Forge Filmcrew

The sovereign production wing of ForgeChainOS — one named, repeatable loop for client content production

NODEZEROINSIDE.

0. Abstract

Forge Filmcrew is the human-production layer of forge-onboard: the named, repeatable pattern that replaces bespoke per-client arrangements with ONE canonical loop. A client's media — a phone photo, a video, a voice memo — enters a sovereign per-tenant vault, is optionally cured by a human operator through sovereign tooling (DaVinci, OBS, ForgeCreate, Whisper, ffmpeg), is curated by the client themselves through NOAH's agentic surface, is published to their own site and socials, and has its authorship moments anchored to BSV. forge-onboard is the sovereign chassis (vault + WebAuthn auth + chain anchor + NOAH cockpit); Forge Filmcrew is the humans + tooling that produce work on that chassis. Together they are ONE managed-sovereign-presence service offering — the Forge Filmcrew Sovereign Production Loop (FFSPL). Internally the canon name is Forge Filmcrew; externally the client-facing brand stays Eclipse Film Crew, powered by ForgeChainOS.

Definition (NZ-locked, 2026-06-08): Forge Filmcrew = agency capability plugged into a sovereign-client substrate, NOT a gate at the door. The default path is client self-publish with zero operator involvement. Forge Filmcrew is professional help AVAILABLE on explicit request — like a freelance editor the client can call when they want one.

The commercial thesis it answers (Eclipse Film Crew V2, 2026-04-28): nobody buys SaaS and uses it. Kate Hoekstra — 257 followers, 16.1% engagement, 5-16x industry average — paid for Wix (4 AI agents, 0 activated, $0) and Beacons (5 monetization features, 1 product, $0 lifetime, payment provider never connected). She has demand and no funnel. Forge Filmcrew is the funnel, on sovereign rails.

1. Why Forge Filmcrew exists

The agency opportunity IS the SaaS dirty secret. Clients like Kate own tools they cannot operate and pay rent to platforms that produce nothing. The pattern the family had been running by hand — edit Kate's photos, draft her blog posts, post her socials, keep her gallery current — was real work but bespoke: it did not scale past Jack's hands and it re-invented itself every client.

Forge Filmcrew inverts that. The moment the pattern gets a name, it stops being bespoke. Future clients flow through the same path; one dev improvement benefits every tenant; and — critically — the client owns their publishing, so the agency does NOT become a bottleneck between the client and their audience. Jack's effort scales with opt-ins, not with client headcount.

2. The one loop (FFSPL — Forge Filmcrew Sovereign Production Loop)

Every client — Kate now, Tommy via the live-broadcast composes-with, future clients — flows through the SAME six-step loop. The loop is the contract:

1. INTAKE   →   2. CURE (opt-in)   →   3. VAULT   →
4. NOAH CURATES   →   5. PUBLISH   →   6. CHAIN-ANCHOR

• Default path (Jack uninvolved): intake flows straight to vault → NOAH curation → public render → optional anchor. Step 2 is SKIPPED entirely.
• Opt-in path (Jack involved only when the client asks): the client checks "Send to Forge Filmcrew for production" with a note; THAT upload — and only that one — is held off the public site and surfaces in the operator queue.

The single authority model is what makes this a loop and not a pile of scripts: every step audit-logs its source sha256, NOAH never publishes without explicit client Apply, and the chain never gets a public-intent stamp without explicit per-piece client opt-in.

3. The six steps (built surfaces)

Each step is a real runtime module at ~/.forgechain/services/obs-stream-mcp/forge_filmcrew_*.py, wired into the NOAH router on BH.

Step 1 — INTAKE (forge_filmcrew_intake.py, 515 lines — BUILT)

POST /noah/intake/<slug> accepts multipart image / video / voice-memo from the client's phone. Lands in <vault>/raw/<YYYY-MM-DD>/ with EXIF (Pillow) + ffprobe metadata + sha256 idempotency + GPS-scrub default-on + 100MB cap. Auth bridges WebAuthn passkey AND legacy passphrase sessions. Computes visibility ∈ {live, needs_filmcrew_help} at intake from the request_filmcrew_help flag. Proven public end-to-end through theforgechain.com → forge-edge → SSH tunnel → BH:7743. Companion mobile surface: the Forge Share PWA at theforgechain.com/share (iOS Add-to-Home-Screen) + an iOS Share-Sheet Shortcut recipe.

