feat: upload audio, get a private Swedish transcript, discuss it (#33, ADR-033) (#39)

Upload a recording (audio, or video with the camera off), get a private Swedish transcript, and chat about it.

- ADR-033: RLS-scoped private transcript store; ffprobe/ffmpeg intake; gateway transcription (iguana kb-whisper, berget fallback); in-process single-replica worker; chat over the transcript (local models only).
- ADR-034: optional two-engine mode (pianissimo + kb-whisper) reconciled by a LOCAL model; off unless TAPIR_RECONCILE_BASE_MODEL is set.
- ADR-035: real progress (phases, running/quiet/lost), phase logging, every judged spot stored, merged segments.
- Hardening from four adversarial reviews: errors logged and stored as kinds never text; per-engine deadlines; converted-length check; bounded queue; client hang-ups are not errors; strict local-alias check.
- Dockerfile: static ffmpeg/ffprobe 7.0.2 pinned by sha256 (#34). Built and inspected by hand; CI does not build the image on a PR, so its first CI build is this merge.

Uploads stay OFF until TAPIR_UPLOADS_ENABLED is set in the deployment.

Closes #33, #34, #42, #43, #44.

Co-authored-by: Mathias <mthbqv@gmail.com>

internal/config/config.go

@@ -20,6 +20,9 @@ import (
 
 // Config is Tapir's fully-resolved runtime configuration.
 type Config struct {
+	// UploadConfig is the audio-upload and private-transcription settings (ADR-033).
+	UploadConfig
+
 	// UserID is the Tapir user the run operates as. Stage 0 has exactly one.
 	// It must be a UUID: it keys the UUID user_id/video_id columns (data-model).
 	UserID string
@@ -320,6 +323,10 @@ func Load() (Config, error) {
 	}
 	c.OnboardMaxVideoSeconds = onboardMax
 
+	if c.UploadConfig, err = loadUploadConfig(); err != nil {
+		return Config{}, err
+	}
+
 	return c, nil
 }
 

