Personal AI OS 0.1.5

依米 · Personal AI OS 0.1.5

让每个人都有自己的依米：一个了解你的私人助理，住在你自己的服务器上，用你选择的模型，在你的授权范围内使用你的数据和设备。

这一版，依米可以换用部署者自己准备的本地模型，还新增了可选的会议助手服务端能力和 Keynote 编辑协议。对外发送的许可细化到具体的收件人和消息类别；结果不明的操作，要先核查原来那次操作，不会自动重做。

从这一版起，版本号跟随项目自身的发布序列，所以 0.0.2 之后直接是 0.1.5。

有哪些变化

• 本地模型目录。 模型设置里新增本地模型目录，列出每个模型的名称、是否已安装、能否切换和切换条件，每页最多 8 项。语音识别、语音活动检测、声纹、唤醒词和向量模型，都可以提交带签名的切换请求；也可以切回保留的上一个模型，或选回当前实际生效的模型。设置页会同时显示选中的版本、实际生效的版本、上一个版本、切换进度和错误。语音类模型选定后，要重启服务才会加载。模型文件由部署者自备，见下文。
• 各类模型的切换规则。 换声纹模型时，会提示重新录入和校准；新版本还没实际生效时，设置页会标出付款声纹待更新。人脸模型会出现在目录里，但不能在这里切换，要走人脸录入流程。换唤醒词模型不会改掉原有的常规唤醒词和通话中断词：如果要换上的模型缺少通话中断词，或者改了词语，就拒绝切换。换向量模型时，先建好新的索引空间并报告进度，建完才切换过去。
• 模型配置、密钥与费用。 改了模型配置或换了密钥，在收到实际启用的确认之前，服务会保留实际启用或可能已启用的配置版本所需的密钥。服务重启后会重新确认，避免切换还没确认就提前清理旧密钥。估算模型费用时，能区分缓存写入是按普通输入计价还是单独计价；缺少计量或价格时，费用仍标为未知。
• 通话分类的有序后备。 如果主脑已经配好有序后备路由，而通话分类（call.intent）的后备链还空着，可以用新增的命令把这条链补给通话分类，用法见下文。通话分类自己的输出和采样参数不变。
• 会议助手（本地 Keynote）。 新增会议服务端编排和 Keynote 编辑协议。执行端可以通过它读取指定本地 Keynote 演示文稿的当前页和页上的文字、定位讨论区域、生成修改预览、执行修改，并查询原操作的结果。实际读写还需要实现该协议的 Mac 执行端，本版所附的 Mac 源码尚未提供。选定会议时，要绑定已有的文件授权、确切的那台电脑和一副在线的眼镜；文件或设备对不上，就不开始。会议期间的媒体只用于这场会议；迟到的媒体，或属于已结束会议的媒体，也不会进入日常的人物与情绪记录。会议助手是可选的能力包，默认不启用，见下文。
• 会议里怎么定位、怎么改。 接通相应的 Mac 执行端后，它会结合会上的话、眼镜画面和投影片，定位到唯一对应的文字元素；也可以按明确的页码查文档结构。指代含糊、画面已经过期或缺少事实依据时，它会等更多材料再定位。修改计划只允许替换文字或追加段落，每一条都绑定原来的页面、原文和预览；删除、图片、布局和发送都不在计划范围内。第一次修改文字需要你确认，之后会对同一个文件、同一台电脑和允许的操作类型，建立最长两小时的会话许可；会话结束或连接持续断开后，许可失效。某次修改结果不明时，先查询原来那次操作，核对目标、计划和修改前后的文字回读，核对清楚后才允许继续修改。
• 发送许可认准收件人和消息类别。 对外发送的许可改为按“解析出的具体收件人 + 消息类别”来认，类别包括文本、文件、添加反应和移除反应等。微信收件人必须在通讯录里唯一匹配；按名称匹配有歧义或查不到时，就不发送。收件人和类别由能力包的声明和经过认证的调用准备来决定；消息工具传进来的效果或任务类型，不能自己挑另一条历史许可来用。旧许可怎样迁移，见下文。
