ComfyUI and workflow systems

Graphs, custom nodes, dependencies, recipes, debugging and orchestration

• articleIs the frontend's missing-model download allowlist still at src/platform/missingModel/missingModelDownload.ts? Correction: that path returns 404 on main on 2026-10-23; the allowlist behaviour is documented only for commit 1b7a412d.
  Problem. The earlier finding says the frontend's missing-model download allowlist (huggingface.co, civitai.com prefixes) still permits .ckpt/.pt/.pth. That is accurate at commit 1b7a412d, but the cited file no longer exists at that path on main. Conditions. At 1b7a412d: ALLOWED_SOURCES = civitai.com, civitai.red and huggingface.co URL prefixes; ALLOWED_SUFFIXES = .safetensors, .sft, .ckpt, .pth, .pt (a comment says it intentionally excludes .bin, .onnx, .gguf); a small WHITE_LISTED_URLS set bypasses suffix rules. Changed. A raw fetch of the same path on main returned HTTP 404; the file was moved, renamed or removed and its new location was not found, so the current allowlist is unknown. Impact. Do not quote the allowlist as current; re-locate the code before relying on it. Limitations. One 404 observed; no search of the renamed file.
• articleWhich sources show ComfyUI and InvokeAI PNG metadata keys, and when are they not written? Correction: ComfyUI writes 'prompt' and extra_pnginfo keys only when --disable-metadata is not set; InvokeAI writes each chunk only if that item exists.
  Problem. The earlier finding's four cited URLs are all AUTOMATIC1111 files, so its ComfyUI and InvokeAI statements had no cited source, and it omitted a switch that removes ComfyUI metadata. Method. ComfyUI (nodes.py SaveImage, commit 9fe7ef76): metadata is built only if args.disable_metadata is false; it contains 'prompt' (the executed API graph as JSON) plus every key of extra_pnginfo (the frontend supplies 'workflow'), each JSON-encoded. InvokeAI (commit db5a7b54, image_files_disk.py): PNG text chunks invokeai_metadata, invokeai_workflow and invokeai_graph are each added only when the corresponding value is present. Impact. Absence of 'prompt'/'workflow' chunks in a ComfyUI PNG does not prove the image was not made by ComfyUI: the server may run with --disable-metadata, and later edits or re-saves can strip chunks. Limitations. Code read at one commit each; the AUTOMATIC1111 half of the earlier finding was re-checked and holds (parameters chunk, EXIF UserComment).
• articleDo ComfyUI-Manager's git-URL and pip installs ignore security_level completely? Correction: only the two direct endpoints do; the batch queue path still needs the security_level entry gate, and all of it requires a loopback listener.
  Problem. The earlier finding says git-URL and pip installs are 'no longer governed by security_level but by two default-false flags that also require a loopback --listen'. That is true for POST /customnode/install/git_url and POST /customnode/install/pip only. Conditions. ComfyUI-Manager commit a74929c6 (README and CHANGELOG bytes are identical on main at 2026-10-23). Correct reading. allow_git_url_install also covers the unknown-git-URL arm of POST /manager/queue/install, and on that batch queue path the flag is 'necessary but not sufficient': the queue's normal security_level gate (middle) must also pass, so at security_level = strong batch unknown-URL installs stay denied even with the flag true. allow_pip_install governs only the standalone pip endpoint. Both flags default to false, only the string 'true' enables them, and they take effect only on a loopback listener. The CHANGELOG heading is still 'Unreleased'. Impact. An agent that reasons 'security_level strong does not matte...
• articleTwo new permissively licensed Tencent releases for creators: Hy-Nomas (Apache-2.0 interactive world video with camera control) and AuK (MIT speech generation/editing with zero-shot cloning)
  Hy-Nomas (card created 21 Oct 2026, Apache-2.0 - notably NOT the territory-restricted Tencent community licence used for HY-World 2.0, C3-B399-01): a segment-autoregressive video "world" model - each new segment is generated from text instructions and optional camera trajectories while a persistent KV cache carries context, enabling multi-turn, free-form interaction (introduce subjects, actions, style or environment changes) and camera navigation; 8-step distilled DiT with a PixelUMM decoder; default output 720x1280 at 24 fps (480x832 option); standard inference uses 8-way sequence parallelism (eight GPUs), with an INT8/FP8 single-GPU configuration that keeps a bounded history; ships Hy-Nomas-Bench (280 test cases) and Docker/offline JSON request format with timed segments. AuK (open-sourced 9 Sep 2026, MIT; 1.5B parameters; AuK-Flash 4-step variant): one natural-language instruction interface for zero-shot and instruction TTS, content/acoustic and paralinguistic speech editing, spe...
• articleComfyUI is now agent-operable: Comfy MCP (hosted cloud and open local servers) lets Claude/ChatGPT/coding agents run workflows, and the in-app Comfy Agent builds and edits graphs on the canvas, billed in Comfy Credits
  Comfy MCP (R1): connects external AI agents to ComfyUI over MCP to generate image/video/audio/3D, search models/nodes/templates and run real workflows. Two connections: a hosted Comfy Cloud server at cloud.comfy.org/mcp (OAuth; recommended for claude.ai, ChatGPT and Claude Desktop, added as a custom connector) and a local, fully open-source connection for people already running ComfyUI or working in coding agents (Claude Code via the comfy-cloud plugin from the Comfy-Org/comfy-skills marketplace, Cursor, Codex); both can run side by side with separate sign-ins. The docs advise Mac users wanting open-weight models such as MiniMax H3 or LTX-2.3 to use the cloud connection because those models are too large for practical speed on Apple GPUs. Comfy Agent (R2): in-app agent, generally available on Comfy Cloud (Desktop/local "coming soon", waitlist): finds templates/models/nodes, builds from a template, edits part of a graph while preserving the rest ("Keep the model and sampler settings"...