internal/config/uploads.go

@@ -0,0 +1,197 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// UploadConfig holds the settings for audio upload and private transcription
+// (ADR-033). It is embedded in Config, so its fields read as c.UploadsEnabled etc.
+type UploadConfig struct {
+	// UploadsEnabled mounts the /uploads routes and starts the worker. Off by
+	// default: the runtime image must contain ffmpeg and ffprobe first (ADR-033).
+	UploadsEnabled bool
+	// UploadMaxBytes caps one upload. UploadMaxDuration caps one recording; 90
+	// minutes is the longest length MEASURED, not a ceiling that was found, so
+	// raising it is a measurement, not an edit.
+	UploadMaxBytes    int64
+	UploadMaxDuration time.Duration
+	// TranscribeModel is the primary gateway alias; TranscribeFallbackModel is the
+	// fallback, tried on ANY primary failure. The fallback is a cloud endpoint
+	// (berget): set it EMPTY to keep private audio on the homelab.
+	TranscribeModel         string
+	TranscribeFallbackModel string
+	// TranscribeTimeout bounds one job (conversion + transcription); a 90 minute
+	// recording took ~7.5 minutes on iguana.
+	TranscribeTimeout time.Duration
+	// TranscribeEngineTimeout bounds ONE engine call, so a wedged engine fails while the
+	// job is still alive and the fallback (or the other engine) can take over. The job
+	// timeout alone cannot do that (ADR-035 review).
+	TranscribeEngineTimeout time.Duration
+	// UploadTmpDir is where uploads are spooled and converted. Audio is deleted
+	// after transcription, so this holds at most the in-flight files.
+	UploadTmpDir string
+	FFmpegBin    string
+	FFprobeBin   string
+	// MaxUploadedTranscriptChars bounds the transcript sent to a chat model for an
+	// UPLOADED recording. The 18,000-char default for captions is ~22 minutes of
+	// speech; an hour of meeting is ~50,000 chars. MEASURED 2026-10-01 against the
+	// real models: iguana/gemma4-26b answers correctly to 90,000 chars but silently
+	// drops the head of a 120,000-char transcript, so 90,000 is the ceiling of the
+	// best model, not a round number.
+	MaxUploadedTranscriptChars int
+	// UploadChatModel is the model chat over an uploaded recording opens with. It is
+	// NOT the summarizer default: koala/phi4-mini has an 8,192-token context and
+	// returns HTTP 400 on an hour of speech (~13,000 tokens).
+	UploadChatModel string
+	// ReconcileBaseModel turns on two-engine transcription (ADR-034): the engine whose
+	// TEXT is the base of the merged transcript (e.g. iguana/pianissimo). TranscribeModel
+	// stays the other engine (e.g. kb-whisper). Empty = off.
+	ReconcileBaseModel string
+	// ReconcileModel is the LOCAL chat model that chooses between the two engines'
+	// disagreements. Required when ReconcileBaseModel is set.
+	ReconcileModel string
+	// ReconcileCheckOrder asks the model twice per dispute with the reading order
+	// swapped and keeps only agreement. It doubles the time; off by default.
+	ReconcileCheckOrder bool
+}
+
+const (
+	defaultUploadMaxMB             = 200
+	defaultUploadMaxMinutes        = 90
+	defaultTranscribeModel         = "iguana/kb-whisper"
+	defaultTranscribeFallbackModel = "berget/kb-whisper"
+	defaultTranscribeTimeout       = 60 * time.Minute
+	defaultTranscribeEngineTimeout = 20 * time.Minute
+	defaultMaxUploadedChars        = 90000
+	defaultUploadChatModel         = "iguana/gemma4-26b"
+)
+
+func loadUploadConfig() (UploadConfig, error) {
+	u := UploadConfig{
+		TranscribeModel:         envOr("TAPIR_TRANSCRIBE_MODEL", defaultTranscribeModel),
+		TranscribeFallbackModel: lookupOr("TAPIR_TRANSCRIBE_FALLBACK_MODEL", defaultTranscribeFallbackModel),
+		UploadTmpDir:            envOr("TAPIR_UPLOAD_TMP_DIR", os.TempDir()),
+		FFmpegBin:               envOr("TAPIR_FFMPEG_BIN", "ffmpeg"),
+		FFprobeBin:              envOr("TAPIR_FFPROBE_BIN", "ffprobe"),
+		UploadChatModel:         envOr("TAPIR_UPLOAD_CHAT_MODEL", defaultUploadChatModel),
+		ReconcileBaseModel:      os.Getenv("TAPIR_RECONCILE_BASE_MODEL"),
+		ReconcileModel:          os.Getenv("TAPIR_RECONCILE_MODEL"),
+	}
+
+	if v := os.Getenv("TAPIR_UPLOADS_ENABLED"); v != "" {
+		on, err := strconv.ParseBool(v)
