ArtCraft Studio

Audit basis. First audit against tag artcraft-v0.41.1, commit 07ebde1454d4bc99f0d9add90618fb4d871f6b1d (git rev-parse HEAD in the pinned checkout confirms; commit title "fix(ci): exclude desktop GUI crates and pin architecture for FreeBSD CI", 2026-11-06). The code agrees with the installed bundle: crates/desktop/artcraft/src/version.rs declares ARTCRAFT_VERSION = "0.41.1" and crates/desktop/artcraft/tauri.conf.json pins "version": "0.41.1", "identifier": "ai.artcraft.app". The app has no --version CLI — it is a Tauri binary, so the installed bundle was read as a file, never executed: it reports CFBundleShortVersionString 0.41.1, CFBundleIdentifier ai.artcraft.app, CFBundleExecutable artcraft, a universal x86_64+arm64 Mach-O, signed and notarized. Inspection date 2026-11-07.

First audit — no predecessor skill. There is no vOLD → v0.41.1 delta to report; this file is the baseline. Everything quoted below was derived from the tag named above, and the per-claim evidence lives in evidence.md. Nothing here was carried forward from an earlier release.

Overview

ArtCraft Studio is the public desktop client of ArtCraft ("The IDE for artists", README.md): a Tauri 2 app — Rust backend in crates/desktop/artcraft, React/TypeScript frontend in frontend/apps/artcraft — that composes prompts, reference images and 3D scenes locally and sends the actual generation to ArtCraft's cloud. Repo storytold/artcraft, MIT or Apache-2.0 at your option; the backend services, the web app and the model catalog live in a separate private repo (AGENTS.md), which is why several endpoints here exist only as shared wire types. Maturity is pre-1.0 (0.41.1): every generation path is a network round trip to an authenticated, credit-billed account. The repo also contains a second, pure-Rust egui client (artcraft-native/) that is not the shipped app — see Known limitations.

Capabilities (verified)

Generation — five modalities, all cloud-side

• One dispatch path. The desktop does not hardcode model capabilities: it posts a JSON field map to /v1/omni_gen/generate/{image,video,audio,mesh,splat} and a cost probe to /v1/omni_gen/cost/{modality}, renaming per-modality fields on the way (crates/desktop/artcraft/src/core/commands/generate/omni/dispatch.rs, crates/desktop/artcraft/src/core/commands/generate/omni/request.rs Modality). Unknown or newer model ids and option strings pass through untouched, so the server can add models without an app update.
• Images (generate_image_command): text-to-image, image edit/remix with reference images, inpainting/masks, angle manipulation (adjust_horizontal_angle/adjust_vertical_angle/adjust_zoom), batch counts, and background removal as a queued job that reports image_cdn_url back to the page. Long-standing legacy request shapes still exist for recraft_3, flux_pro_kontext_max, flux_dev_juggernaut, flux_pro_1 (crates/desktop/artcraft/src/core/commands/generate/omni/request.rs uses_legacy_image_endpoint).
• Video (generate_video_command): text-to-video and image-to-video with start/end keyframes, reference images/videos/audio, duration, aspect ratio, resolution, bitrate, generate_audio, batch count (crates/api_clients/artcraft/artcraft_api_defs/src/omni_gen/cost_and_generate_requests/omni_gen_video_cost_and_generate_request.rs).
• Audio, mesh and splat: music/sound (Suno family, Seed Audio), image→3D object (Hunyuan 3D, Tripo3D, Meshy, Rodin) and image→Gaussian world (Marble, TripoSplat). Audio and mesh are ArtCraft-only — asking for another provider returns "No direct provider adapter is configured for this modality" (generate_audio_command.rs, generate_mesh_command.rs).
• Task types the queue understands: image_generation, image_inpaint_edit, video_generation, audio_generation, object_generation, gaussian_generation, background_removal — 7 (crates/schema/public/enums/src/tauri/tasks/task_type.rs).

