Changelog

All notable changes to this project will be documented here. The format follows Keep a Changelog, and releases use Semantic Versioning.

Unreleased

1.0.2 - 2026-10-27

Changed

2026-10-27: Maintained source and extracted-package CLI qualification now uses owned headless Windows/Linux terminals for progress and Ctrl+C, with an independent durable runtime, bounded capture and explicit cleanup. Release qualification requires the nested terminal receipt to match its package and executable identity. Ordinary product deadlines and wait/cancel semantics are unchanged.
2026-10-22: Refresh Playwright maintainer tooling, Windows IPC/Linux credential and S3 client dependencies, and static-documentation renderer dependencies. Capture tooling follows the root exact Playwright pin; maintained desktop source checks retain independently verified pristine upstream checksums after Go graph refresh and enforce both archive and module-file entries without conflicts.
2026-10-24: Expand maintained test and qualification allowances through native/frontend, package/installer, CLI, source preparation, browser, release and diagnostic paths. Qualification now targets thirty minutes with a sixty-minute hard limit after verified readiness and a sixty-second provisional finalization reserve; outer job watchdogs retain cleanup headroom. Constitution 5.0.0 explicitly redefines the previous timing policy. Required functional/security/provenance checks, ordinary product deadlines and intentionally short failure fixtures retain their meanings. Help qualification records bounded monotonic progress for delayed-completion diagnosis.
2026-10-25: Keep the existing sixty-second worker/readiness deadlines and record fixed bounded progress inside each private probe directory. Native and child clocks remain separate, receipt observations are optional for backward compatibility, and only ephemeral worker observation requests gain disconnect cancellation. Diagnostic additions do not relax environment hashes, version checks or real processing acceptance. The bounded durable history uses checkpoints, preserving the catalog prohibition on raw observations payloads. Real Arcade functional qualification uses the maintained test request allowance while keeping the production transport cutoff and earlier caller cancellation unchanged. Maintained connected qualification waits for correlated owned-runtime readiness before issuing commands and retains bounded startup receipts.

Added

Actual-terminal wait acceptance verifies running/count progress, client interruption with continued durable work, explicit cancellation, timeout and failed work, plus JSON/quiet/redirected output controls. Compact platform receipts record natural exits and owned resource release without claiming installed-desktop or acoustic-quality coverage.
Maintained packaged CPU acceptance now prepares destination workers after self-contained restore, runs fresh held-out recognition/diarization and speaker matching, and verifies retained canonical media, profiles and completed work history. Versioned internal receipts distinguish this coverage from earlier recovery-only evidence and retain separate source/destination provenance, terminal work identities and unchanged qualification timing.
Worker inspection and failed setup now expose bounded stage, reason and timing facts through shared JSON, CLI and desktop summaries. Readiness retains observed role facts when its enclosing budget expires, and interrupted hashing preserves cancellation or deadline identity. Ephemeral inspection disconnects stop owned probes; managed receipts retain their original integrity checks. Maintained CPU qualification records fresh snapshot and repeated inspection measurements separately.
Reference-backed packaged Windows CPU qualification prepares managed workers through the normal CLI, measures real transcription and two-reader speaker-profile matching against frozen licensed references, and verifies query, timeline, playback and model recovery after source withdrawal. Compact receipts separate functional acceptance, measured quality limits, preparation and qualification; deterministic integrity and cleanup regressions run without inference in CI.
Maintained CLI fixture provenance and a bounded command/option coverage ledger derived from the executed binary, with image/package identity and explicit semantic, invocation, refusal and unverified dispositions. Installed qualification exercises spaces and non-Latin library/program destinations.
Windows native qualification records owned desktop/input conditions, completion timings and created-environment runtime identity separately from loader availability. Its show/focus join now allows ten seconds within unchanged outer deadlines, with real input and natural release still required.
Initial CI queue accounting reads the verified workflow creation record separately from attempt-record creation, which can occur after attempt start.
Desktop File > Exit uses the normal window shutdown lifecycle, works before library selection and preserves independently owned background work. Windows retains Alt+F, X and Alt+F4 behavior.
Windows setup EXE coordinates the native per-user MSI and retains full local package sources for failed-upgrade recovery. The raw MSI remains available with explicit engine recovery limits. Trusted release verification independently rebuilds the setup executable from reviewed source and compares its complete code/resource prefix.
Successful full-UI fresh Windows installation offers an independent, initially unchecked Open documentation choice alongside the existing checked client-launch option. It uses the invoking user’s HTML association and reports opening failures without changing the committed installation result.
Dedicated current-main website publication preserves original product releases and records separate site/product source identities, exact Pages/live-byte proof, five package-link checks and eight hosted landing screenshots.
Read-only public release and documentation verification compares the selected published inventory and original documentation with live pages, schemas, aliases and referenced resources, then rechecks the elected Pages deployment identity.