• 结果不明，先核查再继续。 需要确认的操作中断后恢复时，先核查原来的执行记录；已经认领却没有结果的调用，会返回待核查的信息，不会自动再执行一遍。结果不明的写操作，要先拿到绑定原操作和原目标的核查证据，才能重试；已经成功、且不允许重试的操作，不会重复执行。手机任务遇到来源无法核实的付款记录时，会要求核对原订单，核查结果绑定到原任务后才继续；明确不含付款意图的隔离记录，不会挡住普通任务。
• 执行结果的汇报。 汇报执行结果时，重复的事实合并成一条，列表收成数量摘要；每次最多展示 12 项，每项不超过 160 字符，其余细节可以接着问。电脑和桌面能力返回的截图、音频、资源和旧式附件标记，转换成回执时都会保留，供后面读取截图内容和坐标。
• 聊天记录。 手机上的聊天历史改为懒加载：默认显示最新的 150 行，每次往前展开 100 行；已加载的行都显示完了，才去请求更早的记录。超长消息在聊天和首页预览里只显示开头一段，上限是 2000 字符或 40 个换行；在聊天里可以打开全文。翻看旧记录时，阅读位置保持不动；判断滚动时观察的是系统原生的滚动手势，系统的侧滑返回照常可用。停在最新消息处时，如果键盘弹出、可视区域或消息高度发生变化，聊天会重新对齐到最新一条，这修复了历史记录出现空白的问题。服务端做过历史隔离后，各端收到可信的新历史代次，会清掉旧的本地历史，见下文。
• 活动卡。 活动卡按持久保存的递增版本回放。服务重启后，仍然挂着的卡片会根据执行记录收尾，进度显示的是实际的工作项。找不到原始请求或回复的活动卡，按服务端的开始时间插进聊天，而不是一律堆在最新消息后面。
• 通话。 说话指示只在实际播放的声音超过噪声阈值时亮起，连续静音 0.8 秒后熄灭，减少停顿时的闪烁。通话里没有核实或认不出的声音，保留原来的归属；不会因为这通电话是已配对的用户发起的，就被当成已核实的请求。
• Mac 解除配对。 离线时也能点解除配对，界面会显示进度：本机已经解除，服务器尚待同步。
• 眼镜。 随身模式下，眼镜的空闲画面会显示一条最多 48 个字符、两行的短回复；说话指示跟着实际的语音播放，展示完后淡出。眼镜与其他客户端使用同一张获授权的 AI 生成虚构默认头像；公开源码将随身回复界面的头像文件替换为中性的矢量占位图。付款提示过期后，眼镜会重新判断还需不需要麦克风，并取消还在等待发出的付款语音采集。重新连接或启动时，眼镜会收到一份表示当前空闲的移动状态快照，清掉旧的骑行和导航显示，不再显示已经结束的路线。
• 声纹与人物列表。 声纹核验按采集通道分别保存阈值，阈值逐步上调；自动上调需要同一通道足够多的确认样本。重启或在配置里调低，都不会自动降低已经保存的阈值。人物列表默认分页列出有名字的人，也可以查看没有名字的人或全部人物；列表会给出下一页的位置，以及声纹模型与当前模型已不匹配的人物条目数。
• 说话偏好。 依米的说话偏好可以在语气、表达和习惯三类选项里选择，总长不超过 1500 字符，可以恢复上一版。偏好改变不了她的身份，也改不了受保护的规则。
• 主动关怀与存储。 如果没有在线的终端，通知交付也不可用，主动关怀的结果会等有终端连上后再尝试送达；同一服务运行期间，同一段离线等待只记一次这类错误。存储信息里新增热数据积压、最早记录和归档进度。配置冷存储后，可归档的不可变文件满足以下条件时，会清理本地热副本：超过热保留期限、云端副本核验通过、没有活动会话或待接收原件占用。SQLite 和可变登记数据不在清理范围内。清理也不再因为冷历史变大而要等一次完整遍历。

升级与部署前请注意

• 先重建镜像，再跑迁移。 用新源码重新构建服务镜像，并执行现有的发布迁移入口；标准切换流程会在启动业务服务之前跑迁移。不要让旧容器直接读取新配置。Hermes 要按新的 producer.lock.json 和补丁重新构建，已有的本地重建目录不能代替这套新组合。模型设置和桌面任务队列新增的表与列，会在对应存储打开时自动创建或升级。