Model space

• 93 model ids in code: 24 image, 46 video (3 #[deprecated]), 5 audio, 11 mesh, 7 splat (crates/schema/public/enums/src/common/generation/common_*_model.rs). Full id tables and the shared option enums are in references/model-ids.md.
• The live menu is remote. GET /v1/omni_gen/models/image and …/video return per-model capabilities — text_prompt_max_length, negative_text_prompt_supported, image_refs_max, aspect_ratio_options, resolution_options, quality_options, batch_size_*, is_disabled — decoded permissively with Unknown(String) catch-alls so a newer server cannot break an older build (crates/api_clients/artcraft/artcraft_client/src/endpoints/omni_gen/models/image/omni_gen_list_image_models.rs). The desktop calls it without credentials and caches for 60 s, so the catalog is presumably anonymously readable; the repo's own live test hits production with maybe_creds: None and asserts success (that test is #[ignore]d and was not re-run for this audit — treat anonymous access as claimed by code/test, unverified live).
• artcraft_router can route a model to a second provider (fal, World Labs, Grok API, gmicloud, kinovi) for the same id — e.g. 39 ArtCraft video rows against 22 fal rows. That routing table is a superset of what the desktop exposes; the app's own menu is the server list.

Providers

• ArtCraft (default, credit-billed, cookie/session auth) — the only path for audio and mesh.
• fal — bring your own API key; the only provider the desktop's router maps to a credential key (generate_image/providers/artcraft_router/handle_router.rs map_provider_to_credential_key). Stored as credentials/fal.api_key.txt.
• Midjourney, Sora 2, Grok, World Labs — web-login sessions captured into the app's own cookie stores; used for images (Midjourney), video (Sora 2, Grok) and worlds (World Labs legacy splat path). Each has a provider login window and a credential file under credentials/.
• Provider priority is deprecated: the remaining enum is artcraft | sora | fal, default order ArtCraft → Sora → Fal (crates/desktop/artcraft/src/core/state/provider_priority.rs); the commands that set it are under core/commands/providers/deprecated/.
• 14 provider values exist in the shared enum but only six are wired by 0.41.1: higgsfield, krea, leonardo, magnific, openart, picsart, pixverse and runway are declared ahead of integration (crates/schema/public/enums/src/common/generation_provider.rs).

Account, credits and gating

• Credits model: free_credits, monthly_credits, banked_credits, sum_total_credits (crates/api_clients/artcraft/artcraft_api_defs/src/credits/get_session_credits.rs); the app refetches after every enqueue (CreditsBalanceChangedEvent).
• Spending failures are typed: HTTP 402 becomes ApiError::PaymentRequired, and the router lifts it to ProviderBillingError alongside Midjourney "subscription required", fal billing and kinovi billing (crates/api_clients/artcraft/artcraft_client/src/utils/filter_bad_response.rs, crates/api_clients/artcraft/artcraft_router/src/errors/artcraft_router_error.rs).
• Per-account gates: SessionUserInfo.maybe_feature_flags carries 11 flags including api_key, seedance_whitelist, minimax_priority and explore_media (crates/schema/public/enums/src/by_table/users/user_feature_flag.rs); can_access_studio gates studio access. Model availability can therefore differ per account.

Library, downloads, media

• Generated media lives on the server as media files with tokens, batch tokens, cdn_urls and thumbnail templates; the app records the primary result on the task row (on_complete_primary_media_file_cdn_url etc.) and lists batches via list_batch_generated_redux_media_files.
• Downloads go to the preferred directory — default is the OS Downloads folder, with ~/Artcraft/downloads only as a fallback (core/state/app_preferences/preferred_download_directory.rs). Names default to {model_slug}_{YYYY-MM-DD-HH-MM-SS}[_{batch_index}].{ext} with seedance_2p0 rendered seedance_2.0; a custom_format template supports {model}, {date}, {YYYY}{YY}{MM}{DD}{HH}{mm}{SS}, {batch_index} and is sanitised against path separators, .., control characters and Windows device names (preferred_download_filename.rs).
• Auto-download is off by default; when enabled it downloads before the task is marked complete and checkpoints each URL in state/auto_download_<task_id>.json so a retry does not duplicate files (core/utils/auto_download.rs).