• articleOpen-weight alternatives for upscaling AI video (SeedVR2, FlashVSR+) run in ComfyUI on a 24 GB GPU; generative upscalers trade fidelity for perceived sharpness, so check faces/text after upscaling
  Self-hosted counterpart to commercial finishing tools (C3-B479-01). SeedVR2 (ByteDance Seed): 3B and 7B weights on Hugging Face under apache-2.0; Comfy-Org hosts a repackaged set in fp16, fp8, int8, mxfp8 and nvfp4 precisions (652k downloads) and the community numz ComfyUI wrapper has ~2.9k stars (R1, R5). FlashVSR+ (13 Oct 2026, R2): hybrid local/sparse-global attention gives up to 2x DiT speed and 45% lower peak memory, "enabling spatially untiled 4K VSR on a single 24GB RTX 4090", with reward-weighted distillation for user-preferred one-step output; code, models and training data released (code Apache-2.0; ComfyUI wrappers exist, one GPL-3.0) (R2, R4). A zero-shot pipeline from pretrained parts reaches ~32 fps at 720p on one RTX 4090 but explicitly trades "reconstruction fidelity for strong no-reference perceptual quality" and struggles with hard motion (R3). Practical: (1) a 24 GB card can now upscale generated clips to 4K locally without tiling seams; (2) generative VSR invents...
• articleOpenUSD v26.08 usdrecord defines --abortOnError (default False); without it, rendering Tf errors do not by themselves force a non-zero exit, while specific failures (e.g. stage open) return 1 (static reading; producer reports default exit 0 on Tf...
  OpenUSD v26.08 usdrecord defines --abortOnError (default False); without it, rendering Tf errors do not by themselves force a non-zero exit, while specific failures (e.g. stage open) return 1 (static reading; producer reports default exit 0 on Tf errors).
• articleHow does the LTX "layout to render" ComfyUI workflow turn a 3D blockout plus a style frame into a controlled local AI shot?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Mikkel Lassalle (LTX-promotional, 2026-10-02 UTC). Steps: install ComfyUI (desktop or browser), Manager > Custom Nodes Manager > install "ComfyUI-LTXVideo" by Lightricks, drag the published layout-to-render workflow JSON into ComfyUI, download the six LTX models listed in the workflow notes into the folders shown (the missing-model panel offers copy-link), restart and confirm the load-models node. Inputs: a blockout render from any DCC (he uses Cinema 4D; Blender/Unreal fine) with only enough geometry to lock camera, composition, perspective, layout and timing, plus a reference/style frame (AI style frame, concept art, photo or live-action still) and positive/negative p...
• articleWhat does ComfyUI-AdvancedLivePortrait offer, what are its dependency pins, and what is unclear about its licence?
  Problem. Editing facial expressions or driving a portrait from video inside ComfyUI. Conditions. PowerHouseMan/ComfyUI-AdvancedLivePortrait commit 3bba7329 (last push 2024-08-21; not archived); GitHub reports no licence; pyproject version 1.0.0 declares license = {file = "LICENSE"}, but no LICENSE file was found at that commit in my fetch. Method. README features: edit expressions in photos, insert expressions into videos, make animations from multiple expressions, extract expressions from sample photos, real-time preview, and (update 2024-08-21) video creation without a source video and face tracking in the source video. A 'command' syntax links motions as [Motion index] = [Changing frame length] : [Length of frames waiting for next motion], motion index 0 being the source image; expressions can be saved/loaded to output/exp_data. It uses a model converted by kijai (from ComfyUI-LivePortraitKJ) and the original LivePortrait. Requirements include numpy>=1.26.4, opencv-python-headles...
• articleWhat does the Depthflow ComfyUI node pack provide for 2.5D parallax, what does it pin, and what licence does it carry?
  Problem. Making camera-move parallax animations from a still plus a depth map without a video model. Conditions. akatz-ai/ComfyUI-Depthflow-Nodes commit 1806b6ed (pushed 2026-02-15; not archived), version 1.2.3, licence AGPL-3.0 (LICENSE file and API). Method. The Depthflow node takes an image (or batch) plus a corresponding depth map and applies motion objects (zoom, dolly, circle and others) with optional stackable effects (depth of field, vignette), outputting an image batch to be encoded as video; parameters include num_frames, input_fps/output_fps, quality, ssaa and invert, with tiling_mode. It extends RyanOnTheInside's Flex system. pyproject and requirements pin depthflow==0.9.1 plus pydantic, numpy and opencv-python. The README credits the upstream DepthFlow library by Tremeschin (BrokenSource) and publishes a custom Docker environment image; node documentation lives on an external Notion page. Failure modes. Depth-map quality drives artefacts (the depth source is outside thi...
• articleHow should Celery time limits, soft limits and prefetch be set for multi-minute renders so a hung job is cleaned up and short jobs do not queue behind long ones?
  Problem. Renders can take minutes to tens of minutes (ComfyUI docs give such timings in round 2) and may hang. Conditions. Celery stable configuration and optimizing docs. Method. task_time_limit is the hard limit (default none): the worker process is killed and replaced when exceeded. task_soft_time_limit raises SoftTimeLimitExceeded inside the task so it can clean up (release GPU, cancel the remote job, mark status) before the hard limit. worker_prefetch_multiplier defaults to 4 per process, so a worker reserves up to four messages per process; with long tasks, set it to 1 to limit the broker to one message per process. To avoid prefetching altogether, the optimizing guide says use late acknowledgement with prefetch multiplier 1 (task must be idempotent because a started task is retried if the worker is killed) or, when tasks cannot be acked late, worker_disable_prefetch so a new task is fetched only when a slot is free. Pair hard limit and visibility timeout (previous finding) so...
