Best possible solution:

Keep the QA Lab producer wiring and command compatibility, but require credentialed hosted image/video evidence before treating the new scenarios as maturity pass proof.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is QA evidence wiring, not a bug report. The relevant path was traced from the new YAML scenarios through the QA Lab script runner and the hosted media producer.

Is this the best way to solve the issue?

Yes; moving the existing hosted media harness into a QA Lab script producer is the right owner boundary and preserves the existing package script surface. The remaining caveat is operational proof, not a code-shape blocker.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d43366b4e392.

Label justifications:

• P3: This is maintainer-facing QA evidence wiring with limited runtime blast radius and no user-facing product behavior change.
• merge-risk: 🚨 automation: The diff changes QA proof capture and maturity-evidence automation, while credentialed hosted image/video output has not been produced on this PR.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external contributor proof gate does not apply to this maintainer-labeled PR; the body includes local wiring validation and explicitly notes that live hosted media generation was not run.

PR surface:

Tests +391, Config 0, Other +80. Total +471 across 8 files.

What I checked:

• Repository policy read: Root AGENTS.md and the scoped scripts/test guides were read fully; the maintainer-label protected-item rule and script-wrapper guidance apply to this review. (AGENTS.md:24, d43366b4e392)
• Live PR state: Live GitHub metadata shows author RomneyDa, the maintainer label, head 2660d46, MERGEABLE/UNSTABLE state, and no human review comments. (2660d469f106)
• Current main lacks this wiring: Current main still points test:live:media scripts at scripts/test-live-media.ts and has no hosted-media-provider-live runner or hosted image/video scenario IDs. (package.json:1883, d43366b4e392)
• Package command compatibility: The PR preserves the four existing test:live:media script names while retargeting them to the QA Lab hosted-media runner path. (package.json:1883, 2660d469f106)
• Scenario evidence mapping: The added image and video scenarios are script-backed live-only scenarios; the video scenario maps two primary coverage IDs and one secondary coverage ID, and both scenarios allow blocked evidence for missing credentials. (qa/scenarios/media/hosted-video-generation-providers-live.yaml:8, 2660d469f106)
• Producer behavior: The new producer classifies no-auth/no-runnable-provider output as blocked, writes qa-evidence.json plus latest-run.json, and returns nonzero only for fail status. (test/e2e/qa-lab/media/hosted-media-provider-live.ts:710, 2660d469f106)

Likely related people:

• RomneyDa: Authored this PR and recently merged the ClawHub release-candidate QA script producer that uses the same QA Lab producer-evidence pattern. (role: recent adjacent owner; confidence: high; commits: 2660d469f106, 80a3c515fd13; files: test/e2e/qa-lab/media/hosted-media-provider-live.ts, qa/scenarios/media/hosted-video-generation-providers-live.yaml, test/e2e/qa-lab/plugins/clawhub-release-candidate-install.ts)
• vincentkoc: Current-main blame and PR metadata tie the existing live media harness and QA Lab script-runner support to recent merged work by this contributor. (role: current-main area contributor; confidence: medium; commits: c0ee7a1d20f0; files: scripts/test-live-media.ts, extensions/qa-lab/src/test-file-scenario-runner.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.