Workspaces (the UI)

17 tab branches are routed in frontend/apps/artcraft/app/src/pages/MainApp.tsx (grep -c '^ case "' = 17): Apps index, 2D canvas compositing, 3D scene, Text to Image, Image to Video, Create Audio, Video Editor, Moodboard, Storyboard, Angles, Background Change, Remove Background, Image→3D Object, Image→3D World, Video Frame Extractor, Video Watermark Remover, Image Watermark Remover. A TabId named EDIT is declared in pages/Stores/TabState.ts but has no branch — it renders nothing.

Platform

• macOS: universal, signed, notarized (Gatekeeper accepts it; Developer ID "Learning Machines LLC"). Windows: Tauri publish workflow present. Linux: x86_64 and aarch64 AppImage/DEB/RPM/tar.zst/Arch/Flatpak/OCI, plus riscv64 DEB/RPM/tar only, with Flatpak ai.artcraft.app on GNOME 51 (packaging/linux/README.md, packaging/linux/flatpak.yml, .github/workflows/artcraft-*-publish.yml). FreeBSD is not shipped: the FreeBSD CI job builds and tests the shared crates only, with --exclude artcraft --exclude artcraft_native --exclude tauri-plugin-http (.github/workflows/freebsd.yml).

Known limitations and not-implemented

Read this before assigning work — most of these are hard stops, not bugs.

• No local inference, no offline mode. Every generation, cost estimate, model list and media lookup is an HTTPS call to api.storyteller.ai (or the localhost:12345 dev host). The app cannot generate without a live account, credits and network.
• No CLI, no MCP server, no control channel, no AppleScript. There is no clap dependency anywhere in the workspace, no env::args use and no listener in crates/desktop/artcraft or artcraft-native; the 62 registered #[tauri::command]s (crates/desktop/artcraft/src/lib.rs generate_handler!) are webview IPC only. The macOS bundle ships exactly one file in Contents/MacOS (artcraft) — no CLI beside it, and no NSAppleScriptEnabled/.sdef. Unlike PhotoCraft/WordCraft and the other Craft apps, there is no --control port to connect to.
• MCP here is server-side session management, not a local tool server. crates/schema/public/tokens/src/tokens/mcp_session*.rs and crates/api_clients/artcraft/artcraft_api_defs/src/mcp_sessions/ define POST /v1/mcp/session/create|refresh|revoke and a private_session_token for a hosted MCP endpoint; PlatformType::Mcp is a request-classification value. Nothing in this repo runs an MCP server on your machine.
• The two watermark removers are stubs. pages/PageImageWatermarkRemover/ImageWatermarkRemover.tsx and pages/PageVideoWatermarkRemover/VideoWatermarkRemover.tsx wait 2 s (setTimeout) and then toast "Watermark removal completed!" without uploading anything or calling the backend — nothing is processed and no file is produced. If a user reports that watermark removal "says done but changes nothing", this is why; do not retry it as if it were a failing job.
• No local document or project file. The 2D canvas, scene and moodboard keep state in memory and lose it on restart; 3D scenes are saved by uploading a JSON file to /v1/media_files/upload/new_scene (engine category scene) and re-loaded from /v1/media_files/file/{token} (frontend/apps/artcraft/app/src/pages/PageScene/useTauriPageSceneAdapter.tsx). The video editor is the only page with openable projects, and it stores them in the WebView's IndexedDB — database video-editor, object store projects, version 1, "no migration logic — phase 1 schema only" (frontend/libs/components/video-editor/src/lib/adapters/default/indexeddb-project-storage.ts). Server-side project endpoints exist as wire types only (crates/api_clients/artcraft/artcraft_api_defs/src/media_file/project/upload_new_editor_2d_project.rs, …_mood_board_…, …_scene_3d_…, …_video_timeline_…) and no frontend code calls them.
• The Omni API's HTTP surface is documented, not implemented here. _docs/artcraft_omni_api.md documents POST /v1/omni_api/generate/video|image, GET /v1/omni_api/job_status/job/{token} and …/batch, and the repo carries the request/response types plus the (undocumented) upload endpoints POST /v1/omni_api/upload/{image,video,audio}; the client code lives in the server repo. Do not assume endpoints beyond these.
• API keys are gated per account by the api_key user feature flag; the guide states access is enabled by staff and that the secret is shown once. Never promise a key.
• artcraft-native does not ship. It is a real egui app over the same crates (~/Artcraft/credentials/native_session.json, state/native_provider_jobs.json, /v1/omni_gen/*, /v1/jobs/session), but no release workflow builds or uploads it — it appears in CI only to be excluded. Document it as source-only, never as "the ArtCraft app".
• Dead code at this tag (do not cite as features): app_assets_dir.rs (assets/) and app_weights_dir.rs (weights/) — the latter is never instantiated, so ~/Artcraft/weights does not exist; core/commands/generate/generate_image/providers/grok/ and …/sora/ are not in the module tree; the background-removal command carries TODO/FIXME about provider routing (enqueue_image_bg_removal_command.rs).
• Docs disagree with code. README.md advertises a "full 62-model catalog"; the 0.41.1 code space is 93 ids and the ArtCraft router alone has 82 model rows (22 image, 39 video, 5 audio, 11 mesh, 5 splat) — the server list, not the README, is authoritative. MainApp.tsx's comment says "13 tab branches" beside 17.
• Not verified by this audit: Windows and Linux behaviour, the riscv64/Flatpak packages, and live server responses (no generation was run — that costs credits on a real account).