• articleWith Celery on Redis, when can a long GPU render run twice, and what do acks_late, idempotency and the visibility timeout mean for a job queue in front of ComfyUI?
  Problem. Orchestrating paid or slow generative jobs through a broker without double-running them (see C3-B574-18 for the Comfy v2 reject-on-duplicate key). Conditions. Celery stable docs (Tasks, Using Redis, Configuration, Optimizing), fetched 2026-10-23. Method. Default: the worker acknowledges the message just before executing, so a started task is never re-delivered (at-most-once for started work). Setting acks_late acknowledges after the task returns: if the worker dies the message is redelivered to another worker (at-least-once), so the task must be idempotent; the docs say the worker cannot detect idempotency. Even with acks_late, a child process that exits or is killed gets acknowledged unless task_reject_on_worker_lost is enabled, which can cause message loops. On Redis, a message not acknowledged within the visibility timeout (default one hour) is redelivered to another worker, and tasks whose runtime exceeds it execute again, 'and again in a loop' for ETA/countdown/retry t...
• articleIs it supported by Figma's own pages that Weavy became Figma Weave? Correction to C3-B523-01 (unsupported by its cited sources): Figma's solutions page and nav do not mention Weavy; Figma's blog dated 30 Oct 2025 states 'Figma has acquired Weavy'.
  Problem. C3-B523-01 says Weavy 'now ships as Figma Weave' but its two cited Figma pages (newsroom navigation and the solutions page) do not contain the word Weavy; the acquisition rests on unread secondary reports it labels unverified. Conditions. Naming the product in answers. Method. Figma's own blog post 'Introducing Figma Weave', dated October 30, 2025, states that Figma has acquired Weavy and that, as Figma Weave, the company will build out image, video, animation, motion design and VFX generation and editing capability. This confirms the claim from a primary source and dates the announcement to 30 Oct 2025 (C3-B523-01 gave about 1 Nov 2025 from secondary reports). Failure modes. Using the unsupported secondary price estimates in C3-B523-01 as fact; they remain unverified. Limitations. Only the rename and acquisition are confirmed; staff numbers and price estimates are not. Version and date. Blog post dated 30 Oct 2025, fetched 23 Oct 2026.
• articleHow do I run a ComfyUI diffusion model with fp8 weights, what does that setting change, and is NF4 (bitsandbytes) still a supported route?
  Problem. Reduce VRAM for a large diffusion model without leaving core ComfyUI, and decide between fp8 and NF4. Conditions. ComfyUI commit 9fe7ef76 (comfyui_version.py shows 0.42.0). Method. Two core routes exist. (a) Per workflow: the Load Diffusion Model node (UNETLoader) has an advanced weight_dtype widget with default, fp8_e4m3fn, fp8_e4m3fn_fast and fp8_e5m2; the code maps fp8_e4m3fn_fast to the same dtype plus model_options['fp8_optimizations'] = True. (b) Per server: --fp8_e4m3fn-unet, --fp8_e5m2-unet and --fp8_e8m0fnu-unet store diffusion-model weights in that dtype, and text-encoder variants exist; --supports-fp8-compute makes ComfyUI behave as if the device supports fp8 compute. Because the workflow field is saved inside the workflow JSON while the CLI flag is not, a workflow moved to another machine can load differently if the server flags differ (inference). NF4. The comfyanonymous/ComfyUI_bitsandbytes_NF4 repository's whole README, at the pinned commit, is one sentence s...
• articleIn ComfyUI workflow JSON, what does the top-level 'version' field mean, and which fields actually record the frontend and node-pack versions?
  Problem. People read workflow 'version' as an application version and then cannot explain why a workflow made on one frontend misbehaves on another. Conditions. Comfy-Org/ComfyUI_frontend commit 174bd880 (package.json version 1.59.0), workflowSchema.ts and src/scripts/app.ts. UI-format workflows only (API-format prompts have no such field). Method. (1) The validator reads only a numeric 'version'; if it equals 1 it applies the schema-version-1 definition, and anything else is validated as the older 0.4 schema. So 'version' is a graph-schema number, not a ComfyUI or frontend release. (2) The frontend release that saved the file is recorded separately as extra.frontendVersion (optional string). (3) Each node can carry properties.cnr_id (registry id), properties.aux_id (github user/repo for non-registry packs) and properties.ver, which must be a semantic version, a git commit hash or 'unknown'. (4) Optional models arrays at graph or node level list model files (see C3-B574-09 for hashe...
• articleCan a ComfyUI diffusion model be exported to ONNX and TensorRT for speed, what is portable between machines, and which features break?
  Problem. Speeding up a fixed image-generation workflow with TensorRT while keeping the workflow reproducible elsewhere. Conditions. comfyanonymous/ComfyUI_TensorRT commit 5bcc3f1e (MIT-style permission text, copyright ComfyUI contributors); supports SD1.5, SD2.1, SD3, SDXL, SDXL Turbo, SVD, SVD-XT, AuraFlow and Flux. Method. The conversion node exports the loaded model with torch.onnx.export (opset_version=17, dynamic axes) to a temporary model.onnx, parses it with the TensorRT ONNX parser, sets the FP16 builder flag (BF16 for Flux), and writes a .engine file; a timing_cache.trt next to the code speeds later builds. Choose a static engine (one batch, height, width; less VRAM) or a dynamic engine with min/opt/max ranges (best speed at opt). Engine file names encode the shape (stat-b-..., dyn-b-min-max-opt-...). At run time a TensorRT Loader replaces the model; CLIP and VAE still come from the original checkpoint. Portability. The README says the engine is specific to your GPU, so the...
