Pull request overview

Adds a new experimental demo-video skill to assemble ordered prototype frames/clips and per-segment narration WAVs into a single narrated MP4 using FFmpeg, and registers the skill across collections, plugins, and behavior evals.

Changes:

• Added the demo-video skill package (docs, Python assembler CLI, bash/PowerShell wrappers, examples, and tests including a fuzz harness).
• Registered demo-video in experimental and hve-core-all collections and regenerated plugin READMEs.
• Extended skill behavior conformance eval coverage with demo-video knowledge/tool-trigger/bleed-detection stimuli.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 6 comments.

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*

Alain Uyidi (@auyidi1) if you don´t mind you can add the additional context from our chat yesterday to the readme as well. Thanks for this great skill

Thanks for the demo-video skill — the assembler/wrapper design is clean, the subprocess handling is injection-safe (list args, no shell=True, yaml.safe_load), and the repo Python-skill conventions (ruff/pytest/fuzz/uv.lock, dual wrappers, copyright headers) are all met. A few items I didn't see raised elsewhere on the PR:

• Blocking: the shipped examples/segments.yml uses ./examples/fixtures/... paths, but the assembler resolves relative paths against the manifest's own directory (examples/), so they expand to examples/examples/fixtures/... and don't match the fixture layout examples/README.md documents — the flagship example fails on first run. Changing the manifest paths to ./fixtures/... (and output: ./output/demo.mp4) fixes it; please verify end-to-end since the PR notes the smoke run was skipped.
• The npm run test:py 13 passed figure in the PR body isn't reproducible — the two discoverable pytest files contain 11 test functions; please re-run and update the count.
• tests/DemoVideoHelpers.Tests.ps1 doesn't mirror its system under test (Invoke-AssembleVideo.ps1); renaming to Invoke-AssembleVideo.Tests.ps1 matches the Pester convention.
• Minor: SKILL.md's Manifest Schema omits the top-level output/resolution/fps keys the code and example use; an empty-string narration skips the narration_wav fallback; and _validate_manifest returns the segments list redundantly.

Dependency Review — demo-video Skill

This PR introduces a new Python skill with the following dependencies. No existing workflow, devcontainer, or copilot-setup-steps.yml files are modified, so SHA-pinning and environment-sync checks are not applicable.

Dependencies Introduced

Safety Checks

All dependency safety checks passed. No action required from this review.

Generated by Dependabot PR Review for #2404 · 39.3 AIC · ⌖ 7.05 AIC · ⊞ 8.5K

Dependency Review — demo-video skill

Scope: pyproject.toml + uv.lock added under .github/skills/experimental/demo-video/

Dependencies introduced

Indirect lock-file entries (colorama, coverage, iniconfig, packaging, pluggy, pygments, tomli) are all MIT, BSD, or Apache-2.0 — all compatible with the project's MIT license.

Safety check results

• ✅ License compatibility — all dependencies (runtime and dev) carry MIT, BSD, or Apache-2.0 licenses, compatible with the project's MIT license.
• ✅ No duplication — pyyaml is the only runtime dependency; no existing repo-level dependency provides YAML parsing for this skill's use case.
• ✅ SHA/hash pinning — uv.lock pins every wheel and sdist by SHA-256 hash. No GitHub Actions references were modified in this PR.
• ✅ Environment synchronization — no changes to .devcontainer/ or copilot-setup-steps.yml; synchronization concern is N/A.
• ✅ Vulnerability posture — all packages are well-established, actively maintained, and carry no known vulnerability signals. atheris is correctly isolated in the fuzz dependency group (no macOS wheels) per repo convention.
• ✅ uv.lock committed — lock file is present alongside pyproject.toml, satisfying Dependabot resolution requirements.

All dependency safety checks passed. No findings require changes.

Generated by Dependabot PR Review for #2404 · 42.7 AIC · ⌖ 8.7 AIC · ⊞ 8.5K

Pull request overview

Copilot reviewed 22 out of 23 changed files in this pull request and generated 3 comments.

Re-reviewing at 2f2d912 — the type/source enforcement, --fps validation, non-string-key handling, and tighter fuzz scope from the follow-up commits all look good and are covered by new tests. I'm not repeating the items already open on the PR (the examples/segments.yml path-doubling thread and the Pester filename / SKILL.md top-level-keys notes from Chris Montazer (@rezatnoMsirhC) still apply and remain unresolved — the example still fails on first run). A few net-new items I didn't see raised elsewhere:

• Please verify (from the concat change): the final concat now uses -c copy (per the earlier suggestion) instead of re-encoding. With fractional per-segment durations and fixed-size AAC frames, stream-copy concat can drift A/V sync or leave gaps at segment seams that the previous re-encode masked. Since FFmpeg isn't in the dev container and the smoke run is still skipped, this primary output path is untested — please confirm the final MP4 stays in sync end-to-end, or keep a re-encode fallback for the concat step.
• Add a shipped-example regression test: a test that loads examples/segments.yml and asserts the resolved fixture paths match the README layout would guard the open path-doubling issue from recurring.
• PR body count: npm run test:py 13 passed isn't reproducible — there are now 14 discoverable test functions for this skill (12 in test_assemble_video.py + 2 in fuzz_harness.py). Please re-run and update the figure (or note it''s a repo-wide aggregate).
• Minor: an empty-string narration: still skips the narration_wav fallback (only None/absent falls back); and _validate_manifest returns the segments list a second time even though the config dict it returns already contains segments.

Also note the branch is currently BEHIND main and the four approvals predate the still-open 07-15 findings, so a fresh look after the fixes would be worthwhile.