Second release of the audio-upload follow-up sprint (epic #54). Red test commit then fix commit per item; task check and golangci-lint run ./... exit 0 on the head.
#53 LLM client reads a bounded body: 8 MiB on success (WithMaxResponseBytes), the error bound on failure.
#52 a transcript served by a non-local endpoint says in plain words that the audio left the homelab and names the provider; "local" is config.IsLocalModel (one definition). ADR-033/docs note that an empty transcript also triggers the fallback.
#51 tracker: every save/heartbeat write has a 5 s timeout so a hung database cannot stall the reporting engines or the heartbeat; heartbeats are stamped with the application clock (Sink.Beat(ctx, at), alive_at = $3).
#37 home list links to /uploads when mounted; POST /uploads/{id}/delete is owner-scoped (404 for others), refused with 409 while queued/transcribing (decision D3), confirm-then-delete on a finished/failed recording; store DeleteUpload (+ ErrUploadInProgress); the route is covered by the cross-origin gate test.
Not in this release (need the owner or are decisions):#36, #38 (model loads on production iguana, D4-D6), #45 (question), #46 remainder, #56 slow-drip, #57 shutdown logging. #50 stays open until a rollout under the new code shows the old pod Completed.
Review lane: risk/medium (#37, #51): an adversarial pass verified by execution is required before merge; verdict goes in #54.
Second release of the audio-upload follow-up sprint (epic #54). Red test commit then fix commit per item; `task check` and `golangci-lint run ./...` exit 0 on the head.
- **#53** LLM client reads a bounded body: 8 MiB on success (`WithMaxResponseBytes`), the error bound on failure.
- **#52** a transcript served by a non-local endpoint says in plain words that the audio left the homelab and names the provider; "local" is `config.IsLocalModel` (one definition). ADR-033/docs note that an empty transcript also triggers the fallback.
- **#51** tracker: every save/heartbeat write has a 5 s timeout so a hung database cannot stall the reporting engines or the heartbeat; heartbeats are stamped with the application clock (`Sink.Beat(ctx, at)`, `alive_at = $3`).
- **#37** home list links to `/uploads` when mounted; `POST /uploads/{id}/delete` is owner-scoped (404 for others), refused with 409 while queued/transcribing (decision D3), confirm-then-delete on a finished/failed recording; store `DeleteUpload` (+ `ErrUploadInProgress`); the route is covered by the cross-origin gate test.
**Not in this release (need the owner or are decisions):** #36, #38 (model loads on production iguana, D4-D6), #45 (question), #46 remainder, #56 slow-drip, #57 shutdown logging. #50 stays open until a rollout under the new code shows the old pod `Completed`.
**Review lane:** risk/medium (#37, #51): an adversarial pass verified by execution is required before merge; verdict goes in #54.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
_Created via git-mcp on behalf of @mathias_
The two-engine path writes '<base> + <alt>, reconciled by <model>'. IsLocalModel is a
single-alias match, so the composite was 'not local' and the note claimed the audio left
the homelab, naming a local host as the provider. Found by the PR #58 review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Every earlier test passed WithSaveTimeout; the worker passes nothing, so the 5 s default
was the only production value and a flip to 0, 1ms or 1h stayed green. Found by the PR #58
review; each flip is now red.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The worker fake ignored the heartbeat time, so the store-boundary half of the app-clock
fix had no assertion. Found by the PR #58 review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Only the 8-byte override was exercised; >= vs >, a huge default and a non-positive option
all stayed green. Also says why the error-body read ignores its error. Found by the PR #58
review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The earlier entry posted to an app without uploads, where the route does not exist, and
stayed green with the route removed. This one seeds a finished row and goes red without the
gate. Found by the PR #58 review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The tracker comment said 'never a stalled job'; each transition can wait up to the timeout.
The delete refusal is judged at the moment of the attempt. Found by the PR #58 review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adversarial review, round 1 (agent, verified by execution): BLOCK on head 25628a9.
Gates by exit code: task check 0 (after one embedded-postgres port collision with another session), golangci-lint 0, go test -race 0, FORCE_COLOR=1 go test ./test/lintgate/ 0. A green gate covered none of findings 1-3.
BLOCK, fixed.cloudProvider called an all-local reconciled endpoint ("iguana/kb-whisper + koala/whisper, reconciled by iguana/gemma4-26b") cloud-served and named a local host as provider. Now judged alias by alias. Two red tests first (all-local composite: no note; composite with a cloud alias: names it) — commit 9aa0146.
BLOCK, fixed. The 5 s default save timeout was pinned by nothing (flips to 0, 1ms, 1h stayed green). New test uses a Tracker built without options and checks the deadline each write receives; all three flips now red. Also jobSink forwards the tracker's timestamp to the store, with a mutation-proven test.
BLOCK, fixed. LLM body cap: at-cap, cap+1, the 8 MiB production default and the non-positive option are now pinned; >=, a huge default, a 4 MiB default and n > -1 all go red.
