feat(store): Store API for private uploaded transcripts (ADR-033)

Create/Start/Complete/Fail/Get/List plus the start-up sweep that fails unfinished rows as interrupted (audio is not retained, so no resume). Every call goes through withUser AND names user_id in its predicate, so isolation does not rest on RLS alone and stays testable under the superuser test connection; a non-owner gets ErrUploadNotFound, never a distinct forbidden. List drops transcript text. Mutation-checked: removing the user predicate from Get or from the UPDATEs turns the cross-user tests red. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
feat(domain): types for private uploaded transcripts (ADR-033)
2026-10-01 16:38:25 +02:00 · 2026-10-01 16:37:39 +02:00 · 2026-10-01 16:37:30 +02:00 · 2026-10-01 16:36:50 +02:00 · 2026-10-01 16:36:22 +02:00 · 2026-10-01 16:35:04 +02:00
21 changed files with 2472 additions and 31 deletions
@@ -0,0 +1,121 @@
 #!/usr/bin/env bash
 # Build an OCI image with buildctl and push it to the local registry.
 #
 # CANONICAL COPY: mathias/infra ci-templates/build-image.sh (infra#309).
 # Every repo carries a byte-identical copy at .gitea/build-image.sh, written by
 # `task ci:sync` and held in place by the drift gate. DO NOT EDIT THE COPIES --
 # edit here, re-sync, and the gate will tell you which repos still disagree.
 #
 # Why this exists: this step was hand-copied into a dozen repos, so migrating it
 # off rootless buildah (infra#241) meant eleven near-identical commits, eleven
 # verifications, and three separate rediscoveries of the same fix in the two
 # repo templates and the gitea-ci skill. The differences between the copies were
 # incidental -- a label here, a build-arg there -- never intentional. Those are
 # inputs now, not forks of the implementation.
 #
 # Why buildctl and not buildah: the gitea-runner pod runs with
 # `capabilities: drop [ALL]` and `allowPrivilegeEscalation: false`, which
 # unconditionally blocks the setuid-root exec that rootless buildah's uid/gid
 # remapping needs, and the pod has no OCI runtime at all. buildctl is a thin
 # client -- it hands the build to the host's buildkitd over a socket, so the
 # privileged layer work happens on the host and this pod's securityContext is
 # not in the picture. buildah is absent from the runner image as of baked-v14
 # and its absence is asserted at pod start (infra#308).
 #
 # Inputs, all via environment:
 #
 #   IMAGE            (required) image name, e.g. cobalt-dingo
 #   REGISTRY         default localhost:5000
 #   SHA_TAG          default `git rev-parse --short HEAD`
 #   VERSION_TAG      optional extra tag, e.g. v1.2.3 on a tag build
 #   PUSH_LATEST      default 1; set 0 to skip the :latest tag
 #   CONTEXT          default . -- build context directory
 #   DOCKERFILE_DIR   default $CONTEXT -- directory holding the Dockerfile
 #   DOCKERFILE_NAME  optional, when the file is not named `Dockerfile`
 #   TARGET           optional, multi-stage build target (--opt target=)
 #   BUILD_ARGS       optional, space-separated K=V pairs
 #   BUILD_SECRETS    optional, space-separated buildkit secret specs, each
 #                    `id=NAME,src=PATH`. Pass the SPEC only -- the caller
 #                    writes the secret to PATH itself. A secret VALUE must
 #                    never be passed here: it would land in this script's
 #                    argv and therefore in the CI log.
 #   EXTRA_LABELS     optional, space-separated K=V pairs
 #   GIT_SHA          optional, stamped as org.opencontainers.image.revision
 #   IMAGE_SOURCE     optional, stamped as org.opencontainers.image.source
 #
 # Note on shell style below: every conditional is a full `if` block, never
 # `[ -n "$X" ] && cmd`. Under `set -e` the && form exits the script whenever the
 # test is false, which is a real bug this estate has already shipped once.
 set -euo pipefail
 if [ -z "${IMAGE:-}" ]; then
  echo "build-image: IMAGE is required" >&2
  exit 2
 fi
 REGISTRY="${REGISTRY:-localhost:5000}"
 BUILDKIT_HOST="${BUILDKIT_HOST:-unix:///run/buildkit/buildkitd.sock}"
 CONTEXT="${CONTEXT:-.}"
 DOCKERFILE_DIR="${DOCKERFILE_DIR:-$CONTEXT}"
 PUSH_LATEST="${PUSH_LATEST:-1}"
 VERSION_TAG="${VERSION_TAG:-}"
 if [ -z "${SHA_TAG:-}" ]; then
  SHA_TAG="$(git rev-parse --short HEAD)"
 fi
 REF="${REGISTRY}/${IMAGE}:${SHA_TAG}"
 TAR_FILE="$(mktemp)"
 trap 'rm -f "$TAR_FILE"' EXIT
 args=(
  --frontend dockerfile.v0
  --local "context=${CONTEXT}"
  --local "dockerfile=${DOCKERFILE_DIR}"
 )
 if [ -n "${DOCKERFILE_NAME:-}" ]; then
  args+=(--opt "filename=${DOCKERFILE_NAME}")
 fi
 if [ -n "${TARGET:-}" ]; then
  args+=(--opt "target=${TARGET}")
 fi
 for spec in ${BUILD_SECRETS:-}; do
  # Opaque id=NAME,src=PATH -- buildkit reads the file, nothing is echoed.
  args+=(--secret "${spec}")
 done
 if [ -n "${GIT_SHA:-}" ]; then
  args+=(--opt "label:org.opencontainers.image.revision=${GIT_SHA}")
 fi
 if [ -n "${IMAGE_SOURCE:-}" ]; then
  args+=(--opt "label:org.opencontainers.image.source=${IMAGE_SOURCE}")
 fi
 for kv in ${BUILD_ARGS:-}; do
  args+=(--opt "build-arg:${kv}")
 done
 for kv in ${EXTRA_LABELS:-}; do
  args+=(--opt "label:${kv}")
 done
 echo "build-image: building ${REF}"
 buildctl --addr "$BUILDKIT_HOST" build "${args[@]}" --output "type=oci,dest=${TAR_FILE}"
 # buildctl has no registry-push equivalent to `buildah push`, so skopeo copies
 # the OCI archive up -- once per tag, from the same archive, so every tag points
 # at bit-identical content.
 push_tag() {
  echo "build-image: pushing ${1}"
  skopeo copy --dest-tls-verify=false "oci-archive:${TAR_FILE}" "docker://${1}"
 }
 push_tag "$REF"
 if [ "$PUSH_LATEST" = "1" ]; then
  push_tag "${REGISTRY}/${IMAGE}:latest"
 fi
 if [ -n "$VERSION_TAG" ]; then
  push_tag "${REGISTRY}/${IMAGE}:${VERSION_TAG}"
 fi
 echo "✓ build-image: ${REF} pushed"
@@ -61,33 +61,163 @@ jobs:
            echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
          fi
      # infra#241: rootless buildah inside the gitea-runner pod can't remap the
      # UID/GID range newuidmap/newgidmap need (the pod drops ALL capabilities
      # and sets allowPrivilegeEscalation:false — both deliberate, it also holds
      # CI secrets), so extracting a base-image layer that chowns outside the
      # single available mapping fails with `ApplyLayer ... requested 0:42 for
      # /etc/gshadow`. Main has been red on exactly this since 2026-08-13.
      # buildctl instead talks to koala's host buildkitd over the socket the
      # runner pod already mounts: the privileged extraction happens inside
      # buildkitd on the host, never in this pod. Same migration agentsquad
      # (infra#233) and segment-embedder (infra#243) already made — zero
      # security tradeoff, unlike loosening the pod's capabilities.
      #
      # buildctl has no registry-push flag of its own: it writes an OCI archive
      # and skopeo pushes that, which is also why every tag below is one copy of
      # a single build rather than a rebuild.
      - name: Build and push to local registry
-        run: |
+      # infra#309: implementation lives in .gitea/build-image.sh, a
-          REGISTRY="localhost:5000"
+      # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
+      # Do not edit it here -- edit the canonical file, run `task ci:sync`,
-          buildah build \
+      # and infra's drift gate names any repo still carrying an old copy.
-            --label "org.opencontainers.image.revision=${{ github.sha }}" \
+        env:
-            --label "org.opencontainers.image.source=${{ github.repositoryUrl }}" \
+          SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
-            -t ${REF} \
+          VERSION_TAG: ${{ steps.meta.outputs.version-tag }}
-            -t ${REGISTRY}/${{ env.IMAGE }}:latest \
+          GIT_SHA: ${{ github.sha }}
-            .
+          IMAGE_SOURCE: ${{ github.repositoryUrl }}
-          buildah push --tls-verify=false ${REF}
+        run: bash .gitea/build-image.sh
          buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
          [[ -n "${{ steps.meta.outputs.version-tag }}" ]] && \
            buildah push --tls-verify=false \
              ${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }} || true
          echo "Image pushed to ${REF}"
-      - name: Smoke test
+      # The buildah-based smoke test that used to sit here is gone with the
-        run: |
+      # buildctl migration above: `buildah from ${REF}` would pull the image
-          REGISTRY="localhost:5000"
+      # back into the pod's buildah store and hit the very uid/gid wall the
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
+      # migration exists to avoid — it would fail the job for a reason that has
-          CNAME="smoke-${{ steps.meta.outputs.sha-tag }}"
+      # nothing to do with the image being good. The `Verify rollout` step in
-          sudo k3s ctr images pull --plain-http ${REF}
+      # the deploy job below is the stronger check anyway: it requires the real
-          OUTPUT=$(timeout 5 sudo k3s ctr run --rm ${REF} ${CNAME} /tapir 2>&1 || true)
+      # pod to reach Ready in-cluster, not just the entrypoint to print its own
-          sudo k3s ctr containers delete ${CNAME} 2>/dev/null || true
+      # name for 5s. Tag builds lose their only image-level check (deploy is
-          echo "$OUTPUT" | grep -q "tapir" \
+      # main-push only) — accepted; a tag is always built from a main commit
-            && echo "Smoke test passed" \
+      # that already deployed.
            || echo "Smoke test inconclusive: $OUTPUT"
-  # ── 3. Mirror to GitHub — skipped for now (SSH key rotation pending) ─
+  # ── 3. Deploy via infra repo + Flux ─────────────────────────────────────────
  # Flux native image-automation can't scan localhost:5000 from inside k3s pods
  # (mathias/infra k3s/flux/flux-system/image-automation.yaml) — this job
  # mirrors cobalt-dingo's proven pattern instead: patch the infra repo's
  # manifest directly on every push to main, then annotate Flux for a fast
  # reconcile. Fixes infra#111 (image built+pushed but manifest bump was
  # manual, so merged features silently didn't deploy).
  deploy:
    name: Deploy via GitOps
    needs: build
    runs-on: self-hosted
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment: staging
    steps:
      - name: Update image tag in infra repo
        env:
          IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
          DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
        run: |
          set -euo pipefail
          # infra#311: fail on an empty tag BEFORE patching anything. The
          # grep verification further down CANNOT catch it -- with IMAGE_TAG
          # empty its pattern matches the very corruption it exists to reject.
          # The result is `image: <repo>:` in the manifest, which is invalid
          # YAML, so Flux fails the ENTIRE apps Kustomization and every app
          # stops reconciling, not just this one. That happened on 2026-08-25.
          [ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; }
          # INFRA_DEPLOY_KEY is a Gitea org secret (mathias org), already
          # configured per docs/cd-pipeline.md in the infra repo — same key
          # cobalt-dingo and brain-gardener use, no new secret needed.
          mkdir -p ~/.ssh
          echo "$DEPLOY_KEY" > ~/.ssh/id_infra
          chmod 600 ~/.ssh/id_infra
          ssh-keyscan -p 30022 10.0.1.20 >> ~/.ssh/known_hosts 2>/dev/null
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_infra -o IdentitiesOnly=yes"
          rm -rf /tmp/infra
          git clone -b main ssh://git@10.0.1.20:30022/mathias/infra.git /tmp/infra
          cd /tmp/infra
          DEPLOYMENT="k3s/apps/tapir/deployment.yaml"
          # In-place update of the image tag. sed (not yq) so we don't
          # depend on additional tooling on the runner — same as cobalt-dingo.
          sed -i "s|image: localhost:5000/tapir:.*|image: localhost:5000/tapir:${IMAGE_TAG}|" "$DEPLOYMENT"
          # Verify the patch took effect.
          grep -q "localhost:5000/tapir:${IMAGE_TAG}" "$DEPLOYMENT" \
            || { echo "✗ image tag patch failed"; exit 1; }
          if git diff --quiet "$DEPLOYMENT"; then
            echo "ℹ image tag unchanged — skipping push"
          else
            git -c user.name="tapir CI" \
                -c user.email="ci@tapir.local" \
                commit -m "chore(deploy): tapir → ${IMAGE_TAG}" "$DEPLOYMENT"
            git push origin main
            echo "✓ pushed to infra repo"
          fi
          shred -u ~/.ssh/id_infra
      - name: Trigger Flux reconcile (immediate)
        run: |
          # Without these annotations, Flux would still pick up the change
          # within 30s (the apps Kustomization interval). The annotations
          # cut latency to ~1s.
          kubectl -n flux-system annotate gitrepository flux-system \
            reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
          kubectl -n flux-system annotate kustomization apps \
            reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
      - name: Wait for Flux to apply new image
        env:
          IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
        run: |
          # Poll the Deployment spec until it reflects the new tag.
          # Bound to 60s so a stuck Flux doesn't hang CI.
          EXPECTED="localhost:5000/tapir:${IMAGE_TAG}"
          for i in $(seq 1 60); do
            CURRENT=$(kubectl get deploy tapir -n tapir \
              -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null || echo "")
            if [ "$CURRENT" = "$EXPECTED" ]; then
              echo "✓ Flux applied new image after ${i}s"
              break
            fi
            sleep 1
          done
          # Final assertion (in case the loop exited without matching).
          kubectl get deploy tapir -n tapir \
            -o jsonpath='{.spec.template.spec.containers[0].image}' \
            | grep -qx "$EXPECTED" \
            || { echo "✗ Flux did not apply new image within 60s"; exit 1; }
      - name: Verify rollout
        run: |
          kubectl rollout status deployment/tapir \
            --namespace tapir \
            --timeout=120s \
          || {
            echo "── pod status ──"
            kubectl get pods -n tapir -o wide
            echo "── events ──"
            kubectl get events -n tapir --sort-by='.lastTimestamp' | tail -20
            echo "── describe ──"
            kubectl describe pods -n tapir -l app=tapir | tail -40
            exit 1
          }
      - name: Confirm pod running new image
        env:
          IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
        run: |
          kubectl get pods -n tapir \
            -l app=tapir \
            --field-selector=status.phase=Running \
            -o jsonpath='{.items[*].spec.containers[0].image}' \
          | grep -q "localhost:5000/tapir:${IMAGE_TAG}" \
          && echo "✓ pod running new image" \
          || { echo "✗ pod image mismatch"; exit 1; }
  # ── 4. Mirror to GitHub — skipped for now (SSH key rotation pending) ─
@@ -11,3 +11,14 @@
 .env.*
 !.env.example
 *.local
 # Spike media (#28): real recordings, their transcripts and derived analyses are
 # private third-party content and this repo is public. Only synthetic fixtures
 # are committed — see scripts/spike-media/README.md.
 /scripts/spike-media/*.mov
 /scripts/spike-media/*.mp4
 /scripts/spike-media/*.wav
 /scripts/spike-media/*.srt
 /scripts/spike-media/*.json
 /scripts/spike-media/*.html
 !/scripts/spike-media/fixtures/
@@ -123,7 +123,9 @@ secret surface (see VISION Stage 2); it gets the existing, vetted secret path.
 ## ADR-007 — Captions-first; audio-download + speech-to-text deferred
 **Status:** Accepted (2026-06-02). Acquisition mechanism superseded by ADR-010 (Data API
-`captions.download` → player/timedtext baseUrl); captions-first stance and STT deferral stand.
+`captions.download` → player/timedtext baseUrl); captions-first stance and STT deferral stand
 **for YouTube**. STT deferral superseded **for user-supplied audio only** by ADR-033; the
 YouTube audio-download rejection is unchanged.
