Code review: fix TTS response-pipe bug, dedupe transcription finishing, trim hot-path I/O

[JRufer]

Full code-review pass over the Rust workspace and the Svelte frontend, focused on correctness, speed and reuse.

Important

One-time setup is needed before merging. Every push to master runs the release workflow, and that workflow now refuses to build or publish without the update-signing key. Generate the key and add a repository variable and a secret first. It takes about two minutes; see docs/release-signing.md:

minisign -G -W -p voxctrl-update.pub -s voxctrl-update.key

• variable VOXCTRL_UPDATE_PUBKEY: the second line of voxctrl-update.pub
• secret VOXCTRL_UPDATE_SIGNING_KEY: the contents of voxctrl-update.key

Security

Releases are signed, and the updater verifies the signature before installing.

• The gap: the updater only compared downloads with the SHA-256 digest GitHub reports for the same upload. That catches corruption, not tampering, because whoever can replace a release asset replaces its digest too.
• Signing: the publish job signs every asset with minisign and uploads <asset>.minisig beside it. Before publishing, it verifies each signature against the public key, so a mismatched key pair fails the release.
• Verifying: release builds bake in the public key (via voxctrl-update/build.rs). After the digest check, the updater stream-verifies the download against its signature before putting it in place.
• Replay protection: the signed trusted comment names the file and the release tag, and must match exactly.
• Unsigned releases: a release with no signature for this platform is shown as available but not installable, at check time rather than after a 100 MB download.
• Development builds have no key and keep the digest-only behavior. The release workflow refuses to build a release without the key.
• Verified end to end: I dry-ran the workflow's signing script with a real key pair, and the updater's verifier accepted its output. Real minisign fixtures cover genuine, tampered, wrong-key, replayed-older-tag, wrong-asset and malformed cases.
• Caveat: the first signed release is still installed by the previous, unsigned updater. Every update after that is verified.
• Docs: docs/release-signing.md covers setup, key rotation and manual verification. docs/privacy.md is updated.

Bugs fixed

1. Response-pipe (FIFO) replies were dropped silently. Startup created a callback-less TTS worker, bound the FIFO responders to it, then replaced it with the real one. The responders were never rebound. Responders now look up the current worker per line, and startup creates only one worker, which also stops a prewarming engine from loading its model twice.

2. Shortcuts with punctuation, numpad or right-hand modifier keys never fired. The recorders saved names the backends never report, and the key matcher compares names exactly:

   • . became KEY_. rather than KEY_DOT;
   • Numpad 1 became KEY_1 rather than KEY_KP1;
   • Right Ctrl became KEY_LEFTCTRL.

   Keys are now mapped by physical key (KeyboardEvent.code), and each name was checked against the evdev crate and the Windows scan-code table. The portal's accelerator translation gains the numpad keysyms. Saved bindings and stop keys using the old punctuation names are migrated on load. Old numpad bindings saved as KEY_1 can't be distinguished from the top-row key, so they are left alone.

3. Stereo-only microphones never opened. Capture always requested mono. It now uses mono when offered, and otherwise opens at the device's channel count and downmixes on the audio thread without allocating.

4. Config saves were not atomic. A crash mid-save could leave config.json truncated, and it would then load as all defaults. Saves now write a temp file and rename it into place; routing's TOML saves share the helper.

5. Stale tray/overlay target label after renaming the active target. The targets cache now carries a version counter, which the tray includes in its cache key.

6. The TTS stop-key recorder saved letter keys wrong (Q became KEYQ) because of a drifted private copy of the key mapper. It now uses the shared mapper.

7. Inconsistent action-button styles. Five scoped copies had drifted (small text 10px vs 11px; disabled styled two different ways, or not at all). There is now one definition in tab.css, so the shortcut-banner button now looks disabled while it works.

8. Smaller fixes: empty target labels in the tray; get_status with multi-target ids; inference errors losing their target and hotkey ids.

Performance (hot path)

• The dictation path reads no config file. InferenceRequest carries the primary target's processing overrides and the hotkey binding, resolved once per recording from in-memory targets and bindings caches. The OpenAI settings come from the engine's in-memory config.
• Hotkey OpenAI rewrites no longer send GET /models before every request; a 2 s connect_timeout keeps failing fast.
• Config::load writes the file at most once, instead of once per migration.
• Command-trigger fuzzy matching uses the allocation-free Levenshtein.
• Messages on the TTS command queue shrink from 568 bytes, because the config update is boxed.

Structure

All of these are pure moves plus merged duplicates; each was checked mechanically so that every original line appears exactly once.

• commands.rs (1.8k lines) → commands/ with 10 modules. generate_handler! and all paths are unchanged.
• voxctrl-config/src/lib.rs (1.7k lines) → 12 modules. The public API is unchanged, and the test list is identical.
• HotkeysTab.svelte (1584 → 1226 lines) and TtsTab.svelte (1555 → 1349 lines):
  • shared keys.ts, actions.ts, newOutputTarget() and hotkeys.ts;
  • new components: HotkeyBackendBanners, StopKeyRecorder, and KeyValueListEditor, which Features and TTS had as identical copies.
• Dead code removed: the unused retry-shortcuts code, getTriggerSignature, ten unused TtsTab CSS rules, and AudioRecorder's never-read config along with voxctrl-audio's dependency on voxctrl-config.
• voxctrl_inference::finalize is shared by the local and remote transcription paths. start_tts_worker, targets_display_label and onLevelFrame each replace several copies.

Lint

• clippy: zero warnings across the workspace (--all-targets). Beyond mechanical fixes:
  • capture_loop takes the recorder instead of 11 arguments;
  • two identical portal branches are merged, with the same behavior;
  • tests that deliberately hold the environment lock across .await are documented and allowed;
  • the verbatim reference copy in voxctrl-text is exempted rather than rewritten.
• svelte-check: 453 warnings → 0. Tailwind directives now live in <style lang="postcss">, and the real line-clamp warning is fixed.

Tests

New tests cover release signing (10 tests), the finalize module (7), key mapping (punctuation, numpad, right-hand modifiers, keycaps), the portal numpad keysyms, the legacy key-name migration in both config and bindings, the bindings and targets caches, stereo capture, hotkeys.ts, KeyValueListEditor and StopKeyRecorder. Two inference tests that could never fail were replaced, and each replacement was confirmed to fail when the behavior it guards is broken.

Verification

• CI passed on every earlier commit: Linux (default features, moonshine-webgpu, vulkan) and Windows cargo check, cargo test on both platforms, and the frontend check plus tests.
• Locally on the latest commit:
  • cargo test passes for every crate, including voxctrl-app (94);
  • cargo clippy --all-targets reports no warnings;
  • svelte-check reports 0 errors and 0 warnings;
  • vitest passes 260/260.
• The compiled CSS was compared before and after each frontend change; the only differences are the ones listed above.

🤖 Generated with Claude Code

https://claude.ai/code/session_015v84hAqhDBdwy7Q49gAWBR