• 检查发送许可的迁移结果。 既有安装要执行正式的 migrate；走标准切换流程的，这一步已经包含在内。迁移会把能无歧义识别的旧发送许可加入新的许可空间，旧记录原样保留，旧许可文件也不会删除。分不清文本还是附件的旧通用发送许可，以及收件人不明确的许可，会留在迁移返回的 send_consents 未迁移清单里。请检查这份清单，并重新确认其中的许可。

• 核对时区。 部署时区依次从 PAIOS_TIME_ZONE、产品配置里的 time_zone、宿主机时区解析，然后固定下来；日历、关怀、付款的日界和快照计划，都按这同一个 IANA 时区工作。运行配置模板里原来写死的时区默认值已经去掉，改由部署配置传入。重新渲染部署配置时，请核对 PAIOS_TIME_ZONE 或产品配置里的 time_zone，并使用渲染出来的快照定时器，以免容器里的 UTC 决定业务上的日界。

• 按需补齐通话分类的后备链。 既有安装如果想给通话分类补上后备链，先把下面的占位参数换成自己的值，不加 --apply 运行一次，查看计划：

  node deploy/cloud/model-settings-call-intent.ts --directory '<authority-dir>' --master '<master-file>' --environment '<environment>' --profile '<profile>' --expected-revision '<revision>' --principal-id '<principal>'

  确认模型配置空闲、修订号一致后，加上 --apply 再运行一次，然后等运行中的服务确认启用。命令只补空着的链，通话分类自己的输出和采样参数不变；如果已有内容不同的自定义链，它会拒绝覆盖。

• 历史隔离是可选操作，用前先升级所有客户端。 历史隔离是一项需要明确选择的管理操作，普通升级不要求清空历史。它在停止写入、完成迁移之后执行，支持隔离历史、核验保留项、回滚和到期清理；保留期从隔离完成起算七天；未完成的隔离或恢复不设恢复期限，真正执行需要显式的操作参数。启用前请配置隔离边界，并确认保留期和到期清理入口。隔离和回滚都会更换服务端的历史代次，客户端通过只读接口读到新代次后，清理旧缓存。所以使用前要把手机、手表、Mac 和眼镜一起升级；旧客户端会继续保留旧的本地历史。新客户端只在收到可信的新代次后清理：

  • 手机：清空本地的操作、位置和移动历史以及对话状态，删除旧对话、终端记录和临时语音文件，并阻止迟到的异步写入把旧历史写回来；与它共用代码的 Mac 聊天缓存也一样。
  • 手表：清空待处理的操作、回执去重记录和最近的回执显示。
  • Mac：依次清理命令记录、临时传输、撤销目录和会话显示，并重新开始消息预览的游标。
  • 眼镜：停掉旧语音，删除临时语音文件，清空卡片和工作计数，并保存新的代次。

• 本地模型（可选）。 要用本地模型目录，请在模型设置的配置里填写 local_catalog_file，并预先放好可读的模型文件，写明绝对路径和受信摘要；目录不会下载或安装模型。换了本地语音识别、活动检测、唤醒词或声纹模型后，要重启服务；新引擎成功打开并确认对应代次后，才算真正切换。换声纹模型后，要为用到的每个采集通道重新录入并校准；在此之前，不能把旧模型的付款核验能力当成新模型已经具备。本地向量模型需要自备固定的模型文件，以及装好 torch、transformers、Pillow 和 safetensors 的 Python 环境；切换时要等派生索引重建完成。

• 会议助手（可选）。 会议包是可选能力，默认部署配置里没有启用，要通过现有的能力包选择机制打开。启用前请配置平台端口和内部服务凭据，并准备一台在线的 Mac 执行端和一副在线的眼镜；这台 Mac 执行端要实现上述 Keynote 读写和编辑结果核查协议。本版所附的 Mac 源码尚未提供这些动作。