+		if err != nil {
+			return UploadConfig{}, fmt.Errorf("config: TAPIR_UPLOADS_ENABLED=%q: %w", v, err)
+		}
+		u.UploadsEnabled = on
+	}
+
+	mb, err := positiveInt("TAPIR_UPLOAD_MAX_MB", defaultUploadMaxMB)
+	if err != nil {
+		return UploadConfig{}, err
+	}
+	u.UploadMaxBytes = int64(mb) << 20
+
+	mins, err := positiveInt("TAPIR_UPLOAD_MAX_MINUTES", defaultUploadMaxMinutes)
+	if err != nil {
+		return UploadConfig{}, err
+	}
+	u.UploadMaxDuration = time.Duration(mins) * time.Minute
+
+	timeout, err := durationOr("TAPIR_TRANSCRIBE_TIMEOUT", defaultTranscribeTimeout)
+	if err != nil {
+		return UploadConfig{}, err
+	}
+	if timeout <= 0 {
+		return UploadConfig{}, fmt.Errorf("config: TAPIR_TRANSCRIBE_TIMEOUT must be positive, got %v", timeout)
+	}
+	u.TranscribeTimeout = timeout
+
+	engineTimeout, err := durationOr("TAPIR_TRANSCRIBE_ENGINE_TIMEOUT", defaultTranscribeEngineTimeout)
+	if err != nil {
+		return UploadConfig{}, err
+	}
+	if engineTimeout <= 0 {
+		return UploadConfig{}, fmt.Errorf("config: TAPIR_TRANSCRIBE_ENGINE_TIMEOUT must be positive, got %v", engineTimeout)
+	}
+	u.TranscribeEngineTimeout = engineTimeout
+
+	if v := os.Getenv("TAPIR_RECONCILE_CHECK_ORDER"); v != "" {
+		on, err := strconv.ParseBool(v)
+		if err != nil {
+			return UploadConfig{}, fmt.Errorf("config: TAPIR_RECONCILE_CHECK_ORDER=%q: %w", v, err)
+		}
+		u.ReconcileCheckOrder = on
+	}
+	if err := u.validateReconcile(); err != nil {
+		return UploadConfig{}, err
+	}
+	if !IsLocalModel(u.UploadChatModel) {
+		return UploadConfig{}, fmt.Errorf("config: TAPIR_UPLOAD_CHAT_MODEL=%q is not a local model (koala/ or iguana/): the whole private transcript is sent to it", u.UploadChatModel)
+	}
+
+	chars, err := intOr("TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS", defaultMaxUploadedChars)
+	if err != nil {
+		return UploadConfig{}, err
+	}
+	if chars < 0 {
+		chars = 0
+	}
+	u.MaxUploadedTranscriptChars = chars
+	return u, nil
+}
+
+// positiveInt is intOr that refuses zero and negatives: a zero upload limit would
+// reject every file, which is a misconfiguration to fail on, not to run with.
+func positiveInt(key string, fallback int) (int, error) {
+	n, err := intOr(key, fallback)
+	if err != nil {
+		return 0, err
+	}
+	if n <= 0 {
+		return 0, fmt.Errorf("config: %s must be positive, got %d", key, n)
+	}
+	return n, nil
+}
+
+// localAlias is the shape of a model alias that runs on the homelab: a local host
+// prefix, then one plain name. A bare prefix check let through aliases that are shaped
+// like an escape (koala/../berget/x, koala//x, koala/x?host=berget): whether the
+// gateway would route them elsewhere is unknown, so they are refused (ADR-035 review).
+var localAlias = regexp.MustCompile(`^(koala|iguana)/[A-Za-z0-9][A-Za-z0-9._:-]*$`)
+
+// IsLocalModel reports whether alias is a local model. Private meeting content may be
+// sent to these and to nothing else: reconciliation (ADR-034) and chat over an uploaded
+// recording (ADR-035) are both held to it, and a cloud alias is refused at start-up
+// rather than discovered later.
+func IsLocalModel(alias string) bool {
+	return localAlias.MatchString(alias) && !strings.Contains(alias, "..")
+}
+
+// validateReconcile checks the two-engine settings. They are inert while no base
+// engine is set; once one is, the setup must be complete and entirely local.
+func (u UploadConfig) validateReconcile() error {
+	if u.ReconcileBaseModel == "" {
+		return nil
+	}
+	if u.ReconcileModel == "" {
+		return fmt.Errorf("config: TAPIR_RECONCILE_BASE_MODEL is set but TAPIR_RECONCILE_MODEL (the adjudicator) is not")
+	}
+	for _, m := range []struct{ name, alias string }{
+		{"TAPIR_RECONCILE_BASE_MODEL", u.ReconcileBaseModel},
+		{"TAPIR_RECONCILE_MODEL", u.ReconcileModel},
+	} {
+		if !IsLocalModel(m.alias) {
+			return fmt.Errorf("config: %s=%q is not a local model (koala/ or iguana/): private meeting content must not leave the homelab for reconciliation", m.name, m.alias)
+		}
+	}
+	if u.ReconcileBaseModel == u.TranscribeModel {
+		return fmt.Errorf("config: TAPIR_RECONCILE_BASE_MODEL and TAPIR_TRANSCRIBE_MODEL are both %q: two engines must differ", u.TranscribeModel)
+	}
+	return nil
+}