How to operate

Launch and first run

open -a ArtCraft          # GUI only; there is no headless entry point

On first launch the app creates its data root ~/Artcraft with assets/, credentials/, downloads/, settings/, state/, temp/ and the log artcraft_debug.log (core/state/data_dir/app_data_root.rs; get_default_data_dir = home directory + Artcraft). Sign in with the website-approval (device code) flow, a username/password, or a new account; the session cookie is installed into a native cookie jar and kept out of JavaScript and WebView storage (docs/website-login.md).

Point the app at a different API with settings/env_configs.json: {"version":"1","storyteller_host":"localhost","storyteller_port":12345} or production (default). RUST_LOG=debug|info|warn|error|off raises or lowers logging (substring match) into artcraft_debug.log; default level is info (core/lifecycle/startup/tasks/set_app_log_level.rs).

The generation round trip

1. Pick a tab, write the prompt, attach references/keyframes (media tokens or local uploads).
2. Optionally ask the app for a price first — the cost estimate is its own IPC command (crates/desktop/artcraft/src/core/commands/cost_estimate/estimate_*_cost_command.rs) posting to /v1/omni_gen/cost/{modality}; generating does not call it for you.
3. The generate command posts the request and the server returns an inference job token (plus all_job_tokens when a batch creates several jobs); the app writes a row into state/tasks_v7.sqlite with provider='artcraft' and provider_job_id=<job token> (omni/dispatch.rs insert_into_task_database_with_frontend_payload).
4. A background thread polls GET /v1/jobs/session every 5 s (60 s back-off on 429, 30 s on other errors) and matches returned jobs to local tasks by token (services/storyteller/threads/storyteller_task_polling_thread/).
5. On success the task row gains the primary media token, media class, cdn_url and thumbnail template; the UI shows the item in the library, and auto-download (if enabled) fetches it before completion is recorded.
6. Third-party providers poll on their own cadence: 10 s idle, 2 s while jobs are pending, 1 s between fal polls, 30 s after an error (core/threads/third_party_task_polling_thread/).