• 保留手机能力包的运行绑定。 手机能力包使用部署时提供的执行器、付款和凭据文件绑定；镜像里自带的提示和应用资料路径，与可写的任务状态路径是分开的。升级时请保留这些绑定。

• 独立构建服务。 部署了独立构建服务的，请对照新的 deploy/cloud/workshop-build.env.example 补齐五个必填变量：投影目录、设置服务地址、日志服务地址、发布队列和源码仓库。两个服务地址彼此独立，都不带路径。只读挂载的投影里必须有 current.json，共享服务凭据的职责要与示例里的说明一致。

• 开发与测试。 如果开发副本要在 Integration 里本地做类型检查，请按更新后的包锁重新安装依赖；检查器能启动，不代表现有的类型诊断已经全部消除。桌面模拟器的 PDF 用例需要先装 pdftotext：Linux 装 poppler-utils，macOS 装 poppler。

• 仍需在自己的环境里验证。 通话、设备权限、外部执行和恢复，仍需要在你自己的主机和设备上验证。

感谢贡献者

• 感谢 Chirag Jangir（@chiragjangiir）贡献 #15：补全独立构建服务的环境示例，对应 #12。
• 感谢 Pralav Singh（@pralav-25）贡献 #16：让 Integration 自带固定版本的 TypeScript 和 Node 类型，用包内编译器做类型检查，对应 #1。

修复的问题

• #1：Integration 自带固定版本的 TypeScript 和 Node 类型，用包内编译器做类型检查，严格检查保持不变（#16）。
• #2：活动标题的第一个词超出长度预算时，保留看得见的字符前缀并加省略号，组合字符不会被拆开。
• #3：模拟终端（mac-product-sim-client.ts）遇到 --help 或 -h 时输出用法并以 0 退出；缺少必需参数时输出错误并以 2 退出。这些检查都在读取配对文件和访问网络之前完成。
• #6：测试夹具启动前，先把文件 URL 解码成文件系统路径；工作目录含空格时，不会再把 %20 当成实际文件名。
• #7：补充两类时区边界测试：Lord Howe 一天 23.5 小时和 24.5 小时的夏令时日，以及 Kathmandu 的四分之一小时时区。日历的运行实现没有改动。
• #11：桌面模拟器提取 PDF 时，按调用方指定的页序逐页读取；不指定页码时读全文，超过 max_chars 时停止；页码越界返回 GUARD_TYPE_UNSUPPORTED。
• #12：独立构建服务的环境示例补齐五个必填变量、两个不带路径的独立服务地址，以及共享凭据的职责说明（#15）。

---

Yimi · Personal AI OS 0.1.5

Everyone should have their own Yimi: a personal assistant who knows you, lives on your own server, uses the models you choose, and uses your data and devices within your authorization.

In this release, Yimi can switch to local models that the deployer supplies, and gains optional meeting-assistant server capabilities and a Keynote editing protocol. Send consent is now tied to a specific recipient and message category. An operation with an unknown outcome is first checked against the original operation and is never redone automatically.

From this release on, version numbers follow the project's own release sequence, so 0.1.5 comes directly after 0.0.2.