internal/config/uploads_local_test.go

@@ -0,0 +1,101 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+// What counts as a LOCAL model alias, and where that is demanded (ADR-034, ADR-035 review).
+// A private transcript may be sent to a local model and to nothing else; the check is a
+// guard against a misconfiguration or a crafted alias, so it must be strict about shape,
+// not just about a prefix.
+
+func TestIsLocalModel_AcceptsRealLocalAliasesAndNothingShapedLikeAnEscape(t *testing.T) {
+	tests := []struct {
+		alias string
+		want  bool
+	}{
+		{"koala/phi4-mini", true},
+		{"iguana/gemma4-26b", true},
+		{"iguana/gemma4-31b-think", true},
+		{"koala/qwen36-35b-a3b", true},
+		{"iguana/kb-whisper", true},
+		{"iguana/hf.co-model_v1:q4", true},
+		{"", false},
+		{"koala/", false},
+		{"iguana/", false},
+		{"gemma4-26b", false},
+		{"berget/mistral-small", false},
+		{"berget/koala/x", false},
+		{"xkoala/x", false},
+		{"Koala/x", false},
+		{" koala/x", false},
+		{"koala/x ", false},
+		{"koala/x y", false},
+		{"koala/x\n", false},
+		{"koala/../berget/kb", false},
+		{"koala//berget/mistral-small", false},
+		{"koala/x/y", false},
+		{"koala/x?host=berget", false},
+		{"koala/x#frag", false},
+		{"koala/x@evil", false},
+		{"koalа/x", false}, // Cyrillic а
+	}
+	for _, tt := range tests {
+		t.Run(tt.alias, func(t *testing.T) {
+			if got := IsLocalModel(tt.alias); got != tt.want {
+				t.Errorf("IsLocalModel(%q) = %v, want %v", tt.alias, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLoad_UploadChatModelMustBeLocalBecauseTheWholeTranscriptIsSentToIt(t *testing.T) {
+	for _, alias := range []string{"berget/mistral-small", "gemini/gemini-2.5-pro", "gemma4-26b", "koala/../berget/kb"} {
+		t.Run(alias, func(t *testing.T) {
+			clearUploadEnv(t)
+			setEnv(t, map[string]string{"TAPIR_UPLOAD_CHAT_MODEL": alias})
+
+			if _, err := Load(); err == nil {
+				t.Errorf("Load accepted TAPIR_UPLOAD_CHAT_MODEL=%q: a private transcript of up to 90,000 characters would be sent to it", alias)
+			}
+		})
+	}
+}
+
+func TestLoad_ALocalUploadChatModelIsAccepted(t *testing.T) {
+	clearUploadEnv(t)
+	setEnv(t, map[string]string{"TAPIR_UPLOAD_CHAT_MODEL": "iguana/gemma4-31b"})
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.UploadChatModel != "iguana/gemma4-31b" {
+		t.Errorf("UploadChatModel = %q", cfg.UploadChatModel)
+	}
+}
+
+func TestLoad_TheEngineTimeoutDefaultsToTwentyMinutesAndMustBePositive(t *testing.T) {
+	clearUploadEnv(t)
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.TranscribeEngineTimeout != 20*time.Minute {
+		t.Errorf("TranscribeEngineTimeout = %v, want 20m: a 90-minute recording takes about 8 minutes on kb-whisper, and two wedged engines in sequence must leave the job time to reach a fallback", cfg.TranscribeEngineTimeout)
+	}
+
+	setEnv(t, map[string]string{"TAPIR_TRANSCRIBE_ENGINE_TIMEOUT": "7m"})
+	cfg, err = Load()
+	if err != nil || cfg.TranscribeEngineTimeout != 7*time.Minute {
+		t.Errorf("override: %v, %v", cfg.TranscribeEngineTimeout, err)
+	}
+
+	for _, bad := range []string{"0", "-1m", "soon"} {
+		setEnv(t, map[string]string{"TAPIR_TRANSCRIBE_ENGINE_TIMEOUT": bad})
+		if _, err := Load(); err == nil {
+			t.Errorf("Load accepted TAPIR_TRANSCRIBE_ENGINE_TIMEOUT=%q", bad)
+		}
+	}
+}

