One Cloud Run service. Three partner backbones.
Runtime: where a request goes, and who may touch what
Every department is an independent witness
// one immutable, sequenced envelope per action { "sequence_num": 1042, "production_id": "DEMO_PRODUCTION", "shoot_day": "Day 31", "user_role": "SCRIPT_SUPERVISOR", "event_type": "TAKE_LOGGED", "payload": { "slate": "101/1", "take_number": 1, "status": "GOOD", "circled": true } }
- Director / DoP ·
SCREENPLAY_PARSEDCAMERA_ANGLE_ADDEDDOP_OPTICS_CONFIGURED - Script supervisor ·
TAKE_LOGGEDFALSE_START_RECORDEDCIRCLED_TAKE_FLAGGED - Sound mixer ·
SOUND_ALE_INGESTEDPOLY_WAV_TRACKS_MAPPEDWILD_TRACK_LOGGED - DIT ·
CARD_OFFLOAD_VERIFIEDCHECKSUM_VALIDATEDSILVERSTACK_MANIFEST_INGESTED - Editorial ·
DISCREPANCY_INSPECTEDOVERRIDE_APPLIEDMASTER_CONFORM_LOCKED
Append in ClickHouse. Push over SSE. Zero polling.
Publish
POST /api/events/publish
Monotonic sequence_num. Projected into ClickHouse tables (events, takes, discrepancies, requirement_events, user_activity).
Subscribe
GET /api/events/subscribe
Server-Sent Events scoped by production, shoot day and role. @assistant_editor sees editorial; sound sees sound. Cloud Run timeout raised to 3600s so the stream lives.
React
Master Sheet, Discrepancy Matrix, Previz Studio update live
A DIT drops an offload manifest; the assistant editor's discrepancy card resolves on their screen without a refresh.
From paperwork to agents, five stages, no broker
The assistant editor's cockpit: one card per slate, every witness attached
- Composed Master Sheet (15) · slate cards fusing ZoeLog camera clips, Sound CSV poly-WAVs and the script supervisor's lined notes.
- Sequences Log Matrix (6) · scene × take grid; circled, wild-track and VFX filters.
- Card & Roll Map · A001, A120, B039, C005 … which card carried what, and where it was offloaded.
- Active Discrepancies (10) · the reconciliation output, one click from resolution.
- Requirements & Alerts · blockers assigned to
@dit,@sound_supervisor, with audit fields on resolve. - Drop Paperwork · PDF / CSV / ALE / XML ingestion; deterministic parsers, no LLM in the reconciliation path.
Ten open findings on Day 31. Each one names its witnesses.
TIMECODE_DRIFT · 2/1 Take 2
Script Supervisor 14:05:00:00 vs Sound Department 14:05:00:12. Four witness cards: Script (Belief), Sound (Belief), Camera A (Belief), DIT / Silverstack (Existence).
PAPERWORK_WITHOUT_MEDIA · 27/7 Take 2
A120_C002_260728, B039_C002_260728, C005_C002_260728 logged on set, missing from the offload report. Three cameras, one take, one root cause.
MEDIA_WITHOUT_PAPERWORK · A001C099_260831.MOV
Exists on the volume. Referenced by no camera or sound log. The orphan nobody would find until the conform.
Resolution
Resolve / Assign Card appends a DISCREPANCY_RESOLVED event with resolved_by and resolved_at. Diagnose opens the witness diff. The original finding is never deleted.
One call says how a production is doing. Eight tools let an agent act on it.
4blockingblocked, open findings
0missinginferred, names its rule
0runningin progress
4lefteditorial needs, untagged
0doneresolved, closed
@dit on top, then the reconciler’s three findings. Same answer the WebMCP tool returns.
WebMCP · document.modelContext (W3C draft)
The page is the tool surface
The SPA registers tools on document.modelContext, so a browser agent acts on the page instead of scraping it. Tools resolve through a ref, so an agent always runs the latest React state.
navigate_appset_dop_settingsgenerate_dop_test_renderselect_charactertrigger_wrap_rescue_agentrun_full_demosummarize_production_statusranked status as JSON plus a plain-text summarywipe_all_production_datadestructiveHint, refuses withoutconfirm=true
No shipping browser exposes document.modelContext yet outside Chrome's early preview. Nothing changes for ordinary users.
From the writer's words to a multi-camera coverage plan
- Ingests
.fountain.fdx.pdf.md.txt. Transition slugs (CUT TO:,SMASH CUT TO:) become shot boundaries. - Every parse returns a
script_idderived from the text plusparse_warnings. A poor parse explains itself instead of presenting as success.
- Validated, not trusted. Descriptions are checked for filler, placeholders and at least one concrete noun; vague output gets one targeted retry, then is reported.
- Durable. Profiles live in SQLite keyed by
script_id; hand edits survive re-upload and restart. Large casts are inferred in concurrent batches; frames are prompted only with the characters in the scene.
Optics that are computed, not decorative
Twelve master DoP presets, a manual matrix, and a viewfinder that does the sensor maths for real.
27.99× 11.71 mm
Extraction for 2.39:1 on an ALEXA 35. Largest frame that fits the gate.
0
Gate used, width-limited. Switch to 4:3 and it becomes height-limited at 91.6%.
4608× 1928
Delivered resolution: DCI 4K, 6.07 µm photosites.
