the same verified TLS configuration in
e2e-byoc-test/mcp-server/server.py lines 37-39, removing CERT_NONE and ensuring
both service and local-client paths validate orchestrator certificates.
- Around line 1134-1143: The publish flow around _init_stream_session must not
report success or send raw JPEG data when MPEG-TS initialization fails.
Propagate the initialization/encoding failure as an error response and ensure
the stream is not published; alternatively, replace the fallback with a
compatible MPEG-TS encoder. Apply the same behavior to the corresponding flow
near the second affected block.
- Around line 147-180: Update UploadRequest and upload_file to enforce explicit
encoded and decoded payload size limits before and during base64 decoding,
rejecting oversized uploads with HTTP 413 and avoiding unbounded memory use. Add
retention cleanup for files written by upload_file, including an expiry
mechanism that removes old uploads from UPLOAD_DIR, while preserving the
existing URL and response behavior for accepted files.
- Around line 1179-1216: The streaming implementation must not rely on
process-local _stream_sessions and its MediaPublish/MediaOutput objects when
multiple Cloud Run instances are allowed. Either configure this prototype to run
on a single stateful instance, or introduce explicit session ownership and
routing so publish, frame, and stop requests consistently reach the instance
holding each session; preserve session behavior across scaling and restarts.
- Around line 769-781: Update the plan-repair logic for gemini-image and
lucy-i2v dependencies to select replacements through _find_fallback() with the
appropriate incompatible-capability exclusions, rather than unconditionally
choosing flux-schnell or kling-i2v. Ensure each repaired capability is present
in available_caps, and reject the chain when no compatible fallback exists.
- Around line 1154-1165: Update the stream stop flow around the job_request
construction to reuse the capability recorded for the active stream session
instead of hardcoding "scope-live". Persist req.capability when starting the
stream, retrieve it by stream_id during teardown, and use that value in the
Livepeer stop header while preserving the existing request behavior.
- Around line 208-227: Update the async route handlers to offload blocking SDK
helpers— including list_capabilities in get_capabilities, submit_byoc_job,
submit_training_job, wait_for_training, get_training_status, and
_llm_call—through asyncio.to_thread or FastAPI’s threadpool; preserve their
existing arguments, results, and error handling while ensuring the event loop is
not blocked.

In `@e2e-byoc-test/sdk-service/Dockerfile`:
- Around line 18-22: Update the Dockerfile container setup around the app.py
copy and uvicorn CMD to create and select a dedicated non-root user before
starting the service. Ensure the application files are accessible to that user
and preserve the existing PORT-based uvicorn startup behavior.

In `@e2e-byoc-test/setup.sh`:
- Around line 89-93: Update the health-check flow around wait_for_health so
failed checks are not discarded before logging “Stack is running!”. Propagate
failures or explicitly report a degraded stack and exit nonzero, applying the
same behavior to the additional health-check blocks identified near the other
occurrences.

In `@e2e-byoc-test/storyboard/index.html`:
- Around line 3281-3313: Update entriesToZipBase64 to compute a CRC-32 for each
entry’s data and write the result to the local header at offset 14 and the
central directory header at offset 16. Keep the data-descriptor flag unset and
preserve the existing STORE-entry size and offset handling.
- Around line 3117-3131: The dependent-step scheduler around runSubAgent must
only consider a dependency ready when its result represents success, not merely
any non-null result; update the readiness check to exclude {error: ...}
outcomes. When dependencies fail, mark affected descendants as blocked and
remove them from execution rather than invoking them, including in the no-ready
fallback path, while preserving concurrent execution for independently ready
steps.
- Around line 4287-4335: Update the live start handler and transformLive flow to
read the live-video-url value and handle the “Video URL” input instead of only
checking inputSrc. Pass the URL through the /stream/start request in the
expected request field, or invoke URL-to-ingress publishing after stream
creation, so selecting Video URL sends frames to the GPU. Preserve the existing
webcam publisher behavior.
- Around line 2246-2265: Update sdkFetch so the abort timer remains active
through response-body parsing by moving timer cleanup to a finally path that
runs after resp.json() completes or throws. Preserve the existing HTTP error
handling and ensure the timer is cleared for both successful and failed
requests.

