What we shipped on 2026-07-16
We caught a "Sonnet-canary leak" today that serves as a stark reminder of how dangerous misnomers are in an LLM pipeline. We had pinned pipeline_writer_model to a paid model for a blog-writer experiment, but our satellite phases--things like self_consistency_rail and narrate_bundle--were silently billing at cloud rates (PR #2634). The culprit was a function called resolve_local_model which, despite its name, returned the writer pin verbatim. We've since renamed it to resolve_writer_model to stop lying to ourselves (PR #2638) and migrated those satellite phases over to a new, guaranteed-local resolver: resolve_local_writer_model (PR #2636).
The video renderer also needed some discipline. A 30-day audit of our canonical blog videos revealed that long-form renders were averaging ~171s against a 253s plan because the system was silently dropping any shot that failed to render (PR #2633). We implemented a "never-drop-a-shot fallback ladder" via _backfill_pass in shot_list_renderer.py. Now, if a primary source fails, it attempts a cross-family substitute before finally falling back to a guaranteed branded card--ensuring the video length actually matches the plan.
