Photo Analyzer

Integrated, restart-safe photo analysis, duplicate review, metadata, upload, and archive workflow. Planning lives in INTEGRATED_PIPELINE_CONCEPT.md and delivery_backlog/.

Application (photo_pipeline)

The target application lives in photo_pipeline/ (FastAPI + SQLAlchemy + Alembic). Run it with:

python -m photo_pipeline migrate   # apply database migrations
python -m photo_pipeline serve     # start the API + static review UI (127.0.0.1:8000)

Configuration comes from PHOTO_PIPELINE_* environment variables (see photo_pipeline/config.py); secrets are referenced, never logged.

Testing

One offline command runs the whole suite (unit, integration, and browser end-to-end); it needs no network and uses only deterministic synthetic fixtures:

work_item/scripts/python -m pytest tests -q

Browser end-to-end tests require a one-time Playwright browser install:

python -m playwright install chromium

Phase A acceptance gate

Phase A (Epic E01: shared identity, inventory, duplicates, thumbnails, review UI) is gated by a reproducible end-to-end suite:

work_item/scripts/python -m pytest tests/e2e tests/integration -q

• tests/e2e/test_phase_a_pipeline.py launches the real API process against a fresh database and a deterministic fixture library, then drives scan, _IGNORE/ exclusion, move reconciliation, exact/fuzzy duplicate review, thumbnail orientation, canonical selection, browser reload, and a full process restart — asserting durable API and database state after the restart.
• tests/story_traceability.json maps every delivered story to its tests; tests/e2e/test_traceability.py fails if a Phase A story loses coverage or a test file is left unexercised.

Phase B acceptance gate

Phase B (Epic E02: durable jobs, workflow shell, safety/analysis views) is proven through the real process and browser boundaries. One command runs the Phase B API, worker-recovery, and browser (Playwright) suites:

work_item/scripts/python -m pytest tests/e2e -m phase_b -q

• tests/e2e/test_phase_b_pipeline.py launches the real server and durable worker as child processes and drives them only over HTTP/SSE: analysis start/progress, resumable SSE reconnect, the polling fallback, cancellation, per-asset error inspection, one-mutating-job rejection during read-only browsing, the NSFW→vision privacy gate, and durability across a full restart.
• tests/e2e/test_worker_kill.py kills a worker mid-item and proves a fresh worker resumes the fenced job (the "resume" journey).
• tests/e2e/test_analysis_browser.py starts a job from the Analyze view and watches live progress arrive over the browser's real SSE adapter.

The full Phase B regression, including the unchanged Phase A gate, is the whole end-to-end suite:

work_item/scripts/python -m pytest tests/e2e -q

Phase C acceptance gate

Phase C (Epic E03: album evidence, naming policy, versioned proposals, Albums view) is proven through the real process and browser boundaries. One command runs the Phase C API and browser (Playwright) suites with the deterministic naming provider:

work_item/scripts/python -m pytest tests/e2e -m phase_c -q

• tests/e2e/test_phase_c_pipeline.py drives a real server over HTTP: evidence aggregation, generation through the deterministic naming fake (asserting the exact provider inputs and that no file path or asset ID ever reaches it), provider failure and retry, invalid names, path-separator sanitization, editing with optimistic versions, stale-evidence approval refusal, valid approval, and durability across a full restart.
• tests/e2e/test_albums_ui.py covers the browser journeys: evidence display, editing, prompt validation, collision guidance, approval, stale conflict, and keyboard operation.
• Both suites assert that no fixture path changes — Phase C proposes names and never renames.

The deterministic naming provider is enabled only by test configuration (PHOTO_PIPELINE_FAKE_NAMING_LOG); without it the application falls back to the offline naming-policy name. Phase A and B suites remain green in the full run above.

Phase D acceptance gate

Phase D (Epic E04: guarded renaming) is the first phase that changes the library on disk, so its gate is the strictest. One command runs the rename API journeys, the filesystem fault injection, and the browser suite:

work_item/scripts/python -m pytest tests/e2e -m phase_d -q

• tests/e2e/test_phase_d_pipeline.py drives a real server over HTTP: plan and export, confirmation with the plan version and checksum (a stale token is refused without touching disk), a valid apply, the case-only rename procedure, a collision whose occupant survives, a source that changed after planning, and durability across a full restart.
• Fault injection is real. PHOTO_PIPELINE_FAULT_AFTER=<journal state> kills the server process the instant that state is persisted. The suite crashes it at every journal transition in turn (moving, moved, database_updated, verified), starts a fresh process against the same database and library, and requires recovery to converge from journal and disk evidence alone — with the asset set, the stable IDs, and every content hash unchanged. Ambiguous evidence is never guessed: it stays classified manual and keeps blocking. An unresolved rename is the cancellation boundary — there is no cancel once a run starts, and unrelated mutations (album proposal generation and approval) are refused with 409 rename_recovery_required until it is resolved, while reads stay available.
• tests/e2e/test_renames_ui.py covers the browser journeys: preview of every affected path, confirmation carrying the server-issued token, apply with progress and terminal verification, stale confirmation, collision, interruption, recovery, rollback, keyboard confirmation, and the view still matching the journal after a server restart.

The fault barrier is test-only configuration; without PHOTO_PIPELINE_FAULT_AFTER the apply path has no crash points. Phases A–C remain green in the full run above.

Phase E acceptance gate

Phase E (Epic E05: Immich upload) is the one stage the application cannot take back, so its gate runs the fake-uploader suites, the black-box upload API journeys, and the browser suite as a single command:

work_item/scripts/python -m pytest -m phase_e -q

• tests/integration/test_upload_*.py drive a real executable standing in for immich-go through the real adapter and subprocess — argument construction, output bounding, report parsing, verification, and killing a running process.
• tests/e2e/test_phase_e_pipeline.py drives a real server and a real durable worker over HTTP: credential failure and an unreachable server, preflight blockers and the explicitly approved partial scope, a new album, an exact duplicate, an upgrade, a retryable failure and its successful retry, a lost acceptance response, verification against Immich, an inconclusive answer resolved by an operator with evidence, bytes edited after upload, cancellation and resume, and an interrupted attempt recovered across a restart.
• EXIF precedes upload is asserted, not assumed: an album without its verified safety and analysis checkpoints cannot be approved, and the uploader's own argv log proves it was never executed. Each finished upload re-hashes the files in the folder the uploader was handed and requires the persisted SHA-256/SHA-1 to match.
• No secret is retained. The API key is a sentinel string; after a full upload and verification it must appear in the uploader's argv and nowhere else — not in the database, the retained report, or any response the browser can read.
• tests/e2e/test_uploads_ui.py covers the browser journeys (preflight preview, confirmation, progress, stopping a run, verification, manual resolution, stale bytes, and recovery after a restart).

Phases A–D remain green in the full run above.