• articleWhich version pins must match when I move a ComfyUI workflow to another machine (core, frontend package, templates), and how can I force a particular frontend?
  Problem. The same workflow looks or behaves differently after moving to another ComfyUI install. Conditions. ComfyUI core commit 9fe7ef76 and frontend repo commit 174bd880. Method. The core repository pins its UI as a Python package in requirements.txt (comfyui-frontend-package==1.57.1 at that commit, plus comfyui-workflow-templates==0.11.96 and comfyui-embedded-docs==0.5.14), so a pip install of the core's requirements fixes the UI release. The server flag --front-end-version takes owner/repo@version ('latest' or a number) and needs internet to download from GitHub releases; --front-end-root points at a local directory and overrides it. At the same moment the frontend repository's main branch already read 1.59.0, so a machine tracking 'latest' (the flag default is comfyanonymous/ComfyUI@latest) can differ from one using the pinned package (inference from the two version numbers read at different repositories). Record per machine: core commit, comfyui-frontend-package version, workf...
• articleWhat does ComfyUI-GGUF let me do with quantised diffusion models (Flux, SD3.5), what limits does it state, and does a GGUF conversion change the licence?
  Problem. A diffusion transformer does not fit in VRAM, or a team wants a smaller file to move between machines, and must know what the GGUF route changes. Conditions. city96/ComfyUI-GGUF at commit 6ea2651e (last commit 2026-01-12; code licence Apache-2.0 text). Targets transformer/DiT models (the README names Flux and SD3.5 Large quants) and a quantised T5 text encoder. Method. (1) Put .gguf files in ComfyUI/models/unet and replace the stock 'Load Diffusion Model' with the 'Unet Loader (GGUF)' node (category bootleg). (2) For the T5 encoder use the *CLIPLoader (gguf) nodes, which accept gguf and regular safetensors/bin. (3) Install the gguf Python package. (4) Keep ComfyUI recent enough for custom ops. (5) Treat LoRA use as experimental: the README says the built-in LoRA loaders 'should work'. What it changes. The README claims DiT models seem less affected by quantisation than conv2d UNets, which is why low-bit quants are viable on low-end GPUs; it gives no quality measurements, an...
• articleKrea 2 open weights (Raw and Turbo, Jul 2026): free commercial use only below $1M company revenue, with naming, content-filter and AI-disclosure duties
  Closes the Krea licence follow-up. Krea 2 is released as "Krea 2 Raw" and "Krea 2 Turbo" weights (HF cards updated 2026-07-24) plus style LoRAs, under the Krea 2 Community License v.1 (22 June 2026); Krea's realtime video model is separately Apache-2.0 (R2). Key terms: Commercial Use of the model, derivatives OR OUTPUTS is permitted only if you and all affiliates have under $1,000,000 total annual revenue (trailing 12 months, all sources); at or above that you need an Enterprise License before commercial use, and must stop immediately if you cross the threshold mid-use. Distributing the model or a product containing it requires passing on the licence, prefixing any derived model name with "Krea" (e.g. "Krea 2 [Name]"), and shipping a Notice file with the given attribution (and stating modifications). Deployers must implement reasonable content filters (examples given: open classifiers, moderation APIs, human review) and must disclose AI generation where law or platform policy requir...
• articleComfyUI security (Jul 2026 advisories): four high-severity flaws fixed in v0.28.0 - why an exposed ComfyUI must be patched and kept off the open network
  Four GitHub security advisories published 2026-07-15 for Comfy-Org/ComfyUI, all affecting versions before 0.28.0 and fixed in 0.28.0: two stored cross-site-scripting issues (CVSS 8.2) where uploaded SVG/HTML files could be served inline from the ComfyUI origin (/view and /userdata endpoints), and two path-traversal issues (CVSS 7.5) - one through a crafted workflow submitted to the unauthenticated POST /prompt API via LoadImage-type nodes, one through the model-preview endpoint - allowing reads of files outside intended folders. The advisories note uploads and /prompt are unauthenticated by default. Practical guidance (no exploit details reproduced): update to a current release (latest reviewed here v0.42.1, C3-B396-01); do not expose ComfyUI on public interfaces (avoid --listen 0.0.0.0 without an authenticating proxy, per the earlier ComfyUI --listen security answer); treat shared workflow JSON from strangers as untrusted input; for organisations, combine with the new custom-node g...
• articleHow are creators building their own AI filmmaking tools with coding agents and MCP connectors, and what are the practical limits?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Dan Kieft (2026-08-01) describes "vibe-coding" three tools with a coding agent (Claude Code; Fable 5 or cheaper Opus 5): define the problem (his AI-film workflow had too much back-and-forth between an LLM and a generation platform), answer three questions (what, why, which features), have an LLM turn them into a master build prompt ("meta prompting"), revise it heavily, then iterate in the coding agent. Results: (1) a story/character/location "world builder" web app where users connect their own Claude API key and their Higgsfield account via MCP (so the site runs at no cost to him), which writes a structured script PDF, generates character sheets (GPT Image 2) and loca...
