berget/kb-whisper is a cloud endpoint. #33 asks the adapter to fall back to it when iguana/kb-whisper fails (iguana can wedge permanently after a Metal OOM, infra#273). When the fallback fires, a private meeting's audio leaves the homelab. Measured 2026-10-01: both endpoints transcribe the same 11-minute file; berget returns finer timestamps.
The code ships the fallback enabled (TAPIR_TRANSCRIBE_FALLBACK_MODEL=berget/kb-whisper), matching #33, because the issue says so — but this is a data-egress decision and was not mine to take silently. Mitigations already in the PR: the serving endpoint is recorded per row and shown on the transcript page; a cancelled job never falls back; the serve log warns at start-up that the fallback is a cloud endpoint; an explicit empty value disables it.
Options
A. Enabled by default, endpoint shown (current, matches #33).
B. Disabled by default: an iguana failure fails the job honestly and the user re-uploads. Private audio never leaves the homelab unless someone turns it on.
Note the repo-wide rule "client data never goes to cloud APIs unless explicitly OK'd" — this feature is for the maintainer's own meetings, but any client-confidential recording uploaded here would be covered by it.
Blocks: only the production default; the adapter ships either way.
Follow-up to #33 / ADR-033.
`berget/kb-whisper` is a **cloud** endpoint. #33 asks the adapter to fall back to it when `iguana/kb-whisper` fails (iguana can wedge permanently after a Metal OOM, infra#273). When the fallback fires, **a private meeting's audio leaves the homelab.** Measured 2026-10-01: both endpoints transcribe the same 11-minute file; berget returns finer timestamps.
The code ships the fallback **enabled** (`TAPIR_TRANSCRIBE_FALLBACK_MODEL=berget/kb-whisper`), matching #33, because the issue says so — but this is a data-egress decision and was not mine to take silently. Mitigations already in the PR: the serving endpoint is recorded per row and **shown on the transcript page**; a cancelled job never falls back; the serve log warns at start-up that the fallback is a cloud endpoint; an explicit empty value disables it.
**Options**
- **A. Enabled by default, endpoint shown (current, matches #33).**
- B. Disabled by default: an iguana failure fails the job honestly and the user re-uploads. Private audio never leaves the homelab unless someone turns it on.
Note the repo-wide rule "client data never goes to cloud APIs unless explicitly OK'd" — this feature is for the maintainer's own meetings, but any client-confidential recording uploaded here would be covered by it.
**Blocks:** only the production default; the adapter ships either way.
Refs: ADR-033 Open items, #33.
---
_Created via git-mcp on behalf of @mathias_
Decision (Mathias, 2026-10-02): berget fallback stays enabled by default, option A. The code already ships that way, so no change is needed. The mitigations in the PR stand: the serving endpoint is shown on the transcript page, a cancelled job never falls back, the log warns at start-up that the fallback is a cloud endpoint, and an explicit empty TAPIR_TRANSCRIBE_FALLBACK_MODEL turns it off.
Scope note, so the decision is not read wider than it was: it covers the audio transcription fallback only. With two-engine mode the fallback fires only when both local engines fail. Reconciliation text is sent only to a local model, enforced at start-up (ADR-034), and this decision does not change that.
A recording covered by the repo-wide client-data rule must still not be uploaded here unless the fallback is switched off for it.
**Decision (Mathias, 2026-10-02): berget fallback stays enabled by default, option A.** The code already ships that way, so no change is needed. The mitigations in the PR stand: the serving endpoint is shown on the transcript page, a cancelled job never falls back, the log warns at start-up that the fallback is a cloud endpoint, and an explicit empty `TAPIR_TRANSCRIBE_FALLBACK_MODEL` turns it off.
Scope note, so the decision is not read wider than it was: it covers the audio transcription fallback only. With two-engine mode the fallback fires only when both local engines fail. Reconciliation text is sent only to a local model, enforced at start-up (ADR-034), and this decision does not change that.
A recording covered by the repo-wide client-data rule must still not be uploaded here unless the fallback is switched off for it.
Closing as decided.
---
_Created via git-mcp on behalf of @mathias_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #33 / ADR-033.
berget/kb-whisperis a cloud endpoint. #33 asks the adapter to fall back to it wheniguana/kb-whisperfails (iguana can wedge permanently after a Metal OOM, infra#273). When the fallback fires, a private meeting's audio leaves the homelab. Measured 2026-10-01: both endpoints transcribe the same 11-minute file; berget returns finer timestamps.The code ships the fallback enabled (
TAPIR_TRANSCRIBE_FALLBACK_MODEL=berget/kb-whisper), matching #33, because the issue says so — but this is a data-egress decision and was not mine to take silently. Mitigations already in the PR: the serving endpoint is recorded per row and shown on the transcript page; a cancelled job never falls back; the serve log warns at start-up that the fallback is a cloud endpoint; an explicit empty value disables it.Options
Note the repo-wide rule "client data never goes to cloud APIs unless explicitly OK'd" — this feature is for the maintainer's own meetings, but any client-confidential recording uploaded here would be covered by it.
Blocks: only the production default; the adapter ships either way.
Refs: ADR-033 Open items, #33.
Created via git-mcp on behalf of @mathias
Decision (Mathias, 2026-10-02): berget fallback stays enabled by default, option A. The code already ships that way, so no change is needed. The mitigations in the PR stand: the serving endpoint is shown on the transcript page, a cancelled job never falls back, the log warns at start-up that the fallback is a cloud endpoint, and an explicit empty
TAPIR_TRANSCRIBE_FALLBACK_MODELturns it off.Scope note, so the decision is not read wider than it was: it covers the audio transcription fallback only. With two-engine mode the fallback fires only when both local engines fail. Reconciliation text is sent only to a local model, enforced at start-up (ADR-034), and this decision does not change that.
A recording covered by the repo-wide client-data rule must still not be uploaded here unless the fallback is switched off for it.
Closing as decided.
Created via git-mcp on behalf of @mathias