v0.6.3 real ASR production dictation hotfix

v0.6.3 real ASR production dictation hotfix

v0.6.3 publishes the production dictation fix from PR #322/#321.

Changes

• Dictate now sends captured PCM to the worker-owned ASR runtime.
• ASR worker reads installed model files through model-manager storage, runs encoder/predictor/joiner ONNX sessions, resamples PCM, extracts log-Mel features, decodes RNN-T output, detokenizes, and emits final transcript text.
• Added opt-in production Playwright smoke for the deployed Vercel app: real model download, local FFmpeg/flite TTS, Chromium fake microphone input, Dictate recording, and transcript assertion.
• Added redacted install-vs-ASR diagnostics and troubleshooting guidance for empty transcript failures.

Unchanged

• v0.6.0, v0.6.1, and v0.6.2 tags/assets remain immutable.
• No model-pack, profile, adapter, portable-bundle, vocabulary, training, import/export, or privacy schema changes.
• No telemetry, analytics, account service, or broad third-party network allowance added.

Verification required before closing #323

• CI passes on the tagged commit.
• Production deployment for this tag is live.
• Production About shows 0.6.3.
• Production CSP still allows only self, huggingface.co, and us.aws.cdn.hf.co for model downloads.
• Opt-in production dictation smoke passes on a fresh browser profile.

Open evidence gates

• #255 remains open for moderated release-usability participant evidence.
• ADR 0004/0005 production quality/performance evidence boundaries remain unresolved.

v0.6.2 CDN/Xet CSP hotfix

v0.6.2 CDN/Xet CSP hotfix

Patch release over v0.6.1 for production model downloads.

Changes

• Allows the exact Hugging Face CDN/Xet redirect origin https://us.aws.cdn.hf.co in production connect-src alongside https://huggingface.co.
• Preserves direct-route SPA fallback and existing security headers.
• Preserves v0.6 task-first UI and all model/profile/storage/training/privacy schemas.
• Keeps v0.6.0 and v0.6.1 release tags/assets immutable.

Verification required for publication

• Required CI passes on the v0.6.2 release commit.
• Production alias returns direct routes with connect-src 'self' https://huggingface.co https://us.aws.cdn.hf.co.
• Browser smoke verifies the model install path under production CSP without broad wildcard origins.

Known limitations

• Issue #255 remains open for moderated release-usability participant evidence.
• ADR 0004 and ADR 0005 production accuracy/performance evidence limitations remain unresolved.

v0.6.1 CSP model-download hotfix

v0.6.1 CSP model-download hotfix

v0.6.1 is a patch hotfix over v0.6.0. It preserves the task-first v0.6 UI release and fixes production model installation by allowing the committed public Hugging Face model-download origin in Content Security Policy.

Changes

• Adds the exact committed model-file origin https://huggingface.co to Vercel connect-src.
• Keeps direct-route SPA fallback and existing COOP/COEP/Permissions-Policy/security headers intact.
• Adds static Vercel tests that derive installable model origins from committed manifests and reject wildcard or broad CSP sources.
• Documents the CSP troubleshooting pattern for model downloads.

Unchanged from v0.6.0

• No UI, model-pack, profile, adapter, portable-bundle, storage, training, or privacy schema contract changes beyond the deployment CSP header.
• No telemetry, analytics, remote logging, account service, or broad third-party network allowance was added.
• v0.6.0 release artifacts and tag remain immutable.

Known limitations

• Issue #255 remains open for final moderated release-usability participant evidence.
• Production accuracy and reference-hardware performance evidence limitations from ADR 0004 and ADR 0005 remain unresolved.
• Manual Windows NVDA/Edge and macOS VoiceOver/Safari accessibility matrix rows remain accepted limitations until run outside the Linux agent environment.

Assets

• speech-web-v0.6.1-dist.tar.gz — built web distribution for the tagged commit.
• SHA256SUMS.txt — checksum for the web distribution archive.

v0.6.0

v0.6.0 — Minimal task-first UI/UX

v0.6.0 redesigns the local-first speech PWA around three persistent destinations: Dictate, Vocabulary, and Models. Settings, Storage, Privacy, Keyboard shortcuts, Diagnostics, About, import/export, training, enrollment, and release recovery states moved into focused routes or progressive disclosures while preserving v0.5.0 speech, enrollment, training, profile, portability, privacy, security, and compatibility contracts.