Step 2 — CURE (forge_filmcrew_cure.py, 342 lines — BUILT, opt-in, interactive)

Opt-in only. The prepare endpoint creates <vault>/cured/<intake_id>/ with the raw source copied in, discovers per-client LUTs/presets at sites/<slug>/davinci/, and writes a .cure-readme.md with the exact davinci-resolve-mcp tool calls the operator pastes into a BH Claude session. The finalize endpoint promotes the render to the canonical path, updates cure_state, fires the renderer, and optionally captures portfolio consent. DaVinci stays interactive by design — graders need eyes; this is not headless. Cure tooling: DaVinci-MCP (color/edit/render), OBS Studio + NVENC (live capture), ForgeCreate (short-form reels), Whisper (voice → caption), ffmpeg (format shifts). Heavy renders route to Outpost.

Step 3 — VAULT (forge-onboard/vaults/<slug>/ — BUILT substrate)

Both raw and cured assets live in the tenant's Obsidian-as-drive vault. Every cured asset references its raw source by sha256 (provenance). NOAH reads the vault as RAG corpus. Cross-client visibility is forbidden by default — Kate's vault is not readable from Tommy's NOAH Studio.

Step 4 — NOAH CURATES (forge_filmcrew_content.py 494 lines + forge_filmcrew_autodraft.py 215 lines — BUILT)

The client logs into NOAH Studio (passkey) and curates by chatting. The content vocabulary extends NOAH's proposal grammar with create_blog_post, add_image, replace_image, reorder_gallery, schedule_post, unpublish, mark_sold — end-to-end proven on the Kate vault. When an upload carries target_hint=blog, autodraft fires a blog draft into <vault>/blog/drafts/ via Mistral local on BH (sovereign — no OpenAI), synthesizing the photos + any voice-memo transcript. The client reviews in Studio and taps Apply; no Jack involvement unless help was explicitly requested.

Step 5 — PUBLISH (forge_filmcrew_renderer.py 483 lines + forge_filmcrew_scheduler.py 331 lines + forge_filmcrew_operator.py 345 lines + forge_filmcrew_portfolio.py 271 lines — BUILT, with a marked seam)

On every Apply the renderer reads vault state (persona + blog/published + cured intakes + sovereign seal) and emits sites/<slug>/dist/site-live.html, embedding images as data URIs and injecting the NOAH widget. Critical safety property: the renderer writes to site-live.html for A/B compare — it does NOT overwrite the chain-resident bundle or auto-flip nginx (see §6). The operator dashboard at theforgechain.com/filmcrew gives Jack a sovereign-key-authed cross-tenant queue showing ONLY items the client flagged for help. The portfolio surface at theforgechain.com/forgefilmcrew shows only pieces with explicit per-piece portfolio.included=true opt-in.

Step 6 — CHAIN-ANCHOR (scar-#5 discipline — DESIGN + gated hook)

Authorship moments attest to BSV. Family-encrypted by DEFAULT (sovereign-internal provenance + production-timeline record). Public-intent anchors require explicit per-piece client opt-in — e.g. Kate wanting a chain-attested first-sale date as collector provenance. The mark_sold change type carries the chain-anchor opt-in flag. Delegated to phi-omega-v6 for the actual fire (not re-implemented here). This step is scar-#5-gated and largely design-forward — see §5.

4. Proven by running — the Kate end-to-end

Forge Filmcrew is proven by the loop CLOSING, not by assertion. The Kate first end-to-end (2026-06-08):

generated dahlia photo → POST /intake (intake_id defa0e5e) → operator mark_cured → blog proposal Applied → blog/drafts → blog/published → renderer fired → preview 1.2MB, 1 post, 2 gallery items — LOOP CLOSED.