Fixed

Frozen screenshot source verification retrieves the exact pinned capture commit when later branch corrections and a squash merge leave no matching main ancestor. Complete version/source hashes, original PNG/receipt bytes and the shared Git deadline remain mandatory; retrieval disables prompts and leaves checkout and branch identities unchanged.
Terminal qualification drains final buffered output when child termination races the reader snapshot, retaining bounded exit/output diagnostics for a genuine missing observation or incorrect outcome. Required progress, exit semantics, natural cleanup and existing deadlines remain unchanged.
Update the maintained JSON Schema URI parser to fast-uri 3.1.9 in root and desktop tooling to resolve URI normalization and host/scheme confusion advisories.
Release preparation retains v1.0.1 workspace, model, preset, setup-draft and verified worker-receipt authority across the v1.0.2 upgrade. Current IPC and installed package identities remain exact, and retained documents keep field, credential and complete hash validation. The embedded worker catalog envelope advances without changing its resource pins or independently versioned licensed-media provenance.
Restored CPU acceptance requires explicit canonical recording identities unique across all source cases and positive integer source revisions. Missing authority, duplicate enrollment identities and malformed revisions are refused without inventing a baseline; existing destination lineage checks and historical source-only receipt behavior remain intact.
Worker environment snapshots resolve and enumerate declared dependency directories once, preserving file-link/reparse and Windows alias handling, full inventories and complete SHA-256 checks. Snapshot hashing and native receipt verification reuse bounded buffers across files. This removes repeated path work and buffer allocation exposed during managed diarization preparation while preserving the sixty-second probe deadline and all verification boundaries.
Fetched-profile qualification compares canonical destination and file identities, accepting equivalent Windows short/long path spellings while retaining owned-file, link, byte and digest checks.
Resolve the documentation renderer's DOMPurify advisories with a Mermaid-scoped 3.4.17 patch override, preserving rendering modes. Failed CPU qualification retains bounded operator reasons, invocation/runtime observations and cleanup disposition without retaining freeform messages or replacing its first failure.
Reference-backed election pins the committed corpus manifest before execution. Corpus admission enforces archive size/SHA-256 under optimized Python and uses one private verified snapshot for both parsing passes. Linux qualification tracks the owned session across nested worker groups, terminates exact process identities and verifies exit before reporting cleanup.
Community-1 padding-only turns with no decoded-source overlap are discarded and diagnosed before checking overlapping boundary overhang. A padding prediction no longer rejects otherwise valid activity; the overlapping 250 ms guard and strict generic timing validation remain in place. CPU acceptance retains numeric quality diagnostics and checks their exact recovery with processing provenance.
Cold credential-bootstrap qualification separates owned-launch overhead from its two-second CLI classification check and retains both in the invocation total. Reference-backed CPU acceptance rejects source drift and includes owned cleanup in phase timing.
Packaged qualification continues a recoverable pending work wait for the same work ID within its original 180-second operation bound. It retains 30-second wait requests and refuses failed, foreign or late results without restarting the deadline.
CI documentation and package-input installs retain npm advisory audits with bounded request/retry time inside existing operation limits, preventing a five-minute advisory request from exhausting a 180-second input stage.
Native Windows CLI/desktop executables declare a process-local UTF-8 code page so LadybugDB opens the selected non-Latin library path. Qualification and packaging apply the same manifest before signing, and independent current-source package verification requires it.
Windows packaged ExifTool locates its Perl runtime in non-Latin installation directories through a reproducible process-local UTF-8 manifest. Packages retain the original pinned launcher, exact unsigned transformation hashes and portable recipes for independent verification before signing.
Windows ExifTool capture sends UTF-8 filename arguments over stdin so non-Latin library paths survive system code-page conversion. Extraction retains redacted provenance and the original operation deadline. Package failure diagnostics close their SQLite connection before owned-directory cleanup.
Artifact corruption, truncation and missing stored objects report byte-integrity failures separately from revision conflicts. Trainer output must match its declared bytes before publication admission. Worker/model prerequisites retain bounded logical asset details through human, JSON and durable failure reporting.
Newly created worker directories normalize Windows default ownership before private-directory verification; existing directories retain their ownership checks.
Offline worker plans separate zero network transfer from nominal and verified local byte totals. Model previews check local protected-reference resolvability without contacting upstream services. Custom local trainer readiness verifies pinned files without invocation, and training-only pipelines check their elected tasks.
Work waiting retains one caller budget across readiness and polling. Caller expiry produces neutral continuation advice and preserves only observed work state, while independently reported startup failures retain their diagnosis.
Windows browser startup returns loader, asynchronous environment/controller and scoped setup errors without fatal callback termination or success fall-through. Failed frontend setup skips the ordinary development/production application loop; owning-thread cleanup waits for native callbacks and calls to return. Qualification verifies a controlled failed launch followed by a valid launch using the same disposable profile path, retaining the original native cases and deadlines.
Returned desktop startup failures preserve the underlying cause, show native GUI feedback and attempt bounded private events without allowing diagnostic storage failure to replace the startup error. Windows diagnostic files in ordinary inherited-Modify directories no longer require unnecessary ownership-changing access. New files with a different default owner receive the required private DACL before requesting ownership normalization; owner, identity, reparse, rotation and writer checks remain enforced.
CI qualification uses an eleven-minute advisory target and fifteen-minute hard limit after verified readiness. Receipts report target overruns without rejecting otherwise valid delivery; fixed input deadlines and applicable watchdogs share the hard limit. Native operation allowances, prerequisite accounting and required integrity checks remain unchanged.
Windows package consumers wait for explicit verified source, foundation and documentation readiness. Windows prepares dependency libraries through a verified same-attempt handoff before product builds and checks. Cold source preparation no longer races the 180-second transfer wait. Explicit cold-source campaigns isolate compiled caches without evicting ordinary CI inputs. An always-running elected acceptance aggregate rejects missing, failed, cancelled or unexpectedly skipped delivery results and over-budget qualification. First-attempt preparation and combined totals include initial queue time while qualification remains measured from verified readiness.
Windows startup diagnostics verify live process identity through the owned process handle and precise integral UTC timestamps, rejecting failed or inconsistent observations without relying on undefined exit-time data. The private wait-query helper authenticates the inherited input pipe and its live parent executable before accepting diagnostic targets.
Windows archive CI allocates concurrent CLI workload trees to three of its four CPUs, preserving the complete workload, native Exit cases and existing deadlines while keeping one CPU outside that workload's affinity mask.
Windows WebView convenience calls release their temporary settings and controller interfaces on success and failure, preserving caller-owned getter results and native error values.
Windows accelerator registration writes its event token into the caller's output value while preserving native error results.
Windows WebView callbacks return valid COM interfaces, retain native-owned targets until their final release and reject delivery into a closed desktop. Unused desktop objects remain collectible; late controllers close without reopening the destroyed owner.
Windows WebView controller initialization passes its monitor-scale setting as a native Boolean value instead of a pointer, adopting the upstream binding correction while retaining the maintained ownership and native-input fixes.
Windows WebView resource deferrals release their acquired COM references after completion instead of incrementing the reference count.
Release candidate collection verifies independent archives and copied bytes with bounded parallel workers, retaining every integrity check and writing its completion manifest only after all checks succeed.
Windows Alt+F forwards its original native system-key context to the File menu while the WebView owns focus, including inside offline help. Claimed keys retain their handled disposition. The native menu keeps keyboard input in its host while active and restores the prior child focus on cancellation.
Windows native desktop qualification uses disposable WebView profiles and observes normal owned-browser shutdown before reuse or removal. Failed fixtures retain their profiles for diagnosis. Cold and warm menu, close and Alt+F4 checks retain playback cleanup, background-work survival and exact-package proof gates.
Windows closes its WebView controller during owned-window destruction, releases retained COM interfaces and finalizes its owning COM apartment on normal exit. The pinned browser binding includes a maintained source patch with verified upstream and patched-tree checksums and explicit license notices. Native menu, process-job and installer calls retain pointer buffers for their complete native lifetime; installer source inspection errors preserve their original cause.
CLI help describes command purpose, option and operand meaning, defaults, dependencies and executable examples. Positional JSON and protected-input templates, maintenance operands, cursor instructions and training examples agree with execution.
Malformed and unsupported inputs retain generated reasons, known field locations and constraint bounds without repeating private values. Credential bootstrap and failed inspections no longer emit invented success states or zero receipts. Export destination errors explain filesystem corrections separately from revision conflicts.
Human output leads with identities, revisions, digests, task conclusions and valid continuation before optional detail. Capture metadata, facts and dates display readable UTF-8 interiors with exact byte-page authority. Model identities retain their original text and display ambiguous whitespace/control content explicitly.
Public text limits count Unicode code points consistently. Synthetic jobs support the advertised 1..600000 millisecond interval throughout parser, schema and catalog; catalog schema 10 widens the constraint while preserving historical migration identities and schema-9 snapshots.
Documentation capture verification finds complete matching ancestral snapshots even when the first changed file was unchanged in the capture's squash merge. Original images and capture receipts retain their recorded identity.
Native desktop Exit qualification retains separate bounded output streams, native child results and startup/action checkpoints, preserving controller errors that previously disappeared from CI failures.
Desktop selection controls keep square native glyphs inside full label targets. Compact form/card spacing and content-sized buttons reduce wasted space; wrapped headers and wide tables retain contained scrolling at the minimum window size and enlarged text.
Windows Installer repair restores files, registry and shortcuts without unnecessarily recaching its open package. Removal can also clean an advertised product without repeating the fresh-install license requirement. Windows Installer displays engine-driven execution progress, confirms cancellation and reports operation-specific success, cancellation and failure with terminal Finish/Close controls. Desktop Offline help uses one compact button and a controlled local documentation view, with actual native activation and local navigation checks on Windows and Linux.
Single-table catalog lists and model-name lookups read committed rows without reserving the SQLite writer, allowing imports and model downloads to continue while those reads run. Multi-table snapshots retain transactional consistency.
HTTP assertion extraction accepts canonical insonic-http and legacy http inputs, rejects ambiguous or spoofed responses, and retains current cue citations and original source clocks. Query assistance distinguishes provider authentication, missing routes/models, busy services, transport/protocol failures, deadlines and cancellation. Output limits explain artifact materialization, native results and provider responses without exposing external details.
Windows package qualification joins CLI and GUI activity before the runtime idle allowance, then observes executable-image release with bounded failure and owner diagnostics before fixture cleanup.
Graph and search continuation retrieves cross-page relationships and large result sets within bounded responses, binds the effective page limit, and distinguishes stale results from malformed offsets. Query/calendar filters share bundled timezone rules; saved-query examples require titles, native parameter files reject duplicate members, and native reads accept one trailing terminator with actionable grammar guidance. Function validation distinguishes read-clause grouping from calls and rejects qualified calls outside the declared pure subset.
Metadata refresh succeeds after acceptance when readers retain old report leases. Durable cleanup remains pending until retention clears; genuine cleanup failures take precedence and accepted retries retain their selected revision.
Playback MIME identifies canonical audio or preview bytes while preserving original-source observations. Embedded SubRip extraction uses the encoder present in the exact packaged FFmpeg build.
Manifest-only transcript import uses per-item recording targets and rejects media-replacement items before queueing work. HTTP transcript deadlines, byte ceilings and cancellation retain distinct durable causes, with literal corrective flags in human and JSON item notices.
Native query and explain RPCs use one bounded 25-second budget around projection publication and the engine's query deadline. Socket and caller deadlines report cancellation instead of malformed input.
Catalog-only media views and cleanup no longer rediscover and hash installed executable companions. Import and processing tool-use validation remains fresh; native WebView qualification emits success after cleanup.
Versioned screenshots retain their original capture-time provenance when backend source changes. Frozen-source verification uses bounded ancestral Git blobs, while image-byte checks and current native UI capture qualification remain mandatory.
CI shares source/run/attempt/hash-bound documentation exports across native jobs after verified prerequisite readiness. Documentation browser, native and installer checks remain mandatory; only restricted-session capture initialization can retry once after its exact startup timeout.
Landing-page downloads separate Windows MSI installation, portable Windows ZIPs and Linux tar.gz choices with explicit client/format labels, accurate platform guidance and spaced subordinate actions.
Go and Node setup actions are acquired in bounded, digest-verified job steps before normal local action execution, preserving their pinned code, setup inputs and cache post hooks. Historical candidates use bootstrap tooling from the exact defining workflow revision.
Hidden native WebView qualification waits for actual select options and committed React state, yielding UI actions through event-loop message turns instead of fixed timer sleeps. The existing 80/90-second watchdogs and every native assertion remain mandatory.
Release publication accepts documented main-workflow path forms and can supersede verified completed older release-workflow attempts for the same source while retaining every required CI/security gate and immutable tag/artifact checks.

