Quality Control and Compliance: Machine Review, Content Safety, Generated-Content Labeling, and Copyright Boundaries

Making the review judgeable

"Is this shot any good" cannot be judged automatically, because it is not a proposition with a truth value. Machine review always starts by decomposing it into scoreable checks, each satisfying three conditions: a defined thing to measure, a defined threshold, and a defined corrective action.

The third is the one most often missed, and it is the crucial one. A check that fails but cannot say what to do about it is decoration — all you can do is log a line and continue.

Take subtitles. Decompose "will the subtitle overflow" into two measurable quantities: characters per cue, and characters read per second. A vertical short-drama screen holds roughly twenty CJK characters, and the eye comfortably reads about six per second. Those thresholds are this course's, not an industry standard; tune them to your font size and audience. And the corrective action is very concrete: trim the line.

// Character ceilings: what fits one vertical screen, and what the eye reads in a second.
// Tune both to your font size.
const MAX_SUBTITLE_CHARS = 20
const MAX_CHARS_PER_SECOND = 6
 
// Three bands: pass 5, borderline 3, fail 1. Below 3 is sent back.
const scoreOf = (ok, near) => (ok ? 5 : near ? 3 : 1)
 
function checkSubtitleFit(text, durationSec) {
  const perSecond = Number((text.length / Math.max(1, durationSec)).toFixed(2))
  const ok = text.length <= MAX_SUBTITLE_CHARS && perSecond <= MAX_CHARS_PER_SECOND
  const near = text.length <= MAX_SUBTITLE_CHARS + 4 && perSecond <= MAX_CHARS_PER_SECOND + 2
  return {
    id: 'subtitle-fit',
    score: scoreOf(ok, near),
    objective: true,
    detail: `${text.length} chars / ${durationSec}s = ${perSecond} chars per second`,
  }
}

# Character ceilings: what fits one vertical screen, and what the eye reads in a second.
MAX_SUBTITLE_CHARS = 20
MAX_CHARS_PER_SECOND = 6
 
 
def score_of(ok: bool, near: bool) -> int:
    """Three bands: pass 5, borderline 3, fail 1. Below 3 is sent back."""
    return 5 if ok else 3 if near else 1
 
 
def check_subtitle_fit(text: str, duration_s: float) -> dict:
    per_second = round(len(text) / max(1.0, duration_s), 2)
    ok = len(text) <= MAX_SUBTITLE_CHARS and per_second <= MAX_CHARS_PER_SECOND
    near = len(text) <= MAX_SUBTITLE_CHARS + 4 and per_second <= MAX_CHARS_PER_SECOND + 2
    return {
        "id": "subtitle-fit",
        "score": score_of(ok, near),
        "objective": True,
        "detail": f"{len(text)} chars / {duration_s}s = {per_second} chars per second",
    }

When a subjective item goes to the model, one rule is absolute: demand a single structured verdict, and never treat an unparseable answer as a pass.

A model fails to answer in many shapes — two extra sentences of pleasantry, JSON missing a brace, a score given as "four to five." The correct handling marks the item "no verdict, needs a human," not a default pass. Conflating "the model said it is fine" with "the model did not answer" is the easiest accident to bake into automated QC: your report goes green everywhere, and the genuinely broken shots are precisely the ones that confused the model.

async function review(shot, facts) {
  const prompt = [
    'You are a short-drama QC reviewer. Output only one JSON object of the form {"score":integer 1 to 5,"detail":"one sentence"}.',
    `Visual: ${shot.visual}; camera: ${shot.camera}`,
    `Already measured locally: ${facts.map((f) => `${f.id}=${f.score}`).join(', ')}`,
    'Score character consistency and whether the frame has broken down.',
  ].join('\n')
 
  const r = await text.complete({ user: prompt, temperature: 0 })
  try {
    const parsed = JSON.parse(r.text.slice(r.text.indexOf('{'), r.text.lastIndexOf('}') + 1))
    const score = Number(parsed.score)
    if (!Number.isInteger(score) || score < 1 || score > 5) throw new Error('score out of 1 to 5')
    return { id: 'visual-integrity', score, objective: false, detail: String(parsed.detail ?? '') }
  } catch {
    // Key point: unparseable means no verdict and needs a human. It is never a pass.
    return { id: 'visual-integrity', score: 0, objective: false, detail: 'the model gave no parseable score' }
  }
}

import json
 
 
async def review(shot, facts, text) -> dict:
    prompt = "\n".join([
        'You are a short-drama QC reviewer. Output only one JSON object of the form '
        '{"score":integer 1 to 5,"detail":"one sentence"}.',
        f"Visual: {shot.visual}; camera: {shot.camera}",
        "Already measured locally: " + ", ".join(f"{f['id']}={f['score']}" for f in facts),
        "Score character consistency and whether the frame has broken down.",
    ])
 
    r = await text.complete(user=prompt, temperature=0)
    try:
        raw = r.text[r.text.index("{") : r.text.rindex("}") + 1]
        parsed = json.loads(raw)
        score = int(parsed["score"])
        if not 1 <= score <= 5:
            raise ValueError("score out of 1 to 5")
        return {"id": "visual-integrity", "score": score, "objective": False, "detail": str(parsed.get("detail", ""))}
    except Exception:
        # Key point: unparseable means no verdict and needs a human. It is never a pass.
        return {"id": "visual-integrity", "score": 0, "objective": False, "detail": "no parseable score"}

One pass before, one pass after

How many content-safety passes belong in the pipeline? Two, and they guard against completely different things.

