docs(use-cases): scenarios for the review's hardening (ADR-035 decision 8) -- the coverage gate is red until mapped

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-02 16:50:35 +02:00
parent f03b0213d0
commit 08b7654d06
1 changed files with 41 additions and 0 deletions
@@ -214,3 +214,44 @@ Feature: Upload an audio recording, get a private Swedish transcript, discuss it
    When the model changes a word
    Then the segment containing it carries the reconciled word
    And the segment's timing is unchanged
  # ADR-035 decision 8: hardening from the adversarial review
  Scenario: Chat about a recording is offered with local models only
    When I open the chat for my recording
    Then the model list holds only models that run on the homelab
    And a cloud model the shared chat service knows is not in it
  Scenario: A forged cloud model is never sent the transcript
    When a chat request names a cloud model
    Then a local model answers instead, and nothing was sent to the cloud one
  Scenario: A wedged engine does not use up the whole job
    When the primary engine never answers
    Then it fails at its own deadline while the job is still alive
    And the fallback runs, unless the job itself was cancelled or timed out
  Scenario: A file that lies about its length is refused
    When a file claims to be short but converts to more than the limit
    Then the job fails with a plain explanation and no engine receives the audio
  Scenario: A truncated recording is refused, not half transcribed
    When a file converts to far less audio than it claimed
    Then the job fails and asks for the complete recording
  Scenario: A full queue is a retry, not an error
    When too many recordings are already waiting
    Then the upload is answered as busy, its row is failed honestly and its audio is deleted
  Scenario: One user cannot fill the queue for everyone
    When one user has several recordings waiting
    Then further uploads from that user are refused and other users are not affected
  Scenario: Errors are shown as kinds, never their text
    When a model or an engine fails
    Then the log, the stored reason and the page carry a kind such as timeout or http_502
    And never the provider's response, a file path or a word from the transcript
  Scenario: Input that cannot be right is a client error
    When the id is not an id, or a header or title holds control bytes
    Then the answer is a 4xx or the title is cleaned, never a server error