Changed

Opening an older catalog with this source upgrades it to schema 10. Binaries limited to schema 9 cannot open the upgraded catalog; retain a prior backup when an older binary must remain usable. Current restoration still accepts schema-9 snapshots without changing their recorded identities.

Decisions

2026-10-15: Separate reviewed-main website corrections from immutable product release promotion. Use parent-fenced Git transport, retain independent source identities, verify deployed bytes and bounded live-response browser renders, and share same-run documentation exports to remove repeated native CI builds without weakening qualification.
2026-10-15: Recover interrupted publication through a reviewed trusted-main verifier correction rather than deleting check history, changing immutable v1.0.1 source or bypassing failed unrelated checks. Older release attempts require independently verified repository, main branch, workflow, source, suite and terminal-run identity.
2026-10-15: Repair the failed main-branch Windows package qualification in its UI driver after verifying the pinned loader clears browser environment overrides. Preserve foreground-free execution, ordinary application browser policy, all package/installer acceptance and the 660-second CI budget; do not turn a failed run green by skipping or extending its checks.
2026-10-15: Move only Go/Node action acquisition out of runner preparation into a three-attempt, 60-second digest-locked bootstrap. Preserve upstream action/cache execution and exact historical-source qualification. Verify live documentation after exact Pages promotion using original published bytes; report public binary metadata proof separately from downloaded documentation content proof.
2026-10-15: Verify landing choices in both publication states from the same product component, retaining candidate truth and all five official package destinations. Extend the isolated hosted-Linux browser verifier for full-page captures, target geometry, reflow and intercepted native link activation; do not launch an owner-desktop browser or claim these checks certify assistive technology.
2026-10-15: Reuse catalog retirement rows and runtime sweeps for retained media reports. Mark only proven retention deferrals internally, preserve real conflict/storage failures, and carry transcript corrections in existing durable notices so published versioned schema bytes remain unchanged.
2026-10-17: Use native Windows Installer progress subscriptions and operation-specific terminal dialogs. Share installed-help manifest validation between a controlled local-only desktop view and same-user Windows HTML association dispatch. Exercise real full-UI transactions and independent completion elections in a disposable ordinary-user Windows CI session; retain all silent, inventory and ownership gates within the 660-second job budget. Assemble the Windows ZIP/MSI/setup tuple once, qualify archive, interactive, maintenance and setup behavior on isolated hosts, then join exact asset hashes and complete evidence before candidate eligibility.
2026-10-17: Extracted Windows/Linux package checks exercise deterministic loopback HTTP extraction, provider diagnostics and operation-specific output bounds in the existing isolated fixture workspace. Production CI inference refusal remains in place. Canonical extraction configuration retains the legacy input alias, and strict JSON validation is shared below the catalog to avoid dependency cycles.
2026-10-17: Installed-package qualification adds generated query/graph continuation, timezone, save-example and native-parameter cases on Windows and Linux. Separate row/relationship continuation preserves existing response budgets, and old pagination-policy cursors conflict instead of mixing results.
2026-10-17: Add an owner-selected ordinary-user setup EXE around the exact MSI. The coordinator declares asInvoker, validates retained full MSI sources and prior installation choices before destructive upgrade work, and waits for supported public recovery in a fresh hidden process before returning the original failure/cancellation result. Embedded MSI containers and in-transaction recovery are rejected by focused native comparisons; raw MSI remains available with documented engine limits.
2026-10-19: Manual native-startup incident replay selects a statically pinned run/source/attempt and independently verifies its assets and ZIP inventory. This diagnostic cannot confer publication authority; production artifact attempts and all native gates remain mandatory.
2026-10-19: Preserve the advertised ten-minute synthetic-job capability with a forward catalog constraint migration, freezing historical schema-9 authority and retaining schema-9 snapshot restoration. Generate bounded input constraints from packaged contracts and preserve exact identity text without normalization. Separate cold native compilation from full acceptance while retaining the complete package/tag matrix, 180-second child bounds and eleven-minute hosted job cap. Prepare independent Windows proof consumers alongside assembly, then require its successful exact-run artifact before consumption and retain every final proof gate. Prepare the candidate reader and qualified Linux/docs inputs while Windows finishes, then require both successful Windows package producers before final collection.
2026-10-19: Maintain the pinned Windows WebView binding as verified repository source so owned-window destruction explicitly closes its controller. Preserve original upstream checksums and licenses, verify the exact patch tree and allow only its declared local replacement through package notice verification. Real native release, original deadlines and every exact-source delivery gate remain required.
2026-10-19: Native asset preparation reuses checksum-verified atomic acquisition with bounded transient retries. Candidate collection overlaps independent verification and copy/hash work with four workers while retaining deterministic metadata, private verifier scratch directories, all producer/proof gates and final completion authority.
2026-10-19: Correct the pinned WebView resource-deferral Release dispatch with a native reference-count regression and checksum-bound source allowlist. Keep unresolved startup observations separate from demonstrated ownership corrections.
2026-10-19: Adopt the verified go-webview2 v1.0.23 native Boolean ABI correction, preserve the explicit maintained lifecycle patch and checksum-bound corresponding source, and keep unresolved startup/process-release observations separate from the demonstrated argument correction.
2026-10-20: At the owner’s direction, constitution 3.1.0 separates verified source prerequisite preparation from the 660-second qualification phase, reports preparation/qualification/combined elapsed time and counts phase queue time. All elected checks start after readiness. A provisional aggregate retains fifteen seconds for finalization; terminal timestamps remain required for final timing claims. The bootstrap declares the elected acceptance check without implying live protection has already changed.
2026-10-21: At the owner’s direction, constitution 4.0.0 changes qualification to a 660-second advisory target and 900-second hard limit, retaining verified readiness, phase/queue reporting, terminal timestamp authority, the fifteen-second provisional reserve and all mandatory elected checks. Align active qualification watchdogs and shared input validation; retain native operation and unrelated preparation/release/deployment limits. Preserve old-policy failed receipts and obtain fresh normal-workflow acceptance.
2026-10-21: Derive CLI coverage from executed help and reuse the existing installed qualification helpers and verified package identity. Index reusable fixture owners instead of preserving ad hoc audit transcripts. Keep semantic assertions distinct from successful invocation and observed refusal; include spaces/non-Latin installed destinations without adding another test matrix or changing qualification deadlines.
2026-10-22: Correct the pinned Windows ExifTool launcher's ANSI install-path handling through a deterministic packaged-copy manifest transformation before signing and inventory. Preserve upstream cached bytes, original resource contents and source reproduction evidence; retain mandatory Unicode capture checks and existing timing limits. Apply the same process-local code-page contract to native CLI/desktop executables after demonstrating the later LadybugDB parent-path failure.

