fix(stt): refuse quantized Whisper runtime models

.env.debug.example

@@ -22,6 +22,9 @@
 # CODESCRIBE_ONNX_MODEL_PATH=  # Default: unset — Custom path to ONNX Whisper model
 # CODESCRIBE_ONNX_QUANT=  # Default: unset — ONNX quantization level (e.g. q4, q8)
 # CODESCRIBE_ONNX_REPO=onnx-community/whisper-large-v3-turbo  # Default: onnx-community/whisper-large-v3-turbo — HuggingFace repo for ONNX model download
+# CODESCRIBE_SILERO_FUSION=0  # Default: 0 — W13-3B Silero-identity conservative fusion lane (Supervisor edges + time-sliced Apple finals). Default OFF.
+# CODESCRIBE_SILERO_FUSION_CONTEXT=utterance  # Default: utterance — Bounded-context A/B: utterance | left_pad | stable_prompt. Never crosses a long-silence fence.
+# CODESCRIBE_SPAN_IDEMPOTENCE=0  # Default: 0 — W13-4 sealed-span replay refusal + in-span loop fence (range identity, never content). Default OFF.
 # CODESCRIBE_STT_COMMIT_MIN_INTERVAL_MS=180  # Default: 180 — Minimum interval between committed/final STT inference jobs in milliseconds
 # CODESCRIBE_STT_ENGINE=auto  # Default: auto — STT engine: auto (Apple on supported macOS, Candle fallback), candle, onnx, or apple
 # CODESCRIBE_STT_INITIAL_PROMPT_ENABLED=0  # Default: 0 — Opt-in gate for Candle Whisper runtime-lexicon initial_prompt. Default OFF after W2-F measured a 100% WER regression with the active prompt.
@@ -33,9 +36,9 @@
 # CODESCRIBE_STT_THERMAL_NOMINAL_MULT=0.0  # Default: 0.0 — Thermal duty-cycle multiplier for nominal system thermal pressure; 0.0 disables nominal backoff
 # CODESCRIBE_STT_THERMAL_SERIOUS_MULT=2.0  # Default: 2.0 — Thermal multiplier for serious system thermal pressure
 # CODESCRIBE_TOGGLE_FINAL_PASS=1  # Default: 1 — Use saved-WAV final-pass adjudication when stopping toggle dictation (0 restores preview-only stop path)
-# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 disables)
+# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 = explicit keep-warm)
 # CODESCRIBE_WHISPER_INITIAL_PROMPT=  # Default: unset — Initial prompt hint for Whisper decoding (ignored by ONNX adapter)
-# LOCAL_MODEL=whisper-large-v3-turbo-mlx-q8  # Default: whisper-large-v3-turbo-mlx-q8 — Local Whisper model id (HF cache / embedded lookup)
+# LOCAL_MODEL=whisper-large-v3-turbo  # Default fp16 local Whisper model id
 # STT_API_KEY=<your-key>  # Default: unset — Cloud STT API key; prefer Settings / macOS Keychain
 # STT_ENDPOINT=  # Default: unset — Cloud STT API endpoint (when USE_LOCAL_STT=0)
 # USE_LOCAL_STT=1  # Default: 1 — Use local Whisper model (vs cloud)
@@ -60,6 +63,12 @@
 # SOUND_NAME=Tink  # Default: Tink — macOS system sound name for beep
 # SOUND_VOLUME=1.0  # Default: 1.0 — Sound volume (0.0-1.0)
 
+# =============================================================================
+# STORAGE / OBSERVABILITY
+# =============================================================================
+# CODESCRIBE_TRANSCRIPT_BUS_PATH=  # Default: unset — Override private committed transcript NDJSON bus path
+# XDG_STATE_HOME=  # Default: unset — Standard XDG state root used by the transcript bus
+
 # =============================================================================
 # STREAMING / BUFFERING
 # =============================================================================

