Let article drafts carry figures and embeds, approved with the article

[egeozin]

What and why

Page bundles, part 1a: the contract. Plan: https://with.md/s/6bxvmfrh

Today a Tin draft is exactly one Markdown file, and every step after it assumes that: the sandbox runner, publication, the approval token, revisions and delivery. On sheepdogs.io, the report's 14 diagrams and its interactive canvas were dropped at the draft step for that reason.

This PR lets an article draft carry its figures and embeds and have them approved with the article. No workflow turns it on yet. Part 1b enables it for content.public_article and content.generate, together with the reader, the Decisions card and the prompts.

The bundle

A draft whose definition declares output.assets may write files into an assets folder next to the article and refer to them from the Markdown:

content/articles/2026-10-05-1a2b3c4d.md
content/articles/2026-10-05-1a2b3c4d.assets/flow.svg      ![How a request flows](./2026-10-05-1a2b3c4d.assets/flow.svg)
content/articles/2026-10-05-1a2b3c4d.assets/field.html    a tin-embed block with src: ./2026-10-05-1a2b3c4d.assets/field.html

• The article declares its assets. Tin keeps exactly the files the Markdown refers to. This also works when Tin recovers a run whose sandbox died, and files nothing refers to are never published.
• Types and limits. SVG and self-contained HTML for now; raster images come with binary support (plan PR 4). Each definition sets its limits, under ceilings of 24 files and 4 MB. Files are capped at 512 KB each.
• Failing well. A missing, oversized or unsafe file is left out with its reason, recorded as dropped_assets on the persist receipt. An unsafe file is an SVG with script, event handlers, foreignObject or outside references. A left-out file never fails the run.

What changed

• page_assets.py (new): the folder rule, reference parsing, types, the SVG safety rule, the definition policy, and the approval binding helpers.
• procedures.py: output.assets is accepted only for article drafts (the content draft and public article validators) and is pinned with the definition. The sandbox context carries the folder and limits.
• sandbox/run_procedure.sh and procedure_app_server.py:
  • Files directly in the folder count as declared outputs. Anything else in the folder (subfolders, symlinks) is discarded with a note rather than failing the run.
  • Runaway limits and the identity/card leak scan apply to assets.
  • Assets are committed with the article, and the recovery path accepts them.
  • --check-assets lets the host refuse an old image before any model call.
  • The agent's instructions name the folder.
• publication.py and code_storage.py:
  • The checkpoint records assets as checksummed files; validation keeps them in the article's folder, at the same revision, with matching types.
  • Publication, retries and reconciliation cover them through the existing files list.
  • A checkpoint without assets serializes exactly as before.
• activities.py: collects the assets at persist, on both the fresh and the recovered path, and rechecks them at publication.
• Approval:
  • The review artifact, and so the token, binds each asset's path and checksum. Drafts without assets leave the key out, so their tokens don't change.
  • approved_article and approved_document carry the verified asset list to delivery, and their guards rebuild the same record.
• Revisions: the revision packet's source.assets lists the saved copy's files, and the revision instruction says to copy the ones it keeps into the run's own folder. compare lists each version's assets.
• Delivery: the wording check from Put approved pages on the site in the site's own format #302 skips tin-embed, tin-video and mermaid blocks, which are figures rather than prose.
• Docs: a contributor invariant in docs/content-review.md.

Rollout

• This PR alone changes nothing for running workflows: no definition declares output.assets yet, and drafts keep their exact contract and tokens.
• The sandbox runner and app server changed, so the Codex templates need a rebuild before part 1b turns the feature on. Finish runs instead of crashing on recoverable checks, and write down how to fail well #298's task-bridge fix is waiting for one too.
• If part 1b ever ran on an old image, the run would stop at --check-assets before buying a model call.

No migration and no Temporal change.

Verification

• tests/test_page_assets.py:
  • Reference parsing and the SVG safety rule.
  • The definition: accepted only for article drafts, limits checked, and the sandbox context carries the folder.
  • End to end on the content draft fixture:
    • The draft refers to a good SVG, an HTML embed, an unsafe SVG and a missing file, and also writes a file nothing refers to.
    • Persist keeps exactly the first two, and records the other two with their reasons.
    • Publication writes only those files.
    • The review artifact binds them, and approved-page delivery re-reads them and refuses one that changed.
  • Runtime: the host passes the folder and limits to the runner, and an image without --check-assets fails before any model call.
  • Revisions: the revision packet carries the approved assets.
  • Checkpoints: a saved checkpoint keeps its assets inside the article's folder, at the same revision, with matching types.
  • Delivery: the wording check skips embed and diagram blocks and keeps ordinary code.
• Full suite: 5,281 passed, 22 skipped against a disposable Postgres. The 2 macOS-only localtime tests fail as on main. ruff, format, lint-imports and dump_catalog.py --check are clean.
• Runner filter: checked by hand against real paths. The repo's runner tests check its text, not its execution.

🤖 Generated with Claude Code