MEDIUM, not changed, reasoned. A delete of a row that finishes between the DELETE and the existence SELECT returns 409 once. The refusal reflects the row's state when the delete was attempted (it was transcribing), nothing is wrongly deleted, a retry succeeds. A one-statement classification would give the same 409. DECISIONS wording amended. The re-review is asked to try to break this.
Fixed (comment). "never a stalled job" overclaimed; the tracker comment now says each transition can wait up to the timeout and a dropped final save is not retried.
Fixed. Comment on the ignored error of the diagnostic body read.
Fixed. The cross-origin test for the delete route posted to an app without uploads; the new test seeds a finished row on an app that mounts uploads and goes red without the gate.
Re-review of the delta is running. Not merging until it returns APPROVE and CI is green on the head. CI was not checked by the round-1 reviewer.
**Adversarial review, round 1 (agent, verified by execution): BLOCK** on head 25628a9.
Gates by exit code: `task check` 0 (after one embedded-postgres port collision with another session), `golangci-lint` 0, `go test -race` 0, `FORCE_COLOR=1 go test ./test/lintgate/` 0. A green gate covered none of findings 1-3.
Findings and what I did (head c24573b):
1. **BLOCK, fixed.** `cloudProvider` called an all-local reconciled endpoint ("iguana/kb-whisper + koala/whisper, reconciled by iguana/gemma4-26b") cloud-served and named a local host as provider. Now judged alias by alias. Two red tests first (all-local composite: no note; composite with a cloud alias: names it) — commit 9aa0146.
2. **BLOCK, fixed.** The 5 s default save timeout was pinned by nothing (flips to 0, 1ms, 1h stayed green). New test uses a Tracker built without options and checks the deadline each write receives; all three flips now red. Also `jobSink` forwards the tracker's timestamp to the store, with a mutation-proven test.
3. **BLOCK, fixed.** LLM body cap: at-cap, cap+1, the 8 MiB production default and the non-positive option are now pinned; `>=`, a huge default, a 4 MiB default and `n > -1` all go red.
4. **MEDIUM, not changed, reasoned.** A delete of a row that finishes between the DELETE and the existence SELECT returns 409 once. The refusal reflects the row's state when the delete was attempted (it was transcribing), nothing is wrongly deleted, a retry succeeds. A one-statement classification would give the same 409. DECISIONS wording amended. The re-review is asked to try to break this.
5. **Fixed (comment).** "never a stalled job" overclaimed; the tracker comment now says each transition can wait up to the timeout and a dropped final save is not retried.
6. **Fixed.** Comment on the ignored error of the diagnostic body read.
7. **Fixed.** The cross-origin test for the delete route posted to an app without uploads; the new test seeds a finished row on an app that mounts uploads and goes red without the gate.
Re-review of the delta is running. Not merging until it returns APPROVE and CI is green on the head. CI was not checked by the round-1 reviewer.
---
_Created via git-mcp on behalf of @mathias_
The previous version kept only words containing '/' and dropped the rest, so a bare
TAPIR_TRANSCRIBE_MODEL alias in the composite produced a false 'all local' result. Found
by the PR #58 re-review; red tests for a bare alias, an alias with a space and a split
'berget / x' first.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Skipping 'by', 'reconciled' and '+' as words everywhere let an alias with one of those
names pass as local. The two-engine shape is now split on its own separators and each alias
judged whole; a reconciler that is not local is pinned too. Hardening suggested by the third
PR #58 review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adversarial review, rounds 2-4: APPROVE on head 41ab1f5 (agent reviews, each by execution in a git archive copy; the author's PR-comment above holds round 1).
Round 2 (delta since round 1): BLOCK, one medium. cloudProvider kept only words containing "/" and so judged a composite with a bare alias (iguana/kb-whisper + whisper-1, reconciled by …) as local, the dangerous direction. Items 2-6 held (default-timeout flips 0/1ms/1h/6s, jobSink time flips, body-cap flips, cross-origin gate removal, and the delete-race argument: no wrong deletion, no permanent refusal, no 404 for an existing row). Fixed test-first in 67bd035.
Round 3: APPROVE, one low. Connector words (by, reconciled, +) were skipped everywhere, so an alias with such a name passed as local; only reachable with a pathological LiteLLM alias. Hardened test-first in 41ab1f5: the two-engine shape is split exactly (", reconciled by ", " + "), each alias judged whole, the reconciler pinned.
Round 4 (41ab1f5): APPROVE. About 60 probes, none judged a non-local engine local; 19 mutations, only two redundant TrimSpace mutants survived (each covers the other; a survivor only makes the check stricter).
Gates on 41ab1f5: task check exit 0, golangci-lint exit 0, go test -race of the touched packages exit 0, CI run 9010 success. Pod check before merge: tapir-6cb44996bf-l7dhr running image e037c6b, no job in flight in the log.
Not verified by any reviewer: a real hung Postgres, real browser rendering of the delete <details> control and HTMX swaps, the live cluster Deployment strategy beyond the ADR text. Merging now.
**Adversarial review, rounds 2-4: APPROVE on head 41ab1f5** (agent reviews, each by execution in a `git archive` copy; the author's PR-comment above holds round 1).