 **Context.** YouTube's Data API does not expose transcripts. Options: official captions
 (clean, limited coverage) vs. audio download + local Whisper (broad coverage, ToS-grey,
@@ -1314,6 +1316,191 @@ roll back. No schema, no structural change.
 ---
 ## ADR-033 — Upload audio, get a private Swedish transcript, discuss it (user-supplied STT)
 **Status:** Proposed (2026-10-01). **Decider: Mathias — pending.** Issue #33 (audio-only subset of
 #28). **Supersedes ADR-007's speech-to-text deferral for user-supplied audio only.** The
 YouTube audio-download rejection in ADR-007 **stands untouched**. Builds on ADR-012 (isolation),
 ADR-018 (single replica), ADR-021 (**the constraint**), ADR-022 (endpoint chain), ADR-025
 (honest status), ADR-027 (chat). ADR-014 item 4 ("Whisper reconsideration is a future ADR,
 gated on caption data") is a different question — whether to transcribe YouTube videos with no
 captions — and this ADR does not answer it. Measurements: `docs/research/audio-length-ceiling-2026-10-01.md`.
 **Context.** The maintainer has a concrete need: a Swedish Teams voice-only export, 30–90
 minutes, to upload and then *discuss* (what was decided, what is open, who owes what). Every
 piece exists — a Whisper endpoint on the gateway (infra#274), chat-with-transcript (ADR-027) —
 and nothing connects them.
 ADR-007 deferred STT for three reasons: yt-dlp fragility, ToS-grey scraping, and GPU contention
 with the JEPA PoC. Upload-STT shares **none** of them: the user owns the file, nothing is
 scraped, there is no caption rate gate, and the contention moved from koala to iguana. What it
 does share is landing Whisper in the codebase, which ADR-007 deferred — so a new ADR is required,
 and ADR-017's process note records the one time a guardrail-reversing change shipped without one.
 **The constraint that shapes everything.** ADR-021 made `transcripts` a shared, **non-RLS**
 table on the explicit grounds that it holds only public caption content and nothing
 user-identifying. A recorded internal meeting is the opposite: private third-party content owned
 by one user. The existing isolation test asserts `transcripts` *is* non-RLS, so a naive reuse
 would leak across tenants **and pass CI green**.
 **What was measured, not argued** (research doc above):
 - **No transcription ceiling up to 90 minutes.** One 174 MB request through the LiteLLM NodePort
  took 440 s (~12× realtime). The first failure is the public ingress `llm-api.d-ma.be`
  returning `413` above roughly 8–10 MB (~5 min of WAV) — not whisper, and not a Metal OOM.
  The 8:20 failure recorded in #33 is consistent with that cap.
 - **`response_format=srt` survives LiteLLM, wrapped** in a JSON envelope (`{"text": "<srt>"}`).
 - **The two backends differ.** `iguana/kb-whisper` returns whole-second segments;
  `berget/kb-whisper` returns sub-second times and a different `language` token.
 - **The existing chat path truncates at 18,000 chars (~22 min of speech), keeping the head.**
  #33 assumed chat "retrieves rather than generates" and so has no length ceiling. It does
  not retrieve; it stuffs the transcript into the prompt and cuts the tail.
 **Unknowns, stated.** Real-speech accuracy; compressed-input behaviour; concurrent long jobs on
 iguana; whether the models chat offers can hold an hour of Swedish (~50 k chars); and the Metal
 OOM, deliberately not provoked.
 **Decision.**
 1. **Audio only; transcript is the only thing kept.** An authenticated user uploads an audio
   file; Tapir transcribes it and stores the transcript. The audio itself is deleted after
   transcription (temp file, removed in a `defer`, swept at start-up) — no custody problem to
   solve, and nothing to hand to #31. Video is rejected with a message naming #28. YouTube
   audio-download stays rejected. No public/anonymous upload (ADR-008).
 2. **Private store: a separate RLS-scoped table, `uploaded_transcripts`** (resolves #28's
   decision 1). `user_id NOT NULL REFERENCES users ON DELETE CASCADE`, `ENABLE` + `FORCE ROW LEVEL
   SECURITY`, the same `tapir.current_user_id` policy as every other user-owned table. It carries
   the transcript text and its timestamped segments (re-transcribing 90 minutes costs ~7
   minutes; discarding the timestamps is irreversible), `status`, the `endpoint` that served
   it, `audio_seconds`, and a typed `error_kind`. **Not** a `user_id` column on `transcripts`
   with a partial policy, even though that would reuse more code: ADR-021's exception is
   precisely that *that table holds no private row*, the isolation test asserts it has no
   `user_id`, and a partial policy would turn "single exception" into "single exception, with a
   private lane inside it" — the shape under which a future query drops the policy clause and
   leaks. Two tables keep both boundaries independently assertable.
 3. **The isolation test asserts both boundaries and the set.** (a) User A cannot read, update or
   delete user B's uploaded transcript; no GUC set → deny-all. (b) `transcripts` is still
   non-RLS with no `user_id`. (c) **The set of public-schema tables with row security off is
   asserted exactly** — so a new table added without RLS fails CI instead of passing it. (c) is
   new; the existing test only checks the named tables.
 4. **Validate by probing, reject clearly.** Format and duration cannot be read from a filename
   or MIME type — a Teams "voice-only" recording is typically an `.mp4` container with no video
   stream, which is indistinguishable from video by extension. The upload is probed
   (`ffprobe`): accept any container with an audio stream and **no** video stream; reject video
   with "video is #28"; reject unreadable files. Limits, all configurable, all rejected
   synchronously with a specific message rather than by timeout: **200 MB** upload and
   **90 minutes** duration. 90 minutes is *the longest length measured*, not a ceiling that was
   found; raising it is a measurement, not an edit.
 5. **Transcode server-side, always, to 16 kHz mono PCM WAV** — even when the input already is,
   rather than assuming. whisper-server's `--convert` is rejected (its `--tmp-dir` is created at
   process start and rots under macOS periodic cleanup). The transcoder sits behind a port; the
   tests use a fake. **This puts `ffmpeg` and `ffprobe` in the runtime image**, which is
   distroless-static today. **Provisional: copy static ffmpeg/ffprobe binaries into the existing
   distroless image** (no shell, no package manager retained). This is a heavy new dependency
   and is **the maintainer's call** — see Open items.
 6. **Transcription adapter via the gateway, never the public hostname.** A `Transcriber` port;
   the implementation calls `POST {TAPIR_GATEWAY_URL}/audio/transcriptions` where the gateway
   URL is the in-cluster NodePort (`koala:30401/v1`). Primary `iguana/kb-whisper`, fallback
   `berget/kb-whisper` (immune to iguana contention, which can wedge permanently — infra#273).
   - **Fallback triggers on any primary failure** (transport error, timeout, non-2xx). It never
     branches on the body: `{"error":"failed to process audio"}` has had at least five distinct
     causes.
   - **`response_format=verbose_json`**, normalised to one segment shape: times clamped to the
     audio duration (the final segment can end past it), one language token. Not `srt`: the
     envelope adds a parse step and iguana's segment timing is the same either way.
   - **No chunking in v1.** Nothing failed to 90 minutes (measured). Chunk-and-stitch is the
     answer *if* the cap is raised or smaller requests become necessary — see triggers.
   - **The serving endpoint is recorded per row**, and surfaced, because the two backends
     differ in timestamp granularity: which one served a transcript is a quality fact.
   - **Berget is a cloud endpoint.** On fallback the audio of a private meeting leaves the
     homelab. #33 asks for this fallback; it is configurable (`TAPIR_TRANSCRIBE_FALLBACK_MODEL`,
     empty disables), recorded per row, and called out in Open items rather than defaulted
     silently.
   - Swedish only (`language=sv`). Language detection and routing (#28 decision 2) are not
     touched.
   - `-H 'Expect:'`, multipart field `file` — encoded in the adapter and its tests, not rediscovered.
 7. **Jobs run in-process, one at a time (ADR-018 stands).** Transcription is minutes (~7.5 min
   for 90) but a single goroutine behind a one-slot semaphore: two simultaneous 90-minute jobs on
   iguana were not measured, so concurrency is 1 until they are. No worker, no new deployable,
   no second replica. Honest status per ADR-025: `queued → transcribing → done | failed`, polled
   by the same `/status` pattern, every terminal state a rendered card, never a stuck spinner.
   Audio is not retained, so a restart mid-job **cannot resume**: at start-up any
   `queued`/`transcribing` row is marked `failed` with `error_kind = interrupted`, and the user
   re-uploads. The single-replica assumption gains a second dependent (the semaphore is
   process-local) and is recorded here.
 8. **Chat reuses `chat.Service`; it is not forked.** The uploaded-transcript chat handlers
   look the row up through the RLS-scoped store, so a non-owner gets 404 by the same mechanism
   as ADR-027's summary gate. ADR-027's decisions (ephemeral, switchable models, trust-the-model)
   carry over unchanged. **One thing must differ:** the 18,000-char default cuts a one-hour
   meeting to its first third, so uploaded transcripts take their own cap,
   `TAPIR_MAX_UPLOADED_TRANSCRIPT_CHARS`. **Provisional default 120,000 chars (~2.4 h at
   measured density)**, with the existing `Truncated` flag surfaced honestly. The default is a
   guess until the chat slice measures what the offered models actually accept; it is not
   evidence that they can.
 9. **Not decided here.** Rich `AVSNITT`/`ALTERNATIV` analysis (gated on #30 — `analyze_srt.py`
   hardcodes `max_tokens: 6000`); video, keyframes, synced playback (#28); language detection;
   per-transcript deletion UX (account deletion cascades; see Open items); retention of audio.
 **On the sequencing question #28 asks of itself** — *is this the thing that best serves the
 Stage-0 gate, or the most interesting thing to build?* Recorded answer: it proceeds **ahead of
 #32** (the demand test) as the maintainer's explicit, knowing call (#28, comment of 2026-10-01),
 on a concrete need rather than speculation. It is not a return-nudge (ADR-020/027): it adds
 nothing that prompts a user to come back, so it does not contaminate the unprompted-return signal
 ADR-016 measures. The honest risk is the one ADR-016 names: it is larger than anything ADR-020
 deferred. The scope cut — chat first, no rich analysis, no video — is what keeps it bounded.
 **Consequences.**
 - **Positive.** The user's request is met end to end with existing parts. ADR-021's exception stays
  singular and now provably so. The measured ceiling removes chunking from v1. No audio is stored.
 - **Negative / watch.**
  - Tapir's runtime image gains `ffmpeg`: a larger image and a new CVE surface to patch.
  - iguana becomes load-bearing for a user-facing feature (#28 decision 3; infra#273 is still the
    dependency that matters) — a Metal OOM now means *every upload fails over to berget*, i.e.
    private audio leaving the homelab, silently unless the per-row endpoint is surfaced.
  - A 90-minute job holds the single slot for ~7.5 minutes; a second user's upload queues behind it.
  - Chat over a long transcript is bounded by model context, not by anything in Tapir.
  - Tapir's own ingress body limit for a 200 MB upload is **unverified** (it lives in `infra`).
 **Validation / resolution triggers** (each observable by someone other than the author):
 - *Chunking*: build it when the duration cap is raised above 90 min, or when a measured
  request at the current cap fails with whisper-side (not ingress) errors.
 - *Berget-first*: if more than a quarter of uploads in any week are served by the fallback,
  swap the primary/fallback order and revisit infra#273.
 - *Retrieval chat*: if the chat slice finds an offered model cannot answer a question whose
  answer is in the last third of a 60-minute transcript, chunked retrieval replaces the larger cap.
 - *Worker*: if a transcription job ever degrades the reading UI, or Tapir runs more than one
  replica, ADR-018 is revisited.
 - *The decision itself*: if the maintainer has not used the feature unprompted within the
  ADR-016 window, it was the interesting thing, not the useful one — remove it.
 **Open items this ADR creates.**
 - **DECISION NEEDED — ffmpeg in the runtime image.** *Options:* (A) static ffmpeg/ffprobe copied
  into distroless **(recommended — the only option that satisfies "accept m4a/mp3/opus/mp4,
  validate duration, reject video"; pure-Go decoders cover wav/mp3 only)**; (B) accept WAV
  only, convert client-side (fails "I just want to upload it"); (C) a transcode sidecar
  (second deployable, ADR-018's reasoning against). *Blocks:* the Dockerfile slice, not the
  tests, which use the port.
 - **DECISION NEEDED — berget fallback for private audio.** *Options:* (A) enabled by default as
  #33 specifies, with the serving endpoint shown **(recommended, matches the issue)**; (B)
  disabled by default, a failed iguana job fails honestly and the user retries. *Blocks:*
  the production default only; the adapter ships either way.
 - Verify Tapir's ingress `proxy-body-size` against the 200 MB cap (`infra`).
 - Per-transcript deletion is not built; account deletion cascades. A private-content store
  without a delete button is a gap worth a ticket, not a silent omission.
 **Reversibility.** Additive: one table (down-migration drops it), one adapter, one upload
 surface, one image change. Removing the upload route removes the feature; `transcripts`, `videos`
 and ADR-021 are untouched.
 ---
 ## Rejected alternatives
 Approaches considered during the 2026-06-02 planning + grill session and **deliberately not
@@ -1338,6 +1525,9 @@ maps to the ADR that settles it.
 | Reverse the Dex-write invite flow (Google OIDC only) | Some intended Future-B users won't use Google; OIDC-only leaves them with no onboarding path — invite flow is load-bearing | ADR-017 |
 | k8s CronJob for scheduled discovery (vs in-process) | At Future-B scale the in-process scheduler is simpler to deploy; CronJob's failure-isolation benefit was weighed and traded away knowingly (revisit if >1 replica or load grows) | ADR-018 |
 | Cached-transcript-first onboarding burst (instant, zero-fetch picks) | Live pilot DB: ~3% cross-user video overlap, 0 cached-and-unsummarized, a new user's newest-20 are 20/20 uncached — newest-first and cached-first are structurally incompatible. Empty lever at pilot scale | ADR-028 |
 | Uploaded transcripts as a `user_id` column + partial RLS policy on `transcripts` | Turns ADR-021's single exception into an exception with a private lane inside it; the isolation test asserts `transcripts` has no `user_id`. A separate RLS table keeps both boundaries independently assertable | ADR-033 |
 | whisper-server `--convert` for server-side transcode | Its `--tmp-dir` is created at process start and rots under macOS periodic cleanup | ADR-033 |
 | Calling the public `llm-api.d-ma.be` from in-cluster Tapir | Its ingress returns 413 above ~8–10 MB (~5 min of WAV); the NodePort has no such cap | ADR-033 |
 If a future case genuinely reopens one of these, that's a new ADR superseding the relevant one —
 not a silent reversal.
@@ -0,0 +1,110 @@
 # Audio length ceiling — measured before designing chunking (tapir#33, 2026-10-01)
 Question (#33, "the main technical risk"): at what recording length does Swedish
 transcription through the LiteLLM gateway first fail, and with what failure mode?
 Measured **before** any chunking design, with iguana not holding a large ollama model,
 so the result is the ceiling and not the Metal OOM of infra#273.
 ## Answer
 **No transcription ceiling was found at or below 90 minutes.** A single request carrying
 90 minutes of 16 kHz mono PCM (174 MB) transcribed in one pass in 440 s. The first thing
 that actually fails is **not whisper**: it is the public gateway ingress, which rejects the
 upload with `413` at roughly 5.5 minutes of WAV.
 | Route | First failure | Failure mode |
 |---|---|---|
 | `https://llm-api.d-ma.be` (openresty ingress) | between 8.0 MB and 10.5 MB body (~4–5.5 min of WAV) | `413 Request Entity Too Large`, HTML body from `openresty`, returned instantly |
 | `http://koala:30401` (LiteLLM NodePort) → `iguana/kb-whisper` | **none up to 90 min / 174 MB** | — |
 | `http://koala:30401` → `berget/kb-whisper` | **none up to 22 min / 42 MB** (largest tried) | — |
 The ingress limit is the reason the 8:20 / 15 MB recording in #33 "failed repeatedly" and a
 30-second slice succeeded. That failure was attributed to a Metal OOM; at least in the
 size-dependent form described, a body-size cap explains it without one. (The OOM
 mechanism in infra#273 is separately real; this run did not provoke it.)
