I had a piece I was fairly proud of. It opened the video app in a browser, signed in with my account, slipped the photos in, wrote the request and downloaded the result. Without me touching anything.
To make it work it did three things the page doesn’t offer. It looked for a hidden file selector inside the page to get the photos in. It faked a paste to dodge the system dialog. And it downloaded the video with an internal request, since the download button didn’t work in that profile.
Three workarounds, and each one was the signal. I was reading them as ingenuity.
On 11 August I sat down to audit the project against the rules of the house. The file that tells machines where they can’t go said exactly the opposite of what I was doing: that route is closed to automated access. The terms forbid it on two counts as well, because you can’t use automated means to get around those instructions, nor bypass the page’s protections.
So I retired it. The code stays saved in case it ever needs consulting, but it doesn’t run.
What’s at stake there isn’t a throwaway account. It’s mine, with my email and my photos inside it. And what really gets automated is the route they publish for it, which is the API. The app is still a valid, free path, but with my hands on it: the system lays the material out in order, and I paste and download.
The written rule was worth nothing
This channel has toys in it, not children. That was written into the project instructions from day one, and it was checked by watching the video once it was already made and paid for.
That same day I found two reference photos of the ship with a child’s arm holding the toy. While those photos only lived in a folder it didn’t matter. But since they get attached to the generation, whatever is in the photo ends up in the video.
A rule written in a document is followed by whoever has read it. So I pushed it down into three places where it no longer depends on my memory. A gatekeeper looks at every photo before it’s attached and marks it fit, to be cropped or rejected, so without a verdict it doesn’t go in. It costs nothing. The parameter that blocks generating minors now goes with every request, which before never happened at all. And the reviewer still looks at the result at the end, as always.
Along the way I found I was only using two of the four ways of asking for a video. I was missing exactly the one meant to keep a character identical in a new shot. I fixed that the same day, and it’s what holds up the video below.
What I take away
Neither of the two things was found by the system running. Both turned up when I stopped and read the rules of the place I was working in, with the project green and producing.
And I’m left with a new habit. When something needs a workaround to function, the workaround isn’t the ingenuity: it’s the warning that I’m somewhere I wasn’t invited.