What changed

• Local model catalog. Model settings gain a local model catalog that lists each model's name, whether it is installed, whether it can be switched and under what conditions, with up to 8 entries per page. Speech recognition, voice activity detection, voiceprint, wake-word and embedding models can all be switched through a signed request; you can also switch back to the retained previous model or reselect the model currently in effect. The settings page shows the selected version, the effective version, the previous version, switching progress and errors. A newly selected speech model loads only after a service restart. The deployer supplies model files; see below.
• Switching rules per model type. Changing the voiceprint model prompts for re-enrollment and calibration; until the new version is actually in effect, the settings page marks the payment voiceprint as pending update. Face models appear in the catalog but cannot be switched here; use the face-enrollment flow. Changing the wake-word model does not change the existing regular wake word or call-interrupt words: if the incoming model lacks the call-interrupt words or changes them, the switch is refused. Changing the embedding model first builds a new index space and reports progress, and switches only once the build is complete.
• Model configuration, keys and costs. After a model configuration change or key rotation, until activation is confirmed, the service keeps the keys needed by every configuration version that is or may be active. It re-confirms after a restart, so old keys are not cleaned up before the switch is confirmed. Cost estimates can distinguish whether cache writes are billed as regular input or separately; costs stay marked unknown when usage or prices are missing.
• Ordered fallbacks for call classification. If the brain already has ordered fallback routes but the fallback chain of call classification (call.intent) is empty, a new command can give that chain to call classification; see below for usage. Call classification keeps its own output and sampling parameters.
• Meeting assistant (local Keynote). New meeting server orchestration and a Keynote editing protocol let an executor read the current slide of a specified local Keynote presentation and its text, locate the area under discussion, generate an edit preview, apply the edit and query the result of the original operation. Actual reads and writes require a Mac executor that implements this protocol; the included Mac source does not yet provide one. Selecting a meeting binds an existing file authorization, the exact Mac and one pair of online glasses; if the file or devices do not match, the meeting does not start. Media captured during the meeting is used only for that meeting; late media, or media belonging to a meeting that has ended, also stays out of everyday people and mood records. The meeting assistant is an optional capability package and is off by default; see below.
• Locating and editing in a meeting. Once a matching Mac executor is connected, it combines what is said in the meeting, the glasses view and the slides to locate the single matching text element; it can also query document structure by an explicit slide number. When a reference is ambiguous, the view is stale or factual grounding is missing, it waits for more input before locating. An edit plan may only replace text or append paragraphs, and every item is bound to its original slide, original text and preview; deletion, images, layout and sending are outside the plan. The first text edit needs your confirmation, which then opens a session grant of up to two hours for the same file, the same Mac and the allowed operation types; the grant expires when the session ends or the connection stays down. When an edit's outcome is unknown, the original operation is queried first and its target, plan and before-and-after text readback are checked; further edits are allowed only after that check is settled.
• Send consent keyed to recipient and message category. Consent for outbound sending is now keyed to "resolved specific recipient + message category", with categories such as text, file, add reaction and remove reaction. A WeChat recipient must match exactly one contact; if a name match is ambiguous or finds nothing, nothing is sent. The recipient and category come from the capability package's declaration and the authenticated call preparation; an effect or task type passed in by a messaging tool cannot pick a different historical consent on its own. See below for how old consents migrate.
• Unknown outcome: check before continuing. When an operation that needs confirmation resumes after an interruption, the original execution record is checked first; a call that was claimed but has no result returns pending-check information and is not executed again automatically. A write with an unknown outcome can be retried only after check evidence bound to the original operation and target is obtained; an operation that already succeeded and does not allow retries is never repeated. When a phone task meets a payment record whose source cannot be verified, it asks for the original order to be checked and continues only after the result is bound to the original task; a quarantined record that explicitly carries no payment intent does not block ordinary tasks.
• Reporting results. When reporting results, duplicate facts merge into one and lists collapse into count summaries; at most 12 items are shown at a time, each up to 160 characters, and you can ask for the rest. Screenshots, audio, resources and legacy attachment markers returned by computer and desktop capabilities are kept when converted into receipts, so screenshot content and coordinates can be read later.
• Chat history. Phone chat history now loads lazily: the latest 150 rows by default, expanding 100 rows further back at a time, and older records are requested only after all loaded rows are shown. Very long messages show only their beginning in chat and in the home preview, up to 2000 characters or 40 line breaks; the full text can be opened in chat. Reading position is kept while browsing older history; scrolling is detected from the system's native scroll gesture, so the system swipe-back still works. When you are at the latest message and the keyboard appears or the visible area or message heights change, the chat re-aligns to the latest message, which fixes blank gaps in history. After the server performs history isolation, each client clears its old local history once it receives a trusted new history epoch; see below.
• Activity cards. Activity cards replay by persisted, increasing versions. After a service restart, cards still pending are closed out from the execution records, and progress shows the actual work items. An activity card whose original request or reply cannot be found is inserted into the chat at the server's start time instead of being piled after the latest message.
• Calls. The speaking indicator lights only when audio actually being played exceeds the noise threshold and goes off after 0.8 seconds of continuous silence, reducing flicker during pauses. Unverified or unrecognized voices in a call keep their original attribution; they are not treated as verified requests just because a paired user started the call.
• Mac unpairing. You can unpair even while offline; the interface shows that this Mac is unpaired and the server is pending sync.
• Glasses. In companion mode, the glasses' idle screen shows a two-line short reply of up to 48 characters; the speaking indicator follows actual speech playback and fades out after display. The glasses use the same authorized AI-generated fictional default portrait as the other clients; in the public source, the companion reply screen's face file is replaced by a neutral vector placeholder. After a payment prompt expires, the glasses re-evaluate whether the microphone is still needed and cancel any payment voice capture still waiting to be sent. On reconnect or startup, the glasses receive a mobility-state snapshot indicating idle, which clears old ride and navigation displays so a finished route is no longer shown.
• Voiceprints and people list. Voiceprint verification stores thresholds per capture channel, and thresholds rise gradually; automatic increases need enough confirmed samples from the same channel. Restarting or lowering the configured value never automatically lowers a saved threshold. The people list pages through named people by default and can also show unnamed people or everyone; it gives the next-page position and the number of entries whose voiceprint model no longer matches the current one.
• Speaking preferences. Yimi's speaking preferences can be chosen from three groups of options, tone, expression and habits, up to 1500 characters in total, and the previous version can be restored. Preferences cannot change her identity or protected rules.
• Proactive care and storage. When no client is online and notification delivery is unavailable, proactive-care results wait until a client connects and then attempt delivery; within one service run, one offline wait logs this error only once. Storage info adds hot-data backlog, oldest record and archive progress. With cold storage configured, the local hot copy of an archivable immutable file is cleaned up once it is past the hot retention period, its cloud copy has passed verification and no active session or pending original holds it. SQLite and mutable registry data are excluded. Cleanup no longer waits for a full traversal as cold history grows.