In `@e2e-byoc-test/storyboard/mpegts_muxer.js`:
- Around line 19-38: Update TSMuxer initialization so PAT/PMT packets are not
emitted during construction before onData is configured. Accept the output
callback through the constructor or add an explicit start method that calls
initTables after the consumer wires onData, while preserving table generation
and emission behavior.
- Around line 1-17: Update crc32 to use the non-reflected CRC-32/MPEG-2
algorithm required by PAT/PMT, including its polynomial and finalization
semantics. In the muxer initialization flow, ensure tsMuxer.onData is assigned
before initTables() emits the initial PAT/PMT packets, preserving those packets
instead of dropping them.

In `@e2e-byoc-test/storyboard/trickle_publisher.js`:
- Around line 5-15: Update the publisher initialization around create() and
next() so stream creation is guaranteed before any segment request. Cache a
shared create promise to prevent duplicate POSTs, and await that promise at the
start of next() before opening segment zero or subsequent segments. Preserve the
existing create error handling and request behavior.

In `@e2e-byoc-test/test-byoc-client.py`:
- Around line 188-191: Update the health-check calls in
e2e-byoc-test/test-byoc-client.py lines 188-191 so test_health uses the
orchestrator’s /status endpoint while retaining /health for the adapter. In
e2e-byoc-test/test-fal-e2e.py lines 349-367, replace the capability-token probe
with a GET request to ${ORCH}/status, preserving the existing health-check
result handling.

In `@e2e-byoc-test/test-fal-e2e.py`:
- Around line 335-340: Update the all-tests execution flow to skip or replace
test_protocol() when args.via is "adapter", since that test requires the
orchestrator directly. Preserve the existing protocol test for "orch" mode while
ensuring --test all succeeds using only adapter-compatible tests in adapter
mode.
- Around line 96-110: Update call_orch() to generate and include a valid
Livepeer-Payment header in each protocol request alongside Content-Type and
Livepeer. Extend the protocol test assertions to validate the ticket-related
behavior, including ExpectedPrice, RecipientRandHash, and either the resulting
Livepeer-Balance change or the expected payment-validation outcome.

In `@e2e-byoc-test/test-scope-trickle.py`:
- Around line 191-200: Update the script’s final summary flow to return a
nonzero process exit status when out_count is zero or pub_ok is less than
args.frames, while preserving the existing PASS output and successful zero exit
status when all input frames publish and output is received.

In `@e2e-byoc-test/test-storyboard-playback.py`:
- Around line 276-289: Update the playback verdict flow after computing ok so a
false result causes the test process to exit unsuccessfully, while preserving
browser cleanup and publisher completion before failing. Use the existing async
test flow around browser.close() and await pub_task, then raise an assertion or
call sys.exit(1) when playback validation fails.
- Around line 38-45: Update the sample-video setup before av.open in the
playback flow: either require and use a --video argument, or generate
deterministic frames and write /tmp/sample.mp4 before opening it. Ensure the
standalone command works on a fresh machine without assuming the file already
exists.
- Around line 69-76: Update the stream creation flow around the requests.post
call and response parsing to validate the HTTP response and require a valid
stream_id and subscribe_url before continuing. Raise or assert immediately on
request failure or malformed results, preventing publication through an invalid
trickle URL.

In `@e2e-byoc-test/test-training-e2e.py`:
- Around line 214-219: Update both training completion paths around the
final.status == "completed" checks to require final.lora_url to be present and
not "N/A" before returning success. Log or assert the missing artifact as a
failure and avoid marking the E2E test passed; preserve the existing success
logging for valid URLs.
- Around line 73-96: The endpoint tests in test_adapter_train_endpoint and the
related Test 3/Test 4 flows must enforce their contracts instead of treating
unexpected responses as success. Require Test 2 to receive exactly HTTP 400,
require Test 3 to receive its expected status and a non-empty job_id before
polling, and reject HTTP 404 in Test 4; return failure for all other statuses,
missing identifiers, or malformed responses.