 The exact ingress cap was bracketed (8.0 MB passed, 10.5 MB failed), not read from the
 ingress configuration, which lives in `infra`. "About 10 MB" is an inference.
 ## Method
 - **Audio.** No known-good Swedish recording is available that is safe to use: the only real
  one (`IMG_1233.wav`) is the private `/bygge` recording (#31 custody still open) and was
  deliberately not touched. Instead: macOS `say -v Alva` (Swedish) on iguana, a 1,171-char
  five-paragraph meeting script → 82.5 s of 16 kHz mono PCM WAV (`ffmpeg -ar 16000 -ac 1`).
  Concatenated ×4, ×8, ×16, ×32, ×44, ×66 with Python `wave` (the issue's own recipe).
  Nothing here is a real transcript; none of it is committed.
 - **Request.** `POST /v1/audio/transcriptions`, multipart `file=`, `model=iguana/kb-whisper`,
  `response_format=verbose_json`, `-H 'Expect:'` (per #33's traps), master key supplied only
  through `op run` and never on argv.
 - **Confound control.** `ollama /api/ps` on iguana was read before every step. Resident:
  nothing, or `nomic-embed-text` (0.37 GB). Never a large model.
 ## Results (`iguana/kb-whisper`, NodePort)
 | Audio | WAV size | HTTP | Wall | Realtime factor | Segments | Chars |
 |---|---|---|---|---|---|---|
 | 0:30 | 0.96 MB | 200 | 2.8 s | 11× | — | — |
 | 2:30 / 3:20 / 4:10 | 4.8 / 6.4 / 8.0 MB | 200 (ingress) | 12.9 / 16.0 / 19.9 s | 12× | — | — |
 | 5:30 (×4) | 10.5 MB | **413 ingress**, 200 NodePort in 27 s | 27 s | 12× | 121 | 4,557 |
 | 11:00 (×8) | 21.1 MB | 200 | 53 s | 12× | 241 | 9,094 |
 | 22:00 (×16) | 42.3 MB | 200 | 105 s | 13× | 482 | 18,201 |
 | 44:01 (×32) | 84.5 MB | 200 | 209 s | 13× | 966 | 36,438 |
 | 60:32 (×44) | 116.2 MB | 200 | 291 s | 12× | 1,332 | 50,145 |
 | 90:48 (×66) | 174.3 MB | 200 | 440 s | 12× | 2,005 | 75,165 |
 - Throughput is flat at ~12× realtime. 90 minutes costs ~7.5 minutes of wall time. This is
  a minutes-long job, not a request/response one (see ADR-033 on ADR-018).
 - Segments per source repetition stay at 30.1–30.4 from ×4 to ×66, and segment times are
  monotonic with `last_end` within 0.2 s of `duration`. No drift and no repetition-loop
  hallucination appeared across 90 minutes. This is a weak check — the input is a repeated
  loop and synthetic voice — not evidence of accuracy.
 - **Only `iguana/kb-whisper`'s `x4` run reported `last_end` 360.0 s against `duration`
  330.2 s.** Whisper's final segment can end past the audio; clamp to `duration`.
 ## Findings that change the design
 1. **Use the NodePort route, not the public hostname.** Tapir runs in-cluster beside the
   gateway; `llm-api.d-ma.be` is the external door and has a body cap. #33 said "use the
   gateway, never the host" and named the public URL; the gateway is right, that URL is not.
   `TAPIR_GATEWAY_URL` already points at `koala:30401/v1`.
 2. **`response_format=srt` survives the LiteLLM hop, but wrapped.** The response is JSON
   `{"text": "<the SRT>", "usage": …}`, not a bare SRT body — a client that parses the body
   as SRT gets a parse error on `{`. #33 question 2 is answered: it passes through, inside
   an envelope.
 3. **The two backends return different timestamp granularity.** `iguana/kb-whisper`
   segments are **whole seconds** (`0→1`, `1→4`, `4→7`); `berget/kb-whisper` returns real
   sub-second times (`0.051→1.192`) and a different `language` token (`swedish` vs `sv`).
   `verbose_json` and the default JSON were byte-identical on iguana. An adapter that
   falls back between the two must normalise both, and "which endpoint served this" is
   a quality fact, not just a log line.
 4. **The existing chat path cannot answer about most of a long recording.** At
   828 chars/min (this fixture; real speech is plausibly a little denser),
   `TAPIR_MAX_TRANSCRIPT_CHARS`'s default of **18,000** is ~21.7 minutes. A 60-minute
   transcript is 50 k chars, a 90-minute one 75 k. `chat.Service` truncates by keeping
   the head (`internal/adapters/chat/chat.go`), so questions about the last two-thirds of
   a one-hour meeting get an answer from a transcript that does not contain it. #33 says
   chat "retrieves rather than generates" and therefore has no ceiling; it **stuffs and
   truncates**, and its ceiling is the model context. See ADR-033.
 5. **Chunking is not needed for v1 on length.** Nothing failed up to 90 minutes. The
   chunking-and-stitching recipe in #33 (offset timestamps, renumber cues, strip `\r`) is
   not built. It stays the answer *if* a longer cap is wanted or the OOM mechanism forces
   smaller requests — see ADR-033's resolution triggers.
 ## What this did not measure
 - **Metal OOM under contention.** Deliberately avoided. A big resident ollama model
  during a long transcription is still the known way to wedge iguana permanently.
 - **Real speech.** TTS is clean, single-voice, no crosstalk or room noise. WER and
  speaker overlap in a Teams export are untested. Speed is probably representative;
  accuracy is not claimed.
 - **Compressed input.** Only WAV was sent. Whether `m4a`/`mp3`/`opus` can reach whisper
  without a server-side transcode is not established here (ADR-033 treats it as needing one).
 - **Concurrency.** One request at a time. Two simultaneous 90-minute jobs on iguana were
  not tried.
 - **`berget/kb-whisper` beyond 22 min / 42 MB.** Enough to know the fallback is not
  size-capped at meeting length for 22 minutes; not proven at 90.
 - **Time-of-day / other tenants.** One afternoon, one run per length.
 Scripts were throwaway shell/Python in a session scratchpad and are not committed; the
 method above reproduces them.
@@ -0,0 +1,3 @@
 -- Drops the private uploaded-transcript store and every transcript in it. There
 -- is no revert of the data: the original audio was never kept (ADR-033).
 DROP TABLE uploaded_transcripts;
@@ -0,0 +1,48 @@
 -- Migration 017: uploaded_transcripts — PRIVATE transcripts of audio a user
 -- uploaded themselves (ADR-033, tapir#33).
 --
 -- This is deliberately NOT the shared `transcripts` table (migration 015,
 -- ADR-021). That table is non-RLS on the explicit grounds that it holds only
 -- public caption content and nothing user-identifying. A recorded meeting is the
 -- opposite: private third-party content owned by exactly one user. Reusing
 -- `transcripts` — or adding a user_id to it with a partial policy — would put a
 -- private row in the one table the isolation test asserts is shared, and would
 -- pass CI green. A separate table keeps ADR-021's exception singular.
 --
 -- Row-level security follows migration 003 exactly: ENABLE + FORCE (the app
 -- connects as the table owner, which bypasses RLS unless forced), and a policy
 -- keyed off the per-request GUC tapir.current_user_id. With no GUC set the
 -- predicate is NULL and the table is deny-all.
 --
 -- The original audio is never stored (ADR-033): this row is all that is kept.
 -- segments holds the timestamped cues; re-transcribing 90 minutes costs ~7
 -- minutes, so discarding the timestamps would be irreversible.
 CREATE TABLE uploaded_transcripts (
    id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id       UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    title         TEXT NOT NULL,
    status        TEXT NOT NULL DEFAULT 'queued'
                  CHECK (status IN ('queued', 'transcribing', 'done', 'failed')),
    content       TEXT,
    segments      JSONB,
    endpoint      TEXT,             -- which backend served it (iguana | berget); a quality fact
    audio_seconds DOUBLE PRECISION,
    error_kind    TEXT,             -- typed, never a provider's error string (ADR-033)
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    finished_at   TIMESTAMPTZ,
    CONSTRAINT uploaded_transcripts_done_has_content
        CHECK (status <> 'done' OR content IS NOT NULL),
    CONSTRAINT uploaded_transcripts_failed_has_error_kind
        CHECK (status <> 'failed' OR error_kind IS NOT NULL)
 );
 CREATE INDEX idx_uploaded_transcripts_user ON uploaded_transcripts (user_id, created_at DESC);
 ALTER TABLE uploaded_transcripts ENABLE ROW LEVEL SECURITY;
 ALTER TABLE uploaded_transcripts FORCE ROW LEVEL SECURITY;
 CREATE POLICY uploaded_transcripts_isolation ON uploaded_transcripts
    FOR ALL
    USING (user_id = current_setting('tapir.current_user_id', true)::uuid);
 COMMENT ON TABLE uploaded_transcripts IS
    'PRIVATE per-user transcripts of user-supplied audio. RLS-scoped (ADR-012). Never merge into the shared transcripts table (ADR-021, ADR-033).';
@@ -0,0 +1,199 @@
 package store
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"time"
 	"github.com/jackc/pgx/v5"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // ErrUploadNotFound is returned when an uploaded transcript does not exist OR is
 // not the caller's. The two are deliberately indistinguishable: a non-owner learns
 // nothing about whether someone else's upload exists (ADR-033).
 var ErrUploadNotFound = errors.New("store: uploaded transcript not found")
 // Uploaded transcripts are PRIVATE per-user content, stored in their own
 // RLS-scoped table (migration 017) — never in the shared `transcripts` (ADR-021).
 // Every method goes through withUser, so row-level security confines it to the
 // caller's rows; each statement ALSO names user_id in its predicate, so the
 // isolation does not rest on a single mechanism and stays testable under the
 // superuser connection the unit tests use.
 // CreateUpload records a new upload in the queued state and returns its id.
 func (s *Store) CreateUpload(ctx context.Context, userID, title string) (string, error) {
 	var id string
 	if err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		return tx.QueryRow(ctx,
 			`INSERT INTO uploaded_transcripts (user_id, title) VALUES ($1, $2) RETURNING id`,
 			userID, title).Scan(&id)
 	}); err != nil {
 		return "", fmt.Errorf("store: create upload: %w", err)
 	}
 	return id, nil
 }
 // StartTranscribing moves an upload to transcribing.
 func (s *Store) StartTranscribing(ctx context.Context, userID, id string) error {
 	return s.updateUpload(ctx, userID, id, "start transcribing",
 		`UPDATE uploaded_transcripts SET status = 'transcribing'
 		  WHERE id = $1 AND user_id = $2`)
 }
 // CompleteUpload stores the finished transcription and moves the upload to done.
 func (s *Store) CompleteUpload(ctx context.Context, userID, id string, t domain.Transcription) error {
 	segs, err := json.Marshal(t.Segments)
 	if err != nil {
 		return fmt.Errorf("store: complete upload: marshal segments: %w", err)
 	}
 	return s.updateUpload(ctx, userID, id, "complete upload",
 		`UPDATE uploaded_transcripts
 		    SET status = 'done', content = $3, segments = $4, endpoint = $5,
 		        audio_seconds = $6, error_kind = NULL, finished_at = NOW()
 		  WHERE id = $1 AND user_id = $2`,
 		t.Text, segs, t.Endpoint, t.AudioSeconds)
 }
 // FailUpload moves an upload to failed with a typed reason.
 func (s *Store) FailUpload(ctx context.Context, userID, id string, kind domain.UploadErrorKind) error {
 	return s.updateUpload(ctx, userID, id, "fail upload",
 		`UPDATE uploaded_transcripts
 		    SET status = 'failed', error_kind = $3, finished_at = NOW()
 		  WHERE id = $1 AND user_id = $2`,
 		string(kind))
 }
 // updateUpload runs one UPDATE keyed on ($1 = id, $2 = userID) plus extra args,
 // and maps "no row touched" to ErrUploadNotFound — which is what a write to another
 // user's upload looks like under RLS (the row is invisible, not forbidden).
 func (s *Store) updateUpload(ctx context.Context, userID, id, op, sql string, args ...any) error {
 	all := append([]any{id, userID}, args...)
 	return s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		ct, err := tx.Exec(ctx, sql, all...)
 		if err != nil {
 			return fmt.Errorf("store: %s: %w", op, err)
 		}
 		if ct.RowsAffected() == 0 {
 			return ErrUploadNotFound
 		}
 		return nil
 	})
 }
 // GetUpload returns one of the caller's uploads, including the transcript text.
 func (s *Store) GetUpload(ctx context.Context, userID, id string) (*domain.UploadedTranscript, error) {
 	var u domain.UploadedTranscript
 	err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		row := tx.QueryRow(ctx, uploadSelect+` WHERE id = $1 AND user_id = $2`, id, userID)
 		return scanUpload(row, &u, true)
 	})
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrUploadNotFound
 	}
 	if err != nil {
 		return nil, fmt.Errorf("store: get upload: %w", err)
 	}
 	return &u, nil
 }
 // ListUploads returns the caller's uploads, newest first, WITHOUT transcript text
 // or segments: a list view must not drag every transcript along.
 func (s *Store) ListUploads(ctx context.Context, userID string) ([]domain.UploadedTranscript, error) {
 	var out []domain.UploadedTranscript
 	err := s.withUser(ctx, userID, func(tx pgx.Tx) error {
 		rows, err := tx.Query(ctx, uploadSelect+` WHERE user_id = $1 ORDER BY created_at DESC, id`, userID)
 		if err != nil {
 			return err
 		}
 		defer rows.Close()
 		for rows.Next() {
 			var u domain.UploadedTranscript
 			if err := scanUpload(rows, &u, false); err != nil {
 				return err
 			}
 			out = append(out, u)
 		}
 		return rows.Err()
 	})
 	if err != nil {
 		return nil, fmt.Errorf("store: list uploads: %w", err)
 	}
 	return out, nil
 }
 // FailInterruptedUploads is the start-up sweep. The audio of an upload is never
 // retained (ADR-033), so a job that was queued or transcribing when the process
 // stopped can never resume; leaving it would be a stuck spinner. Every such row,
 // for every user, becomes failed/interrupted and the user re-uploads. It
 // enumerates users from the un-RLS'd identity map and scopes each pass with
 // withUser, exactly as scheduled discovery does (ADR-018). Returns rows failed.
 func (s *Store) FailInterruptedUploads(ctx context.Context) (int, error) {
 	users, err := s.ListAllUsers(ctx)
 	if err != nil {
 		return 0, fmt.Errorf("store: fail interrupted uploads: %w", err)
 	}
 	total := 0
 	for _, u := range users {
 		err := s.withUser(ctx, u.UserID, func(tx pgx.Tx) error {
 			ct, err := tx.Exec(ctx,
 				`UPDATE uploaded_transcripts
 				    SET status = 'failed', error_kind = $2, finished_at = NOW()
 				  WHERE user_id = $1 AND status IN ('queued', 'transcribing')`,
 				u.UserID, string(domain.UploadErrInterrupted))
 			total += int(ct.RowsAffected())
 			return err
 		})
 		if err != nil {
 			return total, fmt.Errorf("store: fail interrupted uploads: user %s: %w", u.UserID, err)
 		}
 	}
 	return total, nil
 }
 const uploadSelect = `SELECT id, user_id, title, status, content, segments, endpoint,
       audio_seconds, error_kind, created_at, finished_at FROM uploaded_transcripts`
 // scanUpload scans one uploadSelect row. withText controls whether the transcript
 // body and segments are kept (GetUpload) or dropped (ListUploads).
 func scanUpload(row pgx.Row, u *domain.UploadedTranscript, withText bool) error {
 	var (
 		status, errKind, endpoint, content *string
 		segments                           []byte
 		seconds                            *float64
 		finished                           *time.Time
 	)
 	if err := row.Scan(&u.ID, &u.UserID, &u.Title, &status, &content, &segments, &endpoint,
 		&seconds, &errKind, &u.CreatedAt, &finished); err != nil {
 		return err
 	}
 	u.Status = domain.UploadStatus(deref(status))
 	u.Endpoint = deref(endpoint)
 	u.ErrorKind = domain.UploadErrorKind(deref(errKind))
 	if seconds != nil {
 		u.AudioSeconds = *seconds
 	}
 	if finished != nil {
 		u.FinishedAt = *finished
 	}
 	if !withText {
 		return nil
 	}
 	u.Content = deref(content)
 	if len(segments) > 0 {
 		if err := json.Unmarshal(segments, &u.Segments); err != nil {
 			return fmt.Errorf("unmarshal segments: %w", err)
 		}
 	}
 	return nil
 }
 func deref(s *string) string {
 	if s == nil {
 		return ""
 	}
 	return *s
 }
@@ -0,0 +1,196 @@
 package store_test
 import (
 	"context"
 	"sort"
 	"testing"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/stretchr/testify/require"
 )
 // Isolation proof for ADR-033: an uploaded transcript is PRIVATE content owned by
 // one user, so it lives in its own RLS-scoped table — never in the shared,
 // non-RLS `transcripts` (ADR-021). These tests drive the database directly (raw
 // SQL as the non-superuser `app` role) so they observe row-level security itself,
 // not any application-layer WHERE clause. The superuser pool is used only to seed
 // and to read pg_catalog; it bypasses RLS and so must never be the pool whose
 // answers the assertions rest on.