internal/config/uploads_test.go

@@ -0,0 +1,217 @@
+package config
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// clearUploadEnv unsets every upload knob so a test observes the default, not the
+// host environment.
+func clearUploadEnv(t *testing.T) {
+	t.Helper()
+	for _, k := range []string{
+		"TAPIR_UPLOADS_ENABLED", "TAPIR_UPLOAD_MAX_MB", "TAPIR_UPLOAD_MAX_MINUTES",
+		"TAPIR_TRANSCRIBE_MODEL", "TAPIR_TRANSCRIBE_FALLBACK_MODEL", "TAPIR_TRANSCRIBE_TIMEOUT", "TAPIR_TRANSCRIBE_ENGINE_TIMEOUT",
+		"TAPIR_UPLOAD_TMP_DIR", "TAPIR_FFMPEG_BIN", "TAPIR_FFPROBE_BIN",
+		"TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS", "TAPIR_UPLOAD_CHAT_MODEL",
+		"TAPIR_RECONCILE_BASE_MODEL", "TAPIR_RECONCILE_MODEL", "TAPIR_RECONCILE_CHECK_ORDER",
+	} {
+		unset(t, k)
+	}
+}
+
+func TestLoad_UploadDefaults(t *testing.T) {
+	clearUploadEnv(t)
+
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+
+	if c.UploadsEnabled {
+		t.Error("uploads must be OFF by default: the runtime image needs ffmpeg first (ADR-033)")
+	}
+	if c.UploadMaxBytes != 200<<20 {
+		t.Errorf("UploadMaxBytes = %d, want 200 MB", c.UploadMaxBytes)
+	}
+	if c.UploadMaxDuration != 90*time.Minute {
+		t.Errorf("UploadMaxDuration = %v, want 90m (the longest length measured, not a found ceiling)", c.UploadMaxDuration)
+	}
+	if c.TranscribeModel != "iguana/kb-whisper" {
+		t.Errorf("TranscribeModel = %q", c.TranscribeModel)
+	}
+	if c.TranscribeFallbackModel != "berget/kb-whisper" {
+		t.Errorf("TranscribeFallbackModel = %q", c.TranscribeFallbackModel)
+	}
+	if c.TranscribeTimeout != 60*time.Minute {
+		t.Errorf("TranscribeTimeout = %v, want 60m (ADR-034: two engines plus ~300 adjudications)", c.TranscribeTimeout)
+	}
+	if c.ReconcileBaseModel != "" || c.ReconcileModel != "" || c.ReconcileCheckOrder {
+		t.Errorf("reconciliation must be OFF by default: %q %q %v", c.ReconcileBaseModel, c.ReconcileModel, c.ReconcileCheckOrder)
+	}
+	if c.UploadTmpDir != os.TempDir() {
+		t.Errorf("UploadTmpDir = %q, want os.TempDir()", c.UploadTmpDir)
+	}
+	if c.FFmpegBin != "ffmpeg" || c.FFprobeBin != "ffprobe" {
+		t.Errorf("bins = %q, %q", c.FFmpegBin, c.FFprobeBin)
+	}
+	if c.MaxUploadedTranscriptChars != 90000 {
+		t.Errorf("MaxUploadedTranscriptChars = %d, want 90000: iguana/gemma4-26b answered correctly at 90,000 chars "+
+			"but silently dropped the head of a 120,000-char transcript (docs/research/chat-context)", c.MaxUploadedTranscriptChars)
+	}
+	if c.UploadChatModel != "iguana/gemma4-26b" {
+		t.Errorf("UploadChatModel = %q: koala/phi4-mini has an 8,192-token context and answers HTTP 400 on an hour of speech", c.UploadChatModel)
+	}
+}
+
+func TestLoad_UploadChatModelOverride(t *testing.T) {
+	clearUploadEnv(t)
+	t.Setenv("TAPIR_UPLOAD_CHAT_MODEL", "koala/qwen36-35b-a3b")
+
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+
+	if c.UploadChatModel != "koala/qwen36-35b-a3b" {
+		t.Errorf("UploadChatModel = %q", c.UploadChatModel)
+	}
+}
+
+func TestLoad_UploadValuesAreParsed(t *testing.T) {
+	clearUploadEnv(t)
+	setEnv(t, map[string]string{
+		"TAPIR_UPLOADS_ENABLED":               "true",
+		"TAPIR_UPLOAD_MAX_MB":                 "50",
+		"TAPIR_UPLOAD_MAX_MINUTES":            "30",
+		"TAPIR_TRANSCRIBE_MODEL":              "koala/whisper",
+		"TAPIR_TRANSCRIBE_TIMEOUT":            "10m",
+		"TAPIR_UPLOAD_TMP_DIR":                "/var/spool/tapir",
+		"TAPIR_FFMPEG_BIN":                    "/opt/ffmpeg",
+		"TAPIR_FFPROBE_BIN":                   "/opt/ffprobe",
+		"TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS": "60000",
+	})
+
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+
+	if !c.UploadsEnabled || c.UploadMaxBytes != 50<<20 || c.UploadMaxDuration != 30*time.Minute ||
+		c.TranscribeModel != "koala/whisper" || c.TranscribeTimeout != 10*time.Minute ||