Fixed

2026-10-25: Confine application-capture and documentation-browser fixtures beneath designated temporary or ignored build parents on Windows and Linux. Public application captures choose scratch outside both home and program directories, resolving aliases before selecting actual temp or ignored repository build scratch. Reject volume/share roots and root aliases, retain cleanup responsibility through marker/profile initialization failures, verify allocation identity before removal, and report residual locations when child release or removal fails. Browser qualification now exercises both tools on both supported platforms with retained location and post-run absence evidence.

1.0.1 - 2026-10-15

Resolve contextual CLI help before effects and preserve literal arguments, atomic option values, scalar/Boolean arity, repeatable speaker selectors and early invalid-command diagnostics. Include operation-specific JSON-file templates and contracts.
Repair shared settings dispatch, initial speaker-model listing and protected vault deletion against live or stopped runtimes.
Preserve exact signed integer values and distinguish captured local timezone policy from explicit timezone selections across prepared/replayed date inputs.
Preserve classified durable failures through show/results/wait, reload and portable proofs, including acquisition checksum, limit and timeout causes.
Normalize all machine output to runtime-response envelopes with success on stdout and failure on stderr; failed waits retain both result and error. Consumers of formerly bare local/maintenance output must unwrap result. Output delivery failures return a nonzero status.
Retain read compatibility for persisted 1.0.0 workspace/tool/document contracts without rewriting historical bytes, profile identities or generic failure receipts. Current transport/package versions remain exact.
Add readable bounded CLI results, exact document/page and lease actions, interactive work progress, partial-date warnings, truthful credential state and generated operation-specific corrections.
Report hidden runtime startup failures promptly and support verbose/debug/quiet controls with explicitly elected private bounded diagnostic logs.
Retain incompatible model inspection identity, acquisition/verification readiness, manifest file roles and dataset preparation readiness. Model materialization now returns an object containing named files and readiness instead of a bare positional array; consumers must read result.files. Execution eligibility and frozen identities remain unchanged.
Add revisioned workspace import presets shared by the CLI and desktop, with applied filesystem/S3 destinations, date policy and optional frozen pipeline elections. Reject unresolved selections before enqueue and retain effective choices and deterministic processing children across retries.
Replace unsupported current documentation commands with executable input files, observed ID/revision steps and extracted-package qualification. Clarify mapping concurrency, admitted partial-date results and current manual setup capabilities; preserve immutable historical documentation.
Withdraw macOS support in 1.0.1. Windows/Linux x86-64 retain CLI-only and Desktop + CLI packages; this release requires four variants. Historical 1.0.0 packages, documentation and six-variant record validation remain unchanged.
Explain package inclusion, prerequisites and complete Windows ZIP installation/update/removal; copy through alias-aware owned attempts with atomic promotion, and preserve existing/substituted directories on failure.
Add complete shared CLI/desktop backend plans, non-mutating readiness preflight and explicit fresh provisioning with protected credentials before catalog connection.
Add native Ollama query assistance, metadata-only service/model discovery, explicit inference-route election, synthetic task receipts and cancellation of underlying desktop operations.
Reject remote PostgreSQL profiles mislabeled local; retain verified TLS by default and provide explicitly named insecure remote transport.
Qualify cache/restore 6.1.0, artifact upload 7.0.2/download 8.0.2, setup-node 7.1.0, Next.js 16.4.0 and the Go runtime dependency group. Require explicit archived artifact uploads, extracted downloads and digest failure, with repository checks rejecting mutable artifact pins and missing attempt fences regardless of action-name case. Retain controlled qualification output on timeout after terminating its process tree.
Derive Go package notices from the modules linked into each shipped executable, reject missing or mismatched upstream source/license evidence, and independently check candidate inventory membership. Exclude unused tooling modules without downloading their graph.
Update x/net to 0.61.0 and the docs renderer to Mermaid 12.2.0 with KaTeX 0.18.2, covering inherited trust-option handling and actual public/offline SVG theme rendering.
Add shared managed CPU worker setup, exact builtin model acquisition/local reuse, protected token registration and five-task readiness across CLI and desktop Settings. Preserve frozen environments, devices, destinations and settings revisions; package complete optional acquisition metadata and hash locks.
Add optional, resumable first-run setup across CLI and desktop, with editable library location, backend selection before fresh provisioning, five saved stages and explicit task readiness. Preserve accepted settings and durable work on skip/defer, reconcile repeated saves and reject stale progress writes.
Add an unsigned per-user Windows MSI with selectable Desktop/CLI clients, optional branded integrations, transactional maintenance and a useful selected-client launcher. Preserve the four archive choices and add independent MSI payload/source qualification.
Preserve explicitly selected program locations during upgrades, check active work in both installation roots and refuse unrelated exact-name shortcut replacement.
Keep desktop grid content aligned to the start of its viewport so tall windows do not stretch setup and form rows into blank gaps.
Add version-matched unsigned Windows installation guidance and repeatable headless application/native installer capture tooling with explicit renderer, fixture and exact-source receipts.
Restore deterministic real-backend lease-fencing qualification and allow eleven minutes for active CI/release jobs. Preserve operation-specific timeouts and all security/integrity gates.
Add manifest-elected current documentation routes and explicit archives, with shared mobile disclosures, readable reference pages and keyboard/reflow improvements across public and offline help. Link the README company attribution.
Finalize the 1.0.1 release cut, correct historical release labels and require publication-target site, diagram and browser qualification before documentation archival.

Fixed

Read every page of exact-source GitHub checks before publication, retaining required checks, external failure/pending rejection and verified current-workflow suite exclusion. Reject incomplete, duplicate or changing inventories before release writes.