Highlights

• Task-first application shell with exactly Dictate, Vocabulary, and Models as persistent primary destinations.
• Compact Dictate workspace with in-place speech-model setup, transcript actions menu, concise microphone/offline/update states, and local-only privacy boundaries.
• Vocabulary list/editor redesigned around compact sets, basic word editing, and Advanced disclosures for steering and diagnostics.
• Voice Models list/detail, create/enroll/train/results/import/export/storage workflows redesigned around next actions, blockers, and disclosed technical details.
• Dedicated Settings, Audio, Storage, Privacy, Keyboard shortcuts, Diagnostics, and About routes behind the application menu.
• Repository-owned UI primitives, semantic tokens, component gallery, semantic copy/accessibility gates, responsive visual matrix, and manual accessibility matrix.
• Worker-owned encrypted .speechmodel export and dedicated import route preserve local-first security and avoid moving archive, crypto, hashing, training, or inference work to the UI thread.

Known limitations

• Issue #255 remains open for final moderated release-usability participant evidence. The user explicitly approved publishing v0.6.0 while preserving this open gate.
• Manual Windows NVDA/Edge and macOS VoiceOver/Safari rows in the accessibility matrix remain accepted limitations until run outside the Linux agent environment.
• Production model accuracy and reference-hardware performance gates remain bounded by ADR 0004 and ADR 0005 evidence limitations; this release does not claim those gates pass.

Assets

• speech-web-v0.6.0-dist.tar.gz — built apps/web/dist from the tagged commit.
• SHA256SUMS.txt — SHA-256 checksum for the web dist archive.

v0.5.0 — Browser personal-model infrastructure

v0.5.0 — Browser personal-model infrastructure

This release tags the local-first browser Personal Voice Model infrastructure milestone. It is an infrastructure, portability, hardening, and release-gate milestone; it does not publish production Personal Voice Model accuracy or reference-hardware performance claims.

Included

• Personal Voice Model schemas and contracts: SpeechModelManifestV3, BrowserTrainingContractV1, SpeechProfileManifestV2, BrowserTrainingJobV1, TrainingFeatureShardV1, and PortableSpeechModelManifestV1.
• Browser-training infrastructure behind @speech/browser-training: fixed adapter-math backend, residual bottleneck/LHUC reference math, balanced sampling, AdamW, validation/early stopping, deterministic checkpoints/resume, Web Locks coordination, ASR-priority pause, and accessible progress/recovery UI.
• Local preparation/evaluation flow: training-readiness reports, frozen enrollment/vocabulary revisions, prompt-identity splits, FP16 feature shards, CTC frame labels, selected-vocabulary metadata, personal/anchor evaluation, activation decisions, rollback, and aggregate release gates.
• Personal Models UI: profile cards, capability preflight, readiness tasks, activation comparison/override/rollback, multi-profile dedupe/import-as-new/replace/rename/delete, and worker-owned lifecycle operations.
• Portable .speechmodel lifecycle: deterministic inner bundles, default Web Crypto encrypted export, hostile importer validation, exact base-model compatibility, worker-owned smoke vectors, atomic staging, CLI residual-adapter compatibility, and V1-to-V2 speech-profile migration/recovery.
• Hardening/release plumbing: cross-browser/fault-injection smoke coverage, parser/import-security corpus, synthetic fixture licensing, privacy/security/licensing review, bilingual cohort gate contract, and reference-hardware benchmark gate contract.

Release limitations

• ADR 0004: no user-approved 30-speaker bilingual quality cohort evidence is available in this repository. Do not claim production Personal Voice Model accuracy or quality gates pass.
• ADR 0005: no declared reference-hardware Personal Voice Model benchmark evidence is available in this repository. Do not claim production memory, storage, latency, RTF, export/import, offline, or zero-network performance gates pass.
• ADR 0006/0007: release notes must preserve local-first privacy boundaries. Raw audio, transcript text, feature tensors, checkpoints, adapter weights, profile JSON, private vocabulary, prompt/case/profile IDs, storage paths, and network payloads are not release artifacts.
• Synthetic fixtures, CI smoke tests, local diagnostics, and contract tests are regression evidence only; they are not substitutes for cohort or reference-hardware evidence.
• Production ASR/model weights remain out of Git. The current external VietASR catalog entry remains metadata-only and is not advertised as a low-latency bilingual streaming model.