The pass before checks the prompt you are about to send. It saves money and your account: a non-compliant prompt at best gets rejected by the vendor's moderation (MiniMax returns 1026 or 1027 here), wasting a round; at worst it trips risk controls. The pre-check is a local word list plus rules, a few milliseconds, and every block saves a call.

The point is that a block must offer an alternative rather than throwing an exception that halts the pipeline. The lab replaces the matched fragment with safe phrasing, prints it, lets the flow continue, and records the interception in the report, so a human can later see which line was changed and to what.

The pass after checks the cut the vendor gave back. It matters more than the first, for a blunt reason: a clean prompt does not mean a clean result. Generative models improvise; you write "outside a convenience store" and it may fill a whole shelf with branded packaging. The pre-check only proves you did not ask for it; the post-check is what proves what the audience sees is fine.

The post-check covers three things: run the cut's subtitle text through the word list again, verify the implicit label was written, and verify the explicit label is present. The last two are the next section.

Generated-content labeling: explicit and implicit

This is the only section of the chapter with a hard legal constraint, so the wording follows the official text strictly.

The Measures for Labeling AI-Generated Synthetic Content were jointly issued by four departments and took effect on 1 September 2025. They define two kinds of label, verbatim:

An explicit label is a label "added within the generated synthetic content or the interactive interface, presented as text, sound, graphics or similar, and clearly perceivable by the user."

An implicit label is a label "added by technical means within the file data of the generated synthetic content, and not readily perceivable by the user."

Two points must be remembered. First, a service provider shall add an implicit label in the file metadata of generated synthetic content. Second, both explicit and implicit labels are required; it is not a choice between them. Additionally, no organization or individual may maliciously delete, alter, forge or conceal a label.

The accompanying mandatory national standard is GB 45438-2025, Cybersecurity technology — Labeling method for AI-generated synthetic content, effective the same day.

Implementing the implicit label is easy — write it into the container metadata, with -c copy avoiding a re-encode, in tens of milliseconds:

ffmpeg -v error -i joined.mp4 -i episode-1.srt \
  -c copy -c:s mov_text -metadata:s:s:0 language=eng \
  -metadata "comment={\"generatedBy\":\"ai\",\"runId\":\"run-20260907-001\"}" \
  -metadata "title=AI-generated synthetic content" \
  episode-1.mp4

Then read it back to verify, because written but never read is the same as not written:

ffprobe -v error -show_entries format_tags=comment \
  -of default=noprint_wrappers=1:nokey=1 episode-1.mp4

The explicit label has an engineering trap: the most robust approach burns "this piece is AI-generated synthetic content" into the picture, and burning text requires ffmpeg built with libfreetype, that is, the drawtext filter. Many minimal builds lack it. So the program must probe the capability and degrade:

ffmpeg -hide_banner -filters | grep -w drawtext

Found: burn it in. Not found: emit the label as the first subtitle cue, and print the degradation explicitly rather than quietly doing one less compliance action. The subtitle route is visible in many playback contexts, but it can be turned off and is therefore not fully equivalent — before formal release it must be replaced with the burned-in version. This is the same pattern as D6's capability probing.

One broadcast-regulator requirement in passing: online micro-dramas are tiered into key, ordinary and other categories for review by investment amount, and a license number or filing number must be shown at the head of the piece before it goes live. That is separate from the AI label above; both are required.

Three copyright minefields

Beyond labeling, three lines must not be crossed, each sufficient to get a whole piece taken down.

One: likeness rights. Do not generate the likeness of a real person. This is the easiest to step on unintentionally in a prompt — phrasing like "make the lead look like so-and-so" must be blocked by the pre-check. It is the first entry in the lab's rule table.

Two: music. Background music draws the most complaints in short drama, because it is so easy to grab casually. The criterion is simple: unless you can produce a license, do not use it. The viable routes are commercial licenses from a proper library, material explicitly marked for commercial use, or generating it yourself with a model — and for that last one, read the terms of service on commercial use carefully.

Three: material provenance. If reference images, look tests or set images come from a casual web search, you have inherited someone else's copyright problem. Every asset in this course is generated or shot ourselves. That is not fastidiousness; it keeps the risk out at the source.

What these three share is that none is a technical problem, and every one must be implemented by technical means — written into the pre-check's rule table, into the asset library's provenance field, into the pre-export checklist. Relying on people to remember does not work.

The stop-loss point: after how many redos do you call a human

One last thing, and the place automated QC most easily runs away: if failing means redo, how many redos are enough?