Decisions

2026-10-11: Correct the publication verifier's first-page limit after complete qualification and launch together exceeded 100 checks. Keep the qualified immutable v1.0.0 source/tag unchanged and execute the corrected verifier from reviewed protected-main tooling against that ancestor.
2026-10-11: Keep startup transport separate from detached lifetime: one bounded report, one child wait owner and one ten-second deadline cover the client handshake. Log only generated context, using three bounded data files and a private empty coordination lock; diagnostic input/tool/provider payloads are excluded. Model readiness remains response-only and named file roles come from immutable manifests.
2026-10-11: Save import choices in a bounded typed catalog registry; publish/read by immutable storage profile revision. Preset values precede manifest defaults/items and explicit CLI overrides; capture local timezone only after resolution. Elect existing processing contracts and reconcile child identity after admission. Current documentation examples qualify extracted binaries using deterministic adapter fixtures without inference.
2026-10-12: Execute documented post-install processing/training against owned loopback fixtures in a separate disposable workspace. Retain CI refusal in the main runtime and all guard tests; permit the established detached runtime owner to restart between package qualification journeys.
2026-10-13: Keep first-run orchestration metadata separate from accepted configuration/work. Persist normalized bootstrap identities before provisioning and qualify setup retry/readback plus ordinary import after deferral in native package checks.
2026-10-13: Constitution 3.0.0 implements the owner-directed removal of the macOS platform obligation. Remove owned Darwin runtime/build/signing paths and macOS CI/release dependencies while retaining every Windows/Linux/backend integrity lane. Read historical version schemas as data under trusted current validation rather than changing published records.
2026-10-13: Windows copy attempts are created and held through native directory handles. Resolve source/parent aliases, create a unique absent attempt atomically, preserve locks through no-replace promotion and delete failed owned objects by handle without following reparse points. Program files and persistent user data remain separate; current runtime shutdown uses existing idle exit.
2026-10-13: Keep backend preflight outside mutating owner startup; fresh provisioning publishes configuration after selected catalog/storage preparation and retains identical generated-plan and credential-backend retry identity before mutations and on completed retries. Observe selected S3 bucket access and initialize graph schema/owner before success. Native Ollama translates into the existing validated query contract and separates endpoint location from actual model routing. Preserve cloud support without assuming upstream structured-output support.
2026-10-13: Add initial credential/bootstrap and read-only PostgreSQL qualification to the existing bounded adapter CI lane. Explicit insecure transport preserves elected remote plaintext while removing the misleading local label.
2026-10-13: Consolidate seven dependency updates into one complete Windows/Linux qualification boundary. Preserve verified cache keys, source/attempt identities, four-package candidate completeness and frozen historical documentation; retain the original bot PRs until consolidation merge. Runtime updates include the required text/sync closure without changing Go or native library pins. Preserve flat and nested historical Next segment URLs only through exact verified counterparts beside the same page. Keep the 180-second qualification child and ten-minute job bounds; retain controlled timeout checkpoints after terminating owned descendants.
2026-10-13: Resolve shipped Go membership from executable build metadata, check selective source identities against the canonical module cache, and record effective versioned replacement sources without changing inventory fields. Pin Mermaid's KaTeX resolution to the elected patched 0.18.2 rather than silently taking a later range match. Render exported diagram sources with a bounded hidden browser and private temporary profile; final qualification retains all native/backend/source and publication boundaries.
2026-10-13: Authenticate selected cached module files against the executable's Go h1 sum and copy the notice bytes captured by that verification. Recorded cache metadata and copy equality alone cannot establish upstream evidence; do not reread mutable source notices afterward.
2026-10-13: Prepare local engines through private isolated CPython/uv environments and complete platform wheel hashes. Record and revalidate runtime/dependency bytes before frozen work; reuse unchanged accepted environments. Model preparation retains immutable builtin roles and first-elected storage/credentials, strips cross-origin tokens on official CDN redirects and reports prerequisite readiness separately from inference. Request Windows ownership transfer only when the directory owner changes; retain private protected ACL verification.
2026-10-13: Author Windows Installer tables/cabinets through native Windows APIs, retain shared runtime bytes for Desktop-only and omit global PATH/prerequisite acquisition. Model MSI separately from the four archive receipts; maintain strict payload/source/help/license identity and transactional ownership.
2026-10-13: Retire native installer UI probing on the owner host after an isolation/cleanup failure affected unrelated windows. Local captures use verified headless Chromium and real shared runtime fixtures; native installer UI/lifecycle run only on disposable CI runners. Cleanup targets owned process trees and never desktop-wide windows. Launcher label proposals require explicit owner signoff before shipping.
2026-10-13: Separate MSI qualification from independently verified same-run archive assembly. Use exact owned native API workers with checked logging and bounded diagnostics, retain unchecked shortcut elections through upgrades, and publish screenshots only after clean-source validation and verified fixture/browser cleanup.
2026-10-14: Constitution 3.0.1 applies the owner-approved additional minute to the active CI policy (660 seconds). Test real lease authority against guarded durable fixture states rather than wall-clock sleeps; production lease duration remains unchanged. Render full current-documentation aliases statically so no-script readers, fragments and offline files retain content, while explicit version URLs preserve historical identity. Use native disclosures and governed semantic styles for shared documentation navigation; automated standards evidence states its assistive-technology limits.
2026-10-15: Finalize the existing unpublished 1.0.1 cut without weakening newer-version/no-overwrite preparation guards. Correct known historical release status through current metadata and render-only overlays, qualify publication-target site/diagram/browser output before archival, and publish/promote only a fresh reviewed squash-main candidate after owner merge.

1.0.0 - 2026-10-11

Compatibility

Current insonic workspace/runtime envelopes and master JSON contracts identify version 1.0.0. The preserved 0.0.0 tree remains a specification baseline, not a deployed product data migration. Cueson transcript versions and catalog schema revisions retain their separate compatibility rules.
Native packages have no configured publisher signing identity or notarization. macOS ARM64 retains platform-required ad-hoc loader signatures. Required qualification does not establish acoustic prediction or speaker-identification accuracy.