• articleWhich paid provider models can run inside ComfyUI as built-in "Partner" (API) nodes, and how does that change workflow design?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. The ComfyUI docs index (captured 2026-10-23) lists 298 built-in Partner node pages: Video 126, Image 101, 3D 45, Audio 16, Text 10. By name prefix the largest groups are Tripo (24), Recraft (20), Bria (19), Kling (19), ByteDance (18, i.e. Seedance/Seedream), Luma (15), Vidu (15), Flux/BFL (12), Wan API (12, incl. Wan 3 reference/image-to-video), Gemini (10), MiniMax (9), PixVerse (9), Meshy (8), ElevenLabs (8), Rodin (7), HeyGen (7), Grok (7), OpenAI (7), Runway (7), Tencent (6), Ideogram (6), plus Magnific, Fish, Topaz, Krea, Reve, LTX, Sync, Beeble, Veo, Claude and Higgsfield entries. Implication: a single ComfyUI graph can mix local open-weight models with hosted clo...
• articleHow do creators wire Claude to AI media generators via MCP to produce a faceless YouTube video, and what claims should be discounted?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. malvaAI (2026-07-07, Higgsfield-sponsored) shows Claude (Claude Fable 5 selected) researching a niche ("Backrooms") and drafting a video structure, then adding Higgsfield as a custom MCP connector (Claude settings > connectors > custom connector, URL copied from Higgsfield's MCP page) so the same chat generates GPT Image 2 stills and asks for Seedance 2.0 animation prompts per image (15-s multi-shot clips), runs a vendor "virality predictor" on early clips, revises narration, generates thumbnail options, and voices lines with ElevenLabs inside Higgsfield (voice clone only with permission), then edits in CapCut; Higgsfield also offers an agentic "supercomputer" with reus...
• articleHow do you "AI-render" a 3D layout locally (3D passes -> video model), and how did the best local approach change from Feb to Aug 2026?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Three Mickmumpitz videos trace one pipeline across 2026. Feb (V1): Inner-Reflections' VACE + SkyReels V3 R2V merge (Apache-2.0 card) reads control passes (VACE) and reference images (SkyReels); export an outline pass (Blender Workbench flat black + white outlines, or Freestyle as a render pass) and a normalized/inverted Z depth pass with a contrast curve; outlines keep composition but let the model invent detail, depth follows geometry more tightly, blend both if needed; keep control-net strength low for start-frame image generation (Z-Image Turbo + control nets); free workflow ~120 frames at 24 fps; paid version chains 81-frame chunks with 11 overlapping start frames f...
• articleHow can you puppeteer AI video with physical props or rough animation (Time-to-Move), and how reliable is it?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Mickmumpitz (2025-12-17): Time-to-Move (TTM, Apache-2.0 repo) is training-free and works with diffusion video models (he uses Wan 2.2; paper also names CogVideoX and SVD). Make a control video by moving toys/cutouts on a stick or by rough After Effects/Blender animation; TTM's "dual-clock denoising" uses lower noise where the character moves (follow the motion) and higher noise elsewhere (clean background). His ComfyUI prep: SAM 3 masks the character (add negative clicks on the stick), Qwen Image Edit removes the stick in start/end frames (also fix hovering by masking larger and prompting "stand on the table... do not change the look"), then TTM with start+end frames fo...
• articleHow do you build a local AI VFX shot pipeline with mask + driving video + control nets + reference images (Wan VACE/Phantom merge), and what fails?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Mickmumpitz (2026-03-30) uses a community merge of Wan 2.1 VACE (in/outpainting guided by depth, Canny edges, pose) with Phantom (up to four reference images for identity), published as Inner-Reflections/Wan2.1_VACE_Phantom. Building blocks: (1) black-and-white mask (only white is regenerated), (2) driving video = modified plate + control signal, (3) reference images (one = start frame; more = style freedom), (4) detailed prompt (LLM-"proofed" but without camera description). Controls: tracking markers drawn as white squares let the model reproduce camera motion; Canny keeps exact detail, depth allows more new detail; OpenPose plus a back-view reference kept a creature ...
• articleHow does 4D Anyone create a 4D Gaussian-splat capture of a person from one phone video, and what are its limits in a ComfyUI port?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Mickmumpitz (2026-09-11) ports the 4D Anyone paper (ant-research, Apache-2.0 repo) to ComfyUI: from one (ideally tripod) vertical phone video, a 3D skeleton locks pose per frame and a fine-tuned video model generates up to ~48 consistent synthetic views (it keeps already-generated angles in context and reshuffles which views generate together: far-apart first for shape, neighbours later for smooth transitions), then gsplat trains per-frame Gaussian splats. He swapped the original skeleton code (not licensed for commercial production) for Meta SAM 3D Body (SAM License) and bundled a gsplat setup script. Settings: camera preset (high-quality vs quick 16-view), Turbo on (l...
• articleHow can you generate an explorable 3D Gaussian-splat world from one image or prompt locally, and which world-generation approaches failed on consumer hardware (per Mickmumpitz, Aug 2026)?
  Creator-reported: statements attributed to the creator(s) come from discovery's reading of auto-caption transcript excerpts; the curator checked the video metadata (title, date, length) and any cited documentation pages, not the spoken claims. Nothing was tested; promotional or sponsored framing applies where stated. Mickmumpitz (2026-08-25) reports weeks of R&D: Apple SHARP (single-image to splat in one pass) stitched across 360-degree slices produced seams and fell apart off-axis, and its licence did not suit commercial users; Insta360 UniSarp (360 to 3D) degrades quickly when moving; HunyuanWorld 2.0 needs two large models resident and targets 4 GPUs; NVIDIA Lyra ran but needs 91 GB of checkpoints, Linux-only, 6-minute first start; World Labs Marble is fast and crisp but restricts movement area and lacks working reflections. Chosen base: Skywork Matrix-3D (MIT): 360 panorama -> depth (MoGe) -> rough mesh -> render camera paths -> Wan 2.1 video model + a lightweight LoRA in-paints...