Before you upgrade

• Rebuild images, then run migrations. Rebuild the service images from the new source and run the existing release migration entry point; the standard cutover flow runs migrations before starting business services. Do not let old containers read the new configuration directly. Rebuild Hermes from the new producer.lock.json and patches; an existing local rebuild directory cannot stand in for this new combination. New tables and columns for model settings and the desktop task queue are created or upgraded automatically when their stores open.

• Review the send-consent migration. Existing installations must run the official migrate; the standard cutover flow already includes it. The migration adds unambiguously identifiable old send consents to the new consent space, keeps the old records unchanged and does not delete old consent files. Old generic send consents that cannot tell text from attachments, and consents with unclear recipients, stay in the send_consents unmigrated list returned by the migration. Review that list and re-confirm those consents.

• Check the time zone. The deployment time zone is resolved, in order, from PAIOS_TIME_ZONE, time_zone in the product configuration and the host time zone, and is then fixed; calendar, care, payment day boundaries and snapshot schedules all use that one IANA time zone. The previously fixed time-zone default in the runtime configuration template is removed; the deployment configuration now passes it in. When re-rendering the deployment configuration, check PAIOS_TIME_ZONE or time_zone in the product configuration, and use the rendered snapshot timer, so UTC inside the container does not decide business day boundaries.

• Fill the call-classification fallback chain if needed. Existing installations that want a fallback chain for call classification should first replace the placeholder arguments below with their own values and run the command without --apply to review the plan:

  node deploy/cloud/model-settings-call-intent.ts --directory '<authority-dir>' --master '<master-file>' --environment '<environment>' --profile '<profile>' --expected-revision '<revision>' --principal-id '<principal>'

  When model settings are idle and the revision matches, run it again with --apply, then wait for the running service to confirm activation. The command only fills an empty chain and leaves call classification's own output and sampling parameters unchanged; it refuses to overwrite an existing custom chain with different contents.