- Round 2 (delta since round 1): BLOCK, one medium. `cloudProvider` kept only words containing "/" and so judged a composite with a bare alias (`iguana/kb-whisper + whisper-1, reconciled by …`) as local, the dangerous direction. Items 2-6 held (default-timeout flips 0/1ms/1h/6s, jobSink time flips, body-cap flips, cross-origin gate removal, and the delete-race argument: no wrong deletion, no permanent refusal, no 404 for an existing row). Fixed test-first in 67bd035.
- Round 3: APPROVE, one low. Connector words (`by`, `reconciled`, `+`) were skipped everywhere, so an alias with such a name passed as local; only reachable with a pathological LiteLLM alias. Hardened test-first in 41ab1f5: the two-engine shape is split exactly (", reconciled by ", " + "), each alias judged whole, the reconciler pinned.
- Round 4 (41ab1f5): APPROVE. About 60 probes, none judged a non-local engine local; 19 mutations, only two redundant `TrimSpace` mutants survived (each covers the other; a survivor only makes the check stricter).
Gates on 41ab1f5: `task check` exit 0, `golangci-lint` exit 0, `go test -race` of the touched packages exit 0, CI run 9010 success. Pod check before merge: tapir-6cb44996bf-l7dhr running image e037c6b, no job in flight in the log.
Not verified by any reviewer: a real hung Postgres, real browser rendering of the delete `<details>` control and HTMX swaps, the live cluster Deployment strategy beyond the ADR text. Merging now.
---
_Created via git-mcp on behalf of @mathias_
mathias
merged commit 85f4cc3236 into main2026-10-03 22:31:26 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Second release of the audio-upload follow-up sprint (epic #54). Red test commit then fix commit per item;
task checkandgolangci-lint run ./...exit 0 on the head.WithMaxResponseBytes), the error bound on failure.config.IsLocalModel(one definition). ADR-033/docs note that an empty transcript also triggers the fallback.Sink.Beat(ctx, at),alive_at = $3)./uploadswhen mounted;POST /uploads/{id}/deleteis owner-scoped (404 for others), refused with 409 while queued/transcribing (decision D3), confirm-then-delete on a finished/failed recording; storeDeleteUpload(+ErrUploadInProgress); the route is covered by the cross-origin gate test.Not in this release (need the owner or are decisions): #36, #38 (model loads on production iguana, D4-D6), #45 (question), #46 remainder, #56 slow-drip, #57 shutdown logging. #50 stays open until a rollout under the new code shows the old pod
Completed.Review lane: risk/medium (#37, #51): an adversarial pass verified by execution is required before merge; verdict goes in #54.
🤖 Generated with Claude Code
Created via git-mcp on behalf of @mathias
Adversarial review, round 1 (agent, verified by execution): BLOCK on head
25628a9.Gates by exit code:
task check0 (after one embedded-postgres port collision with another session),golangci-lint0,go test -race0,FORCE_COLOR=1 go test ./test/lintgate/0. A green gate covered none of findings 1-3.Findings and what I did (head
c24573b):cloudProvidercalled an all-local reconciled endpoint ("iguana/kb-whisper + koala/whisper, reconciled by iguana/gemma4-26b") cloud-served and named a local host as provider. Now judged alias by alias. Two red tests first (all-local composite: no note; composite with a cloud alias: names it) — commit9aa0146.jobSinkforwards the tracker's timestamp to the store, with a mutation-proven test.>=, a huge default, a 4 MiB default andn > -1all go red.Re-review of the delta is running. Not merging until it returns APPROVE and CI is green on the head. CI was not checked by the round-1 reviewer.
Created via git-mcp on behalf of @mathias
Adversarial review, rounds 2-4: APPROVE on head
41ab1f5(agent reviews, each by execution in agit archivecopy; the author's PR-comment above holds round 1).cloudProviderkept only words containing "/" and so judged a composite with a bare alias (iguana/kb-whisper + whisper-1, reconciled by …) as local, the dangerous direction. Items 2-6 held (default-timeout flips 0/1ms/1h/6s, jobSink time flips, body-cap flips, cross-origin gate removal, and the delete-race argument: no wrong deletion, no permanent refusal, no 404 for an existing row). Fixed test-first in67bd035.by,reconciled,+) were skipped everywhere, so an alias with such a name passed as local; only reachable with a pathological LiteLLM alias. Hardened test-first in41ab1f5: the two-engine shape is split exactly (", reconciled by ", " + "), each alias judged whole, the reconciler pinned.41ab1f5): APPROVE. About 60 probes, none judged a non-local engine local; 19 mutations, only two redundantTrimSpacemutants survived (each covers the other; a survivor only makes the check stricter).Gates on
41ab1f5:task checkexit 0,golangci-lintexit 0,go test -raceof the touched packages exit 0, CI run 9010 success. Pod check before merge: tapir-6cb44996bf-l7dhr running imagee037c6b, no job in flight in the log.Not verified by any reviewer: a real hung Postgres, real browser rendering of the delete
<details>control and HTMX swaps, the live cluster Deployment strategy beyond the ADR text. Merging now.Created via git-mcp on behalf of @mathias