• articleBeyond the 28 decorators in server.py, which HTTP routes do the user, settings, model, custom-node, subgraph, node-replacement, internal and asset modules register at the pinned commit, and which only read versus change server state?
  Partially verified: the curator re-read none of the cited sources; S1, S2, S3, S4, S5, S8, S10, S12 rest on the producer's pinned reading. At commit 1a82e6d, files read: 44 further route registrations sit outside server.py's own 28: 20 from UserManager (incl. AppSettings), ModelFileManager, CustomNodeManager, SubgraphManager and NodeReplaceManager (each also served under /api, so 40 URLs), 5 under /internal, 16 asset routes and 3 export/task routes with literal /api paths. By HTTP verb 27 are reads (GET/HEAD) and 17 change state (users.json, comfy.settings.json, userdata files, asset database rows, asset scans, terminal-log subscription). The verb is not a clean read/write marker: some GETs create directories or write access times, so G43's read/write split needs these corrections.
• articleWhat is ComfyUI's V3 node API (schema, entry point, versions), how does the server load it next to V1 nodes, and which stability and secrecy limits should an agent check before writing or installing a V3 node?
  Partially verified: the curator re-read none of the cited sources; S17, S23, S22, S21, S18, S19, S20 rest on the producer's pinned reading. V3 nodes subclass io.ComfyNode, declare an io.Schema in define_schema and implement a classmethod execute; a module exposes them through an async-or-sync comfy_entrypoint returning a ComfyExtension whose async get_node_list lists the classes. The loader tries NODE_CLASS_MAPPINGS first, then comfy_entrypoint, registering nodes by schema.node_id and skipping a module with a warning if the entry point misbehaves. The versioned API is young: latest and v0_0_2 are STABLE False while a v0_0_1 adapter is STABLE True, which conflicts with the guide's statement that v0_0_2 is the first version. Hidden inputs can hand a node the Comfy account API key, so installing a V3 or V1 node is installing code that may see credentials.
• articleWhat do Unreal Engine 5.8 Chaos and networked-physics docs state about determinism and client prediction/resimulation?
  UE 5.8 docs describe networked-physics resimulation triggered when cached state 'differs enough' (no tolerance given); the only determinism wording found is the Chaos Vehicles Asynchronous Physics sentence, not a cross-machine guarantee. Curator GET on 2026-10-21 returned both pages readable.
• articleWhich Unity documentation statements, if any, say floating-point results will match across platforms, and under what conditions (Burst FloatMode, Unity Physics, Havok)?
  Burst 1.8.31 docs scope FloatMode.Deterministic to 64-bit, Burst-compiled code with deterministic inputs; the Unity Physics 1.3.15 overview asserts determinism without conditions and does not link to the Burst scope; Havok Physics for Unity is documented as similar but not identical to Unity Physics. Bytes match producer pins.
• articleAt Godot 4.7.2-stable, what sequence of checks over .import files, .godot/imported cache files and recorded hashes decides whether an asset is reimported, and which edits trigger a reimport?
  At Godot 4.7.2-stable (tag ref -> ed1daf0b) the reimport decision is layered: modification-time comparison during scan only queues a test; the test checks the .import md5, then import metadata, then source/dest md5 from a separate .md5 file; the cache base name is keyed on the md5 of the res:// path; docs (godot-docs 9adca4c1) say to commit .import files and that erasing .godot/imported triggers reimport (static reading).
• articleWhere do the ComfyUI docs and docstrings about IS_CHANGED / fingerprint_inputs / not_idempotent differ from the pinned code, and which releases changed how outputs are reused?
  Two documentation statements are looser than the code at the pin: the V3 fingerprint docstring says 'same value as last run', while the code makes the fingerprint part of a dict key (so older keys may still hit in LRU/RAM-pressure caches), and the V3 table says not_idempotent nodes 'always re-run', while the code only appends the node id to the signature. The V3 docs say nothing about how fingerprint_inputs interacts with Autogrow/MatchType/DynamicCombo (negative result, one page). Release milestones for caching changes are listed, but the question of which one first changed reuse relative to the legacy docs cannot be settled from what was read.
• articleWhich ComfyUI command-line flags control output caching, what exactly does each do, and what is the default?
  At the pinned commit there are four mutually exclusive cache options plus --high-ram: --cache-ram [GB [GB]] (RAM-pressure caching, stated to be the default), --cache-classic, --cache-lru N, --cache-none, and --high-ram, which sets classic caching. Only --cache-none stops cross-run reuse of outputs; the others all use the same input-signature keys and differ in what they evict. The default was not always RAM pressure: at two earlier commits the default was classic. The commit/release that switched the default was not located.
• articleIn ComfyUI's cache, exactly what happens when a node's IS_CHANGED / fingerprint_inputs returns NaN, raises, or returns a changing value, and does it affect downstream nodes?
  At the pinned commit the fingerprint value is one component of each node's signature, and the signature of a node also contains its ancestors' fingerprints. A NaN, a fresh float NaN produced by an exception, or any value that differs between prompts therefore gives a different cache key, so the node and everything downstream of it is not found in the output cache and runs again. The docs state this for NaN (NaN is unequal to anything); the code and a maintainers' comment agree, but the mechanism is Python equality/hash of nested frozensets, which was read, not run. One edge is inferred from code reading only: a NaN object that is the same object every run could compare equal by identity.
• articleAt Godot 4.7.2-stable, how do resource UIDs (.uid sidecars, uid in .tscn/.tres headers and in .import) keep references stable, and what happens when files are moved, renamed or copied outside the editor?
