Evolve AI Studio

Problem

Producing a finished multi-format ad or content campaign from a single instruction normally means separately directing the creative concept, generating each shot, checking every generated asset against usage-rights and licensing constraints, tracking a budget across LLM calls, and manually assembling the results into deliverables at each target aspect ratio. There was no single system that took one campaign brief in and produced a fully provenance-tracked, licensing-safe, multi-format export out, with every stage auditable and none of it silently skipped. A second, harder constraint shaped the problem from the start: the machine this had to run on has no GPU capable of local generation, so the system couldn't be designed around the assumption that generation infrastructure exists yet, and a failed pipeline stage anywhere in the chain had to be recorded as failed with an explicit error rather than silently skipped or backfilled with a plausible guess, since imputing missing creative output is a worse failure mode than admitting the pipeline stalled.

What was built

Evolve AI Studio takes a raw campaign brief and runs it through a full production pipeline: a moderation check, a Creative Director LLM agent that turns the brief into a validated shot list with camera plans, visual style, music and voice direction, a model router that picks an approved generation model per job type, a license gate that blocks the whole workflow if any selected model isn't cleared for commercial SaaS use, worker jobs that produce the actual media, and an ffmpeg-based assembler that composites captions and exports the finished piece at three aspect ratios. Every asset the system ever writes, including placeholder media, carries a full provenance record (source job, model, model version, seed, prompt) so the production chain can always be reconstructed. Real GPU/API generation workers are intentionally not built; the entire pipeline runs against a frozen worker contract with a mock worker standing in, so the moment real hardware is available, only the worker implementation needs to be swapped in.

Technical approach

The pipeline is coordinated by two arq tasks that never call each other recursively: an idempotent driver (advance_project) that inspects project state and enqueues whatever work is missing, and an executor (run_worker_job) that re-enqueues the driver on completion — this gives per-shot retry without any distributed locking or fan-in coordination. arq's own retry mechanism is disabled (max_tries=1); the actual 3-attempt retry cap is enforced entirely inside run_worker_job, keeping the retry policy in exactly one place after a prior project lost jobs to an implicit Redis DB index mismatch. All Anthropic API access is centralized through a single SpendGate class — nothing else in the codebase may construct an Anthropic client, enforced by a grep-based test — which checks a rolling daily token budget before every call and fails closed with NotConfigured if no API key is present, rather than the pipeline discovering the missing key mid-run. Model selection runs through a pure, IO-free evaluate_workflow() license gate: one model with a bad or missing commercial-use license blocks the entire generation workflow, not just that one asset. The Creative Director agent runs in a fixture mode by default (loads a canned, schema-valid spec, zero tokens spent) and only switches to live Anthropic calls when explicitly configured, and the full test suite runs entirely offline against SQLite with a mocked LLM client. The target machine's ffmpeg build has neither drawtext nor libass, so all burned-in text goes through Pillow-rendered PNG overlays composited via a filter graph instead of native text filters. A 21-agent adversarial review pass found five real defect groups — including an API/worker startup seed race — all fixed with regression tests before the skeleton was called done.

Creative approach

Craft

The system is architected around explicit seams rather than finished surfaces: a tier parameter (draft vs production quality) exists in the model router today but doesn't yet change filtering logic, and the moderation stage is a keyword-blocklist function with a signature designed so a real classifier model can replace it later without the pipeline's calling code changing at all. The public-facing brand name is deliberately kept out of code and templates entirely, living in a single config value, because the working name collides with an existing live Evolve Studio product. The worker contract that every future generation worker must satisfy is versioned and frozen, with its own schema-snapshot test that fails any change that isn't purely additive, so a future real worker can be written against a promise that can't quietly shift underneath it. Every repo-owned resource, database, ports, its own Alembic migration history, is kept fully separate from the other AI-adjacent projects running on the same machine, a deliberate craft decision against the kind of resource collision that has caused real outages elsewhere in the portfolio. Even the project's own operating discipline is treated as a craft surface: a pre-commit voice guard blocks em and en dashes repo-wide, including in the wiki content an automated absorb pass might regenerate, so a documentation update can't silently reintroduce a style violation the human already fixed once.

Reframe

The insight that shaped the whole build was separating 'the pipeline is real' from 'the generation is real.' Every stage that can be fully specified and tested today — moderation, direction, provenance, licensing, routing, assembly — was built completely and adversarially reviewed, while the one stage genuinely blocked on hardware (actual GPU/API media generation) was isolated behind a frozen, versioned contract and a mock worker. That let the entire rest of the system reach a shippable, tested state without waiting on infrastructure that doesn't exist yet, and means the day GPU hardware lands, only one component needs to be written against an already-frozen interface.

Process and what failed

The build reached 'everything done' status across all nine definition-of-done items from the frozen kickoff spec, including two full live end-to-end runs against real Postgres/Redis/arq that produced verified exports at all three target aspect ratios, browser-verified at desktop and mobile widths. A 21-agent adversarial review then surfaced five real defect groups anyway — including a race condition where the API and worker processes seeded the model registry concurrently at startup — all fixed with regression tests in one final commit before the project was deliberately shipped and parked. It stays parked, not launched, because launching it live would require Keychain secrets that haven't been created yet (the house rule is to ask before assuming a key name) and GPU/hosted-API workers the hardware doesn't yet support.

Outcome

The full pipeline is built, tested, and code-reviewed (99 offline tests plus two verified live runs), but the project's own handoff status is explicit: 'SHIPPED and PARKED until GPU hardware. Do not launch.' It has never run in production and has no live users; it exists as a complete, dev-stack-torn-down skeleton waiting on hardware and operator-approved credentials before the real generation workers can be written against the frozen contract. The full build landed in 13 commits against all nine definition-of-done items from the frozen kickoff spec, and the last of those commits is the one that folded in every fix from the 21-agent adversarial review, so the parked state was reached deliberately rather than abandoned mid-build. Two concrete items are named as the explicit blockers to un-parking it: Keychain credential names that are proposed in the project's own decisions doc but not yet created, since the operating rule is to get sign-off before creating a new secret rather than assume a name, and the GPU or hosted-API hardware the worker contract is written against but that doesn't exist on the host yet. The dev stack itself was torn down after the review rather than left running idle, containers removed, with only the database volume kept, so the parked state costs nothing while it waits.