 // seedUploadedTranscript inserts one finished upload for userID as the superuser
 // (RLS bypassed so both users' rows land regardless of any GUC) and returns its id.
 // The text is synthetic — this repo is public, and a real transcript must never
 // appear in it (#33).
 func seedUploadedTranscript(t *testing.T, super *pgxpool.Pool, userID, text string) string {
 	t.Helper()
 	ctx := context.Background()
 	_, err := super.Exec(ctx, `INSERT INTO users (id) VALUES ($1) ON CONFLICT DO NOTHING`, userID)
 	require.NoError(t, err)
 	var id string
 	require.NoError(t, super.QueryRow(ctx,
 		`INSERT INTO uploaded_transcripts (user_id, title, status, content)
 		 VALUES ($1, 'synthetic fixture', 'done', $2) RETURNING id`,
 		userID, text).Scan(&id))
 	return id
 }
 func TestUploadedTranscriptsRLS_ScopedReadsSeeOnlyOwnRows(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	seedUploadedTranscript(t, super, userB, "text owned by B")
 	app := appPool(t, super)
 	require.Equal(t, 0, scopedCount(t, app, "", "uploaded_transcripts"),
 		"no tapir.current_user_id must be deny-all: this proves RLS is live, not bypassed")
 	require.Equal(t, 1, scopedCount(t, app, userA, "uploaded_transcripts"),
 		"user A must see exactly its own upload")
 	require.Equal(t, 1, scopedCount(t, app, userB, "uploaded_transcripts"),
 		"user B must see exactly its own upload")
 	// Count alone cannot distinguish "A's row" from "B's row" — read the content.
 	var got string
 	ctx := context.Background()
 	tx, err := app.Begin(ctx)
 	require.NoError(t, err)
 	defer tx.Rollback(ctx) //nolint:errcheck
 	_, err = tx.Exec(ctx, `SELECT set_config('tapir.current_user_id', $1, true)`, userA)
 	require.NoError(t, err)
 	require.NoError(t, tx.QueryRow(ctx, `SELECT content FROM uploaded_transcripts`).Scan(&got))
 	require.Equal(t, "text owned by A", got, "A's scoped read must return A's text, never B's")
 }
 func TestUploadedTranscriptsRLS_CrossUserWritesAffectZeroRows(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	bID := seedUploadedTranscript(t, super, userB, "text owned by B")
 	app := appPool(t, super)
 	require.Equal(t, int64(0), scopedRowsAffected(t, app, userA,
 		`UPDATE uploaded_transcripts SET content = 'hacked' WHERE id = $1`, bID),
 		"user A scoped UPDATE must touch zero of B's uploads")
 	require.Equal(t, int64(0), scopedRowsAffected(t, app, userA,
 		`DELETE FROM uploaded_transcripts WHERE id = $1`, bID),
 		"user A scoped DELETE must touch zero of B's uploads")
 	var content string
 	require.NoError(t, super.QueryRow(context.Background(),
 		`SELECT content FROM uploaded_transcripts WHERE id = $1`, bID).Scan(&content))
 	require.Equal(t, "text owned by B", content, "B's upload must survive A's writes unchanged")
 }
 func TestUploadedTranscriptsRLS_InsertForAnotherUserIsRejected(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	_, err := super.Exec(context.Background(), `INSERT INTO users (id) VALUES ($1)`, userB)
 	require.NoError(t, err)
 	app := appPool(t, super)
 	ctx := context.Background()
 	tx, err := app.Begin(ctx)
 	require.NoError(t, err)
 	defer tx.Rollback(ctx) //nolint:errcheck
 	_, err = tx.Exec(ctx, `SELECT set_config('tapir.current_user_id', $1, true)`, userA)
 	require.NoError(t, err)
 	// Scoped as A, plant a row that claims to belong to B. The policy's WITH CHECK
 	// (defaulting to USING under FOR ALL) must refuse it.
 	_, err = tx.Exec(ctx,
 		`INSERT INTO uploaded_transcripts (user_id, title, status, content)
 		 VALUES ($1, 'planted', 'done', 'planted')`, userB)
 	require.Error(t, err, "a row scoped as A must not be insertable on behalf of B")
 	require.Contains(t, err.Error(), "row-level security")
 }
 func TestUploadedTranscripts_RowSecurityIsEnabledForcedAndKeyedByUser(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	ctx := context.Background()
 	var enabled, forced bool
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT relrowsecurity, relforcerowsecurity FROM pg_class
 		  WHERE oid = 'public.uploaded_transcripts'::regclass`).Scan(&enabled, &forced))
 	require.True(t, enabled, "uploaded_transcripts must have row-level security enabled")
 	require.True(t, forced,
 		"FORCE is what binds the table-owner role tapir; without it the policy is dead in production")
 	var userIDNotNull bool
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT is_nullable = 'NO' FROM information_schema.columns
 		  WHERE table_name = 'uploaded_transcripts' AND column_name = 'user_id'`).Scan(&userIDNotNull))
 	require.True(t, userIDNotNull, "an upload with no owner would match no policy and be unreachable")
 }
 func TestUploadedTranscripts_DeleteUserRemovesTheirUploads(t *testing.T) {
 	s := newStore(t)
 	super := rawPool(t)
 	resetDB(t, super)
 	seedUploadedTranscript(t, super, userA, "text owned by A")
 	bID := seedUploadedTranscript(t, super, userB, "text owned by B")
 	require.NoError(t, s.DeleteUser(context.Background(), userA))
 	var aRows, bRows int
 	ctx := context.Background()
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT count(*) FROM uploaded_transcripts WHERE user_id = $1`, userA).Scan(&aRows))
 	require.NoError(t, super.QueryRow(ctx,
 		`SELECT count(*) FROM uploaded_transcripts WHERE id = $1`, bID).Scan(&bRows))
 	require.Equal(t, 0, aRows, "deleting a user must remove their private transcripts (ON DELETE CASCADE)")
 	require.Equal(t, 1, bRows, "deleting A must not touch B's transcripts")
 }
 // rowSecurityOffTables are the public-schema tables that deliberately have row
 // security OFF. The list is exact on purpose: a NEW table added without RLS must
 // fail this test and force a decision, instead of passing CI by omission — the
 // failure mode ADR-033 names, where a naive reuse "leaks private content across
 // tenants and passes CI green".
 //
 //   - transcripts: shared public caption content, the single exception for CONTENT
 //     (ADR-021). It is the one that must never gain a private row.
 //   - user_identities: the Dex-subject -> user_id map, read at login before any
 //     user is known (migration 004). Holds no user content.
 //   - invitations: exists before the user does, so there is no user to scope by;
 //     the single-use token is the capability (migration 009).
 //   - schema_migrations: golang-migrate bookkeeping.
 //
 // #33 describes `transcripts` as "the only non-RLS table". That is true of content
 // and false of tables; this test asserts the real set.
 var rowSecurityOffTables = []string{
 	"invitations",
 	"schema_migrations",
 	"transcripts",
 	"user_identities",
 }
 func TestRowSecurityOffTablesAreExactlyTheKnownSet(t *testing.T) {
 	newStore(t)
 	super := rawPool(t)
 	rows, err := super.Query(context.Background(),
 		`SELECT c.relname FROM pg_class c
 		   JOIN pg_namespace n ON n.oid = c.relnamespace
 		  WHERE n.nspname = 'public' AND c.relkind IN ('r', 'p') AND NOT c.relrowsecurity
 		  ORDER BY c.relname`)
 	require.NoError(t, err)
 	defer rows.Close()
 	var got []string
 	for rows.Next() {
 		var name string
 		require.NoError(t, rows.Scan(&name))
 		got = append(got, name)
 	}
 	require.NoError(t, rows.Err())
 	want := append([]string{}, rowSecurityOffTables...)
 	sort.Strings(want)
 	require.Equal(t, want, got,
 		"every public table must have row security ON unless it is in rowSecurityOffTables; "+
 			"adding a table here is a decision that needs an ADR")
 }
@@ -0,0 +1,188 @@
 package store_test
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
 )
 // These exercise the Store API over uploaded_transcripts. The test Store connects
 // as the superuser, which BYPASSES row-level security — so the cross-user cases
 // here prove the query's own user_id predicate (defence in depth), while the
 // database-enforced guarantee is proven separately, as the non-superuser app
 // role, in uploaded_transcripts_isolation_test.go. Text is synthetic; this repo is
 // public and no real transcript may appear in it (#33).
 func seedUsers(t *testing.T, ids ...string) {
 	t.Helper()
 	super := rawPool(t)
 	resetDB(t, super)
 	for _, id := range ids {
 		_, err := super.Exec(context.Background(), `INSERT INTO users (id) VALUES ($1)`, id)
 		require.NoError(t, err)
 	}
 }
 func TestCreateUpload_StartsQueuedAndIsOwnedByTheCreator(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "Teams export")
 	require.NoError(t, err)
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, id, got.ID)
 	assert.Equal(t, userA, got.UserID)
 	assert.Equal(t, "Teams export", got.Title)
 	assert.Equal(t, domain.UploadQueued, got.Status)
 	assert.Empty(t, got.Content)
 	assert.True(t, got.FinishedAt.IsZero(), "an unfinished upload has no finish time")
 }
 func TestUploadLifecycle_CompletedKeepsTextSegmentsEndpointAndDuration(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "m")
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	mid, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadTranscribing, mid.Status)
 	want := domain.Transcription{
 		Text: "God morgon allihopa. Vi går igenom läget.",
 		Segments: []domain.Segment{
 			{Start: 0.0, End: 1.5, Text: "God morgon allihopa."},
 			{Start: 1.5, End: 4.25, Text: "Vi går igenom läget."},
 		},
 		Endpoint:     "iguana/kb-whisper",
 		AudioSeconds: 4.25,
 	}
 	require.NoError(t, s.CompleteUpload(ctx, userA, id, want))
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadDone, got.Status)
 	assert.Equal(t, want.Text, got.Content)
 	assert.Equal(t, want.Segments, got.Segments, "segment times must survive the JSONB round trip")
 	assert.Equal(t, "iguana/kb-whisper", got.Endpoint, "the serving endpoint is a quality fact and is recorded per row")
 	assert.InDelta(t, 4.25, got.AudioSeconds, 1e-9)
 	assert.False(t, got.FinishedAt.IsZero())
 	assert.Empty(t, got.ErrorKind)
 }
 func TestUploadLifecycle_FailedRecordsTypedKindAndNoContent(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "m")
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, id))
 	require.NoError(t, s.FailUpload(ctx, userA, id, domain.UploadErrTranscriptionFailed))
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadFailed, got.Status)
 	assert.Equal(t, domain.UploadErrTranscriptionFailed, got.ErrorKind)
 	assert.Empty(t, got.Content)
 	assert.False(t, got.FinishedAt.IsZero())
 }
 func TestGetUpload_AnotherUsersIDIsNotFound(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "A's meeting")
 	require.NoError(t, err)
 	_, err = s.GetUpload(ctx, userB, id)
 	assert.ErrorIs(t, err, store.ErrUploadNotFound,
 		"a non-owner must get not-found, not forbidden: existence is not disclosed")
 }
 func TestUploadWrites_ByAnotherUserChangeNothing(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
 	id, err := s.CreateUpload(ctx, userA, "A's meeting")
 	require.NoError(t, err)
 	assert.ErrorIs(t, s.StartTranscribing(ctx, userB, id), store.ErrUploadNotFound)
 	assert.ErrorIs(t, s.CompleteUpload(ctx, userB, id, domain.Transcription{Text: "planted"}), store.ErrUploadNotFound)
 	assert.ErrorIs(t, s.FailUpload(ctx, userB, id, domain.UploadErrTranscriptionFailed), store.ErrUploadNotFound)
 	got, err := s.GetUpload(ctx, userA, id)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadQueued, got.Status, "B's writes must leave A's upload exactly as it was")
 	assert.Empty(t, got.Content)
 }
 func TestListUploads_ReturnsOnlyTheCallersNewestFirstWithoutTranscriptText(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	ctx := context.Background()
 	first, err := s.CreateUpload(ctx, userA, "first")
 	require.NoError(t, err)
 	second, err := s.CreateUpload(ctx, userA, "second")
 	require.NoError(t, err)
 	_, err = s.CreateUpload(ctx, userB, "B's")
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, first))
 	require.NoError(t, s.CompleteUpload(ctx, userA, first, domain.Transcription{Text: "long text body", Endpoint: "e"}))
 	got, err := s.ListUploads(ctx, userA)
 	require.NoError(t, err)
 	require.Len(t, got, 2, "A must see only A's uploads")
 	assert.Equal(t, second, got[0].ID, "newest first")
 	assert.Equal(t, first, got[1].ID)
 	assert.Empty(t, got[1].Content, "a list row must not drag the whole transcript along")
 	assert.Equal(t, domain.UploadDone, got[1].Status)
 }
 func TestFailInterruptedUploads_FailsOnlyUnfinishedRowsForEveryUser(t *testing.T) {
 	s := newStore(t)
 	seedUsers(t, userA, userB)
 	super := rawPool(t)
 	ctx := context.Background()
 	for subject, uid := range map[string]string{"sub-a": userA, "sub-b": userB} {
 		_, err := super.Exec(ctx, `INSERT INTO user_identities (dex_subject, user_id) VALUES ($1, $2)`, subject, uid)
 		require.NoError(t, err)
 	}
 	queued, err := s.CreateUpload(ctx, userA, "queued")
 	require.NoError(t, err)
 	running, err := s.CreateUpload(ctx, userB, "running")
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userB, running))
 	done, err := s.CreateUpload(ctx, userA, "done")
 	require.NoError(t, err)
 	require.NoError(t, s.StartTranscribing(ctx, userA, done))
 	require.NoError(t, s.CompleteUpload(ctx, userA, done, domain.Transcription{Text: "kept", Endpoint: "e"}))
 	n, err := s.FailInterruptedUploads(ctx)
 	require.NoError(t, err)
 	assert.Equal(t, 2, n, "the queued and the transcribing row, across both users")
 	for _, c := range []struct{ user, id string }{{userA, queued}, {userB, running}} {
 		got, err := s.GetUpload(ctx, c.user, c.id)
 		require.NoError(t, err)
 		assert.Equal(t, domain.UploadFailed, got.Status)
 		assert.Equal(t, domain.UploadErrInterrupted, got.ErrorKind,
 			"audio is not retained, so a restart cannot resume: the honest state is failed/interrupted")
 	}
 	kept, err := s.GetUpload(ctx, userA, done)
 	require.NoError(t, err)
 	assert.Equal(t, domain.UploadDone, kept.Status, "a finished transcript must survive the sweep")
 	assert.Equal(t, "kept", kept.Content)
 }
@@ -111,3 +111,62 @@ type Summary struct {
 	FallbackUsed bool
 	CreatedAt    time.Time
 }
 // Segment is one timed span of a transcription. Times are seconds from the start
 // of the audio.
 type Segment struct {
 	Start float64 `json:"start"`
 	End   float64 `json:"end"`
 	Text  string  `json:"text"`
 }
 // Transcription is the result of transcribing user-supplied audio (ADR-033):
 // the full text, its timed segments, which backend served it, and how long the
 // audio was. Endpoint is recorded because the backends differ in timestamp
 // granularity — which one served a transcript is a quality fact.
 type Transcription struct {
 	Text         string
 	Segments     []Segment
 	Endpoint     string
 	AudioSeconds float64
 }
 // UploadStatus is the state of an uploaded-audio transcription job.
 type UploadStatus string
 const (
 	UploadQueued       UploadStatus = "queued"
 	UploadTranscribing UploadStatus = "transcribing"
 	UploadDone         UploadStatus = "done"
 	UploadFailed       UploadStatus = "failed"
 )
 // UploadErrorKind is the typed reason an upload failed. It is deliberately NOT a
 // provider's error string: the whisper server's "failed to process audio" has had
 // at least five distinct causes, so nothing may branch on it (ADR-033).
 type UploadErrorKind string
 const (
 	// UploadErrInterrupted: the process restarted mid-job. The audio is not
 	// retained, so the job cannot resume; the user re-uploads.