First a judgment that must be in the code: a bounce-back is not the same input run again. The same input redone ten times gives the same result, especially with temperature at zero or a fixed seed. So every failed item must map to a concrete corrective action: subtitle over the limit means trim the line, audio-video desync means write the shot duration back from the line's length. A check with no corrective action turns redo into pure spending.

Then the ceiling. This course sets it at two, because video is the most expensive thing on this line and the cost of a third redo already exceeds the cost of a human glance. Past the ceiling the answer is neither to keep trying nor to pass it, but to mark the shot "needs a human" and write it — with its scores, its redo count and each item's specific verdict — into the report and push it to yesterday's review console.

const PASS_SCORE = 3
const MAX_REDO = 2
 
function summarize(shotId, scores, redo) {
  const min = Math.min(...scores.map((s) => s.score))
  const passed = min >= PASS_SCORE
  // Three verdicts: passed, send back for redo, or stop at the ceiling and hand to a human
  const verdict = passed ? 'pass' : redo >= MAX_REDO ? 'needs-human' : 'redo'
  return { shotId, scores, min, passed, redo, verdict }
}
 
// A bounce-back carries a corrective action, or every redo gives the same result
function autoFix(shot, qc) {
  for (const c of qc.scores) {
    if (c.score >= PASS_SCORE) continue
    if (c.id === 'subtitle-fit') shot.dialogue[0].text = shot.dialogue[0].text.slice(0, 20)
    if (c.id === 'av-sync') shot.durationSec = Math.round(shot.dialogue[0].text.length * 0.22)
  }
}

PASS_SCORE = 3
MAX_REDO = 2
 
 
def summarize(shot_id: str, scores: list[dict], redo: int) -> dict:
    lowest = min(s["score"] for s in scores)
    passed = lowest >= PASS_SCORE
    # Three verdicts: passed, send back for redo, or stop at the ceiling and hand to a human
    verdict = "pass" if passed else "needs-human" if redo >= MAX_REDO else "redo"
    return {"shotId": shot_id, "scores": scores, "min": lowest, "passed": passed, "redo": redo, "verdict": verdict}
 
 
def auto_fix(shot, qc: dict) -> None:
    """A bounce-back carries a corrective action, or every redo gives the same result."""
    for c in qc["scores"]:
        if c["score"] >= PASS_SCORE:
            continue
        if c["id"] == "subtitle-fit":
            shot.dialogue[0].text = shot.dialogue[0].text[:20]
        if c["id"] == "av-sync":
            shot.duration_s = round(len(shot.dialogue[0].text) * 0.22)

What threshold matches human judgment? That is where yesterday's structured review records earn their keep: back-test against the shots a human gave a verdict to, and see which threshold maximizes agreement between machine and human. Without that data, the threshold is a guess.

Source Reading

Hands-On Lab

Fault injection uses the course-wide INJECT variable, with one value today:

MOCK=1 pnpm start                    # happy path: all three shots pass
INJECT=lowscore MOCK=1 pnpm start    # shot two's line is too long, shot three is high risk

Injection changes only those two shots' inputs; QC, bounce-back, stop-loss and labeling all run normally. The starter leaves four exercises, and running it with injection shows five of seven checks failing. Afterwards, verify the cut yourself with the ffprobe command above and confirm by hand that the label really is in the file.

1. Run the solution with INJECT=lowscore first and see which path each of the three shots takes: one straight pass, one pass after a bounce-back, one handed to a human at the ceiling.
2. Implement the subtitle-overflow check and watch that shot go from full marks to failing and being sent back.
3. Add the stop-loss decision and confirm the high-risk shot is marked as needing a human after two redos rather than being let through.
4. Implement the prompt pre-check and watch it block the non-compliant description and print an alternative.
5. Implement writing the implicit label, read it back with ffprobe, and confirm the post-check no longer reports a missing label.

Interview Questions

Today's three questions are in the question bank below, focused on turning subjective quality into judgeable checks, the division of labor between pre- and post-review, and how generated-content labeling is implemented. Read the analysis before the key points — practicing the derivation beats memorizing them. The cn / global labels let you pick by target market.

Checklist and Tomorrow

• I can run a judgeable quality check on generated output with a vision model, and automatically bounce failing shots back for redo
• I can explain how many content-safety review passes belong in the pipeline and where each one goes
• I can explain the explicit and implicit requirements for generated-content labeling, and implement them in the export step
• I can distinguish locally measurable objective items from model-dependent subjective ones, and say why they are accounted for separately
• I can explain why a bounce-back must carry a corrective action, and why a stop-loss point must exist
• All 5 lab acceptance criteria pass
• I can answer at least 2 of the 3 interview questions without looking at the key points

Tomorrow (D12) we open the books: split cost by stage, give each stage a model-routing policy, push spend down with caching and degradation, and fit every run with a budget circuit breaker that actually brakes. The order is deliberate — we just gave the pipeline the ability to redo work automatically, and automatic redo is the mechanism most likely to burn through a budget; with QC in place first, you know which redo the money went to.