Decisions

2026-10-09: Constitution 2.2.1 removes a hypothetical pre-v1 bulk audio-migration obligation where no deployed data requires it. Explicit replacement, normal catalog/schema evolution and transcript-version interoperability retain their independent integrity contracts.
2026-10-09: Freeze model aliases and configured catalog selectors into exact complete bundle identities before durable acquisition. Shared acquisitions precede dependent processing without occupying waiting worker slots. Explicit manifest catalogs preserve configured transport rules; direct provider downloads are not advertised without their own qualified adapter.
2026-10-09: Extend cross-process CLI and source/relocated native WebView qualification with synthetic model catalogs and tiny verified bundles. Required package receipts include the model-reference journey; acoustic engine loading and real weights remain excluded.
2026-10-09: Implement S013 for speaker-model training/retrieval and roster-constrained matching. Catalog schema 9 freezes schema-8 migration bytes, adds receipt-validated immutable outputs/checkpoints and revisioned current profiles, and distinguishes manual from automatic mappings. Current-reference preparation and frozen admission prevent stale evidence publication; retained outputs preserve their originating identity.
2026-10-09: Add elected pinned local and configured HTTP speaker-training adapters, saved exact training profiles and bounded batch embedding reuse. Required checks use deterministic adapters and synthetic vectors; real acoustic quality remains separately measured. Include the new desktop speaker-model entry point in the frontend fixture build.
2026-10-09: Implement S014 portable backups and release readiness. Preserve receipt-backed catalog authority during destination relocation, retain only current/durable byte assets, pin explicit reference-only backup dependencies and rebuild graph materialization from accepted evidence.
2026-10-09: Replace incomplete third-party media binary source accounting with owned pinned source builds and package corresponding sources/build inputs. Add CLI-only native variants, configured signing before final hashes, exact-version release candidates and verified draft-first publication before documentation promotion. Product release publication remains a separate maintainer action.
2026-10-09: Include the pending setup-go 7.0.0 and runtime Wails 2.16.0, x/crypto 0.57.0 and x/net 0.59.0 dependency changes in the same native/backend qualification boundary. Preserve edited issue history while applying canonical taxonomy to new planned outcomes.
2026-10-09: Separate the optional local credential namespace from portable catalog workspace identity. Restore retains independently configured destination native/vault credentials without rebinding secret values or exporting them.
2026-10-09: Admit portable local-input sanitization with new proof receipts in a disposable catalog while preserving captured-source authority. Fence committed restores with a durable pending activation receipt until exact destination configuration is installed, including after operational lease expiry.
2026-10-09: Split source dependency compilation, FFmpeg compilation and native package qualification into verified cached stages. Same-run transfers bind source revision, compiler, recipe and original archive hashes, retaining the complete decoder set and all qualification checks within bounded jobs.
2026-10-09: Resolve bare Windows qualification executables against the selected child PATH before hidden creation, so compiler identity and build commands use the same configured toolchain without parent-PATH fallback.
2026-10-09: Initialize the native graph before measuring aggregate query phases in the assistance timeout fixture, separating first-open initialization variance from query-budget behavior without changing product timeouts.
2026-10-09: Verify complete source caches before scheduling compilation and use independent platform source chains. Qualify CLI-only and desktop packages on separate native runners, retaining all existing checks and avoiding shared library-isolation races.
2026-10-09: Preserve originating absolute path semantics in cross-platform backup proofs and require native backup lifecycle ownership before pin/release mutations. Reject manual-reference collisions, released-ID reuse and partial release before writes.
2026-10-09: Bind hosted Windows builds to the installed MSYS2 action output and normalize only completely validated internal dependency file aliases for portable transfers. Preflight explicit documentation deployment configuration before publication and allow promotion-only runs without implicit release publication.
2026-10-09: Cache original media sources independently of build recipes, retain exact archive verification and bound transient downloads. Give dav1d available compilation cores and run shared runtime acceptance independently of the six package journeys. Publication excludes only its verified same-revision release run's own unfinished suite while requiring every other check.
2026-10-09: Prepare the sibling CLI before fresh release desktop qualification. Promotion-only runs retrieve and revalidate the original published candidate, avoiding nondeterministic package rebuilds; authenticated downloads strip credentials before official CDN redirects. Platform qualification still requires verified same-run artifacts when a different source platform fails.
2026-10-09: Share verified portable source archives across native platforms while retaining platform-specific binary/compiler caches. Supply Linux's required static math linkage for game-music decoding and preserve bounded source/link failure diagnostics without interpreting them as workflow commands.
2026-10-09: Run publication verifiers from protected main and accept only source revisions in its history. Separate documentation preflight/promotion credentials from repository-write publication, enforce a main-only deployment environment and reject automation credential forwarding without adding mandatory human reviewers.
2026-10-09: Bind libxml2 to the same private iconv header and static archive. Move macOS package resources out of the executable directory and discover verified companions from relocated application resources.
2026-10-09: Remove source-local processing/training tool paths and transient context from portable job authority. Resume elected work automatically with ephemeral destination tool bindings and rebuilt accepted context while retaining exact model identities, settings and completed lineage.
2026-10-09: Compile independent media dependency groups on separate runners, merge exact prefixes and original archives transactionally, and retain each group's receipt in the complete source proof. Start qualification independently per platform and overlap core checks with source compilation; keep full runtime, package and alternative-backend acceptance.
2026-10-09: Bind new speaker-training checkpoints to exact pinned adapter bytes and settings independently of invocation paths, so checkpoints produced after restore remain resumable after another move. Retain existing checkpoint compatibility and reject changed elected adapter settings.
2026-10-10: Prepare the first 1.0.0 release candidate with synchronized software, documentation and JSON contracts while preserving the 0.0.0 baseline. Candidate preparation and qualification do not publish product downloads or deploy documentation.
2026-10-10: Collect all six native package variants and documentation from one CI source revision and workflow attempt using read-only credentials. Verify corresponding source recipes, pins, helpers and all dependency groups against the selected checkout before candidate acceptance.
2026-10-10: Add an elected disposable connected CLI qualification journey, including independent speaker enrollment, cross-clip matching and self-contained restore after the original workspace becomes unavailable. Keep actual CPU acoustic measurements separate from deterministic required checks.
2026-10-10: Integrate go-winio 0.6.3 and x/sys 0.49.0 with the complete native/runtime qualification boundary.
2026-10-10: Diagnose pinned Whisper final timestamp overruns and intersect only endpoints extending at most 250 milliseconds beyond decoded media. Preserve strict generic adapter validation and reject larger excursions; do not extend source audio or claim prediction accuracy.
2026-10-10: Render an elected release-target public/offline artifact before publication, record that target with source identity and reject candidate snapshots from publication/promotion. Keep ordinary builds and source history explicit about candidate status; released landing pages expose all six exact-tag package links.
2026-10-10: Prepare current contract examples with the selected version's native package names and platform archive formats, updating owned common-type descriptions while preserving immutable baseline and upstream identities.
2026-10-10: Separate native Go build caches from the immutable core cache, allowing CLI and desktop/runtime qualification to retain their tagged build artifacts while preserving every integrity check.
2026-10-10: Qualify the packaged CLI and actual LadybugDB graph with the selected native compiler/loader on native lanes, retaining the generic CLI path on lightweight lanes and every cross-process scenario.
2026-10-10: Implement S016 release workflow hardening and launch preparation. Measure complete warm PR and publication-disabled release runs, separate product package identity from harness identity, and preserve explicit signing/deployment/acoustic limitations. Product tagging, official publication and live documentation promotion remain a subsequent owner-authorized launch.
2026-10-11: Stage complete Windows codec compilation before final FFmpeg linking after an independent release cold build exceeded its compile bound. Preserve all decoders and unchanged timeouts; verify configured source/dependency identities, integer timestamps and reuse of compiled objects.
2026-10-11: Preserve older nested Next.js segment URLs as aliases to their exact verified flat-file replacements during Pages preparation. Continue rejecting missing historical pages/schemas, unmatched segments, case collisions and excessive payloads before writes.
2026-10-11: Publish the first official 1.0.0 release and matching documentation through the existing exact-source qualification, verified asset publication and original-archive Pages promotion. Provide concise release highlights with a full changelog link; publisher-signing setup and acoustic accuracy checks are excluded.

Changed

Share independent engine, desktop/credential and package lanes between PR and release qualification, with separate runtime caches and standalone native CLI preparation for desktop checks. Keep all acceptance, source and inventory checks.
Add verified original-release promotion to the existing insonic.io GitHub Pages source, with read-only preflight, nonforced parented ref updates and exact-commit build completion. Retain separately configured generic hosting.
Include the processing worker in both native package inventories and qualify connected Windows CPU journeys from an elected extracted archive with package-only companion resolution.