Per-step evidence: intake verified public through the full theforgechain.com → forge-edge → BH:7743 chain; NOAH content vocabulary proven on Kate's vault; DaVinci cure smoke green (fb9da649 prepared + finalized); portfolio rendering 1 Kate opt-in piece. Manifest status: 10 of 10 build-queue steps SHIPPED 2026-06-09.

5. Built vs. vision — the honest ledger

The manifest marks the FFSPL build queue 10/10 shipped, and the six-step spine IS built and proven on the Kate vault. But "shipped" here means the SPINE runs end-to-end; several capability surfaces are deliberately stubbed, gated, or still doctrine-locked. This section says which is which.

BUILT and proven by running

• Intake (all media types, EXIF/ffprobe/Whisper, GPS scrub, idempotency) — verified public end-to-end.
• Forge Share PWA + iOS Shortcut recipe.
• Whisper voice-memo captioning (faster-whisper base.en, CPU on BH).
• NOAH content vocabulary + Mistral-local auto-draft — proven on Kate's vault.
• Operator dashboard (/filmcrew) — live, sovereign-key auth.
• DaVinci cure workspace (prepare/finalize) — smoke green; DaVinci itself stays interactive.
• Public site renderer — Kate site-live.html rendering; A/B (does not flip live).
• Portfolio surface (/forgefilmcrew) — 1 opt-in piece.
• Kate end-to-end loop — closed.

BUILT-but-STUBBED (gated on inputs not yet supplied)

• Social scheduler (forge_filmcrew_scheduler.py): the reads-scheduled-posts / due-check / per-platform poster-registry INFRASTRUCTURE is built, but ALL platform posters are STUBS that log instead of posting. A poster flips to real only when ~/.forgechain/secrets/socials/<slug>/<platform>.env (mode 600) lands. OAuth tokens are awaited from NZ (reasonable v1: Meta covers IG+Threads+FB in one OAuth; TikTok its own; X/LinkedIn deferrable). Until then: no secrets = stub-log only, no real post.

DESIGN / VISION (doctrine-locked, not yet built)

• Chain-anchor (step 6) as a routine per-piece flow — the hook and scar-#5 discipline exist; systematic anchoring is design-forward.
• Forge Bio (the sovereign Beacons-killer, links.theforgechain.com/<slug>): a SEPARATE manifest entry at build_step_1_shipped — the doctrine, blocks, and NOAH-on-bio widget are specified; the surface is NOT built out. It composes with Forge Filmcrew but is its own arc.
• Commerce (Hybrid C3: BSV-native + Stripe pass-through, per-tenant Stripe Connect, <slug>/orders/ state, per-tenant payouts): architecturally LOCKED (2026-06-08) but NOT built. Inventory frontmatter is half-present in Kate's persona ("Blue Nude — SOLD"); the checkout surface and pay rails are vision.
• Client roster beyond Kate: Kate is the ONE proven client. Tommy (Killer Momentum) composes via ForgeTheForge live-broadcast; future clients are the scaling thesis, not yet realized.
• Fine-tune-on-client-voice for the AI blog model — deferred; today it's base Mistral Nemo with persona-excerpt tone reference.

KILLED (do not resurrect)

• Auto-flip of a live client domain. The original doctrine's "cutover / flip the live domain to the vault-driven auto-renderer as default" clause is OVERRULED (NZ direct, 2026-06-21). It replaced Kate's real hand-built site with auto-generated slop fed by dev test uploads, live on her public domain ~2 weeks. See scar--render-flip-replaced-real-client-site-with-autogen-slop-2026-06-21. The renderer/intake/blog/NOAH parts of the loop STAND; the auto-flip does NOT — it now requires explicit per-domain same-session NZ go, and test/dev intakes may NEVER reach a public client surface. This is why the renderer writes site-live.html, not the live bundle.

