AI Edit: an AI retoucher that looks at Lightroom's render and corrects it

.gitattributes

@@ -0,0 +1,6 @@
+# lrg-develop's fixtures and goldens are compared byte for byte by tests (the
+# registry snapshot, the XMP writer goldens in written/, the Lua wire goldens
+# in wire/); keep them LF on every
+# checkout, Windows runners with core.autocrlf=true included. Only this
+# folder: server-rs/testdata also holds binary files.
+server-rs/testdata/develop/** text eol=lf

.github/workflows/golden-tests-full.yml

@@ -7,6 +7,12 @@ name: "Golden tests (all model assets)"
 # family — AuraFace (261 MB) from Hugging Face, the rest from releases — and
 # runs with LRG_REQUIRE_GOLDENS=all, so a missing asset fails instead of
 # skipping: the numerical checks either run or the job goes red.
+# `all` leaves out the gate's LOCAL_ONLY families (crates/lrg-ml/tests/common),
+# whose data is private or not redistributable and can never be fetched here:
+# lrg-develop's local sweeps `training-dump` (the maintainer's training rows),
+# `lrc-presets` (Lightroom's bundled presets and profiles), `acr-presets`
+# (Camera Raw's user folder: its presets and profiles) and `xmp-corpus`
+# (a private sidecar corpus).
 #
 # Deliberately *not* cached. A fresh download each night also verifies that
 # the published release assets are still present and fetchable, which is what

.github/workflows/lint-format.yml

@@ -54,6 +54,14 @@ jobs:
           set -o pipefail
           python3 scripts/check-docs.py 2>&1 | tee /tmp/check-docs.txt
         continue-on-error: false
+      - name: Develop fixtures carry no private data
+        # server-rs/testdata/develop is derived from the maintainer's own
+        # Lightroom edits; the check is stdlib-only Python.
+        run: |
+          python3 server-rs/scripts/develop_registry/extract_fixtures.py --check-only \
+            --out-dir server-rs/testdata/develop/lua --root server-rs/testdata/develop
+          python3 server-rs/scripts/develop_registry/extract_fixtures.py --self-test \
+            --out-dir server-rs/testdata/develop/lua --root server-rs/testdata/develop
       - name: Report possibly-stale pages
         if: always()
         run: |
@@ -92,6 +100,13 @@ jobs:
       - name: Linting (Rust)
         working-directory: server-rs
         run: cargo clippy --workspace --all-targets -- -D warnings
+      # The invariant also guards plugin/LrGeniusAI.lrdevplugin/DevelopEditManager.lua,
+      # and server-rs-tests.yml runs only for `server-rs/**` changes, so a
+      # plugin-only PR that reintroduced a `Temp` key would pass there and
+      # fail on the next unrelated server-rs PR. This job is unfiltered.
+      - name: No Temp develop key (Rust + DevelopEditManager.lua)
+        working-directory: server-rs
+        run: cargo test -p lrg-develop --test no_temp_key
 
       # `llamacpp` is off by default, but lrg-llama is a workspace member, so
       # the step above already compiles llama.cpp from source and lints that

.github/workflows/lua-tests.yml

@@ -6,13 +6,19 @@ on:
       - ".busted"
       - ".luacheckrc"
       - ".github/workflows/lua-tests.yml"
+      # The backend's wire goldens: plugin/spec/native_wire_format_spec.lua
+      # decodes them, so a re-bless must re-run busted.
+      - "server-rs/testdata/develop/wire/**"
   push:
     branches: [main]
     paths:
       - "plugin/**"
       - ".busted"
       - ".luacheckrc"
       - ".github/workflows/lua-tests.yml"
+      # The backend's wire goldens: plugin/spec/native_wire_format_spec.lua
+      # decodes them, so a re-bless must re-run busted.
+      - "server-rs/testdata/develop/wire/**"
 # A newer commit on the same ref makes the in-flight run obsolete; main is
 # exempt so each commit that lands keeps its own result.
 concurrency:

.gitignore

@@ -15,6 +15,8 @@ model_scripts/**/*.bin
 **/._.DS_Store
 **/.DS_Store
 build/
+# Source, not build output: lrg-develop's mask builders (`lrg_develop::build`).
+!server-rs/crates/lrg-develop/src/build/
 dist/
 models/
 tests/results/*.json

.luacheckrc

@@ -4,6 +4,7 @@ std = "lua51"
 globals = {
     "import",
     "AestheticRefine",
+    "EditLoop",
     "AgentBridge",
     "AgentCommands",
     "PluginTests",
@@ -35,6 +36,7 @@ globals = {
     "SkipPhotoContextDialog",
     "SpeciesLinks",
     "DevelopEditManager",
+    "DevelopExperiments",
     "TaskUpdate"
 }
 