Added

Unpublished 1.0.0 candidate preparation, immutable baseline routes, a connected import/process/enrollment/matching/query/recovery harness and read-only six-variant exact-source CI collection.
Nanosecond import timestamp validation, valid embedding batch provenance and explicitly diagnosed bounded pinned-Whisper endpoint intersections.
Complete portable artifact bundles, reference-only retention lifecycle and verified empty-target restore through advanced shared CLI maintenance contracts. Source-complete native CLI/desktop variants, version preparation, immutable release manifests/checksums and configured publication/documentation promotion tooling.
Complete current independent speaker datasets, elected local/hosted training and local embedding enrollment, exact output discovery/fetch, profile CAS selection and matching-only roster attribution across shared CLI/runtime/desktop contracts. Unknown and ambiguous outcomes remain visible, manual corrections take precedence, and automatic matches do not become their own training evidence.
Workspace model aliases, configured discovery, non-loading compatibility inspection and acquire-on-demand processing/import elections through shared CLI/runtime/desktop contracts. Portable reference state preserves base, trained-version and hosted-handle distinctions; full speaker matching and training remain separate work.
Explicit stable-ID canonical audio replacement with keep/clear/replace transcript policies and source-bound evidence retirement. Declared speaker rosters support atomic initial import, independent CAS edits, portable current proofs and separate graph context through shared CLI/runtime/desktop operations.
Canonical audio admission with stereo/multitrack FLAC, eligible mono MP3 V0, preserved source clocks and captured metadata. Shared local/remote/embedded transcript import preserves annotated Cue JSON, upgrades validated historical versions and converts legacy managed sidecars through atomic current acceptance.
Optional local/hosted query assistance with revisioned settings, complete editable proposals and elected validated current execution in CLI and desktop Explore. Deterministic provider fixtures qualify ordinary backend and native package journeys without model inference.
Current source-backed evidence extraction, real LadybugDB/ArcadeDB reference publication and portable/native queries, with whole-library calendars, recording timelines, versioned saved definitions and separate force-graph layouts in CLI and desktop Explore.
Native desktop Library, Jobs, Pipelines, Speakers, Terms, Models and Settings controls over the shared runtime, including current recording actions, exact raw capture display, scoped ranged audio/video playback, bounded previews and original-time cue seeking.
Installation-relative verified companion discovery and Windows x86-64, Linux x86-64 and macOS ARM64 package builders with relocated CLI/native-webview qualification, offline help, inventories, notices and source/build records. Required checks use committed media and deterministic supplied subtitles/turns without recognition or diarization execution.
Revisioned Local, Connected and Custom processing pipelines with immutable queued elections, explicit local/hosted worker contracts and configurable automatic quality checks.
Stable canonical speaker names and aliases, current library-wide speaker evidence selection and scoped terminology with deterministic bounded recognition hints, through shared CLI/runtime/desktop bridge operations.
Current master recordings with one embedded Cueson v1.2.0 document, recording-local speaker UUIDs, external known-speaker mappings and reference-only downstream evidence.
Shared local mapped-audio/subtitle processing, independent reruns, fenced current replacement, recoverable physical retirement and diagnosed Cue JSON/native export.
Explicit local-worker, decoder and Cueson child environments exclude unrelated credential/configuration variables while retaining selected native-library/device paths.
Committed CC BY 3.0 real speech audio and dialogue video with hashes, license/provenance and supplied reference subtitles; separate opt-in maintainer engine qualification outside CI.
Workspace-scoped native credentials, authenticated Argon2id/AES-GCM vault and explicit session credentials with protected-input bootstrap and status-only display.
Exact multi-file downloaded base-model manifests, resumable verified acquisition and leased materialization through filesystem/S3 storage.
Unified copied/referenced/remote media admission, CSV/JSON batches, qualified raw metadata and stream capture, nullable measured duration, exact timing and explicit historical timezone/DST/date choices.
Durable real-work recovery/cancellation/retry and current metadata refresh with physical superseded-report removal while retaining original media and supplied subtitles.
Managed filesystem and generic S3 artifact storage with streamed SHA-256 verification, resumable multipart receipts, durable publication recovery, leased materialization and reference-aware retirement through the shared CLI/runtime.
Additive catalog schema 2 with schema-1 upgrade/restore compatibility and receipt-validated artifact lifecycle snapshots.
Workspace/profile-scoped object keys, final-link metadata durability and pending reconciliation for uncertain S3 completion/abort; retirement updates typed location availability alongside preserved admission receipts.
Portable SQLite/PostgreSQL catalogs with atomic revision/receipt admission, exact metadata/date provenance, scoped speaker/training/model records, durable job history/recovery and ordered fenced graph outbox.
CLI job history, catalog status, explicit migration and consistent logical export/restore with imported ownership expired.
Change-aware native/backend CI and qualification pin consistency checks.
Source-buildable Go workspace CLI, one current-user local runtime, shared desktop bridge, generation-fenced session attempts and hidden bounded child supervision.
Checksum-pinned three-OS native qualification for Cueson, Ladybug/SQLite, Wails/offline help and isolated PostgreSQL/S3/ArcadeDB fixture operations.
v0.0.0 system specification covering cross-platform CLI/GUI orchestration, media/subtitle correlation, metadata/date provenance, configurable adapters, speaker/term catalogs, graph exploration and optional speaker-model training/retrieval.
Upstream insonic 1.0.0 brand kit built with BrandBuilder 3.0.1, with a manually triggered checksum-verified update process.
Versioned Markdown documentation and a static Next.js renderer with a public product landing page and separate documentation-only offline export for installed GUI help.
Spec Kit infrastructure and a staged, issue-oriented delivery plan.
Public repository contribution, security, issue and pull request templates, efficient foundation CI and local GitHub setup tooling.
Version-matched master JSON Schema and rendered JSON contracts, with the master changelog included in the documentation site.
Expanded technical glossary with primary learning references and links to the pages using each term.
Source-linked interactive archive illustration, a glacial-blue landing gradient and a platform download section that reports package availability.
Sun/moon documentation toggle with an operating-system default, remembered light/dark choice and matching logos and diagram colors in offline help.