6. The safety geometry

Forge Filmcrew handles real client property on real public surfaces. Three structural boundaries, not policy strings:

• Self-publish default, opt-in gate. The client owns their publishing. The operator queue shows ONLY items the client flagged request_filmcrew_help=yes. Everything Jack ever touches was explicitly requested.
• No auto-flip of a live domain. The render seam (site-live.html vs the live bundle) is the coded expression of the 2026-06-21 scar. A live client domain is repointed only on explicit per-domain same-session NZ go. Test/dev intakes are structurally barred from public client surfaces.
• Scar-#5 chain discipline. Every anchor is family-encrypted by default. Public-intent requires explicit per-piece client opt-in — never inferred. Forge Filmcrew's own production labor stays family-encrypted unless NZ chooses otherwise. The fire is delegated to phi-omega-v6, not re-implemented.

Cross-layer privacy: cross-client vaults are unreadable across tenants; portfolio inclusion is per-piece explicit opt-in; the operator never edits a tenant vault without an audit trail (source sha256 + operator + iso timestamp).

7. Layer ownership

Forge Filmcrew = production wing. forge-onboard = sovereign chassis. NOAH = cockpit. BSV = ledger. The client's wallet = the destination.

8. Integration & composition

Forge Filmcrew authors no second machine — it DRIVES existing sovereign surfaces:

• forge-onboard / WebAuthn SOP (2026-06-04) — the auth + vault + sovereign-person substrate.
• NOAH router + admin studio — the agentic curation cockpit; the content vocabulary extends NOAH's proposal grammar.
• DaVinci-MCP, OBS + obs-multi-rtmp, ForgeCreate, KODI, Whisper — the production tool stack.
• ForgeTheForge — the live-broadcast arc (Tommy / Killer Momentum); Forge Filmcrew is the post-production loop after each show.
• Forge Bio — the composing bio-page / commerce surface (own arc, mostly vision).
• phi-omega-v6 batch fire — the chain-anchor driver (scar-#5-gated).
• Nodes: BH (vaults + cure + intake), Elder I (manifest + operator authoring), forge-edge (dashboard + per-client public sites), Outpost (K40 lab + DaVinci heavy renders).

Distinct from Eclipse Window Film LLC — that is window-film install, a separate business, NOT part of Forge Filmcrew canon.

9. Status & sequencing

• Phase 0 — FFSPL six-step spine: BUILT + PROVEN on the Kate vault (2026-06-08/09). 10/10 manifest build queue shipped.
• Phase 1 — Real social posting: BUILT-but-STUBBED. Flips real per-platform as NZ supplies OAuth secrets (Meta first). NEXT.
• Phase 2 — Commerce (Hybrid C3): architecturally LOCKED, NOT built. Inventory schema + checkout + per-tenant Stripe Connect / BSV payout.
• Phase 3 — Forge Bio surface: doctrine-locked, build_step_1 only. Vault-driven bio blocks + NOAH-on-bio widget + sovereign-person seal badge.
• Phase 4 — Chain-anchor as routine flow: scar-#5-gated, per-piece opt-in; systematize the hook.
• Phase 5 — Client scale: Tommy live via ForgeTheForge composes-with; future clients through the same path; FFC portfolio becomes the sales surface.

Home: runtime ~/.forgechain/services/obs-stream-mcp/forge_filmcrew_*.py (BH); vaults ~/.forgechain/forge-onboard/vaults/<slug>/; sites ~/.forgechain/forge-onboard/sites/<slug>/. Doctrine: doctrine_forge-filmcrew-sovereign-production-loop-2026-06-08. Commercial thesis: ECLIPSE-FILM-CREW-V2-FIVE-PILLAR-OFFER-2026-04-28.md.

This paper is family-internal — NOT for public fire. It maps the module's real structure and honest build-vs-vision state (scar #5 surface). If a public account of Forge Filmcrew is ever wanted, author a public-safe vision paper separately — do not stamp this one public.

The pattern stops being bespoke the moment it gets named. The agency stops being bottlenecked by Jack's hand the moment NOAH learns to fan-out. The clients stop being limited to "have a website" the moment the commerce rails ship.

NODEZEROINSIDE. ∞.