 	UploadErrInterrupted UploadErrorKind = "interrupted"
 	// UploadErrTranscriptionFailed: every configured transcription endpoint failed.
 	UploadErrTranscriptionFailed UploadErrorKind = "transcription_failed"
 )
 // UploadedTranscript is a user's PRIVATE transcript of audio they uploaded. It is
 // never stored in, or merged with, the shared public-caption Transcript (ADR-021).
 // Content and Segments are empty until Status is UploadDone.
 type UploadedTranscript struct {
 	ID           string
 	UserID       string
 	Title        string
 	Status       UploadStatus
 	Content      string
 	Segments     []Segment
 	Endpoint     string
 	AudioSeconds float64
 	ErrorKind    UploadErrorKind
 	CreatedAt    time.Time
 	FinishedAt   time.Time // zero until the job reaches done or failed
 }
@@ -3,9 +3,10 @@ package web
 import (
 	"bytes"
 	"context"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"strings"
 	"testing"
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 )
 func TestParseYouTubeVideoID(t *testing.T) {
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"
-	"gitea.d-ma.be/mathias/tapir/internal/adapters/store"
+	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 )
 // Layout is the shared HTML shell. HTMX drives the progressive interactions
@@ -14,7 +14,8 @@ import (
 // page renders any GET path's full HTML (helper for theme/structure assertions).
 func page(t *testing.T, app interface {
 	Router() http.Handler
-}, path string) string {
+}, path string,
 ) string {
 	t.Helper()
 	rec := httptest.NewRecorder()
 	app.Router().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
@@ -0,0 +1,72 @@
 # spike-media — the `/bygge` toolchain, recovered
 Throwaway spike tooling for #28 (upload → transcript → takeaways). Committed
 because it was found in `tmpfs` one reboot from gone, not because it is finished.
 Nothing here is wired into tapir. No database, no HTTP handler, no ADR.
 ## What produced `/bygge`
 The prototype at `tapir.d-ma.be/bygge` was **not** hand-built, which the epic and
 the first round of spike issues both got wrong. It came from these three scripts:
 ```
 IMG_1233.mov --transcode.yaml--> IMG_1233.web.mp4   (k3s Job, h264, +faststart)
 IMG_1233.wav --whisper---------> IMG_1233.sv.srt    (interactive — the one manual step)
 IMG_1233.sv.srt --analyze_srt.py--> analys.json     (berget/mistral-medium, temperature=0)
 analys.json + video --build_page.py--> page HTML
 ```
 The reference analysis was produced by **`berget/mistral-medium`** — a mid-tier
 cloud model, not a frontier one. That matters when judging what a local model
 has to clear: the bar is mistral-medium, and it should be re-run as the control
 arm rather than excluded.
 ## The validator is the valuable part
 `analyze_srt.py` grades its own output on four checks. Two of them catch classes
 of error that timestamp- and citation-checking cannot:
 | Check | Catches |
 |---|---|
 | citation exact / **partial** / absent | Paraphrase presented as a quote. Three tiers, because `alternativ` citations legitimately stitch non-contiguous passages — a strict substring test fails the reference output. |
 | `TALET … FINNS INTE I CITATET` | A wrong number carried by a *verbatim* citation and a *real* timestamp. Converts Swedish number-words to digits first. It caught `45×230` where the transcript said `220`. |
 | `TACKNINGSLUCKA` | Spans of the clip no section covers. **The recall term** — without it an empty analysis scores perfectly on every other check. |
 | timestamp exists in the SRT | Fabricated seek targets. Near-solved: 74/75 on the reference, because the model copies the cue starts it was handed. |
 ## Known defects — read before running
 - **`max_tokens: 6000` is too low.** The 4-minute reference analysis is ~4,700
  output tokens, i.e. ~78% of budget. A 10-minute clip truncates for every model,
  and truncation reads as a JSON-discipline failure if you are not counting
  tokens. Record `finish_reason` and separate `truncated` from `malformed`.
 - **`build_page.py` hardcodes the title** (`"Jonas – genomgång av tillbyggnad"`).
 - **The schema carries fields nothing renders** — `projekt.sammanfattning`,
  `projekt.skede`, `avsnitt.bildtid`, `avsnitt.bildmotiv`, `material[]`,
  `oklart[]` — left over from an earlier still-frame/markdown output that
  `build_page.py` replaced. They are paid for in output tokens on every run.
 - **Speaker attribution is inferred, not diarized.** The output attributes
  statements by name from an SRT with no speaker labels. All four checks above
  are blind to a misattribution.
 - **The web encode does not downscale.** The source is 720×1280; `-preset
  veryfast -crf 24` on handheld motion is what makes it ~5 Mbps, not the
  resolution. The lever is the preset.
 ## Fixtures
 `fixtures/fake.sv.srt` + `fixtures/fake.analys.json` — a synthetic 7-cue Swedish
 construction walkthrough with planted numbers. No real people, no real project.
 It exercises the parser and all four validator checks **without a model call**,
 which is what makes it usable in a test.
 ## Why the real artifacts are not here
 **This repo is public.** The prototype's transcript and analysis are a verbatim
 recording of a named person discussing a client's building project — private
 third-party content, and exactly the class of data #28 calls out as the reason
 uploaded transcripts cannot live in the shared `transcripts` table.
 So `IMG_1233.sv.srt`, `payload.json` and the model-comparison runs stay out of
 git here. That leaves `/bygge` without a versioned source of truth, which is a
 real gap and a decision for #28: a private repo, an encrypted blob, or accepting
 that the reference artifacts live outside version control.
@@ -0,0 +1,500 @@
 #!/usr/bin/env python3
 """Analysera en svensk SRT-transkription av ett byggprojekt.
 Steg 1 av 2: producerar tidsstämplad, källbelagd JSON som steg 2
 (ffmpeg-bildutdrag + markdown-montering) konsumerar.
 Varje påstående måste bära sitt ordagranna citat och sin tidsstämpel.
 Det gör hallucination synlig i stället för trolig, och ger samtidigt
 bildtiderna gratis.
 Körning:
    export DMABE_LLMAPI_KEY=...            # redan satt på koala
    python3 analyze_srt.py IMG_1233.sv.srt > analys.json
 """
 from __future__ import annotations
 import argparse
 import json
 import os
 import re
 import sys
 import time
 import urllib.error
 import urllib.request
 from dataclasses import dataclass, asdict
 GATEWAY = os.environ.get("LITELLM_BASE", "http://koala:30401/v1")
 DEFAULT_MODEL = "berget/mistral-medium"
 # ---------------------------------------------------------------- SRT-parsning
 TS = re.compile(
    r"(\d{2}):(\d{2}):(\d{2})[,.](\d{3})\s*-->\s*(\d{2}):(\d{2}):(\d{2})[,.](\d{3})"
 )
@dataclass
 class Cue:
    idx: int
    start: float  # sekunder
    end: float
    text: str
    @property
    def start_hms(self) -> str:
        return secs_to_hms(self.start)
 def secs_to_hms(s: float) -> str:
    h, rem = divmod(int(s), 3600)
    m, sec = divmod(rem, 60)
    return f"{h:02d}:{m:02d}:{sec:02d}"
 def hms_to_secs(v: str) -> float:
    """Tål '00:01:23', '01:23', '83' och '00:01:23,450'."""
    v = v.strip().replace(",", ".")
    parts = v.split(":")
    try:
        nums = [float(p) for p in parts]
    except ValueError as e:
        raise ValueError(f"ogiltig tidsstämpel: {v!r}") from e
    if len(nums) == 3:
        return nums[0] * 3600 + nums[1] * 60 + nums[2]
    if len(nums) == 2:
        return nums[0] * 60 + nums[1]
    if len(nums) == 1:
        return nums[0]
    raise ValueError(f"ogiltig tidsstämpel: {v!r}")
 def parse_srt(raw: str) -> list[Cue]:
    """Blockbaserad parsning. Tål saknade index och CRLF."""
    raw = raw.replace("\r\n", "\n").replace("", "")
    cues: list[Cue] = []
    for block in re.split(r"\n\s*\n", raw.strip()):
        lines = [ln for ln in block.split("\n") if ln.strip()]
        if not lines:
            continue
        m = None
        text_from = 0
        for i, ln in enumerate(lines[:2]):
            m = TS.search(ln)
            if m:
                text_from = i + 1
                break
        if not m:
            continue
        g = [int(x) for x in m.groups()]
        start = g[0] * 3600 + g[1] * 60 + g[2] + g[3] / 1000
        end = g[4] * 3600 + g[5] * 60 + g[6] + g[7] / 1000
        text = " ".join(lines[text_from:]).strip()
        if text:
            cues.append(Cue(len(cues) + 1, start, end, text))
    return cues
 def as_numbered_transcript(cues: list[Cue]) -> str:
    """Tidsstämplad text som modellen kan citera exakt ur."""
    return "\n".join(f"[{c.start_hms}] {c.text}" for c in cues)
 # ------------------------------------------------------------------ LLM-anrop
 SYSTEM = """Du är byggteknisk analytiker. Du analyserar en transkription från ett \
 platsbesök där Jonas beskriver ett PLANERAT byggprojekt för minst en annan person.
 Detta är ett SAMTAL, inte en monolog. Korta inpass som "Hela vägen?", "Vilken höjd?" \
 eller "Måste det bli det?" är motpartens frågor - de driver samtalet men är inte \
 Jonas påståenden. Attribuera inte en fråga som ett beslut.
 Det mesta som sägs är FÖRSLAG under diskussion, inte färdiga beslut. Signalord som \
 "vi tänker", "alternativt", "kanske", "förmodligen", "eventuellt", "om möjligt", \
 "troligast" och "beror på" markerar något ÖPPET. Blanda aldrig ihop ett övervägt \
 alternativ med ett fattat beslut - den skillnaden är hela poängen med analysen.
 ABSOLUTA KRAV:
 - Rapportera ENDAST det som faktiskt sägs. Dra inga egna slutsatser, lägg inte till \
 byggmoment, material eller mått som inte nämns explicit.
 - Varje påstående MÅSTE bära ett ordagrant citat ur transkriptionen samt dess tidsstämpel.
 - Mått revideras under samtalets gång ("nio meter" -> "9,40"). Återge alla varianter \
 som nämns, med citat, i stället för att välja en.
 - Är något oklart, ohörbart eller avbrutet: skriv det i fältet "oklart" i stället för \
 att gissa.
 - Svara ENDAST med giltig JSON. Ingen markdown, inga kodstaket, ingen förklarande text."""
 USER_TMPL = """Dela in transkriptionen i tematiska avsnitt (typiskt 4-8 stycken) som \
 följer hur Jonas rör sig genom projektet.
 TACKNINGSKRAV: avsnitten maste tillsammans tacka HELA klippet, fran 00:00:00 till \
 {slut}. Forsta avsnittet borjar 00:00:00, sista avsnittet slutar {slut}, och varje \
 avsnitts "start" ar lika med foregaende avsnitts "slut". Lamna inga luckor - ocksa \
 korta avslutande kommentarer (tidplan, kostnader, nasta steg) ska tillhora ett avsnitt.
 Svara med exakt denna JSON-struktur:
 {{
  "projekt": {{
    "sammanfattning": "2-3 meningar om vad projektet är",
    "typ": "t.ex. nybyggnad villa / tillbyggnad / renovering - eller null om det inte framgår",
    "skede": "vilket byggskede som visas - eller null"
  }},
  "avsnitt": [
    {{
      "rubrik": "kort beskrivande rubrik",
      "start": "HH:MM:SS",
      "slut": "HH:MM:SS",
      "sammanfattning": "vad Jonas beskriver i detta avsnitt, 1-3 meningar",
      "nyckelpunkter": [
        {{"pastaende": "vad som sags", "citat": "ordagrant citat", "tid": "HH:MM:SS"}}
      ],
      "bildtid": "HH:MM:SS - ogonblicket dar det Jonas beskriver syns tydligast",
      "bildmotiv": "vad som bor synas i bilden vid bildtid"
    }}
  ],
  "beslut": [{{"vad": "nagot som uttalas som bestamt", "citat": "ordagrant citat", "tid": "HH:MM:SS"}}],
  "alternativ": [{{
    "fraga": "vad som vags mot varandra",
    "optioner": ["alternativ A", "alternativ B"],
    "lutar_at": "det alternativ som forespraakas - eller null om oavgjort",
    "citat": "ordagrant citat", "tid": "HH:MM:SS"
  }}],
  "oppna_fragor": [{{
    "fraga": "det som inte ar avgjort",
    "beror_pa": "vad avgorandet hanger pa - eller null",
    "citat": "ordagrant citat", "tid": "HH:MM:SS"
  }}],
  "matt": [{{"vad": "matt/dimension", "citat": "ordagrant citat", "tid": "HH:MM:SS"}}],
  "material": [{{"vad": "material/produkt", "citat": "ordagrant citat", "tid": "HH:MM:SS"}}],
  "oklart": ["saker som ar ohorbara, avbrutna eller tvetydiga i transkriptionen"]
 }}
 Valj "bildtid" omsorgsfullt. I detta samtal pekar Jonas standigt pa saker med ord som \
 "har", "hit", "den typ sa" - orden ar obegripliga utan bilden, sa bildtiden ska ligga \
 dar foremalet han syftar pa syns, inte dar han byter amne. Tomma listor ar helt i sin \
 ordning om inget relevant namns.
 TRANSKRIPTION:
 {transcript}"""
 def call_llm(
    model: str, transcript: str, slut: str, timeout: int = 300, retries: int = 2
 ) -> str:
    key = os.environ.get("DMABE_LLMAPI_KEY") or os.environ.get("LITELLM_API_KEY")
    if not key:
        sys.exit("DMABE_LLMAPI_KEY (eller LITELLM_API_KEY) saknas i miljon.")
    body = json.dumps(
        {
            "model": model,
            "temperature": 0,
            "max_tokens": 6000,
            "messages": [
                {"role": "system", "content": SYSTEM},
                {"role": "user", "content": USER_TMPL.format(transcript=transcript, slut=slut)},
            ],
        }
    ).encode()
    # Gatewayen begransar burst (limit_req burst=5) och berget-anropet kan
    # spika. TimeoutError arvs INTE av URLError, sa den maste fangas separat -
    # annars blir felet en rasptrace efter flera minuters vantan.
    last = ""
    for attempt in range(retries + 1):
        req = urllib.request.Request(
            f"{GATEWAY}/chat/completions",
            data=body,
            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
        )
        try:
            with urllib.request.urlopen(req, timeout=timeout) as r:
                payload = json.load(r)
            break
        except urllib.error.HTTPError as e:
            detail = e.read()[:400].decode(errors="replace")
            if e.code == 429 and attempt < retries:
                last = f"HTTP 429 (rate limit)"
            elif e.code >= 500 and attempt < retries:
                last = f"HTTP {e.code}"
            else:
                sys.exit(f"gateway HTTP {e.code}: {detail}")
        except (TimeoutError, urllib.error.URLError, OSError) as e:
            reason = getattr(e, "reason", e)
            if attempt < retries:
                last = f"{type(e).__name__}: {reason}"
            else:
                sys.exit(
                    f"nadde inte gateway {GATEWAY} efter {retries + 1} forsok "
                    f"({type(e).__name__}: {reason}). Kontrollera att koala:30401 svarar."