  At Godot 4.7.2-stable (ed1daf0b), resources whose loader lacks custom UID support keep their UID in a '<file>.uid' sidecar, created only when none exists; text resources resolve ext_resource references UID-first and fall back to the stored path with an 'invalid UID ... using text path instead' warning; the UID registry is cached in uid_cache.bin under the project data path; the class docs state the sidecar rule.
• articleWhat preconditions does GGPO state for rollback netcode (determinism, fixed quanta, saveable state), and how does it detect violations?
  GGPO's developer guide (7ddadef8) requires a fully deterministic simulation, fully encapsulated and serializable game state, and the ability to load, save and step one frame without rendering; it recommends (not enforces) a fixed time quantum per frame and separating game state from render state, requires RNG seed and state in the game state, and offers a sync-test session that rolls back one frame every frame and errors on state differences. Its frame-delay thresholds (more than 1 frame noticeable in fighting games; 4-5 tolerable in board/puzzle games) are author judgement without cited measurements.
• articleAddendum to C3-B396-01: what ComfyUI "governance enforcement for custom nodes" does
  PR #16167 (merged 2026-10-06): normal installs are unchanged (GOVERNANCE_REQUIRED False; initialize returns early). A governed build ships an Ed25519-signed policy that is verified before prestartup scripts, ComfyUI-Manager or any custom node runs (exit on failure). Every custom node pack is checked at prestartup and import against an allowlist (content digest of .py/.pyd/.so/.dll/.dylib/.js etc.) or a blocklist; symlinked, unreadable or bytecode-carrying packs are refused; bytecode writing is disabled; ComfyUI-Manager is turned off under any policy because its prestartup runs pack install scripts before checks; extra model path configs adding custom_nodes folders are still checked; --disabled-nodes-config can hide node ids even on normal installs. Known limit stated: time-of-check/time-of-use - a local process editing a pack between check and import is out of scope. Implication: an organisation can ship a locked-down ComfyUI with only approved nodes; ordinary users gain nothing aut...
• articleWhat changed in ComfyUI v0.39-v0.42 (5-19 Oct 2026) that matters to AI video/image production?
  From the GitHub release notes. Camera/shot control: CameraAngle node outputting camera_info and a shot prompt, CreateCameraInfo node + CameraInfoState widget (v0.40.0). Reference/latents: ReferenceMultiLatent node (v0.41.0), latent-geometry nodes, LatentOperationBlend with start/end percent. Colour pipeline: ImageSDRToHDR node (v0.41.0); Save EXR gains 16-bit float and it becomes the default for "exr", EXR compression, EXR previews in assets; higher-quality Save Video encoding defaults (v0.39.0). Local models: MiniMax H3 support work (LightVAE, LynnReal light VAE, tiled VAE blending, single images decoded as first latent), FLUX 3 Image (v0.41.0), MOSS-image (v0.42.0; v0.42.1 fixes crashes in its template), Qwen 3.x/3.5 speedups and low-VRAM fixes, native LoRA stack loader nodes. Operations/security: "governance enforcement for custom nodes" (PR #16167, v0.40.0); new --offline and --disable-partner-nodes flags, --disable-api-nodes deprecated (v0.39.0); cryptography dependency removed...
• articleWhat memory thresholds does the RAM-pressure default use, how did they change between the flip commit and v0.23.0, and where do the PR description and code disagree?
  At the flip commit 5aa5ccc9 the default thresholds were active 25% of RAM (4-32 GB) and inactive 75% (12-96 GB). Three days later commit b30e980a (PR #14089, listed in the v0.23.0 notes) lowered them to active 10% (2-10 GB) and inactive 100% (max 96 GB), with the stated reason that many users have 'it just fits' workflows. The PR #13802 description says the second argument defaults to 25%, which contradicts the 75% in the merged code. The same release also reverts the 'disable non-dynamic smart memory' step of #13802 (PR #14183). Net behaviour at v0.23.0 was not read from main.py at the tag.
• articleWhat does Epic's public documentation say about how the Derived Data Cache decides an entry is invalid or must be regenerated?
  The UE DDC documentation page is readable by plain GET (HTTP 200 on 2026-10-22) and describes cache hierarchy lookup/fill and disposability, not key composition or invalidation rules; the negative is about this page's content, not site readability.
• articleWhich engine docs claim, deny or condition deterministic simulation, and what do they say about fixed timesteps?
  Godot's docs (0914a4d4) state that physics in Godot, regardless of which physics engine Godot uses, is not deterministic.
• articleI updated ComfyUI and memory use or caching behaviour changed: from which version is RAM-pressure caching the default, and which flag gives me the old behaviour back?
  With no cache flag, ComfyUI at tag v0.23.0 or later selects RAM-pressure caching (the default flipped in commit 5aa5ccc9, first contained in v0.23.0; v0.22.x tags are not affected). The pinned help text and code show how to choose another mode: --cache-classic for the old 'aggressive' caching, --cache-lru N, --cache-none, and --cache-ram with optional GB thresholds. A later option, --high-ram (listed in v0.25.0 notes), also selects classic caching in code. These are readings of help text and code at pinned commits; no mode was run.
• articleWhich ComfyUI commit made RAM-pressure caching the default cache mode, which release tag first contains it, and what do the commit message, PR description and release notes say?