• History isolation is optional; upgrade all clients first. History isolation is an explicit opt-in admin operation; a normal upgrade does not require clearing history. It runs after writes are stopped and migration is complete, and supports isolating history, verifying retained items, rollback and expiry cleanup; the seven-day retention period starts when quarantine completes; unfinished quarantine or restore has no recovery deadline, and actual execution requires explicit operation arguments. Before enabling it, configure the isolation boundary and confirm the retention period and the expiry-cleanup entry point. Both isolation and rollback change the server's history epoch; clients read the new epoch through a read-only interface and then clear old caches. So upgrade the phone, watch, Mac and glasses together before using it; old clients keep their old local history. New clients clean up only after receiving a trusted new epoch:

  • Phone: clears local operation, location and mobility history and conversation state, deletes old conversations, client records and temporary voice files, and blocks late asynchronous writes from restoring old history; the Mac chat cache that shares its code does the same.
  • Watch: clears pending operations, receipt deduplication records and the recent receipt display.
  • Mac: clears command records, temporary transfers, the undo directory and session display in that order, and restarts the message-preview cursor.
  • Glasses: stops old speech, deletes temporary voice files, clears cards and work counts, and saves the new epoch.

• Local models (optional). To use the local model catalog, set local_catalog_file in the model-settings configuration and place readable model files in advance, with absolute paths and trusted digests; the catalog does not download or install models. After changing the local speech recognition, activity detection, wake-word or voiceprint model, restart the service; the switch is complete only after the new engine opens successfully and confirms the corresponding epoch. After changing the voiceprint model, re-enroll and calibrate every capture channel in use; until then, do not treat the old model's payment verification as available on the new model. A local embedding model needs its own pinned model files and a Python environment with torch, transformers, Pillow and safetensors installed; switching waits until derived indexes are rebuilt.

• Meeting assistant (optional). The meeting package is optional, is not enabled in the default deployment configuration, and is turned on through the existing capability-package selection mechanism. Before enabling it, configure the platform port and internal service credentials, and prepare an online Mac executor that implements the Keynote read/write and edit-result check protocol described above, plus one pair of online glasses; the included Mac source does not yet provide these actions.

• Keep the phone package's runtime bindings. The phone capability package uses executor, payment and credential file bindings provided at deployment; hint and app-profile paths bundled in the image are separate from the writable task-state path. Keep these bindings when upgrading.

• Standalone build service. If you deploy the standalone build service, use the new deploy/cloud/workshop-build.env.example to fill in the five required variables: projection directory, settings service URL, log service URL, publish queue and source repository. The two service URLs are independent and carry no path. The read-only mounted projection must contain current.json, and the role of the shared service credential must match the description in the example.

• Development and testing. Development copies that type-check Integration locally should reinstall dependencies from the updated package lock; the checker starting does not mean existing type diagnostics are all resolved. The desktop simulator's PDF tests need pdftotext: install poppler-utils on Linux or poppler on macOS.

• Still to verify in your environment. Calls, device permissions, external execution and recovery still need verifying on your own host and devices.

Thanks

• Thank you, Chirag Jangir (@chiragjangiir), for #15, which completes the standalone build service's environment example and addresses #12.
• Thank you, Pralav Singh (@pralav-25), for #16, which makes Integration ship pinned TypeScript and Node types and type-check with the package's own compiler, addressing #1.

Fixed issues

• #1: Integration ships pinned TypeScript and Node types and type-checks with the package's own compiler; strict checking is unchanged (#16).
• #2: When the first word of an activity title exceeds the length budget, a visible character prefix and an ellipsis are kept, and combining characters are not split.
• #3: The simulated client (mac-product-sim-client.ts) prints usage and exits 0 on --help or -h; it prints an error and exits 2 when a required argument is missing. These checks run before the pairing file is read or the network is accessed.
• #6: Test fixtures decode file URLs to file-system paths before starting, so %20 is no longer taken as a literal file name when the working directory contains spaces.
• #7: Adds two kinds of time-zone boundary tests: Lord Howe's 23.5-hour and 24.5-hour DST days, and Kathmandu's quarter-hour offset. The calendar's runtime implementation is unchanged.
• #11: PDF extraction in the desktop simulator reads page by page in the caller's page order; without page numbers it reads the whole document, stops once max_chars is exceeded, and returns GUARD_TYPE_UNSUPPORTED for out-of-range pages.
• #12: The standalone build service's environment example now covers the five required variables, two independent service URLs without paths, and the role of the shared credential (#15).