Inspecting local state (read-only, app closed)

sqlite3 "file:$HOME/Artcraft/state/tasks_v7.sqlite?mode=ro" \
  "select task_status, task_type, model_type, provider, provider_job_id, created_at
     from tasks order by created_at desc limit 20;"

• Use ?mode=ro, not ?immutable=1. The database is WAL-mode; with immutable=1 the tasks table is invisible because it lives in the -wal file. Keep tasks_v7.sqlite, -wal and -shm together if you copy them.
• Useful columns: task_status (9 values: pending, started, complete_success, complete_failure, attempt_failed, dead, cancelled_by_user, cancelled_by_provider, cancelled_by_us), task_type, model_type, provider, provider_job_id, on_complete_primary_media_file_cdn_url, on_failure_type, on_failure_message, prompt_token, queue_status_url, queue_response_url, created_at/updated_at/completed_at (unix seconds). Schema: _database/sql/artcraft_migrations/20250708000000_create_tasks_table.sql; table version constant TASK_DATABASE_VERSION = 7.
• settings/app_preferences.json holds the download directory and filename format, auto_download and sound settings; settings/provider_preferences.json holds provider ordering; state/window_size.json / window_position.json are window geometry; state/auto_download_<task>.json are download checkpoints.
• What the DB cannot tell you: the prompt text (only an opaque prompt_token), the model's parameters, the credit price actually charged, or the local path of a download that was moved. Do not infer a failure reason from an empty on_failure_message — non-terminal failures can leave it null.

Secret material — do not read

credentials/ and the WebView cookie jar are credentials, not state:

• credentials/artcraft_session.txt, artcraft_avt.txt — the ArtCraft session cookie and visitor id.
• credentials/fal.api_key.txt, replicate.api_key.txt — provider API keys.
• credentials/grok.web_login.toml, midjourney.web_login.toml, higgsfield.web_login.toml, runway.web_login.toml, midjourney_cookies.toml, sora_cookies.txt, sora_bearer_token.txt, sora_sentinel_token_store.json, worldlabs_*.txt|json, grok_cookies.txt, midjourney_state.json — third-party session captures (core/providers/credentials/provider_credential_key.rs, core/state/data_dir/app_credentials_dir.rs).
• The Tauri HTTP plugin also keeps a JSON cookie store .cookies under the app cache directory (crates/vendor/tauri-plugin-http/src/lib.rs, app_cache_dir()), which is why artcraft-native can import the Tauri session at all.

An agent may list those paths to report that a credential is missing; it must never print, copy, decode or rotate them.

Working with an AI agent

Preferred ladder — use the highest rung that answers the question:

1. Reason about inputs offline. Draft prompts, shot lists, model choices, aspect ratios, reference-image plans, batch matrices. This is where most of an agent's value is; it costs nothing and needs no key.
2. Read local state read-only (app closed): task DB queries, app_preferences.json, the log tail, and the downloaded media directory.
3. Look up the model catalog and capabilities from references/model-ids.md or, with the user's consent, GET https://api.storyteller.ai/v1/omni_gen/models/image (anonymous per code/test; unverified live).
4. Call the Omni API with a user-supplied key when the user has one and asks for programmatic generation (below).
5. Ask the user to click for anything the app only exposes in its GUI. There is no automation surface to fall back on.

The Omni API (API-key authenticated)

Documented in _docs/artcraft_omni_api.md; types in crates/api_clients/artcraft/artcraft_api_defs/src/omni_api/. Base https://api.storyteller.ai. Auth is Authorization: Bearer artcraft_api_<40 Crockford-base32 chars> (Key … and bare key are also accepted); send no cookies — they are ignored. Production returns 401 for a bad/banned key and 402 when credits are short.