.pre-commit-config.yaml

@@ -31,3 +31,21 @@ repos:
         # checks read; staleness warnings surface in CI.
         files: ^(server-rs/crates/lrg-api/src/routes/|plugin/LrGeniusAI\.lrdevplugin/APISearchIndex\.lua|docs/|scripts/check-docs\.py$|CLAUDE\.md$|AGENTS\.md$)
         pass_filenames: false
+      - id: develop-fixture-hygiene
+        name: develop fixtures carry no private data
+        # The fixtures under server-rs/testdata/develop are derived from the
+        # maintainer's own edits and the repository is public. Stdlib-only, so
+        # plain python3 is enough (no uv).
+        entry: python3 server-rs/scripts/develop_registry/extract_fixtures.py --check-only --out-dir server-rs/testdata/develop/lua --root server-rs/testdata/develop
+        language: system
+        files: ^server-rs/(testdata/develop/|scripts/develop_registry/(extract_fixtures|outpath)\.py$)
+        pass_filenames: false
+      - id: develop-fixture-hygiene-self-test
+        name: develop fixture hygiene check flags what it should
+        # Crafted files on a copy of the tree; the same cases as
+        # crates/lrg-develop/tests/fixture_hygiene.rs, so the Python and Rust
+        # checks cannot drift apart unnoticed.
+        entry: python3 server-rs/scripts/develop_registry/extract_fixtures.py --self-test --out-dir server-rs/testdata/develop/lua --root server-rs/testdata/develop
+        language: system
+        files: ^server-rs/(testdata/develop/|scripts/develop_registry/(extract_fixtures|outpath)\.py$)
+        pass_filenames: false

AGENTS.md

@@ -91,7 +91,15 @@ failure — this is what stops CI being green on numerical checks that never ran
 PR CI provisions the face pair (89 MB) and requires it; the nightly
 `golden-tests-full.yml` fetches every family. If you add a golden test, gate it
 through `crates/lrg-ml/tests/common/assets_ready` rather than an early
-`return`.
+`return`. Families whose data can never be in CI (private or not
+redistributable) are listed in the gate's `LOCAL_ONLY`: `all` leaves them out,
+only naming one explicitly makes its absence a failure. They are `lrg-develop`'s
+local sweeps, each reading a path from its variable: `training-dump`
+(`LRG_DEVELOP_TRAINING_DUMP`, the maintainer's training rows), `lrc-presets`
+(`LRG_LRC_PRESETS_DIR`, Lightroom's bundled presets and profiles),
+`acr-presets` (`LRG_ACR_PRESETS_DIR`, Camera Raw's user folder: its presets and
+profiles) and `xmp-corpus` (`LRG_XMP_CORPUS_DIR`, a private sidecar corpus); see
+`docs/wiki/Dev-Develop-Model.md`.
 
 ### Plugin — load into Lightroom
 
@@ -157,12 +165,13 @@ Cargo workspace, one binary (`geniusai-server`) across these crates:
 