In `@server/remote_signer.go`:
- Around line 515-529: Update the elapsed-unit calculation in calculateFee to
use the existing outer timing variables and ceil the elapsed seconds, enforcing
a minimum of one unit; do not multiply by priceInfo.PixelsPerUnit. Align this
behavior with resolveUnits in byoc/job_orchestrator.go so fee calculation and
monitoring use the same interval.
- Around line 287-303: Update the BYOC pricing selection logic around the
top-level check and CapabilitiesPrices loop to require an exact Constraint match
when manifestID is provided, including the top-level candidate. When manifestID
is omitted, only return a valid BYOC price if exactly one candidate exists;
otherwise return no match, preventing ambiguous prices from populating
ExpectedPrice.
- Around line 94-118: Limit the request body in the SignBYOCJob handler before
json.Decoder decodes it by wrapping r.Body with http.MaxBytesReader and an
appropriate maximum size. Ensure oversized payloads are rejected through the
existing decode-error path, preventing unbounded request, request, and
parameters memory usage before FlattenBYOCJob.

---

Minor comments:
In `@byoc/job_orchestrator.go`:
- Around line 614-622: Update the unit parsing logic around ParseFloat in
resolveUnits to reject non-finite values and values whose ceiled result cannot
be represented as int64 before converting. Preserve the existing warning and
defaultSeconds/"second" fallback for all invalid or out-of-range headers, while
retaining the minimum-one-unit clamp for valid positive values.

In `@e2e-byoc-test/DESIGN.md`:
- Around line 119-131: Update the “Gap 3: livepeer-python-gateway SDK Is
LV2V-Focused” section in DESIGN.md to reflect the implemented livepeer-gateway
BYOC submission and training APIs and SDK-backed clients. Remove the obsolete
statement that BYOCClient support is deferred, and revise the recommended BYOC
testing paths to include the supported SDK while retaining valid curl, Python,
or direct HTTP options.

In `@e2e-byoc-test/extend-training-capabilities.md`:
- Line 433: Correct the charge-tick calculation in the orchestrator billing
description: distinguish the 14,400 elapsed seconds from the 480 30-second
billing intervals, and explicitly state whether charges accrue per second with
30-second settlement or each interval represents one charge tick.

In `@e2e-byoc-test/fat-thin-nosdk-client-comp.md`:
- Around line 99-120: The comparison in the “No TRAINER_PARAM_MAP” section
incorrectly claims the SDK Service maps provider parameters. Update it to state
that req.params passes through unchanged and callers must provide
provider-specific field names, unless a documented mapping layer is identified;
apply the same correction to the referenced comparison section.

In `@e2e-byoc-test/storyboard/trickle_publisher.js`:
- Around line 71-77: Update the async close function to await the DELETE request
before resolving, while preserving the existing nextController shutdown and
error reporting. Ensure DELETE failures propagate to callers instead of being
only logged through an unawaited catch.

In `@e2e-byoc-test/test-scope-trickle.py`:
- Around line 87-88: Validate the --fps argument in the argument parser so only
positive values are accepted, preventing zero division and disabling rate
limiting for negative values. Update the fps configuration in the parser setup
near --frames to use the existing argument-validation mechanism or an equivalent
positive-value validator, while preserving the float type and default of 2.

---

Nitpick comments:
In `@byoc/billing_event_test.go`:
- Around line 242-264: Update TestBillingEventRing_DropsOldestPastCap to call
billingEventRingBuffer.append() for each event instead of reproducing the
eviction logic inline. Use a real buffer with billingEventRingSize+1 events,
then assert it retains billingEventRingSize entries and the oldest event was
removed while the newest remains.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 338faa2d-8058-4a99-8b41-612df0822361

📥 Commits

Reviewing files that changed from the base of the PR and between 5e8ab23 and ed8f454.