Validation

Required CI passed on the tagged commit 8e72dd120e41e69cc52458804fa8b8804e74b9bc before release publication:

• lint, typecheck, test, build
• chromium smoke

Local release asset generation ran from tag v0.5.0:

• source archive generation from tag v0.5.0
• pnpm --filter @speech/web build
• web build archive generation from apps/web/dist
• SHA-256 checksum generation for attached archives

Deployment verification

Public production alias verified over HTTPS:

• https://speech-amber-beta.vercel.app/ loads the app shell.
• Required COOP/COEP/CSP/Permissions-Policy headers are present.
• manifest.webmanifest and sw.js are reachable.
• Service-worker-backed offline reload renders the app shell after first load.

The Vercel unique deployment URL for the merge commit is SSO-protected; public verification used the production alias above.

Assets

• speech-v0.5.0-source.tar.gz — source archive generated from tag v0.5.0
• speech-v0.5.0-web-dist.tar.gz — generated web build archive
• SHA256SUMS.txt — SHA-256 checksums for both archives

v0.1.0 — PWA runtime foundation

v0.1.0 — PWA runtime foundation

This release tags the local-first speech PWA runtime foundation. It is a browser/runtime and contract release, not a production ASR accuracy release.

Included

• Installable React/Vite PWA shell with offline app-shell caching and model lifecycle UI.
• Microphone permission flow, AudioWorklet PCM capture, SharedArrayBuffer ring-buffer primitives, and transferable-buffer fallback.
• Streaming resampler, log-Mel feature extraction, RNN-T decoder primitives, stable-prefix controller, and utterance finalization contracts.
• ONNX Runtime Web loading in a dedicated worker, WebGPU/WASM provider benchmark/fallback reporting, and tiny deterministic mock ONNX graphs for CI.
• Model catalog and manifest validation, metadata-only VietASR candidate manifest, OPFS/Cache storage abstraction, checksum verification, and atomic activation contracts.
• Transcript workspace with page-scoped push-to-talk, committed/provisional text, copy/download/settings/privacy UI, Vietnamese normalization/basic ITN, and deterministic transcript parity fixtures.
• Benchmark/diagnostics JSON export plus release-validation E2E coverage for accessibility, keyboard focus, active-transcription no-network windows, offline reload, and export schema checks.

Model and performance caveats

• No production model weights, private recordings, speech corpora, transcripts, or personal profiles are committed.
• vietasr-iter3-int8 is a metadata-only external Vietnamese candidate. Its inspected ONNX encoder is full-sequence/length based and does not expose streaming cache tensors, so it must not be presented as low-latency streaming-ready yet.
• No repository-owned WER/CER/code-switch/latency/RTF/memory results are published for a real model pack in this release. Synthetic benchmark exports validate report plumbing only.

Validation

Required CI checks passed on the tagged commit 82eecb4bf7b9774a39f9f436569bbd1b7d5c990b:

• lint, typecheck, test, build
• chromium smoke

Local release asset generation also ran:

• pnpm --filter @speech/web build
• source archive generation from tag v0.1.0
• web build archive generation from apps/web/dist
• SHA-256 checksum generation for attached archives

Deployment status

The repository includes Vercel-ready vercel.json headers for COOP/COEP/CSP/Permissions-Policy. Production hosted PWA verification is not claimed from this release automation because this environment has no Vercel CLI installation, no .vercel project link, no VERCEL_TOKEN, and no GitHub deployment records for the repository. Verify the hosted Vercel production URL before claiming hosted app-shell offline behavior or SharedArrayBuffer Tier A support.

Assets

• speech-v0.1.0-source.tar.gz — source archive generated from tag v0.1.0
• speech-v0.1.0-web-dist.tar.gz — generated web build archive
• SHA256SUMS.txt — SHA-256 checksums for both archives