0
Horizontal angle of view at 35mm from
2·atan(w / 2f). Not a lookup table.- Depth of field from the circle of confusion,
c = f² / (N · s), rendered as a livebackdrop-filterblur mask. T2.8 at 3.00 m: 2.67–3.42 m. - Presets carry Kelvin, key-to-fill ratio and film-stock LUT: Deakins 35mm T2.8 5600K Vision3 500T; Fincher 28mm T2.0 4300K bleach bypass.
- Per-camera overrides and saved custom presets. The compiled prompt on screen is exactly what is sent to Gemini image generation.
Gemini for judgement. ADK for agents. Cloud Run for everything.
Cloud Run
One service, one origin
- FastAPI + React SPA in one image,
europe-west4,max-instances=1: one SQLite writer - Litestream ships the WAL to
gs://cinespine-spine-dbevery 1s, hourly snapshots; a revision restores before uvicorn starts CINESPINE_RESTORE_GENERATIONpins the restore for recovery; Secret Manager holds keys, read by thecinespine-runSA only- Second service: self-hosted
mcp-clickhouse, scale-to-zero
Gemini · google-genai SDK
Semantic work, routed by cost
- Character inference, screenplay breakdown, DoP prompt compilation, Wrap Rescue memo
llm_router: 4-model fallback on 404 / 429 / 503, cache by prompt hash- Ingestion parsers call Document AI, Speech, Video Intelligence for scans, audio and footage
- Flash for trivial tasks, Pro only when context demands; Vertex AI via
GOOGLE_GENAI_USE_VERTEXAI
Google ADK
Two agents, both traced
- Wrap Rescue Agent: queries ClickHouse over MCP, ranks blockers, writes requirements + audit event, drafts handoff memo
- Assistant Editor Queue Agent: balances clean scenes across assistants for one day or all days
- Every
generate_contentandexecute_toolis an OTel GenAI span
Cloud Storage
Archival & durability
- Screenplay PDFs and media archived with
google-cloud-storage - Point-in-time restore of the spine:
litestream restore -timestamp … GET /api/productions/{id}/status: done, running, blocking, left, missing, in one call- Runs without any of it: every integration degrades gracefully and the UI says so
cinespine.curiobox.es--timeout=3600 for SSE--memory=2Gi
Every place a model is used, and where it is not
ClickHouse is the agent's operational memory
The Wrap Rescue Agent does not guess what is blocking wrap. It asks the database, through the official mcp-clickhouse server.
-- mcp-clickhouse · run_select_query SELECT requirement_id, priority, assigned_to, dateDiff('hour', created_at, now()) AS age_h, acknowledged_at IS NULL AS never_opened FROM cinespine.requirement_events FINAL WHERE production_id = 'DEMO_PRODUCTION' AND status = 'blocked' ORDER BY priority, age_h DESC
- Projections, not a second source of truth. Every mutation route mirrors into six tables:
production_events,takes_meta,audit_discrepancies,requirement_events,editorial_tag_events,user_activity.FINALfor current state. - Agent loop:
list_tables→run_select_query→ rank blockers by severity, age and missing acknowledgement → file a requirement per blocker, assigned to the owning department → audit event. The memo is delivered: a notification from@wrap_rescue_agentto whoever ran it plus the director, producers and post supervisors. - Same mirror, read three ways. Analytics panels, the crew workload ledger and the ranked status endpoint are all ClickHouse queries; the operational SQLite never answers a whole-production question.
- Honest failure. An MCP error is a 200 with an error body; the client checks
isErrorand shows the failed call. The memo walks the Gemini chain (live:gemini-2.5-flash404,gemini-3.5-flashdrafted) and says so when every model fails.
@dit and @sound_supervisor.
Production health, read straight from ClickHouse
A dashboard a line producer can read: what the audit found, who has filed, what was shot, what is blocked, who is looking.
grafana_ro user · variable per production.Five sections
- Continuity: open CRITICAL / WARNING, findings by type
- Ingestion: documents per department, minutes since last filing
- Takes: per shoot day; post-production stage per scene
- Requirements: by status × priority; blocked, oldest first
- Engagement: actions/hour; median time-to-acknowledge
Signals shipped
- Traces, logs, metrics over OTLP HTTP; logs stamped with
trace_id - Business metrics as OTel instruments (
cinespine_*): discrepancies by severity, events by axis, live SSE connections - Faro RUM from the SPA; Synthetic checks on
/api/healthdeep probe
SLO · backend availabilitySLO · Wrap Rescue run successAlert · telemetry silent 20m
One screen proves the agent did what it says
A Wrap Rescue run is a span tree: ADK → mcp-clickhouse → ClickHouse → Gemini. Runs, MCP tool calls, p95, tokens by model, active discrepancies, on one dashboard.
Pipeline spans we wrote
cinespine.ingest·cinespine.parse·cinespine.reconcile(each unresolved finding as a span event)cinespine.mirror.insert·cinespine.mcp.tool·cinespine.agent.*
0.00s
GenAI instrumentation init. Was ~34s with OpenLIT.
0 → 3gauge
Active discrepancies read 0 for weeks: keyed by
str(enum), so Severity.WARNING matched nothing. Fixed 9 Sep; the test now feeds enums.0silent traces
Cloud Run forwards an unsampled
traceparent; the sampler now keeps sampling under it, so curl, probes and agent triggers trace too.