📒 Files selected for processing (47)

• .mcp.json
• byoc/billing_event.go
• byoc/billing_event_test.go
• byoc/byoc.go
• byoc/job_orchestrator.go
• byoc/stream_orchestrator.go
• byoc/training.go
• byoc/training_gateway.go
• byoc/training_store_test.go
• byoc/types.go
• byoc/utils.go
• core/orchestrator.go
• e2e-byoc-test/ARCHITECTURE-live-streaming.md
• e2e-byoc-test/ARCHITECTURE.md
• e2e-byoc-test/DESIGN.md
• e2e-byoc-test/PLAN-highfps-scope-trickle.md
• e2e-byoc-test/SDK-GUIDE.md
• e2e-byoc-test/agent-client-sdk.py
• e2e-byoc-test/agent-client-thin.py
• e2e-byoc-test/agent-client.py
• e2e-byoc-test/deploy-stream-adapter.sh
• e2e-byoc-test/deploy-vm.sh
• e2e-byoc-test/docker-compose-training.yaml
• e2e-byoc-test/docker-compose.fal.yaml
• e2e-byoc-test/docker-compose.yaml
• e2e-byoc-test/extend-training-capabilities.md
• e2e-byoc-test/fat-thin-nosdk-client-comp.md
• e2e-byoc-test/lora-feat.md
• e2e-byoc-test/mcp-server/openapi.yaml
• e2e-byoc-test/mcp-server/server-sdk.py
• e2e-byoc-test/mcp-server/server.py
• e2e-byoc-test/sdk-service/Dockerfile
• e2e-byoc-test/sdk-service/app.py
• e2e-byoc-test/setup.sh
• e2e-byoc-test/storyboard/index.html
• e2e-byoc-test/storyboard/mpegts_muxer.js
• e2e-byoc-test/storyboard/trickle_publisher.js
• e2e-byoc-test/test-byoc-client.py
• e2e-byoc-test/test-byoc.sh
• e2e-byoc-test/test-fal-e2e.py
• e2e-byoc-test/test-scope-trickle.py
• e2e-byoc-test/test-storyboard-playback.py
• e2e-byoc-test/test-training-e2e.py
• server/remote_signer.go
• server/remote_signer_test.go
• server/rpc.go
• server/rpc_test.go

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Do not proxy caller-controlled orch_url values directly.

This is a read-capable SSRF: a client can make the gateway request arbitrary internal or metadata endpoints and receive the response. Resolve the orchestrator from the discovery result or enforce an allowlist of registered orchestrator origins.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@byoc/training_gateway.go` around lines 123 - 144, The request handler
currently builds statusURL from caller-controlled orch_url values, enabling
SSRF. Replace direct query/header usage with an orchestrator origin resolved
from the trusted discovery result, or validate it against the
registered-orchestrator allowlist before constructing the request in the status
proxy flow around sendReqWithTimeout.

[coderabbitai]

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Remove the undefined cap_lower reference.

A task such as “animate using lucy” evaluates cap_lower and raises NameError. The conditional expression also suppresses the i2v check whenever the step does not contain “lucy”.

Proposed fix

-            if "i2v" in cap or "lucy" in cap_lower if "lucy" in step_lower else False:
+            if "i2v" in cap:
                 result = tool_generate_video(prompt, cap, image_url=prev_image_url)

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if any(w in step_lower for w in ("video", "animate", "i2v", "t2v", "v2v")):
	cap = resolve_capability(cap_hint, "video")
	if "i2v" in cap or "lucy" in cap_lower if "lucy" in step_lower else False:
	result = tool_generate_video(prompt, cap, image_url=prev_image_url)
	elif "v2v" in cap:
	result = tool_generate_video(prompt, cap, video_url=prev_video_url)
	else:
	result = tool_generate_video(prompt, cap, image_url=prev_image_url if prev_image_url else None)
	if any(w in step_lower for w in ("video", "animate", "i2v", "t2v", "v2v")):
	cap = resolve_capability(cap_hint, "video")
	if "i2v" in cap:
	result = tool_generate_video(prompt, cap, image_url=prev_image_url)
	elif "v2v" in cap:
	result = tool_generate_video(prompt, cap, video_url=prev_video_url)
	else:
	result = tool_generate_video(prompt, cap, image_url=prev_image_url if prev_image_url else None)

🧰 Tools

🪛 Ruff (0.15.21)

[error] 226-226: Undefined name cap_lower

(F821)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/agent-client-thin.py` around lines 224 - 231, Update the
video-generation branching around resolve_capability and tool_generate_video to
remove the undefined cap_lower reference. Check the resolved capability and step
text independently so the i2v path remains available regardless of whether the
step contains “lucy”, while preserving the existing v2v and default branches.