                )
        backoff = 3 * (attempt + 1)
        print(f"[!] {last} - forsok {attempt + 2}/{retries + 1} om {backoff}s", file=sys.stderr)
        time.sleep(backoff)
    else:
        sys.exit(f"gav upp efter {retries + 1} forsok: {last}")
    choice = payload["choices"][0]
    content = (choice.get("message") or {}).get("content") or ""
    if not content.strip():
        # Kant lage for thinking-modeller: resonemanget ater hela budgeten.
        sys.exit(
            f"tomt svar (finish_reason={choice.get('finish_reason')}). "
            "Valj en icke-resonerande modell for strukturerad utdata."
        )
    return content
 def extract_json(s: str) -> dict:
    s = s.strip()
    if s.startswith("```"):
        s = re.sub(r"^```(?:json)?\s*", "", s)
        s = re.sub(r"\s*```$", "", s)
    try:
        return json.loads(s)
    except json.JSONDecodeError:
        # Sista utvag: forsta {...sista }
        i, j = s.find("{"), s.rfind("}")
        if i >= 0 and j > i:
            return json.loads(s[i : j + 1])
        raise
 # -------------------------------------------------------------- Verifiering
 def norm(s: str) -> str:
    return re.sub(r"[^\wåäöÅÄÖ]+", " ", (s or "").lower()).strip()
 # --- svenska talord -> siffror -------------------------------------------
 # Byggmatt sags i klartext ("fyrtiofem ganger tvahundratjugo") men refereras
 # i siffror. Utan denna oversattning kan ett felaktigt matt bara ett giltigt
 # ordagrant citat och passera oupptackt - den farligaste feltypen i ett
 # byggdokument.
 _SW_UNITS = {
    "noll": 0, "en": 1, "ett": 1, "två": 2, "tva": 2, "tre": 3, "fyra": 4,
    "fem": 5, "sex": 6, "sju": 7, "åtta": 8, "atta": 8, "nio": 9, "tio": 10,
    "elva": 11, "tolv": 12, "tretton": 13, "fjorton": 14, "femton": 15,
    "sexton": 16, "sjutton": 17, "arton": 18, "nitton": 19,
 }
 _SW_TENS = {
    "tjugo": 20, "trettio": 30, "fyrtio": 40, "femtio": 50, "sextio": 60,
    "sjuttio": 70, "åttio": 80, "attio": 80, "nittio": 90,
 }
 _SW_ATOMS = {**_SW_UNITS, **_SW_TENS, "hundra": 100, "tusen": 1000}
 # Langsta forst sa att "sexton" vinner over "sex", "attio" over "atta".
 _SW_ORDER = sorted(_SW_ATOMS, key=len, reverse=True)
 def _sw_word_to_int(word: str) -> int | None:
    """'tvåhundratjugo' -> 220. None om ordet inte ar ett rent talord."""
    w = word.lower()
    toks: list[str] = []
    while w:
        for atom in _SW_ORDER:
            if w.startswith(atom):
                toks.append(atom)
                w = w[len(atom) :]
                break
        else:
            return None
    if not toks:
        return None
    total = current = 0
    for t in toks:
        v = _SW_ATOMS[t]
        if t == "hundra":
            current = (current or 1) * 100
        elif t == "tusen":
            total += (current or 1) * 1000
            current = 0
        else:
            current += v
    return total + current
 def numbers_in(text: str) -> set[float]:
    """Alla tal i texten, som siffror och som svenska talord.
    Svenska anvander decimalkomma ("9,40" = 9.4). Naiv \\d+-matchning skulle
    lasa det som tva separata heltal 9 och 40 - och just har revideras matten
    live i samtalet ("nio meter" -> "9,40"), sa den skillnaden ar betydelsebarande.
    """
    found: set[float] = set()
    for m in re.finditer(r"\d+(?:[.,]\d+)?", text or ""):
        found.add(float(m.group().replace(",", ".")))
    for w in re.findall(r"[a-zåäöA-ZÅÄÖ]+", text or ""):
        # "en"/"ett" ar obestamd artikel vida oftare an raknetalet 1
        # ("ett sedumtak"), sa fristaende traffar ger falsklarm. Sammansatta
        # former ("etthundra") fangas anda av den giriga tokeniseringen.
        if len(w) < 3 or w.lower() in {"en", "ett"}:
            continue
        v = _sw_word_to_int(w)
        if v is not None and v > 0:
            found.add(float(v))
    return found
 def fmt_num(v: float) -> str:
    return str(int(v)) if v == int(v) else f"{v:g}"
 def unsupported(claimed: set[float], supported: set[float]) -> list[float]:
    """Tal i pastaendet som inte styrks av citatet (med liten tolerans)."""
    return sorted(
        n for n in claimed if not any(abs(n - s) < 0.01 for s in supported)
    )
 def verify(doc: dict, cues: list[Cue], duration: float) -> list[str]:
    """Varje citat ska ga att aterfinna; varje tid ska ligga inom klippet.
    Detta ar sjalva poangen med strukturen - ett pastaende utan verifierbar
    kalla ar en hallucination, och den ska synas har och inte i dokumentet.
    """
    warnings: list[str] = []
    haystack = norm(" ".join(c.text for c in cues))
    def check_quote(where: str, quote: str) -> None:
        n = norm(quote)
        if not n:
            warnings.append(f"{where}: tomt citat")
            return
        if n in haystack:
            return
        # Delvis traff: minst 60 % av orden i foljd nagonstans
        words = n.split()
        if len(words) >= 4:
            for size in (len(words), max(4, int(len(words) * 0.6))):
                for i in range(0, len(words) - size + 1):
                    if " ".join(words[i : i + size]) in haystack:
                        warnings.append(f"{where}: citat matchar bara delvis: {quote!r}")
                        return
        warnings.append(f"{where}: CITAT SAKNAS I TRANSKRIPTION: {quote!r}")
    def check_time(where: str, t: str) -> None:
        try:
            v = hms_to_secs(t)
        except ValueError:
            warnings.append(f"{where}: ogiltig tid {t!r}")
            return
        if not (0 <= v <= duration + 1):
            warnings.append(f"{where}: tid {t} utanfor klippet (0-{secs_to_hms(duration)})")
    for i, sec in enumerate(doc.get("avsnitt") or [], 1):
        tag = f"avsnitt {i} ({sec.get('rubrik','?')})"
        for f in ("start", "slut", "bildtid"):
            if sec.get(f):
                check_time(f"{tag}.{f}", sec[f])
        for j, kp in enumerate(sec.get("nyckelpunkter") or [], 1):
            check_quote(f"{tag}.nyckelpunkt {j}", kp.get("citat", ""))
            if kp.get("tid"):
                check_time(f"{tag}.nyckelpunkt {j}.tid", kp["tid"])
    def check_numbers(where: str, claim: str, quote: str) -> None:
        """Varje tal i pastaendet maste finnas i dess eget citat."""
        claimed = numbers_in(claim)
        if not claimed:
            return
        supported = numbers_in(quote)
        for n in unsupported(claimed, supported):
            stod = ", ".join(fmt_num(s) for s in sorted(supported)) or "inga tal"
            warnings.append(
                f"{where}: TALET {fmt_num(n)} FINNS INTE I CITATET "
                f"(citat stoder {stod}): {claim!r}"
            )
    for i, sec in enumerate(doc.get("avsnitt") or [], 1):
        tag = f"avsnitt {i} ({sec.get('rubrik','?')})"
        for j, kp in enumerate(sec.get("nyckelpunkter") or [], 1):
            check_numbers(f"{tag}.nyckelpunkt {j}", kp.get("pastaende", ""), kp.get("citat", ""))
    for key in ("material", "matt", "beslut"):
        for j, it in enumerate(doc.get(key) or [], 1):
            check_quote(f"{key}[{j}]", it.get("citat", ""))
            if it.get("tid"):
                check_time(f"{key}[{j}].tid", it["tid"])
            check_numbers(f"{key}[{j}]", it.get("vad", ""), it.get("citat", ""))
    # Tackningskontroll: avsnitten ska tacka hela klippet utan hal, annars
    # tappas material tyst (och inget bildutdrag gors for den luckan).
    spans: list[tuple[float, float]] = []
    for sec in doc.get("avsnitt") or []:
        try:
            spans.append((hms_to_secs(sec["start"]), hms_to_secs(sec["slut"])))
        except (KeyError, ValueError):
            continue
    spans.sort()
    cursor = 0.0
    for s, e in spans:
        if s - cursor > 2.0:
            gap_text = " ".join(
                c.text for c in cues if c.start >= cursor - 0.5 and c.end <= s + 0.5
            )
            warnings.append(
                f"TACKNINGSLUCKA {secs_to_hms(cursor)}-{secs_to_hms(s)} "
                f"({s - cursor:.0f}s utan avsnitt): {gap_text[:90]!r}"
            )
        cursor = max(cursor, e)
    if duration - cursor > 2.0:
        warnings.append(
            f"TACKNINGSLUCKA {secs_to_hms(cursor)}-{secs_to_hms(duration)} "
            f"({duration - cursor:.0f}s i slutet utan avsnitt)"
        )
    return warnings
 # ------------------------------------------------------------------- main
 def main() -> None:
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("srt")
    ap.add_argument("--model", default=DEFAULT_MODEL)
    ap.add_argument("--raw", action="store_true", help="skriv aven modellens rasvar till stderr")
    args = ap.parse_args()
    with open(args.srt, encoding="utf-8") as fh:
        cues = parse_srt(fh.read())
    if not cues:
        sys.exit(f"inga cues hittades i {args.srt} - fel format?")
    duration = cues[-1].end
    print(
        f"[i] {len(cues)} cues, langd {secs_to_hms(duration)}, modell {args.model}",
        file=sys.stderr,
    )
    content = call_llm(args.model, as_numbered_transcript(cues), secs_to_hms(duration))
    if args.raw:
        print(content, file=sys.stderr)
    try:
        doc = extract_json(content)
    except json.JSONDecodeError as e:
        sys.exit(f"modellen returnerade ogiltig JSON: {e}\n---\n{content[:800]}")
    warnings = verify(doc, cues, duration)
    doc["_meta"] = {
        "modell": args.model,
        "kallfil": os.path.basename(args.srt),
        "antal_cues": len(cues),
        "langd": secs_to_hms(duration),
        "varningar": warnings,
    }
    print(json.dumps(doc, ensure_ascii=False, indent=2))
    if warnings:
        print(f"\n[!] {len(warnings)} verifieringsvarningar:", file=sys.stderr)
        for w in warnings:
            print(f"    - {w}", file=sys.stderr)
    else:
        print("[ok] alla citat aterfunna, alla tider inom klippet", file=sys.stderr)
 if __name__ == "__main__":
    main()
@@ -0,0 +1,357 @@
 #!/usr/bin/env python3
 """Bygg en fristaende HTML-sida: video + SRT + tidssynkad analys.
 Sidan ar sjalvbarande sa nar som pa videofilen - transkription och analys
 bakas in i HTML:en. Det gor att den fungerar aven over file:// (fetch mot
 en lokal JSON blockeras av CORS).
    python3 build_page.py payload.json IMG_1233.web.mp4 > index.html
 """
 from __future__ import annotations
 import html
 import json
 import sys
 TEMPLATE = """<!doctype html>
 <html lang="sv">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>__TITLE__</title>
 <style>
  :root {
    --bg:#f6f7f9; --panel:#fff; --ink:#16181d; --muted:#6b7280; --line:#e3e6ea;
    --accent:#2563eb; --accent-soft:#eff4ff;
    --beslut:#0f9d58; --alt:#d97706; --oppen:#dc2626; --matt:#7c3aed;
  }
  @media (prefers-color-scheme: dark) {
    :root {
      --bg:#0e1116; --panel:#161a21; --ink:#e6e9ef; --muted:#9aa3b2; --line:#262c36;
      --accent:#60a5fa; --accent-soft:#17233b;
      --beslut:#34d399; --alt:#fbbf24; --oppen:#f87171; --matt:#a78bfa;
    }
  }
  :root[data-theme="dark"] {
    --bg:#0e1116; --panel:#161a21; --ink:#e6e9ef; --muted:#9aa3b2; --line:#262c36;
    --accent:#60a5fa; --accent-soft:#17233b;
    --beslut:#34d399; --alt:#fbbf24; --oppen:#f87171; --matt:#a78bfa;
  }
  :root[data-theme="light"] {
    --bg:#f6f7f9; --panel:#fff; --ink:#16181d; --muted:#6b7280; --line:#e3e6ea;
    --accent:#2563eb; --accent-soft:#eff4ff;
    --beslut:#0f9d58; --alt:#d97706; --oppen:#dc2626; --matt:#7c3aed;
  }
  * { box-sizing:border-box; }
  body {
    margin:0; background:var(--bg); color:var(--ink);
    font:15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;
  }
  header {
    padding:14px 20px; border-bottom:1px solid var(--line); background:var(--panel);
    display:flex; align-items:baseline; gap:14px; flex-wrap:wrap;
  }
  header h1 { margin:0; font-size:17px; font-weight:650; }
  header .sub { color:var(--muted); font-size:13px; }
  .wrap {
    display:grid; grid-template-columns: minmax(0,1.35fr) minmax(320px,1fr);
    gap:20px; padding:20px; align-items:start; max-width:1600px; margin:0 auto;
  }
  @media (max-width: 950px) { .wrap { grid-template-columns:1fr; } }
  /* Videon star stilla; analysen ror sig bredvid. */
  .videocol { position:sticky; top:20px; }
  video { width:100%; border-radius:10px; background:#000; display:block; }
  .nowbar {
    margin-top:10px; padding:12px 14px; background:var(--panel);
    border:1px solid var(--line); border-radius:10px; min-height:64px;
  }
  .nowbar .label { font-size:11px; text-transform:uppercase; letter-spacing:.07em; color:var(--muted); }
  .nowbar .text { margin-top:4px; font-size:16px; }
  .tabs { display:flex; gap:6px; margin-bottom:12px; flex-wrap:wrap; }
  .tab {
    padding:6px 12px; border:1px solid var(--line); background:var(--panel);
    border-radius:999px; cursor:pointer; font-size:13px; color:var(--ink);
  }
  .tab[aria-selected="true"] { background:var(--accent); border-color:var(--accent); color:#fff; }
  .pane { display:none; }
  .pane.active { display:block; }
  .scroller {
    max-height: calc(100vh - 190px); overflow-y:auto; padding-right:6px;
    scroll-behavior:smooth;
  }
  .card {
    background:var(--panel); border:1px solid var(--line); border-left:3px solid var(--line);
    border-radius:8px; padding:11px 13px; margin-bottom:9px; cursor:pointer;
    transition:border-color .15s, background .15s;
  }
  .card:hover { border-color:var(--accent); }
  .card.on { background:var(--accent-soft); border-left-color:var(--accent); }
  .card .k {
    font-size:10px; text-transform:uppercase; letter-spacing:.07em;
    font-weight:700; margin-bottom:5px;
  }
  .card .t { font-size:11px; color:var(--muted); font-variant-numeric:tabular-nums; }
  .card .cit { display:block; margin-top:6px; color:var(--muted); font-size:13px; font-style:italic; }
  .k.beslut{color:var(--beslut)} .k.alt{color:var(--alt)}
  .k.oppen{color:var(--oppen)} .k.matt{color:var(--matt)}
  .card.beslut{border-left-color:var(--beslut)} .card.alt{border-left-color:var(--alt)}
  .card.oppen{border-left-color:var(--oppen)} .card.matt{border-left-color:var(--matt)}
  .opts { margin:6px 0 0; padding-left:18px; font-size:13px; }
  .lutar { font-size:12px; color:var(--muted); margin-top:5px; }
  .cue {
    padding:5px 9px; border-radius:6px; cursor:pointer; display:flex; gap:10px;
    font-size:14px; border-left:2px solid transparent;
  }
  .cue:hover { background:var(--accent-soft); }
  .cue.on { background:var(--accent-soft); border-left-color:var(--accent); font-weight:600; }
  .cue .ts {
    color:var(--muted); font-variant-numeric:tabular-nums; font-size:12px;