.env.example

@@ -24,6 +24,9 @@
 # CODESCRIBE_ONNX_MODEL_PATH=  # Default: unset — Custom path to ONNX Whisper model
 # CODESCRIBE_ONNX_QUANT=  # Default: unset — ONNX quantization level (e.g. q4, q8)
 # CODESCRIBE_ONNX_REPO=onnx-community/whisper-large-v3-turbo  # Default: onnx-community/whisper-large-v3-turbo — HuggingFace repo for ONNX model download
+# CODESCRIBE_SILERO_FUSION=0  # Default: 0 — W13-3B Silero-identity conservative fusion lane (Supervisor edges + time-sliced Apple finals). Default OFF.
+# CODESCRIBE_SILERO_FUSION_CONTEXT=utterance  # Default: utterance — Bounded-context A/B: utterance | left_pad | stable_prompt. Never crosses a long-silence fence.
+# CODESCRIBE_SPAN_IDEMPOTENCE=0  # Default: 0 — W13-4 sealed-span replay refusal + in-span loop fence (range identity, never content). Default OFF.
 # CODESCRIBE_STT_COMMIT_MIN_INTERVAL_MS=180  # Default: 180 — Minimum interval between committed/final STT inference jobs in milliseconds
 # CODESCRIBE_STT_ENGINE=auto  # Default: auto — STT engine: auto (Apple on supported macOS, Candle fallback), candle, onnx, or apple
 # CODESCRIBE_STT_INITIAL_PROMPT_ENABLED=0  # Default: 0 — Opt-in gate for Candle Whisper runtime-lexicon initial_prompt. Default OFF after W2-F measured a 100% WER regression with the active prompt.
@@ -35,9 +38,9 @@
 # CODESCRIBE_STT_THERMAL_NOMINAL_MULT=0.0  # Default: 0.0 — Thermal duty-cycle multiplier for nominal system thermal pressure; 0.0 disables nominal backoff
 # CODESCRIBE_STT_THERMAL_SERIOUS_MULT=2.0  # Default: 2.0 — Thermal multiplier for serious system thermal pressure
 # CODESCRIBE_TOGGLE_FINAL_PASS=1  # Default: 1 — Use saved-WAV final-pass adjudication when stopping toggle dictation (0 restores preview-only stop path)
-# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 disables)
+# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 = explicit keep-warm)
 # CODESCRIBE_WHISPER_INITIAL_PROMPT=  # Default: unset — Initial prompt hint for Whisper decoding (ignored by ONNX adapter)
-# LOCAL_MODEL=whisper-large-v3-turbo-mlx-q8  # Default: whisper-large-v3-turbo-mlx-q8 — Local Whisper model id (HF cache / embedded lookup)
+# LOCAL_MODEL=whisper-large-v3-turbo  # Default fp16 local Whisper model id
 # STT_API_KEY=<your-key>  # Default: unset — Cloud STT API key; prefer Settings / macOS Keychain
 # STT_ENDPOINT=  # Default: unset — Cloud STT API endpoint (when USE_LOCAL_STT=0)
 # USE_LOCAL_STT=1  # Default: 1 — Use local Whisper model (vs cloud)
@@ -62,6 +65,12 @@
 # SOUND_NAME=Tink  # Default: Tink — macOS system sound name for beep
 # SOUND_VOLUME=1.0  # Default: 1.0 — Sound volume (0.0-1.0)
 
+# =============================================================================
+# STORAGE / OBSERVABILITY
+# =============================================================================
+# CODESCRIBE_TRANSCRIPT_BUS_PATH=  # Default: unset — Override private committed transcript NDJSON bus path
+# XDG_STATE_HOME=  # Default: unset — Standard XDG state root used by the transcript bus
+
 # =============================================================================
 # STREAMING / BUFFERING
 # =============================================================================

