Offline Local ASR: measured, sandboxed, Fedora-ready #262

mise ~/.config/mise/config.toml tools: gh@2.100.0

Destination

Voisu Local transcribes a Recording without network capability, preserves Transcript Fidelity and recovery privacy, and ships first on Fedora KDE Wayland only after measured quality, bounded resources, real process-tree traces, packaging checks, and host evidence pass.

Current evidence

• Draft PR feat(local): Arch pilot offline path on whisper-cli base.en #261 proves an Arch/Hyprland Pilot Candidate can install pinned whisper.cpp base.en artifacts, run real first-inference health, reach Ready, and deliver live dictation.
• Raja reports completing the live microphone-to-Transcript-to-Delivery check and two Recordings with clipboard activity between them on 2026-09-09.
• Raja permits prior or newly recorded private Recordings to be used locally in the bakeoff. Private audio stays local; public evidence contains hashes, counts, and aggregate measurements only.
• Raja will provide SSH access to a Fedora KDE Wayland PC for L6; supervised microphone and desktop actions remain his human gate.
• PR feat(local): Arch pilot offline path on whisper-cli base.en #261 must remain draft until Make PR #261 safe and mergeable #263 is complete, exact-head CI is green, and an independent reviewer approves it.

Review resolution

Confirmed gaps: no locked R7 bakeoff; no enforced Landlock/seccomp/core-dump policy; no real process-tree offline trace; no worker cgroup limits; globally opened production admission/download; no native positive-path IPC replacement; arbitrary production executable environment override; host-dependent assertions; false Ready from file metadata; default temporary PCM file; incomplete Setup maintenance reservation; stale documentation; and red CI.

Corrections: the rolling restart budget exists in WorkerSupervisor; the explicitly catalogued Hugging Face CDN host satisfies R4 and fails closed on rotation. Neither is a standalone defect from this review.

Dependency graph

263 safe PR #261
   ├── 264 frozen corpus ──────────────┐
   ├── 265 truthful persistent worker ├── 267 measured winner/no-go
   └── 266 sandbox + resource cgroup ─┘
                                          |
                                          v
                              268 L3 integration, admission closed
                                          |
                                          v
                              269 L4 routing/privacy/offline proof
                                          |
                                          v
                              270 Fedora KDE package + host gate

Tickets #264, #265, and #266 may proceed in parallel after #263 with non-overlapping ownership. The election in #267 cannot begin until all three prerequisites pass.

Issues / tickets

Program gates

Gate A — merge PR #261

• Production Local remains unavailable and production Setup offers no Pilot Candidate download.
• No caller-controlled executable path or false Ready state exists.
• Tests are hermetic, exact-head CI is green, and an independent reviewer approves.

Gate B — elect a Bakeoff Winner

• The frozen 100+20 corpus, critical-content gates, latency limits, sandbox, resource ceilings, and two-hour soak all pass.
• Missing or failed evidence produces no-go, not a renamed Pilot Candidate.

Gate C — enable Local routing

• Atomic installation, maintenance ownership, bounded worker lifecycle, memory-only default PCM, Delivery/Replay correctness, Cloud regressions, and real full-process-tree offline traces pass.

Gate D — claim Fedora support

• The reviewed RPM passes clean-account, reboot, offline, desktop, microphone, upgrade, rollback, restriction, and packaging gates on Raja's Fedora KDE Wayland PC.
• SSH output and Raja-supervised actions are recorded separately and truthfully.

Out of scope

• Public experimental selectors or globally enabling partial L3 work
• Meeting Mode, unsupported languages, or unmeasured host/GPU claims
• Uploading private bakeoff audio or Transcript text
• Moving acceptance thresholds after candidate results are visible
• Treating Arch/Hyprland pilot evidence as Fedora support