+		c.UploadTmpDir != "/var/spool/tapir" || c.FFmpegBin != "/opt/ffmpeg" ||
+		c.FFprobeBin != "/opt/ffprobe" || c.MaxUploadedTranscriptChars != 60000 {
+		t.Errorf("values not applied: %+v", c)
+	}
+}
+
+func TestLoad_EmptyTranscribeFallbackDisablesIt(t *testing.T) {
+	clearUploadEnv(t)
+	t.Setenv("TAPIR_TRANSCRIBE_FALLBACK_MODEL", "")
+
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+
+	if c.TranscribeFallbackModel != "" {
+		t.Errorf("TranscribeFallbackModel = %q: an explicit empty value must disable the cloud fallback, "+
+			"so private audio can be kept on the homelab", c.TranscribeFallbackModel)
+	}
+}
+
+func TestLoad_UploadRejectsInvalidValues(t *testing.T) {
+	tests := []struct{ key, val string }{
+		{"TAPIR_UPLOADS_ENABLED", "maybe"},
+		{"TAPIR_UPLOAD_MAX_MB", "lots"},
+		{"TAPIR_UPLOAD_MAX_MB", "0"},
+		{"TAPIR_UPLOAD_MAX_MB", "-5"},
+		{"TAPIR_UPLOAD_MAX_MINUTES", "0"},
+		{"TAPIR_UPLOAD_MAX_MINUTES", "forever"},
+		{"TAPIR_TRANSCRIBE_TIMEOUT", "soon"},
+		{"TAPIR_TRANSCRIBE_TIMEOUT", "0s"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.key+"="+tt.val, func(t *testing.T) {
+			clearUploadEnv(t)
+			t.Setenv(tt.key, tt.val)
+
+			if _, err := Load(); err == nil {
+				t.Errorf("Load accepted %s=%q; a zero or negative limit would reject every upload", tt.key, tt.val)
+			}
+		})
+	}
+}
+
+func TestLoad_ReconcileSettingsAreParsed(t *testing.T) {
+	clearUploadEnv(t)
+	setEnv(t, map[string]string{
+		"TAPIR_RECONCILE_BASE_MODEL":  "iguana/pianissimo",
+		"TAPIR_RECONCILE_MODEL":       "iguana/gemma4-31b",
+		"TAPIR_RECONCILE_CHECK_ORDER": "true",
+	})
+
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+
+	if c.ReconcileBaseModel != "iguana/pianissimo" || c.ReconcileModel != "iguana/gemma4-31b" || !c.ReconcileCheckOrder {
+		t.Errorf("not applied: %+v", c.UploadConfig)
+	}
+}
+
+func TestLoad_ReconcileRefusesAnUnsafeOrIncompleteSetup(t *testing.T) {
+	tests := []struct {
+		name string
+		env  map[string]string
+	}{
+		{"a base engine with no adjudicator", map[string]string{"TAPIR_RECONCILE_BASE_MODEL": "iguana/pianissimo"}},
+		{"a cloud adjudicator: private meeting content must not reach it", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "iguana/pianissimo", "TAPIR_RECONCILE_MODEL": "berget/mistral-small",
+		}},
+		{"a cloud adjudicator from another provider", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "iguana/pianissimo", "TAPIR_RECONCILE_MODEL": "gemini/gemini-2.5-pro",
+		}},
+		{"an adjudicator alias with no host prefix", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "iguana/pianissimo", "TAPIR_RECONCILE_MODEL": "gemma4-26b",
+		}},
+		{"a cloud alias that merely contains a local host name", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "iguana/pianissimo", "TAPIR_RECONCILE_MODEL": "berget/iguana/gemma4-26b",
+		}},
+		{"a cloud base engine", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "berget/kb-whisper", "TAPIR_RECONCILE_MODEL": "iguana/gemma4-26b",
+		}},
+		{"the same engine twice", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "iguana/kb-whisper", "TAPIR_RECONCILE_MODEL": "iguana/gemma4-26b",
+		}},
+		{"a bad order-check flag", map[string]string{
+			"TAPIR_RECONCILE_BASE_MODEL": "iguana/pianissimo", "TAPIR_RECONCILE_MODEL": "iguana/gemma4-26b", "TAPIR_RECONCILE_CHECK_ORDER": "perhaps",
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clearUploadEnv(t)
+			setEnv(t, tt.env)
+
+			if _, err := Load(); err == nil {
+				t.Errorf("Load accepted %v", tt.env)
+			}
+		})
+	}
+}
+
+func TestLoad_AnAdjudicatorWithoutABaseEngineIsIgnoredNotAnError(t *testing.T) {
+	clearUploadEnv(t)
+	t.Setenv("TAPIR_RECONCILE_MODEL", "iguana/gemma4-26b")
+
+	c, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+
+	if c.ReconcileBaseModel != "" {
+		t.Errorf("reconciliation must stay off without a base engine")
+	}
+}