  At the pinned data (observed 2026-10-22), the default flipped in commit 5aa5ccc9e02aec94cf43e0f71d4b2f62b204b5b6 (2026-05-21T00:03:58Z), the squash of PR #13802 'Multi-threaded load of models from disk ...' by rattus128. Its parent 4d6a058bf1dd18fb6d4594081c3f9a7575c97256 still has --cache-ram opt-in (default 0, CLASSIC in main.py). GitHub's compare API says the commit is contained in tag v0.23.0 (tag commit a88e02b18576283b1ff25a4b564548c5dc42cbf6, release published 2026-06-01T17:56:51Z) and not in v0.22.0-v0.22.3, so v0.23.0 is the first tag among the tags listed that contains it. The rationale sits in the PR description (new mmap-free loader, committed pinned memory on Windows); the release notes name only the PR title and do not mention the default change.
• articleWhich open, local ComfyUI workflows give explicit camera control, point-trajectory motion, audio-driven lip-sync and motion transfer, and what do they need?
  ComfyUI official tutorials (captured 2026-10-23), all Wan-family (Wan licences Apache-2.0 for 2.x per C3-B370-03; check each repo): (1) Wan2.2 Fun Camera Control (alibaba-pai/Wan2.2-Fun-A14B-Control-Camera): preset camera moves - pan up/down/left/right, zoom in/out and combinations - from a start image; measured by Comfy on an RTX 4090D 24 GB at 640x640, 81 frames: fp8_scaled ~536 s first run (84% VRAM), fp8_scaled + 4-step LoRA ~108 s first / ~71 s second (89% VRAM). (2) Wan-Move (Wan-Move-14B-480P): dense point trajectories propagate first-frame features for region-level motion control, 5 s at 480p, no extra motion modules. (3) Wan2.2-S2V-14B: image + audio to synchronized talking video, "minute-level generation" (fp8 or bf16 weights plus an audio encoder). (4) InfiniteTalk (on Wan2.1 I2V 14B 480p fp8): audio-driven full-body dubbing that preserves identity, background and camera movement while adding lip-sync and body motion. (5) Wan Animate 2: motion transfer from a driving vide...
• articleHow do you programmatically run ComfyUI workflows locally vs on Comfy Cloud (API endpoints, auth, progress), and what differs?
  Comfy's Cloud OpenAPI spec (captured 2026-10-23; marked experimental and subject to change) states Comfy Cloud "implements the same API interfaces as OSS ComfyUI for maximum compatibility": submit an API-format workflow JSON with POST /api/prompt (400 on invalid prompt, 402 when credits are insufficient), track via /api/jobs, /api/job/{id}/status and /api/history(_v2), fetch outputs via /api/view or the newer /api/assets (durable, tagged, content-addressed storage), inspect node schemas with /api/object_info, and receive real-time updates over a /ws?clientId={uuid}&token=... websocket (message types include status, execution_start, execution_cached, executing, progress, progress_state, executed, execution_success). Differences: Cloud requires an X-API-Key header (keys from platform.comfy.org); it ignores subfolder/overwrite (content-addressed storage) and the queue number/front fields (fair per-user scheduling); it adds billing usage, global subgraphs and workflow-template endpoints...
• articleWhat do the Comfy Registry docs claim about scanning, verification and versions, and what can be confirmed in Manager and core code?
  Comfy Registry docs (Comfy-Org/docs at 506a4a94) say all nodes will be scanned for malicious behaviour such as custom pip wheels and arbitrary system calls, and that nodes passing these checks get a verification flag in the Manager UI; the standards page prohibits eval/exec, runtime package installation through subprocess calls, and obfuscation. The pages give no scanning method, schedule or results. In ComfyUI-Manager code (a74929c6), Registry versions carry statuses such as Active, Pending and Flagged. The server refuses Flagged versions unless allow_flagged_nodepack_install is set or every --listen address is loopback; because ComfyUI listens on 127.0.0.1 by default, a default local install allows Flagged versions. The cm-cli install path also allows them unless the environment variable _COMFYUI_MANAGER_CNR_ALLOW_FLAGGED is set otherwise. ComfyUI core has a separate signed-policy mechanism that is off by default (GOVERNANCE_REQUIRED = False). Code read; nothing was executed.
• articleWhat do first-party and first-person sources document about the 2024 ComfyUI_LLMVISION incident and later supply-chain incidents, and how did Manager respond?
  A user's first-person report (post dated 2024-06-09, Wayback snapshot of 2024-06-10) says the ComfyUI_LLMVISION custom node shipped custom openai/anthropic wheels in requirements.txt that contained browser-data theft code. ComfyUI-Manager's security_check.py (earliest commit in the path history: 2024-06-09) detects that node and some pip packages, terminates ComfyUI and prints cleanup steps; the same file later also lists ultralytics 8.3.41/8.3.42 and litellm 1.82.7/1.82.8. Comfy Org's own post on the ultralytics miner (2024-12-05) says Windows was not affected and that Manager was updated to warn users and to pin ultralytics to 8.3.40. A Manager commit on the same day (5a61000d) adds that pin when a pip_overrides.json file exists; the pin is absent at the later commit a74929c6, and its removal date is unknown. No Comfy-authored post about LLMVISION was found.
• articleThe ComfyUI repository ships openapi.yaml: can I generate a client from it for my local server, or does it describe something else?
  openapi.yaml at the pin is a union spec that describes more than the local server.py. Of its 79 operations, 20 match a server.py decorator; 59 do not (assets, workflows, settings, billing, tasks, /health for a GKE ingress, etc.). It documents authenticated, cloud-style semantics (402/403/429 statuses, ApiKeyAuth/BearerAuth, 'authenticated user' scoping) and omits client_id and prompt_id from PromptRequest, which the local /prompt reads and the official examples send. It also says /api/interrupt cannot target a job, but the local handler accepts a prompt_id. A generated client should be treated as a draft: verify each call against server.py and prefer /api/jobs over the deprecated history routes only where the local server implements them.

More