Source: Linters/SAST tools

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Remove and rotate the published orchestrator secret.

The same concrete shared credential is documented for both orchSecret and ORCH_SECRET alongside the deployed infrastructure. Replace it with a placeholder and rotate any deployment that used this value.

🧰 Tools

🪛 markdownlint-cli2 (0.23.0)

[warning] 310-310: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/ARCHITECTURE-live-streaming.md` around lines 303 - 317, Replace
the exposed concrete orchestrator credential in the architecture documentation
with a non-sensitive placeholder for both orchSecret and ORCH_SECRET, and ensure
any deployment configuration using the published value is rotated to a new
secret.

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Revoke and remove the committed fal credentials.

Provider credentials are embedded across documentation, deployment, and test artifacts. Assume they are compromised, rotate them before merge, purge them from history where practical, and load replacements exclusively from secret storage.

• e2e-byoc-test/PLAN-highfps-scope-trickle.md#L41-L42: replace both administrative and model keys with placeholders.
• e2e-byoc-test/deploy-stream-adapter.sh#L19-L19: remove the credential default and require FAL_KEY.
• e2e-byoc-test/test-storyboard-playback.py#L27-L27: delete the unused embedded credential.

📍 Affects 3 files

• e2e-byoc-test/PLAN-highfps-scope-trickle.md#L41-L42 (this comment)
• e2e-byoc-test/deploy-stream-adapter.sh#L19-L19
• e2e-byoc-test/test-storyboard-playback.py#L27-L27

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/PLAN-highfps-scope-trickle.md` around lines 41 - 42, Revoke and
rotate the exposed fal credentials, then remove all committed values: in
e2e-byoc-test/PLAN-highfps-scope-trickle.md lines 41-42, replace the
administrative and model keys with placeholders; in
e2e-byoc-test/deploy-stream-adapter.sh line 19, remove the credential default
and require FAL_KEY from secret storage; in
e2e-byoc-test/test-storyboard-playback.py line 27, delete the unused embedded
credential. Purge the revoked values from history where practical.

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

The public SDK service has no client authentication or billing-abuse controls. Hiding provider credentials does not make anonymous paid operations safe.

• e2e-byoc-test/sdk-service/app.py#L61-L72: require authentication, authorization, quotas/rate limits, and restricted CORS.
• e2e-byoc-test/fat-thin-nosdk-client-comp.md#L182-L188: qualify the safety claim until those controls exist.

📍 Affects 2 files

• e2e-byoc-test/sdk-service/app.py#L61-L72 (this comment)
• e2e-byoc-test/fat-thin-nosdk-client-comp.md#L182-L188

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/sdk-service/app.py` around lines 61 - 72, The public SDK
service must not expose anonymous paid operations without safeguards. In
e2e-byoc-test/sdk-service/app.py lines 61-72, add client authentication and
authorization, enforce quotas or rate limits, and replace wildcard CORS with an
explicit allowed-origin policy around the FastAPI app and CORSMiddleware
configuration. In e2e-byoc-test/fat-thin-nosdk-client-comp.md lines 182-188,
qualify the safety claim to state that provider credentials are hidden but safe
public use also requires these controls.

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

Remove dynamic innerHTML construction to prevent DOM XSS.

Remote enrichment IDs/titles, inference URLs/errors, capability metadata, and training values are interpolated into HTML with incomplete escaping. A crafted service response can execute JavaScript in the storyboard origin. Build elements with createElement, textContent, .value, and .src; reserve innerHTML for static markup only.