.github/workflows/release.yml

@@ -65,21 +65,28 @@ jobs:
         env:
           CODESIGN_CERTIFICATE_BASE64: ${{ secrets.CODESIGN_CERTIFICATE_BASE64 }}
           CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.CODESIGN_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_SESSION_STATE_DIR: ${{ runner.temp }}/keychain-session
         run: |
+          set -euo pipefail
           CERT_PATH="$RUNNER_TEMP/codesign.p12"
-          KEYCHAIN_PATH="$RUNNER_TEMP/codesign.keychain-db"
           echo "$CODESIGN_CERTIFICATE_BASE64" | base64 -D > "$CERT_PATH"
-          security create-keychain -p "" "$KEYCHAIN_PATH"
-          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
-          security unlock-keychain -p "" "$KEYCHAIN_PATH"
+
+          # The search-list / default-keychain dance is NOT inlined here any
+          # more. This step used to prepend an ephemeral keychain to the user
+          # search list and never put the list back — it relied on
+          # `delete-keychain` unlisting it, which only works while the file
+          # still exists. On a self-hosted runner that leaves the operator's
+          # own keychain domain pointing at a deleted path (2026-08-15 P0).
+          # scripts/lib/keychain-session.sh snapshots as structured argv,
+          # unlists before deleting, and is concurrency-safe.
+          KEYCHAIN_PATH="$(scripts/lib/keychain-session.sh begin codescribe-signing)"
+          echo "CODESCRIBE_SIGNING_KEYCHAIN=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
+
+          # Read into a variable, never echo. The ephemeral password exists so
+          # the keychain is not world-openable on a shared runner.
+          KEYCHAIN_PASSWORD="$(cat "$(scripts/lib/keychain-session.sh password-file codescribe-signing)")"
           security import "$CERT_PATH" -P "$CODESIGN_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
-          existing_keychains=()
-          while IFS= read -r keychain; do
-            keychain="${keychain//\"/}"
-            [[ -n "$keychain" ]] && existing_keychains+=("$keychain")
-          done < <(security list-keychains -d user)
-          security list-keychains -d user -s "$KEYCHAIN_PATH" "${existing_keychains[@]}"
-          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
           security find-identity -v -p codesigning "$KEYCHAIN_PATH"
           # The identity now lives in the keychain; the raw PKCS12 has no
           # further use. Overwrite-then-unlink so the private key material
@@ -187,12 +194,24 @@ jobs:
             appcast.xml
           generate_release_notes: true
 
-      - name: Remove signing keychain
+      - name: Release the signing keychain
         # Runs on every outcome: a failed build must not leave the imported
-        # Developer ID identity resident on the runner.
+        # Developer ID identity resident on the runner, AND must not leave the
+        # ephemeral keychain in the user search list or as the default
+        # keychain. `end` unlists first and deletes second, so it still cleans
+        # up when the keychain file has already been destroyed — the exact
+        # sequence that poisoned the operator's host on 2026-08-15.
         if: always()
+        env:
+          KEYCHAIN_SESSION_STATE_DIR: ${{ runner.temp }}/keychain-session
         run: |
-          KEYCHAIN_PATH="$RUNNER_TEMP/codesign.keychain-db"
-          if [ -f "$KEYCHAIN_PATH" ]; then
-            security delete-keychain "$KEYCHAIN_PATH"
+          if [ ! -x scripts/lib/keychain-session.sh ]; then
+            echo "::warning::checkout missing; cannot release the signing keychain"
+            exit 0
           fi
+          scripts/lib/keychain-session.sh end codescribe-signing
+          # Read-only verdict on what the runner's keychain domain looks like
+          # now. Advisory: a dirty domain must be visible, not silent, but it
+          # must not fail an otherwise successful release.
+          scripts/keychain-doctor.sh || \
+            echo "::warning::runner keychain domain still has stale entries after cleanup"

.grok/skills/bus-demux/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: bus-demux
+description: >
+  Run scripts/bus-demux.py against codescribe.transcript.v1. Flags: --become,
+  --name, --follow, --once. Use when the operator says bus-demux flags, kielbasa
+  follower, or needs the CLI. Session attach and naming live in the codescribe
+  skill — do not reimplement them here.
+---
+
+# Bus demux — CLI
+
+Session attach lives in `codescribe`. This file is flags only.
+
+```bash
+python3 scripts/bus-demux.py --become --follow
+python3 scripts/bus-demux.py --name james --follow
+python3 scripts/bus-demux.py --name james --once
+```
+
+Unnamed agents do not pass (exit 2). No microphone. No Lab.

.grok/skills/codescribe

@@ -0,0 +1 @@
+../../skills/codescribe