OG images

T1 starter · marketing / content: one task is the whole media pipeline. Generated images land on disk under a declared boundary — outputs carry paths and sha256 hashes, never image bytes.

​

The job

​

The shape

​

The file

nika: og-images

permits:
  tools: ["nika:image_generate"]
  fs:
    # `check` judges the `output_dir:` ARGUMENT; the RUN gates every FINAL
    # file path under it — the images, their provenance sidecars and
    # manifest.json. `**` covers the directory AND every descendant, so one
    # entry answers both. Granting the bare directory (`out/og`) passes
    # `check` and then dies at run on the first asset: measured, and the
    # reason this comment exists.
    write: ["out/og/**"]

tasks:
  hero:
    invoke:
      tool: "nika:image_generate"
      args:
        provider: mock                # offline + deterministic · flip to local/gemini/openai to render for real
        prompt: "OG hero — a monarch butterfly over a deep-blue nebula, editorial photo, negative space left"
        aspect_ratio: "16:9"          # exact WxH is an openai gpt-image-2 feature · gemini folds to a size class
        n: 2                          # two variants to A/B
        output_dir: "out/og"
        filename_prefix: "launch-hero"
        metadata: { campaign: "launch", page_slug: "home" }

outputs:
  paths: ${{ tasks.hero.output.images }}
  manifest: ${{ tasks.hero.output.manifest_path }}

​

Why it reads like that

• provider: mock first — it renders real, decodable PNGs offline, deterministically, with zero keys: the pipeline is testable in CI as-is. Production is a one-line flip to local (the sovereign path — your LocalAI/Ollama/sd.cpp server, NIKA_IMAGE_LOCAL_URL), gemini (GEMINI_API_KEY), openai (OPENAI_API_KEY) or xai (XAI_API_KEY); keys and the local URL are engine-configured, never workflow args.
• permits.fs.write is the contract — ./assets/og/** is the ONLY place assets may land; a templated output_dir that escapes it fails NIKA-SEC-004 before any byte is written. nika check --infer-permits writes this block for you.
• assets, not blobs — tasks.hero.output.images is a list of { path, filename, width, height, sha256, … } entries, and a *.manifest.json lands beside the files (request echo · hashes · usage · your metadata: fields). Base64 never rides outputs, logs or traces.
• n: 2 for A/B — OpenAI renders n natively; Gemini runs n sequential calls (documented); mock renders n distinct deterministic variants.

​

Run it

nika try og-images                             # offline · mock renders real PNGs
nika new og-images                             # take it · ingredients land beside it
ls assets/og/                                  # variants + the provenance manifest