Also applies to: 1499-1535, 1738-1817, 3485-3492

🧰 Tools

🪛 ast-grep (0.44.1)

[warning] 1441-1461: Avoid assigning untrusted data to innerHTML/outerHTML or document.write
Context: el.innerHTML = <div class="card-header"> <span class="card-type-badge ${type}">${type.toUpperCase()}</span> <input class="card-title" value="${safeTitle}" spellcheck="false" title="ref: ${rid}"> <span class="card-ref">${rid}</span> <div class="card-controls"> <button class="card-btn live-btn-card" title="Transform Live" style="display:none;">&#9654;</button> <button class="card-btn save-btn" title="Save media" style="display:none;">&#8615;</button> <button class="card-btn min-btn" title="Minimize">_</button> <button class="card-btn close" title="Close">×</button> </div> </div> <div class="card-body"> <div class="placeholder"> <div class="shimmer"></div> <div class="spinner"></div> <div class="label">Generating…</div> </div> </div> <div class="resize-handle"></div>
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

(inner-outer-html)

---

[warning] 1439-1439: Avoid hand-rolled HTML escaping (replacing characters with HTML entities); use a vetted encoder/sanitizer such as DOMPurify or sanitize-html.
Context: (title || type).replace(/"/g, '"')
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

(manual-sanitization)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/storyboard/index.html` around lines 1427 - 1462, Replace
dynamic innerHTML construction in createCard and the referenced sections with
createElement-based DOM assembly, assigning untrusted titles, refIds, inference
data, capability metadata, and training values via textContent, value, or src as
appropriate. Keep only fully static markup in any remaining innerHTML, and
ensure all user/service-controlled attributes are set through DOM properties
rather than interpolated HTML.

Source: Linters/SAST tools

[coderabbitai]

🎯 Functional Correctness | 🔴 Critical | 🏗️ Heavy lift

Fix malformed PAT/PMT packet generation.

For PSI packets, _pk() writes the pointer byte before the adaptation field, although the header declares adaptation followed by payload. Demuxers therefore parse the pointer as the adaptation length. _crc32() also implements reflected ZIP CRC-32 rather than MPEG-2 PSI CRC-32. The WebCodecs publisher emits invalid program tables as a result.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/storyboard/index.html` around lines 4111 - 4129, Fix PSI
generation in TSMuxer by updating _pk() so the adaptation-field length and bytes
are written before the PSI pointer byte, with payload placement and packet
continuity preserved. Update _crc32() to use the non-reflected MPEG-2 PSI CRC-32
algorithm required by PAT and PMT sections, and keep _pat() and _pmt() using
that corrected checksum.

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

Revoke the exposed fal credential and remove it from browser code.

Any visitor can extract and reuse this authorization key. Route prompt updates through the SDK service using a server-held credential—or the returned scoped liveControlUrl—and rotate the committed key immediately.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/storyboard/index.html` around lines 4247 - 4257, Remove the
hardcoded Authorization credential from the browser-side update flow in the try
block, and rotate/revoke the exposed key. Route the scope-trickle update through
the SDK/server service using a server-held credential, or use the returned
scoped liveControlUrl, while preserving the existing prompt and session_id
parameters.

[coderabbitai]

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Avoid post-increment under set -e.

The first ((pass++)) or ((fail++)) returns status 1 because its previous value is zero, terminating the script after its first result.

Proposed fix

-log_pass() { echo -e "${GREEN}[PASS]${NC} $1"; ((pass++)); }
-log_fail() { echo -e "${RED}[FAIL]${NC} $1"; ((fail++)); }
+log_pass() { echo -e "${GREEN}[PASS]${NC} $1"; ((++pass)); }
+log_fail() { echo -e "${RED}[FAIL]${NC} $1"; ((++fail)); }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	log_pass() { echo -e "${GREEN}[PASS]${NC} $1"; ((pass++)); }
	log_fail() { echo -e "${RED}[FAIL]${NC} $1"; ((fail++)); }
	log_pass() { echo -e "${GREEN}[PASS]${NC} $1"; ((++pass)); }
	log_fail() { echo -e "${RED}[FAIL]${NC} $1"; ((++fail)); }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e-byoc-test/test-byoc.sh` around lines 23 - 24, Update the counter
increments in log_pass and log_fail to avoid post-increment expressions whose
initial zero value returns failure under set -e. Use an increment form that
returns success while preserving the pass and fail counter behavior.