Backchannel v0.4.0

Backchannel v0.4.0

Backchannel now updates itself, measures whether your hardware can keep up
before a call starts, and keeps working through the failures that used to end a
call quietly. Privacy First graduates from a warning into a mode a whole
workspace can actually run in.

Highlights

• Desktop builds update in place. The app checks for a new version,
  verifies its Ed25519 signature before touching anything on disk, applies it
  with a rollback path if the swap fails, and gates shutdown so an active
  recording or a running post-processing pass finishes first.
• Privacy First is a working mode, not a warning. Admission is judged by
  where a model is served, not what its vendor is called, so a model on your
  own machine or LAN keeps the analysis agents, post-import Analyze, Enhance
  Insights, and the call briefing running with the switch on. Refusals now name
  the agent and the model to change instead of only saying no.
• Know before the call whether the machine can keep up. The Local Model Fit
  Test times each self-hosted model against the real agent prompts and a
  realistic transcript, scoring it per role with per-model cycle budgets, an
  adjustable contention slider, and coverage for transcription and the
  briefing. Call-start capacity admission sums diarization, transcription,
  captions, and agents against the machine's measured headroom.
• Measurements expire honestly. A benchmark taken on different hardware or
  against an older standard is marked out of date rather than shown as current,
  and a stale one is excluded from the capacity verdict and named as unmeasured
  rather than quietly counting as a pass.
• On-device live interim captions. Point the audio bridge at the local
  captioner and interim captions run with no cloud call, including under
  Privacy First. CPU-heavy by nature, so the fit test projects whether the
  machine can sustain it.
• The post-call Briefing reads like a briefing. An at-a-glance strip sums
  up the meeting in five seconds, the top outcomes lead the page, and every
  section carries its own color and icon so risks, actions, and open questions
  are found by scanning instead of reading. Owners and status show as chips,
  supporting rationale tucks behind a toggle, and strategic signals from the
  call now appear in the briefing.

Reliability

• A diarizer that falls behind realtime now sheds audio instead of growing an
  unbounded queue until the backend is OOM-killed.
• Self-hosted requests get a budget and a timeout sized for local hardware, so
  a briefing no longer dies partway through on a 120-second limit or a
  truncated reply.
• Text agents validate replies against a schema, so a self-hosted model's
  output is no longer silently discarded.
• Insight revalidation falls back to an admitted self-hosted model when a cloud
  provider's quota is exhausted mid-run.
• Ending a call is honest end to end: stopping the browser share finalizes the
  system track at that moment rather than surfacing a stray speaker minutes
  later, End Call names any analysis stage that degraded, the drain summary is
  saved with the call so a dropped connection cannot lose it, and a long
  post-processing run is no longer reported as a lost connection.
• A runtime diagnosis surface reports what is running, what is blocked, and
  what to change, and editing a self-hosted endpoint no longer silently orphans
  the agents, budgets, and fit results that referenced it.

Release integrity

Desktop release manifests are now signed by a protected Cloudflare Worker that
reads the key from Secrets Store, instead of by a private key kept on the
release coordinator's workstation, and the signing key was rotated as part of
that move. Nothing changes on your machine: the app verifies each update
descriptor against the public key shipped inside the build it is updating from.

Upgrading

No action required. Existing sessions, agents, and endpoint configuration carry
forward. The database gains one additive column on first launch through the
usual startup patch. Desktop installs from v0.3.8 and earlier must be updated
once by hand; from this version forward the in-app updater takes over.

Included

Voice enrollment was hardened against malformed and non-seekable audio imports,
the live-call WebSocket path was refactored under its structural limit, and the
site gained a blog surface carrying the first two research articles.