 - `lrg-common` — config/CLI, error→envelope, version (baked in via `LRG_BACKEND_*` build-time env vars, `option_env!`), logging+rotation, PID/OK lifecycle handshake.
 - `lrg-store` — LanceDB wrapper, Arrow schemas, `db_path` bind state machine, backup, stats. `lrg-chroma-reader` is migration-only: reads an old ChromaDB directory (WAL + HNSW segment binaries) left over from the retired Python backend, to migrate its data into LanceDB — no Chroma dependency at runtime.
-- `lrg-imaging` — image conversion, EXIF/IPTC/XMP, pHash, culling metrics.
+- `lrg-imaging` — image conversion, EXIF/IPTC/XMP, pHash, culling metrics, a render's tones in numbers for AI Edit (`tone.rs`).
 - `lrg-ml` — ONNX Runtime (`ort` crate) session management, SigLIP2 pre/post-processing + `tokenizers`-crate Gemma tokenizer, YuNet face detection + FaceNet embedding, MediaPipe Face Mesh V2 + Blendshape V2 for eye state, smile and gaze (`face_state.rs`). Model file locations resolved in `model_paths.rs` (env vars, see [server-rs/README.md](server-rs/README.md)).
 - `lrg-analysis` — clustering, person matching, group/cull grading, style engine, keyword clustering.
 - `lrg-providers` — LLM provider trait + REST clients (OpenAI, Gemini, Anthropic — Claude through Anthropic's own Messages API in `anthropic.rs`, not its OpenAI-compatible endpoint, which lists no models and ignores the answer format — Ollama, OpenAI-compatible servers — LM Studio found on this computer, and the user's own "Other AI server" such as OpenRouter, llama.cpp `llama-server` or LiteLLM, both in `openai_compatible.rs`), edit-recipe schemas. `local_provider.rs` serves *both* local backends off one `LocalEngine` trait; it has no llama.cpp or MLX dependency of its own.
+- `lrg-develop` — the native Lightroom develop model, a leaf crate (no image, network or async dependencies, so `cargo test -p lrg-develop` takes seconds): the key registry (`registry/table.rs`, one `KeySpec` per `crs:` key with type, stored range, UI scale, number format, defaults, policy class, frame scope, file kind), the typed model (`DevelopSettings`, corrections and masks, `Look`, white balance, the policy filter), the readers for `getDevelopSettings()` blobs (`lua::read`) and XMP sidecars, presets and profiles (`xmp::read`, on `roxmltree`), which share their typing and classification rules so both land in the same model, the deterministic develop-preset writer (`xmp::write`), the Lua writer for `applyDevelopSettings` (`lua::write`; provisional until experiments E1/E2/E4/E11, its open choices in `LuaOptions::PROVISIONAL`) — both writers' lossless test modes exist only behind the crate's `test-roundtrip` feature, which only its own dev-dependency enables — and the correction builders (`build`: semantic, gradient and luminance-range masks with SHA-256-derived sync ids). The LLM edit-recipe schema stays in `lrg-providers`, learning/blending in `lrg-analysis::style_engine`. See [Dev-Develop-Model.md](docs/wiki/Dev-Develop-Model.md).
 - `lrg-mlx` — supervises the `lrgenius-mlx` Swift sidecar (`native/mlx-sidecar/`) and speaks its JSON-lines stdio protocol. No native build step, no cargo feature; Apple silicon only at runtime.
-- `lrg-api` — axum routers (one module per API domain under `routes/`), `db_path` auto-bind middleware, jobs registry, and the browser UI: the pages under `src/ui/` served by `routes/ui.rs`, plus the `ui_bridge` queue that hands their actions to the plugin, and the `agent_bridge` that hands MCP tool calls to the plugin (`/v1/agent/*`).
+- `lrg-api` — axum routers (one module per API domain under `routes/`), `db_path` auto-bind middleware, jobs registry, and the browser UI: the pages under `src/ui/` served by `routes/ui.rs`, plus the `ui_bridge` queue that hands their actions to the plugin, the `agent_bridge` that hands MCP tool calls to the plugin (`/v1/agent/*`), and AI Edit's retoucher sessions (`edit_loop.rs`, `/v1/edit/sessions`): a vision model edits through `lrg_providers::chat::ChatModel` with the tools in `lrg_providers::edit_loop`, each edit becomes an `applyDevelopSettings` table through `lrg_develop::build::recipe` and the Lua writer, and the plugin's `EditLoop.lua` applies, renders and hands back each round.
 - `lrg-mcp` — the MCP endpoint (`/mcp`, bearer agent token required) AI agents connect to: tools over the index (calling the REST routes in-process) and over Lightroom (through `agent_bridge` to the plugin's `AgentBridge.lua`/`AgentCommands.lua`, which starts with Lightroom), result sets, prompts, and `geniusai-server mcp`, a stdio proxy for Claude Desktop. See [Dev-Agent-Bridge.md](docs/wiki/Dev-Agent-Bridge.md).
 - `lrg-chat` — the in-app agent chat (`/v1/chat/*`): a local or cloud model works the catalog through the same tools, as an in-memory MCP client of `lrg-mcp`, with the user's approval (`permissions.rs`). The model answers through `lrg_providers::chat::ChatModel`: `cloud_chat.rs` uses each API's own tool calling, and `local_chat.rs` does it by decoding against a JSON Schema, since llama.cpp cannot render the Jinja templates that carry a model's native tool-call format. See [Dev-Agent-Chat.md](docs/wiki/Dev-Agent-Chat.md).
 - `lrg-server` — the binary: CLI (`clap`), lifecycle, self-updater (`routes::update`), `migrate` and `mcp` (stdio proxy) subcommands; merges the `lrg-mcp` and `lrg-chat` routers next to `lrg_api::build_router`'s.
@@ -194,7 +203,7 @@ Cargo workspace, one binary (`geniusai-server`) across these crates:
 
 ### Rust / Backend (`server-rs/`)
 
-- Routes in `lrg-api::routes` (one axum `Router` per domain, merged in `lrg_api::build_router`); business logic in `lrg-analysis`/`lrg-imaging`/`lrg-ml`; LLM/cloud clients in `lrg-providers`.
+- Routes in `lrg-api::routes` (one axum `Router` per domain, merged in `lrg_api::build_router`); business logic in `lrg-analysis`/`lrg-imaging`/`lrg-ml`; LLM/cloud clients in `lrg-providers`; the native Lightroom develop model (key registry, typed model, readers and writers of the Lua and XMP forms) in `lrg-develop`, while the LLM edit-recipe schema stays in `lrg-providers` — a new develop key is a registry row in `lrg-develop`, not a field or a string literal elsewhere.
 - Always use the `log` facade (`log::info!`/`warn!`/`error!`).
 - Manage dependencies via `cargo add`/`cargo remove` (updates `Cargo.toml` + `Cargo.lock`); commit both.
 - Code must pass `cargo fmt` and `cargo clippy --workspace --all-targets` with zero warnings before considering a change done.