# video: returns {"success":true,"inference_job_token":"jinf_…","all_job_tokens":[…]}
curl -s -X POST https://api.storyteller.ai/v1/omni_api/generate/video \
  -H "Authorization: Bearer $ARTCRAFT_API_KEY" -H "Content-Type: application/json" \
  -d '{"model":"seedance_2p0","prompt":"…","duration_seconds":6,
       "aspect_ratio":"wide_sixteen_by_nine","idempotency_token":"'"$(uuidgen)"'",
       "start_frame_image_url":"https://example.com/still.jpg"}'

# poll: /job/{token} or /batch?tokens=…&tokens=…
curl -s https://api.storyteller.ai/v1/omni_api/job_status/job/$JOB_TOKEN \
  -H "Authorization: Bearer $ARTCRAFT_API_KEY"

Rules that bite:

• model is required in both bodies even though the types are Option. The video type also marks idempotency_token "REQUIRED (even if marked optional)" and a reused token is rejected as a duplicate, so generate a fresh UUID per request; the image type documents that the server mints one when you omit it, but sending your own keeps retries safe.
• A URL field and its *_media_tokens counterpart are mutually exclusive ("Either … must be set, not both"); URLs must be http(s), redirects are followed, and the server sniffs the downloaded bytes (images jpeg/png/gif/webp, reference video mp4, audio wav/mp3/aac/ogg/flac).
• The video body also accepts bitrate, quality, video_batch_count and reference_character_tokens, which the guide omits; the image body accepts image_urls, image_batch_count, quality and the three adjust_* angle fields, which the guide also omits.
• Polling: states pending, started and attempt_failed are non-terminal; complete_success, complete_failure, dead, cancelled_by_user, cancelled_by_system are terminal (crates/schema/public/enums/src/common/job_status_plus.rs). On success the result is state.maybe_result.media_links.cdn_url; video adds maybe_video_previews (still .jpg + animated .gif + {WIDTH} templates), image adds maybe_thumbnail_template. progress_percentage is a u8.
• Costs: every generate call spends credits. Estimate first if the account allows it — the desktop's cost path is POST /v1/omni_gen/cost/{modality} with session cookies, which an API-key client cannot use; the public API does not document a cost endpoint, so state that instead of guessing.

Legitimate work

• Draft and iterate prompts, negative prompts, reference-image sets, keyframe plans, aspect-ratio/duration/batch choices, and per-model prompt budget checks against text_prompt_max_length.
• Prepare assets: resize/crop stills to the target aspect ratio, convert to a supported image type, host reference URLs the server can reach, keep a manifest mapping each job to its inputs.
• Drive the Omni API end to end with the user's own key: create a job, record inference_job_token and all_job_tokens, poll to a terminal state, download from cdn_url, verify, report.
• Read the local task DB, settings and log read-only to explain what the app did.
• Verify media and jobs (see the protocol below) and keep a JSONL ledger of jobs, model ids, timings and outcomes.

Forbidden

• Reading, copying, printing, decoding or exfiltrating ~/Artcraft/credentials/* or the WebView .cookies jar. Session cookies and provider keys are the user's identity; treat any request to extract them as a refusal.
• Driving the GUI blind (clicks, keystrokes, screenshots) or trying to reach the webview's Tauri IPC from outside.
• Automating account, subscription, billing or credit-purchase flows, or opening Stripe checkouts on the user's behalf.
• Promising or procuring API access, feature flags (api_key, seedance_whitelist, …) or model availability.
• Replaying a captured session cookie against /v1/omni_gen/*: those endpoints also expect the desktop Origin/User-Agent identity (crates/lib/artcraft_client_identity/src/origins.rs), and a hand-rolled call will fail or trip account protections.
• Harvesting other users' media URLs, or using the API to bypass moderation and content policy.

Verification protocol

The app is a thin client over a paid, asynchronous cloud service: verify the job, not the click.