    flex:0 0 46px; padding-top:2px;
  }
  .sec-head {
    margin:16px 0 7px; font-size:12px; font-weight:700; text-transform:uppercase;
    letter-spacing:.06em; color:var(--muted); border-bottom:1px solid var(--line);
    padding-bottom:5px;
  }
  .sec-head:first-child { margin-top:0; }
  .warn {
    background:var(--panel); border:1px solid var(--line); border-left:3px solid var(--alt);
    border-radius:8px; padding:11px 13px; font-size:13px; color:var(--muted);
  }
  .warn b { color:var(--ink); }
  .warn ul { margin:6px 0 0; padding-left:18px; }
 </style>
 </head>
 <body>
 <header>
  <h1>__TITLE__</h1>
  <span class="sub">__SUB__</span>
 </header>
 <div class="wrap">
  <div class="videocol">
    <video id="v" controls preload="metadata" src="__VIDEO__"></video>
    <div class="nowbar">
      <div class="label">Sägs nu</div>
      <div class="text" id="now">—</div>
    </div>
  </div>
  <div>
    <div class="tabs" role="tablist">
      <button class="tab" role="tab" aria-selected="true"  data-pane="analys">Analys</button>
      <button class="tab" role="tab" aria-selected="false" data-pane="text">Transkription</button>
      <button class="tab" role="tab" aria-selected="false" data-pane="kvalitet">Kvalitet</button>
    </div>
    <div class="pane active" id="pane-analys"><div class="scroller" id="analys"></div></div>
    <div class="pane" id="pane-text"><div class="scroller" id="text"></div></div>
    <div class="pane" id="pane-kvalitet"><div class="scroller" id="kvalitet"></div></div>
  </div>
 </div>
 <script>
 const DATA = __DATA__;
 const v = document.getElementById('v');
 const hms = s => {
  s = Math.max(0, Math.floor(s));
  return String(Math.floor(s/60)).padStart(2,'0') + ':' + String(s%60).padStart(2,'0');
 };
 const toSec = t => {
  if (t == null) return null;
  const p = String(t).trim().split(':').map(Number);
  if (p.some(isNaN)) return null;
  return p.length === 3 ? p[0]*3600+p[1]*60+p[2] : p.length === 2 ? p[0]*60+p[1] : p[0];
 };
 const esc = s => { const d = document.createElement('div'); d.textContent = s ?? ''; return d.innerHTML; };
 /* Varje kort bar sin tid; ett klick soker dit. Analysen ar tidsforankrad
   hela vagen ned, sa synkningen ar bara en sortering pa den tiden. */
 const items = [];
 const A = DATA.analys;
 (A.avsnitt || []).forEach((s, i) => {
  const t = toSec(s.start) ?? 0;
  items.push({t, end: toSec(s.slut) ?? 1e9, kind:'avsnitt', html:
    `<div class="k">Avsnitt ${i+1} · ${esc(s.start)}–${esc(s.slut)}</div>
     <div style="font-weight:650;font-size:15px">${esc(s.rubrik)}</div>
     <div style="margin-top:5px">${esc(s.sammanfattning)}</div>`});
  (s.nyckelpunkter || []).forEach(k => {
    const kt = toSec(k.tid); if (kt == null) return;
    items.push({t:kt, end:kt+6, kind:'punkt', citat:k.citat, html:
      `<div class="t">${esc(k.tid)}</div><div>${esc(k.pastaende)}</div>
       <div class="cit">”${esc(k.citat)}”</div>`});
  });
 });
 (A.beslut || []).forEach(b => {
  const t = toSec(b.tid); if (t == null) return;
  items.push({t, end:t+8, kind:'beslut', citat:b.citat, html:
    `<div class="k beslut">Beslut</div><div class="t">${esc(b.tid)}</div>
     <div style="font-weight:600">${esc(b.vad)}</div>
     ${b.skal ? `<div class="lutar">Skäl: ${esc(b.skal)}</div>` : ''}
     <div class="cit">”${esc(b.citat)}”</div>`});
 });
 (A.alternativ || []).forEach(a => {
  const t = toSec(a.tid); if (t == null) return;
  items.push({t, end:t+8, kind:'alt', citat:a.citat, html:
    `<div class="k alt">Alternativ</div><div class="t">${esc(a.tid)}</div>
     <div style="font-weight:600">${esc(a.fraga)}</div>
     <ul class="opts">${(a.optioner||[]).map(o=>`<li>${esc(o)}</li>`).join('')}</ul>
     <div class="lutar">${a.lutar_at ? 'Lutar åt: <b>'+esc(a.lutar_at)+'</b>' : 'Oavgjort'}</div>
     <div class="cit">”${esc(a.citat)}”</div>`});
 });
 (A.oppna_fragor || []).forEach(o => {
  const t = toSec(o.tid); if (t == null) return;
  items.push({t, end:t+8, kind:'oppen', citat:o.citat, html:
    `<div class="k oppen">Öppen fråga</div><div class="t">${esc(o.tid)}</div>
     <div style="font-weight:600">${esc(o.fraga)}</div>
     ${o.beror_pa ? `<div class="lutar">Beror på: ${esc(o.beror_pa)}</div>` : ''}
     <div class="cit">”${esc(o.citat)}”</div>`});
 });
 (A.matt || []).forEach(m => {
  const t = toSec(m.tid); if (t == null) return;
  items.push({t, end:t+6, kind:'matt', citat:m.citat, html:
    `<div class="k matt">Mått</div><div class="t">${esc(m.tid)}</div>
     <div>${esc(m.vad)}</div><div class="cit">”${esc(m.citat)}”</div>`});
 });
 const RANK = {avsnitt:0, beslut:1, oppen:2, alt:3, matt:4, punkt:5};
 /* Samma replik klassas ofta bade som nyckelpunkt och som matt/beslut.
   Visa den mest specifika varianten en gang i stallet for tva nastan
   identiska kort - annars later flodet som ett eko. */
 const bestByQuote = new Map();
 items.forEach(it => {
  const key = (it.citat||'').trim().toLowerCase() + '@' + it.t;
  if (!it.citat) return;
  const prev = bestByQuote.get(key);
  if (prev === undefined || RANK[it.kind] < RANK[prev.kind]) bestByQuote.set(key, it);
 });
 const kept = items.filter(it => {
  if (!it.citat) return true;
  const key = (it.citat||'').trim().toLowerCase() + '@' + it.t;
  return bestByQuote.get(key) === it;
 });
 items.length = 0; items.push(...kept);
 items.sort((a,b) => a.t - b.t || RANK[a.kind] - RANK[b.kind]);
 const analysEl = document.getElementById('analys');
 analysEl.innerHTML = items.map((it,i) =>
  `<div class="card ${it.kind}" data-i="${i}" data-t="${it.t}">${it.html}</div>`).join('');
 const textEl = document.getElementById('text');
 textEl.innerHTML = DATA.cues.map((c,i) =>
  `<div class="cue" data-ci="${i}" data-t="${c.t}">
     <span class="ts">${hms(c.t)}</span><span>${esc(c.text)}</span></div>`).join('');
 const warns = (A._meta && A._meta.varningar) || [];
 document.getElementById('kvalitet').innerHTML = `
  <div class="warn">
    <b>Automatisk källkontroll</b><br>
    Modell: ${esc((A._meta&&A._meta.modell)||'–')} · ${DATA.cues.length} repliker · längd ${esc((A._meta&&A._meta.langd)||'–')}<br><br>
    Varje påstående kontrolleras mot sitt eget citat: citatet måste återfinnas
    ordagrant i transkriptionen, tiden måste ligga inom klippet, och varje tal i
    påståendet måste styrkas av citatet.
    ${warns.length
      ? `<br><br><b>${warns.length} varningar:</b><ul>${warns.map(w=>`<li>${esc(w)}</li>`).join('')}</ul>`
      : '<br><br>Inga avvikelser.'}
  </div>`;
 /* Klick söker i videon - åt båda håll: kort och replik. */
 document.addEventListener('click', e => {
  const el = e.target.closest('.card, .cue');
  if (!el) return;
  v.currentTime = parseFloat(el.dataset.t) + 0.05;
  v.play().catch(()=>{});
 });
 document.querySelectorAll('.tab').forEach(tab => {
  tab.addEventListener('click', () => {
    document.querySelectorAll('.tab').forEach(t => t.setAttribute('aria-selected','false'));
    tab.setAttribute('aria-selected','true');
    document.querySelectorAll('.pane').forEach(p => p.classList.remove('active'));
    document.getElementById('pane-' + tab.dataset.pane).classList.add('active');
  });
 });
 /* Auto-scroll bara nar anvandaren inte sjalv scrollar - annars slits vyn
   ur handerna pa den som lasar. */
 let userScrolled = 0;
 document.querySelectorAll('.scroller').forEach(s =>
  s.addEventListener('wheel', () => { userScrolled = Date.now(); }, {passive:true}));
 let lastCard = -1, lastCue = -1;
 function sync() {
  const t = v.currentTime;
  let ci = -1;
  for (let i = 0; i < DATA.cues.length; i++) {
    if (t >= DATA.cues[i].t - 0.15) ci = i; else break;
  }
  if (ci !== lastCue) {
    document.querySelectorAll('.cue.on').forEach(e => e.classList.remove('on'));
    if (ci >= 0) {
      const el = textEl.querySelector(`[data-ci="${ci}"]`);
      if (el) {
        el.classList.add('on');
        if (Date.now() - userScrolled > 3000) el.scrollIntoView({block:'center'});
      }
      document.getElementById('now').textContent = DATA.cues[ci].text;
    }
    lastCue = ci;
  }
  let ai = -1;
  for (let i = 0; i < items.length; i++) {
    if (t >= items[i].t - 0.15) ai = i; else break;
  }
  if (ai !== lastCard) {
    document.querySelectorAll('.card.on').forEach(e => e.classList.remove('on'));
    if (ai >= 0) {
      const el = analysEl.querySelector(`[data-i="${ai}"]`);
      if (el) {
        el.classList.add('on');
        if (Date.now() - userScrolled > 3000 &&
            document.getElementById('pane-analys').classList.contains('active')) {
          el.scrollIntoView({block:'center'});
        }
      }
    }
    lastCard = ai;
  }
  requestAnimationFrame(sync);
 }
 requestAnimationFrame(sync);
 </script>
 </body>
 </html>
 """
 def main() -> None:
    payload_path, video = sys.argv[1], sys.argv[2]
    payload = json.load(open(payload_path, encoding="utf-8"))
    a = payload["analys"]
    proj = a.get("projekt") or {}
    sub = " · ".join(
        x for x in [proj.get("typ"), (a.get("_meta") or {}).get("langd"), video] if x
    )
    out = (
        TEMPLATE.replace("__TITLE__", html.escape("Jonas – genomgång av tillbyggnad"))
        .replace("__SUB__", html.escape(sub))
        .replace("__VIDEO__", html.escape(video))
        .replace("__DATA__", json.dumps(payload, ensure_ascii=False))
    )
    sys.stdout.write(out)
 if __name__ == "__main__":
    main()
@@ -0,0 +1,173 @@
 {
  "projekt": {
    "sammanfattning": "Projektet är en nybyggnad med grundläggning, betongplatta och limträstomme. Taket kommer att vara ett sedumtak.",
    "typ": "nybyggnad",
    "skede": "stomme"
  },
  "avsnitt": [
    {
      "rubrik": "Introduktion och grundläggning",
      "start": "00:00:00",
      "slut": "00:00:06",
      "sammanfattning": "Jonas introducerar platsen och meddelar att grundläggningen är klar.",
      "nyckelpunkter": [
        {
          "pastaende": "Grundläggningen är klar",
          "citat": "Vi har precis blivit klara med grundläggningen.",
          "tid": "00:00:03"
        }
      ],
      "bildtid": "00:00:03",
      "bildmotiv": "tomten med färdig grundläggning"
    },
    {
      "rubrik": "Dränering och grundvatten",
      "start": "00:00:06",
      "slut": "00:00:14",
      "sammanfattning": "Jonas beskriver dräneringsarbetet som krävdes på grund av högt grundvatten.",
      "nyckelpunkter": [
        {
          "pastaende": "Dränering utfördes på grund av högt grundvatten",
          "citat": "Vi fick dränera ordentligt först, för grundvattnet stod väldigt högt här.",
          "tid": "00:00:06"
        }
      ],
      "bildtid": "00:00:10",
      "bildmotiv": "dräneringssystem eller markarbete"
    },
    {
      "rubrik": "Betongplatta och isolering",
      "start": "00:00:14",
      "slut": "00:00:22",
      "sammanfattning": "Jonas beskriver betongplattan och isoleringen under den.",
      "nyckelpunkter": [
        {
          "pastaende": "Betongplatta på mark med cellplast under",
          "citat": "det är en betongplatta på mark med tvåhundra millimeter cellplast under.",
          "tid": "00:00:16"
        }
      ],
      "bildtid": "00:00:18",
      "bildmotiv": "betongplattan med cellplast"
    },
    {
      "rubrik": "Stomme och bjälklag",
      "start": "00:00:22",
      "slut": "00:00:31",
      "sammanfattning": "Jonas beskriver stommen i limträ och bjälklagets dimensioner.",
      "nyckelpunkter": [
        {
          "pastaende": "Stommen är i limträ",
          "citat": "Här ser ni stommen, den är i limträ.",
          "tid": "00:00:22"
        },
        {
          "pastaende": "Pelarnas dimensioner",
          "citat": "Pelarna är hundraåttio gånger hundraåttio.",
          "tid": "00:00:25"
        },
        {
          "pastaende": "Bjälklagets spännvidd och dimensioner",
          "citat": "Bjälklaget spänner sex meter fritt, och vi har fyrtiofem gånger tvåhundratjugo som balkar.",
          "tid": "00:00:31"
        }
      ],
      "bildtid": "00:00:28",
      "bildmotiv": "limträstommen med pelare och bjälklag"
    },
    {
      "rubrik": "Tak och tidplan",
      "start": "00:00:40",
      "slut": "00:00:48",
      "sammanfattning": "Jonas nämner taktypen och förklarar att projektet är försenat på grund av leveransproblem.",
      "nyckelpunkter": [
        {
          "pastaende": "Taket kommer att vara sedumtak",
          "citat": "Taket blir sedumtak, det var byggherrens önskemål.",
          "tid": "00:00:40"
        },
        {
          "pastaende": "Sedumtaket ställer krav på bärigheten",
          "citat": "Det ställer krav på bärigheten.",
          "tid": "00:00:44"
        },
        {
          "pastaende": "Projektet är två veckor efter tidplanen",
          "citat": "Vi ligger ungefär två veckor efter tidplanen på grund av leveransproblem på limträet.",
          "tid": "00:00:48"
        }
      ],
      "bildtid": "00:00:44",
      "bildmotiv": "stommen med eventuella förberedelser för taket"
    }
  ],
  "material": [
    {
      "vad": "cellplast",
      "citat": "med tvåhundra millimeter cellplast under",
      "tid": "00:00:18"
    },
    {
      "vad": "betongplatta",
      "citat": "det är en betongplatta på mark",
      "tid": "00:00:16"
    },
    {
      "vad": "limträ",
      "citat": "den är i limträ",
      "tid": "00:00:22"
    },
    {
      "vad": "sedumtak",
      "citat": "Taket blir sedumtak",
      "tid": "00:00:40"
    }
  ],
  "matt": [
    {
      "vad": "200 mm cellplast",
      "citat": "tvåhundra millimeter cellplast",
      "tid": "00:00:18"
    },
    {
      "vad": "180x180 mm pelare",
      "citat": "Pelarna är hundraåttio gånger hundraåttio",
      "tid": "00:00:25"
    },
    {
      "vad": "6 meter spännvidd för bjälklag",
      "citat": "Bjälklaget spänner sex meter fritt",
      "tid": "00:00:31"
    },
    {
      "vad": "45x230 mm balkar",
      "citat": "fyrtiofem gånger tvåhundratjugo som balkar",
      "tid": "00:00:31"
    }
  ],
  "problem": [
    {
      "vad": "högt grundvatten",
      "citat": "grundvattnet stod väldigt högt här",
      "tid": "00:00:10"
    },
    {
      "vad": "leveransproblem med limträ",
      "citat": "leveransproblem på limträet",
      "tid": "00:00:48"
    },
    {
      "vad": "försenat projekt",
      "citat": "Vi ligger ungefär två veckor efter tidplanen",
      "tid": "00:00:48"
    }
  ],
  "oklart": [],
  "_meta": {
    "modell": "berget/mistral-medium",
    "kallfil": "fake.sv.srt",
    "antal_cues": 7,
    "langd": "00:00:56",
    "varningar": []
  }
 }
@@ -0,0 +1,27 @@
 1
 00:00:00,000 --> 00:00:06,500
 Ja, då står vi här på tomten. Vi har precis blivit klara med grundläggningen.
