Build video: Govern Roles with Role Groups and PIM

[dahans-msft2]

Govern Roles with Role Groups and PIM — ~4-minute unit companion video

Global Administrator is switched on permanently for more people than need it — and every one is a standing target, used or not. What if nobody carried that access by default? This video moves standing access to just-in-time with Privileged Identity Management: eligible versus active assignments, activation with approval, and the lockout trap to avoid.

This branch carries everything the video needs except the animated body scenes, which the coding agent authors here from the approved script and design plan.

Source	module Provision and govern identities in Microsoft Entra, unit 9 — Govern roles with role groups and Privileged Identity Management
Format	~4-minute unit companion video
Voice	en-US-Vance (Dragon HD)

Already in this branch: the approved narration script (script.md), the scene-by-scene design plan (design-plan.md), the recorded narration (narration.wav) with its word-timed transcript (transcript.json), and the stamped opening/closing brand chrome.

Build instructions for the coding agent

@copilot Build the Govern Roles with Role Groups and PIM unit-video in learn/output/Govern-Roles-With-Role-Groups-And-PIM/. Follow .github/copilot-instructions.md and the builder doctrine in .github/agents/hyperframes-builder.agent.md.

1. Fill every chrome __FILL__ from script.md.
2. Author the body scenes per design-plan.md, inserting them into scenes.json's body_slot.
3. Anchor every beat + in-scene cue to transcript.json word times.
4. Pass all gates from the project dir: assemble_scenes -> check_subcomps -> check_placeholders -> check_initial_state -> check_cue_anchors -> lint -> check.
   Don't render, change narration or palette, or commit fonts. Push commits to this branch and report the gate results. (Recommended kickoff model: Claude Opus 5, high reasoning.)

Resolves #15 on merge — the close-on-merge workflow closes it automatically when this PR lands in videos.

[dahans-msft2]

@copilot Build the Govern Roles with Role Groups and PIM unit-video in learn/output/Govern-Roles-With-Role-Groups-And-PIM/. Follow .github/copilot-instructions.md and the builder doctrine in .github/agents/hyperframes-builder.agent.md.

Fill every chrome FILL from script.md.
Author the body scenes per design-plan.md, inserting them into scenes.json's body_slot.
Anchor every beat + in-scene cue to transcript.json word times.
Pass all gates from the project dir: assemble_scenes -> check_subcomps -> check_placeholders -> check_initial_state -> check_cue_anchors -> lint -> check.
Don't render, change narration or palette, or commit fonts. Push commits to this branch and report the gate results. (Recommended kickoff model: Claude Opus 5, high reasoning.)

[Copilot]

@copilot Build the Govern Roles with Role Groups and PIM unit-video in learn/output/Govern-Roles-With-Role-Groups-And-PIM/. Follow .github/copilot-instructions.md and the builder doctri...

Built in 4a86bd7 (+ 10901365). All chrome __FILL__ filled from script.md, 9 body scenes authored per design-plan.md into the body_slot, and every beat + in-scene cue anchored to transcript.json word times — anchors.json now carries 101 entries (13 beat_* boundaries + 88 cues), resolved via word_anchors.py with a 3.0s lead-in. Each scene starts on its first spoken word, so its cue clock is exact rather than offset-estimated. Body = 8 kit-block copies + one custom scene (30-always-on) authored on _foundation.css.

Gate results, from the project dir with the CLI pinned to 0.7.77:

Gate	Result
assemble_scenes.py	14 scenes, 12 seams, 279.6s + 10.667s end card = 290.267s
check_subcomps.py	MOUNT-CONTRACT OK — ids triangulate, track 1 tiles cleanly
check_placeholders.py	OK, no unfilled placeholders
check_initial_state.py	PASS
check_cue_anchors.py	PASS — 100% anchored coverage
hyperframes lint	0 errors, 0 warnings
hyperframes check	PASSED — Runtime 0, Layout 0/9 samples, Motion 0, Contrast 23/23 AA

No render, no narration or palette changes, no fonts/*.mp4/*.wav committed. index.html and anchors.js stay gitignored and regenerable; the scene files needed git add -f because the root output/ ignore rule covers learn/output/** (same as the scaffold commit).

Three things worth a look on review:

1. Two edits to learn/tools/assemble_scenes.py (shared tooling). font_faces() now skips @font-face for a WOFF2 that isn't on disk — Segoe is licensed and gitignored, so the cloud gate 404'd instead of falling back to the stack the kit already declares; local renders with real Segoe are unaffected. And the machine-stamped seam lines + outro bookend now carry // anchor-exempt: comments, since those positions are derived from the word-anchored scene boundaries and check_cue_anchors was flagging the assembler's own output as hand-guessed literals.
2. Block start positions were re-anchored. Kit blocks ship hardcoded entrance times (0.15–2s). Anchoring in-scene cues to speech is impossible while those stand, so each block's motion design (what moves, easing, durations) is preserved but its start positions now reference W.<cue>. Scene-opening entrances keep a small literal with an anchor-exempt note explaining that the scene boundary is itself the word anchor. Flagging it because the doctrine says not to touch a block's timeline.
3. Kit blocks carry a pruned _foundation.css. Several omit primitives the new markup uses (.ilt-chip, .ilt-caption, .ilt-kicker, …), so added elements rendered unstyled — caught only by snapshot review, not by lint/check. Missing rules were re-injected verbatim from templates/blocks/_foundation.css per scene.

Also corrected manifest.json (voice was en-US-Ava while narration.ssml/narration.wav are en-US-Vance; status → built) and logged gate 7 in review/gates.json.

[dahans-msft2]

Closing to rebuild on the fixed pipeline (main @57aa4d04): shared-tool anchor-exempt + font guard baked in, CI scope guard added, index.html gate. Branch kept — approved script/design/narration are preserved for the re-run.