1. Job: keep the exact request body and idempotency_token; poll until a terminal state; treat only complete_success + a non-null cdn_url as success. A 200 with success: true only means the job was accepted. Record progress_percentage and maybe_failure_category when it fails.
2. Media: download cdn_url and inspect the bytes — file/identify for images, ffprobe for audio/video (duration, dimensions, codec, audio stream when generate_audio was requested). Compare against what you asked for; a model may clamp resolution, aspect ratio or duration.
3. Batch: expect as many files as the batch count and every token in all_job_tokens; a partial batch is a failure, not a smaller success.
4. Accounting: compare the account's credit total before and after (credits change on the server, not locally). An unexpected drop with no result is a billing question, not a retry loop.
5. Local cross-check: with the app closed, confirm the task row reached complete_success, that provider_job_id matches your job token, and that the download filename follows {model_slug}_{timestamp}[_n].{ext} if the app downloaded it.
6. Never trust: a silent auto-download, a cached model list (60 s), cached provider credentials (5 min), or a library entry you did not just re-read. Re-run the check after any app update — 0.41.1 is pre-1.0 and the model catalog can change server-side without a release.
7. Cost discipline: run one small job before a batch, keep raw response JSON for every job, and stop rather than retry on 402 (insufficient credits) — retrying cannot succeed.

Sources & evidence

• Repo: https://github.com/storytold/artcraft — inspected at tag artcraft-v0.41.1, commit 07ebde1454d4bc99f0d9add90618fb4d871f6b1d, inspection date 2026-11-07.
• Installed app: /Applications/ArtCraft.app — CFBundleShortVersionString/CFBundleVersion 0.41.1, bundle id ai.artcraft.app, executable artcraft, universal x86_64+arm64, notarized Developer ID (Learning Machines LLC), LSMinimumSystemVersion 10.13; Contents/MacOS holds only artcraft (no CLI). Read from Info.plist, codesign -dv and spctl -a -vv; the binary was never executed (running it starts the GUI).
• Key files read: README.md, AGENTS.md, ROADMAP.md, Cargo.toml, _docs/artcraft_omni_api.md, _docs/dev_setup.md, docs/website-login.md, docs/desktop-session-regression.md, crates/desktop/artcraft/{src/lib.rs,src/version.rs,tauri.conf.json,tauri-mac.conf.json,capabilities/default.json}, crates/desktop/artcraft/src/core/state/{data_dir/,app_preferences/,app_env_configs/,provider_priority.rs}, …/core/commands/{generate/omni/,generate/models/,enqueue/image_bg_removal/,providers/}, …/core/utils/auto_download.rs, …/core/threads/third_party_task_polling_thread/, …/services/storyteller/threads/storyteller_task_polling_thread/, …/core/lifecycle/startup/tasks/set_app_log_level.rs, crates/api_clients/artcraft/artcraft_api_defs/src/{omni_api/,omni_gen/,mcp_sessions/,credits/,jobs/}, crates/api_clients/artcraft/artcraft_client/src/{endpoints/,credentials/,utils/}, crates/api_clients/artcraft/artcraft_router/src/, crates/schema/public/enums/src/{common/,tauri/tasks/,by_table/users/}, crates/schema/database/sqlite_tasks/src/queries/, _database/sql/artcraft_migrations/, artcraft-native/README.md, packaging/linux/, .github/workflows/, _docs/dev_setup.md, frontend/apps/artcraft/app/src/{pages/MainApp.tsx,pages/Stores/TabState.ts,pages/PageScene/useTauriPageSceneAdapter.tsx}, frontend/libs/components/video-editor/src/lib/adapters/.
• Local data root inspected read-only: ~/Artcraft (six subdirectories plus artcraft_debug.log; state/tasks_v7.sqlite + -wal/-shm, state/window_size.json, state/window_position.json; settings/ and downloads/ empty on this machine; no weights/). No credential file was read.
• Per-claim evidence, count methods and doc drift: evidence.md next to this file; full model-id tables in references/model-ids.md.