[jamiesun]

Problem and behavior

Agents could promote mixed concept boards into canonical character references and compose shots without a clear reference-authoring workflow. Add versioned MCP instructions/prompts/resources and a tools-only fallback, typed face/body/prop/scene/storyboard materials, per-item visual review, pinned source lineage, exact generation-input packets and external actual-use evidence. Strict projects enforce the same rules through domain, REST, MCP and UI; existing projects and immutable revisions remain readable.

Add the reference-authoring workbench with independent tile/original previews, review/history, source impact, input inspection and draft recovery. V2 interchange preserves material dependencies and storyboard baselines and rejects lossy v1 overwrites. No generation or rendering runtime is introduced.

Use https://vflow.talkincode.net as the canonical website and /mcp endpoint. Retain the old hostname as a compatibility alias on the same Worker/D1/R2; OAuth discovery derives endpoints from the requested origin. Preserve the already-deployed OAuth, candidate-material and preview fixes that had not yet been committed.

Data and rollout

Migration 0003_reference_authoring.sql adds reference document/evidence tables without rewriting projects, media or timelines. Existing OAuth migration 0002 remains intact. Apply schema before Worker promotion, preserve dashboard vars, and verify Access/OAuth, authenticated UI, input guidance and existing composition readback after deployment. Old data does not become automatically visually approved.

Validation

• npm run typecheck and npm run lint
• npm test: 49 checks across 15 suites
• npm run test:browser: 17 Chromium checks, including decoded original images, strict reference approval/input previews, read-only access and failed/unsaved draft recovery
• Synthetic migration coverage preserves all 31 main shots / 5316 frames and 32 B-roll / 4800 frames, bindings and selected outputs
• Both vflow and legacy origins tested for OAuth discovery and Bearer challenges
• Worker dry run and additive production D1 migration completed before promotion

Closes #1.