Changed

2026-10-04: Adopt Apache 2.0 for original source/documentation and Go for CLI-first shared orchestration, with Wails as the desktop baseline subject to native packaging qualification. Require the official Cueson executable/schema boundary and a rebuildable LadybugDB graph projection.
2026-10-04: Amend constitution to 2.0.0 for GUI core parity with documented advanced/experimental lag, early metadata/date provenance, full filesystem/S3, SQLite/PostgreSQL and LadybugDB/ArcadeDB support, and configured automation without mandatory per-item review. Add optional speaker-model delivery under S015/M5.
2026-10-05: Amend constitution to 2.1.0 for synchronized software, documentation and JSON Schema versions, practical compatibility, concise breaking-change notes and major-release glossary reviews. Keep numbered plans internal and one specification-status statement in the documentation index.
2026-10-05: Amend constitution to 2.1.1 for numbered linear procedures; replace four sequential diagrams while retaining branching, relationship and feedback diagrams.
2026-10-05: Implement the shared runtime foundation using Go 1.27.1, Wails 2.14.0, private Unix sockets and current-user Windows pipe/directory ACLs. Keep attempts session-scoped until portable durable catalogs arrive; retain supported backend boundaries and separate native artifact availability from executed platform evidence.
2026-10-05: Remove mandatory human PR approvals at the owner's direction. Bootstrap preserves zero required approvals while retaining CI and resolved-conversation gates; constitution 2.1.2 separates optional PR approval from merge authorization.
2026-10-05: Implement S002 catalog authority using shared typed portable SQL, short workspace transactions, expiring ownership and atomic receipts. Keep qualified dependency pins; separate migration permissions from runtime data permissions. Restore only empty authority, expire imported claims and keep native/encrypted credential persistence and media/graph execution in their subsequent slices.
2026-10-06: Implement S003 for issue #4 using dedicated renewable artifact claims, unique nonreused keys, exact-version readback/deletion and atomic catalog retirement barriers. Preserve immutable domain evidence and existing dependency pins; encrypted credential persistence and the model registry remain subsequent work. Extend the affected pinned backend fixture job with shared artifact acceptance.
2026-10-07: Implement S004 for issues #5 and #6. Freeze historical migration definitions and add catalog schema 3 for current library/model/work records. Keep unknown duration separate from zero; replace superseded computed metadata under issue #21. Full Cueson document assembly remains subsequent work.
2026-10-07: Qualify the macOS arm64 native operations on macOS 15 ahead of the announced macOS 14 runner retirement, preserving the pinned tool architecture and ten-minute CI budget.
2026-10-07: Resolve review findings with logical model-version identity, bounded 8 MiB normalized import ingress, shared desktop/runtime operation deadlines and fenced cleanup of unused admission candidates. Preserve retryable partial batch results and require the latest accepted current-state proofs in portable snapshots.
2026-10-07: Require encrypted remote credential acquisition with an explicit loopback HTTP exception. Add configurable remote byte/time budgets and reject common query-authentication aliases before durable enqueue while retaining ordinary noncredential source selectors.
2026-10-07: Implement S005 for issues #21 and #7. Replace the obsolete transcript/assignment retention contract with one current embedded Cueson v1.2.0 document and reference-only consumers. Invalidate affected corpus/evidence preparation, physically retire superseded managed results, and preserve original media/subtitles plus noncontent model/run lineage. Catalog schema 4 freezes prior migration definitions and reconciles legacy copied assignments without reviving them.
2026-10-07: Record explicit Windows CPU maintainer qualification separately from CI: speech recognition has 4 word errors across 33 reference words and dialogue recognition has 2 across 31. Diarization yields two voices for the speech fixture and one for the two-character dialogue reference. These results demonstrate actual engine execution and model split/merge limitations; editorial caption windows are not sample-accurate acoustic ground truth.
2026-10-07: Exclude transcription/diarization invocation, model initialization/loading, weight downloads and engine-result requirements from every CI path and merge check. Allow deterministic stage injection, committed media probing/extraction and real pinned Cueson qualification; record real engine behavior only in explicit maintainer runs.
2026-10-07: Address review findings with byte-preserving BOM WebVTT detection, exact canonical engine-role casing and explicit allowlisted environments for new local processing children. Preserve existing process-helper inheritance only for callers that elect it; session/provider credential variables are excluded from the new local adapters.
2026-10-07: Implement S006 for issues #8 and #9. Catalog schema 5 preserves frozen earlier migrations and adds saved worker definitions, speaker state/aliases and scoped terminology. Replace the unused generic stage-DAG pipeline interchange shape with the implemented recognition/diarization configuration envelope; dedicated GUI controls, general graph capabilities and training remain separate delivery outcomes.
2026-10-07: Freeze local model manifest digests and resolved tools alongside pipeline/context elections. Revalidate digests before model materialization and reject changed audio mappings before diarization reuse. Recompute reused quality from current embedded millisecond assignments with an explicit basis. Context preview and execution share configured hints/language; correlation analysis can be disabled while current-reference integrity remains mandatory.
2026-10-07: Resolve review findings by normalizing the local English recognition default before context election and by comparing speaker selection against all earlier current source evidence across cursor pages. Bind comparisons to the selected evidence epoch and keep assignment arrays solely in current embedded Cue JSON.
2026-10-07: Implement S007 for issue #10 with dedicated desktop controls, current-authority playback tickets and section-scoped revision-checked settings. Preserve advanced CLI access for catalog transfer, profile migration and detailed artifact operations. Packages remain unsigned and unpublished pending release promotion; retain complete corresponding-source distribution as a prerequisite for GPL-enabled binary publication.
2026-10-07: Replace the nonredistributable macOS media artifact with exact-source FFmpeg/ffprobe builds using system VideoToolbox and no GPL/nonfree external libraries. Record executed OS/architecture qualification separately from artifact availability and release readiness.
Bind landing hero and page metadata to approved upstream slogan and description fields; expand syntax highlighting for JSON and CLI examples.
Support optional validated read-only AI query execution through the configured assistance mode.
Subdivide workspace/runtime, catalog/jobs, artifact storage and secrets/model-registry development into four focused slices; renumber the remaining application slices through S015.
Define each backend configuration once and reuse it in adapter-selection validation without changing its fields or constraints.
Include backend/query alternatives and shared timestamp descriptions/examples in the generated JSON contract reference.
Load a small shared theme/tab script and confine the Mermaid runtime to documentation routes.
Keep specification status in the documentation index, replace generic landing copy with concrete outcomes, and remove conversation-specific instructions from public prose.

Fixed

Preserve accepted speaker-dataset retries after evidence invalidation, enforce inline hosted model/checkpoint outputs, send declared hosted cancellation after adapter deadlines and use one complete-corpus reference limit. Retry elected playback seeks when native decoder data becomes ready without rewinding subsequent playback.
Reset Library playback media state for each verified ticket before seeking newly loaded source metadata.
Preserve large generated integer parameters through desktop JSON with exact decimal-string transport and real native integer binding. Legacy numeric parameter inputs remain supported.
Reconcile durable acknowledgement receipts after ownership expires; validate restored checkpoints against accepted acknowledgements, reject scalar coercion, and restore large catalog exports without an asymmetric file-size limit.
Reject common credential-key aliases in persisted options while retaining opaque references, preserve shutdown evidence, and keep replayed requests from detaching newer work or blocking at runtime capacity.
Keep the landing archive widget at the tallest tab's natural height so switching views leaves following content in place.
Align audit-instant schemas, examples and documentation on Cueson's {iso, unix_ns} representation, including lossless nanosecond-integer handling.
Preserve closed GitHub Projects when rerunning repository setup.
Cover root schema-validation dependencies in grouped Dependabot updates and correct contributor installation guidance.

Decisions (2026-10-08)

Freeze catalog schema 5 and migrate to schema 6 for current extraction, immutable query versions and layouts. Graph events retain references, while current catalog hydration supplies text and clocks. Saved views no longer offer pinned processing-result snapshots.
Prepare real graph adapters in native packages and required backend/UI qualification. Inference, model initialization and weight downloads remain excluded from required CI.
Windows native graph DLLs reside beside the CLI and GUI so the operating-system loader resolves them before runtime startup, without development PATH dependencies.
Pin Windows OpenSSL 3.5.9 loader companions and their Apache 2.0 notice, with a pinned archive decoder; native preparation and relocated checks no longer depend on ambient OpenSSL installations.
Query assistance uses an explicitly elected versioned HTTP provider, portable catalog settings and the shared current query path. Suggestions are the default; auto-run requires ordinary read validation and selected-engine EXPLAIN. Required checks use injected deterministic provider replies and refuse production provider calls under CI markers.

Decisions (2026-10-09)

Amend constitution to 2.2.0 for canonical managed audio and one current embedded document. New reference admission is unsupported; existing legacy references remain readable. Imported local speaker tokens retain exact upstream-valid values. Original owner inputs stay untouched, while accepted work and captured metadata omit original local locators.