 2
 00:00:06,500 --> 00:00:14,000
 Vi fick dränera ordentligt först, för grundvattnet stod väldigt högt här.
 3
 00:00:14,000 --> 00:00:22,000
 Sen göt vi plattan, det är en betongplatta på mark med tvåhundra millimeter cellplast under.
 4
 00:00:22,000 --> 00:00:31,000
 Här ser ni stommen, den är i limträ. Pelarna är hundraåttio gånger hundraåttio.
 5
 00:00:31,000 --> 00:00:40,000
 Bjälklaget spänner sex meter fritt, och vi har fyrtiofem gånger tvåhundratjugo som balkar.
 6
 00:00:40,000 --> 00:00:48,000
 Taket blir sedumtak, det var byggherrens önskemål. Det ställer krav på bärigheten.
 7
 00:00:48,000 --> 00:00:56,000
 Vi ligger ungefär två veckor efter tidplanen på grund av leveransproblem på limträet.
@@ -0,0 +1,51 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: jonas-transcode
  namespace: default
 spec:
  ttlSecondsAfterFinished: 600
  activeDeadlineSeconds: 1800
  backoffLimit: 0
  template:
    spec:
      restartPolicy: Never
      nodeSelector:
        kubernetes.io/hostname: koala
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: ffmpeg
          image: mwader/static-ffmpeg:7.1
          args:
            - "-nostdin"
            - "-i"
            - "/work/IMG_1233.mov"
            - "-c:v"
            - "libx264"
            - "-preset"
            - "veryfast"
            - "-crf"
            - "24"
            - "-vf"
            - "scale='min(1280,iw)':-2"
            - "-c:a"
            - "aac"
            - "-b:a"
            - "128k"
            - "-movflags"
            - "+faststart"
            - "-y"
            - "/work/IMG_1233.web.mp4"
          volumeMounts:
            - name: work
              mountPath: /work
          resources:
            limits: {cpu: "6", memory: "4Gi"}
      volumes:
        - name: work
          hostPath:
            path: /home/mathias/dev/AGENTS/agentsquad
            type: Directory
@@ -25,9 +25,11 @@ type fakeSource struct {
 func (f fakeSource) ListSubscriptions(ctx context.Context, userID string) ([]domain.Subscription, error) {
 	return nil, nil
 }
 func (f fakeSource) NewVideos(ctx context.Context, sub domain.Subscription) ([]domain.Video, error) {
 	return nil, nil
 }
 func (f fakeSource) FetchTranscript(ctx context.Context, v domain.Video) (domain.Transcript, error) {
 	return f.transcript, nil
 }
@@ -132,10 +134,12 @@ type watchSource struct {
 func (s *watchSource) ListSubscriptions(ctx context.Context, userID string) ([]domain.Subscription, error) {
 	return s.subs, nil
 }
 func (s *watchSource) NewVideos(ctx context.Context, sub domain.Subscription) ([]domain.Video, error) {
 	s.newVideoHits++
 	return s.videosBySub[sub.ID], nil
 }
 func (s *watchSource) FetchTranscript(ctx context.Context, v domain.Video) (domain.Transcript, error) {
 	return s.transcripts[v.ID], nil
 }
Author	SHA1	Message	Date
mathiasandClaude Sonnet 5.5	836a501576	feat(store): Store API for private uploaded transcripts (ADR-033) Create/Start/Complete/Fail/Get/List plus the start-up sweep that fails unfinished rows as interrupted (audio is not retained, so no resume). Every call goes through withUser AND names user_id in its predicate, so isolation does not rest on RLS alone and stays testable under the superuser test connection; a non-owner gets ErrUploadNotFound, never a distinct forbidden. List drops transcript text. Mutation-checked: removing the user predicate from Get or from the UPDATEs turns the cross-user tests red. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:38:25 +02:00
mathiasandClaude Sonnet 5.5	c29c0a7127	feat(domain): types for private uploaded transcripts (ADR-033) Segment, Transcription, UploadStatus, UploadErrorKind and UploadedTranscript. Error kinds are typed, never a provider's string. UploadedTranscript is a distinct type from the shared public-caption Transcript on purpose. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:37:39 +02:00
mathiasandClaude Sonnet 5.5	4b557209c8	test(store): Store API for uploaded transcripts (red) Lifecycle queued -> transcribing -> done\|failed, per-row serving endpoint, segments JSONB round trip, owner-only get/write (not-found, not forbidden), list without transcript text, and the start-up sweep that fails unfinished rows as `interrupted` for every user (audio is not retained, so no resume). Red: CreateUpload and friends are undefined. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:37:30 +02:00
mathiasandClaude Sonnet 5.5	e36c4c1e0c	feat(store): migration 017 -- private RLS-scoped uploaded_transcripts (ADR-033) Separate table, not a user_id on the shared transcripts (ADR-021). ENABLE + FORCE ROW LEVEL SECURITY with the migration-003 policy, user_id NOT NULL ON DELETE CASCADE, typed error_kind, per-row serving endpoint, JSONB segments. CHECK constraints: done => content, failed => error_kind. Up and down are one commit: golang-migrate pairs them. Mutation-checked: dropping FORCE, the policy, or the cascade each turn a test red. FORCE is only observable structurally -- the app role is not the table owner, so no behavioural test can see it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:36:50 +02:00
mathiasandClaude Sonnet 5.5	066ae6966a	test(store): isolation tests for the private uploaded_transcripts table (red) Drives RLS directly as the non-superuser app role: deny-all with no scope, own-rows-only scoped reads, zero-row cross-user UPDATE/DELETE, rejected cross-user INSERT, FORCE + NOT NULL user_id, cascade on DeleteUser. Also pins the EXACT set of public tables with row security off, so a new table added without RLS fails CI rather than passing it (ADR-033). The existing test only named transcripts; #33's "the only non-RLS table" is false -- invitations, user_identities and schema_migrations are off too. Red: relation "uploaded_transcripts" does not exist. Set test passes today and guards the migration that follows. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:36:22 +02:00
mathiasandClaude Sonnet 5.5	38b3f1cf33	docs(adr): ADR-033 upload audio -> private Swedish transcript -> chat (#33 ) Proposed, decider pending. Supersedes ADR-007's STT deferral for user-supplied audio only; the YouTube audio-download rejection stands. Settles #28 decision 1 as a separate RLS-scoped uploaded_transcripts table and records the measured length ceiling, the ingress 413, and the 18k-char chat truncation that #33 assumed did not exist. Two DECISION NEEDED items (ffmpeg in the runtime image; berget fallback for private audio). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:35:04 +02:00
mathiasandClaude Sonnet 5.5	feb108def3	docs(research): measure the audio length ceiling before designing chunking (#33 ) No transcription ceiling found up to 90 min: one 174 MB request through the LiteLLM NodePort transcribed in 440 s. The first real failure is the public gateway ingress rejecting bodies over ~8-10 MB with 413, not whisper or a Metal OOM. Also records that srt arrives wrapped in a JSON envelope, that the two backends differ in timestamp granularity, and that the existing chat path truncates at 18k chars (~22 min of speech). Synthetic Swedish TTS fixture only; no real transcript. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-01 16:33:34 +02:00
mathias	4bafd5f082	fix(web): views.templ imports the pre-rename gitea.d-ma.be host CI / Build & Import (push) Successful in 11s Details CI / Deploy via GitOps (push) Successful in 4s Details CI / Lint / Test / Vet (push) Successful in 19s Details internal/web/views.templ:7 still imports gitea.d-ma.be/mathias/tapir/internal/adapters/store while go.mod declares git.d-ma.be/mathias/tapir Left behind by the gitea rename (infra ADR-0004). The old hostname still resolves in DNS but no longer serves — HTTPS to it fails outright — so the import is genuinely broken, not merely outdated. Why nothing caught it: the COMMITTED internal/web/views_templ.go is correct, so builds and CI use a good generated file and stay green. The rot is only in the source. It surfaces the moment anyone runs `templ generate` — which regenerates the broken import over the good output, and then the build fails with no required module provides package gitea.d-ma.be/mathias/tapir/internal/adapters/store Found exactly that way while evaluating this repo for the estate-wide lint config: regenerating templ as part of the check turned a green repo red, and the cause was the source, not the check. Source fixed; regenerating now reproduces the committed generated file byte-for-byte, so views_templ.go is unchanged here. Verified: go build and go vet pass.	2026-09-05 14:44:39 +02:00
mathias	e3e78e042b	style: apply gofumpt CI / Build & Import (push) Successful in 10s Details CI / Lint / Test / Vet (push) Successful in 21s Details CI / Deploy via GitOps (push) Successful in 4s Details Estate-wide consolidation pass. The canonical .golangci.yml (infra ci-templates/golangci.yml, infra#309 pattern) enables the gofumpt formatter; golangci-lint v2 default set enables NO formatter, which is why this drift accumulated silently -- the same hole that let two files rot in dma-cli until they were found by hand (dma-cli#12). Mechanical and deterministic: `gofumpt -w .`, nothing hand-edited. Verified per repo before commit -- gofumpt -l now reports 0, gofmt -l reports 0, and go build + go vet both pass. Clears this repo to adopt the canonical lint config in a later wave.	2026-09-05 12:39:31 +02:00
mathiasandClaude Opus 5	6f1e0be09b	ci(deploy): refuse to patch a manifest with an empty IMAGE_TAG (infra#311) CI / Lint / Test / Vet (push) Successful in 44s Details CI / Build & Import (push) Successful in 9s Details CI / Deploy via GitOps (push) Successful in 5s Details On 2026-08-25 a deploy job ran with an empty IMAGE_TAG, wrote `image: localhost:5000/gitea-mcp:` into the infra repo and pushed it. That is invalid YAML, so Flux failed the ENTIRE apps Kustomization -- every app stopped reconciling for about an hour, including three unrelated deploys queued behind it. This job's existing check could not catch it. It greps for `image: <repo>:${IMAGE_TAG}` after the sed, and with IMAGE_TAG empty that pattern matches the corrupted line itself, so the verification passes because of the bug rather than despite it. Asserting the input up front is the fix: an empty tag now fails the job before anything is written, let alone committed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf	2026-08-25 17:25:24 +02:00
mathiasandClaude Opus 5	d45348ad2e	ci: call the shared build-image script instead of an inline copy (infra#309) CI / Lint / Test / Vet (push) Successful in 27s Details CI / Build & Import (push) Successful in 11s Details CI / Deploy via GitOps (push) Successful in 5s Details The buildctl/skopeo step here was one of nineteen near-identical copies across the estate. That duplication is why moving them off rootless buildah (infra#241) took eleven commits and then had to be rediscovered in both repo templates and the gitea-ci skill. The implementation now lives in .gitea/build-image.sh, byte-identical to mathias/infra's ci-templates/build-image.sh and held there by a drift gate. What used to be textual differences between copies -- labels, tags, build-args, build target -- are environment inputs. Behaviour is unchanged: same registry, same tags, same labels, same buildctl-against-host-buildkitd path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf	2026-08-25 11:29:55 +02:00
mathiasandClaude Opus 5	1c2ad2990f	ci: build via buildctl instead of rootless buildah (infra#241) CI / Build & Import (push) Successful in 8s Details CI / Deploy via GitOps (push) Successful in 1s Details CI / Lint / Test / Vet (push) Successful in 34s Details Main has been CI-red since 2026-08-13. The build job dies extracting a base image layer inside the gitea-runner pod: ApplyLayer ... potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/gshadow) Root cause is the runner pod's securityContext, not this repo: it drops ALL capabilities and sets allowPrivilegeEscalation:false, so newuidmap/newgidmap can't gain CAP_SETUID/CAP_SETGID and rootless buildah falls back to a single non-remapped uid/gid mapping. Adding those capabilities was tried live in the infra repo and reverted as a confirmed no-op (no_new_privs blocks the setuid-exec gain regardless of the container's capability set). buildctl talks to koala's host buildkitd over /run/buildkit/buildkitd.sock, which the runner pod already mounts, so the privileged layer work happens in buildkitd on the host and the pod's hardened posture is untouched. Same migration agentsquad (infra#233) and segment-embedder (infra#243) already made. Drops the buildah smoke test with it: `buildah from ${REF}` would pull the image back into the pod's buildah store and hit the very wall this migration avoids, failing the job for a reason unrelated to the image. The deploy job's `Verify rollout` is the stronger check — it requires the real pod to reach Ready in-cluster, rather than the entrypoint printing its own name for 5s. Tag builds lose their only image-level check (deploy runs on main pushes only); accepted, since a tag is always cut from a main commit that already deployed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf	2026-08-17 12:07:51 +02:00
mathiasandClaude Opus 5	489b4bb2a1	chore(spike): recover the /bygge toolchain from tmpfs (#28 ) CI / Lint / Test / Vet (push) Successful in 37s Details CI / Build & Import (push) Failing after 5s Details CI / Deploy via GitOps (push) Skipped Details analyze_srt.py, build_page.py and transcode.yaml produced the /bygge prototype. They were sitting in a session scratchpad on tmpfs, one reboot from gone, while spike issues #29-#31 were written as if they had to be built from scratch. Committed as found, defects documented rather than fixed: max_tokens=6000 truncates anything past ~6 minutes of audio, the page title is hardcoded, and the schema still carries fields no consumer renders. The four-check validator is the part worth keeping — the coverage-gap and Swedish-number-grounding checks catch errors that timestamp and citation checks structurally cannot. Real transcripts and analyses stay out: this repo is public and the recordings are a named person discussing a client's project. Only the synthetic fixture is committed, which exercises all four checks with no model call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m	2026-08-13 11:37:03 +02:00
mathias	21e7d6c74b	fix(ci): smoke test hung 14min — buildah run doesn't die under plain timeout CI / Lint / Test / Vet (push) Successful in 15s Details CI / Build & Import (push) Successful in 20s Details CI / Deploy via GitOps (push) Successful in 5s Details Bare `/tapir` runs the long-running server, same as the old ctr-based smoke test. ctr's --rm reliably force-killed it; a plain `timeout N buildah run` does not — it only signals the wrapper, and the container process can survive that and keep the log pipe open, hanging the whole job (observed live: run 155, 14min before failure). Backgrounds the run and tears it down with `buildah rm -f`, which forcibly kills regardless of wrapper state, and captures output via a file instead of a blocking pipe. Refs infra#132.	2026-07-26 06:17:18 +00:00
mathias	8814ba6673	ci(smoke): use buildah run instead of sudo k3s ctr for smoke test CI / Lint / Test / Vet (push) Successful in 12s Details CI / Build & Import (push) Failing after 13m42s Details CI / Deploy via GitOps (push) Has been skipped Details Same fix as cobalt-dingo — removes the sudo/host-containerd dependency so this still works once the act_runner is containerized (infra#132). Refs infra#132.	2026-07-26 05:57:37 +00:00
mathias	4b557a4325	ci(deploy): add Flux GitOps deploy job, mirroring cobalt-dingo's pattern CI / Lint / Test / Vet (push) Successful in 27s Details CI / Build & Import (push) Successful in 18s Details CI / Deploy via GitOps (push) Successful in 5s Details Fixes silent stale-deploy gap: CI built+pushed images but nothing bumped k3s/apps/tapir/deployment.yaml, so merged features sat CI-green with zero production effect (infra#111, infra#168). Flux native image-automation can't scan localhost:5000 from inside k3s pods, so this patches the infra repo directly via the existing INFRA_DEPLOY_KEY org secret (same key cobalt-dingo and brain-gardener already use) on every push to main. Refs infra#111.	2026-07-25 21:21:02 +00:00