Reliability hardening: fix F-001, F-002, silent recording retention, CI security

.github/workflows/ci-required.yml

@@ -0,0 +1,91 @@
+name: ci-required
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  ci-required:
+    name: ci-required
+    runs-on: windows-latest
+    timeout-minutes: 60
+    env:
+      CARGO_TERM_COLOR: always
+      GGML_NATIVE: "OFF"
+      GGML_AVX: "ON"
+      GGML_AVX2: "ON"
+      GGML_FMA: "ON"
+      GGML_F16C: "ON"
+
+    steps:
+      - name: Enable long paths
+        shell: pwsh
+        run: |
+          New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
+            -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force
+          git config --system core.longpaths true
+
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          workspaces: "./src-tauri -> target"
+          key: ci-required-windows
+
+      - name: Install Windows native dependencies
+        shell: pwsh
+        run: |
+          if (-not (Get-Command ninja -ErrorAction SilentlyContinue)) {
+            choco install ninja -y --no-progress
+          }
+
+      - name: Install Vulkan SDK
+        uses: humbletim/install-vulkan-sdk@v1.2
+        with:
+          version: 1.4.309.0
+          cache: true
+
+      - name: Configure Windows native build
+        shell: pwsh
+        run: |
+          $drive = Split-Path -Qualifier $env:GITHUB_WORKSPACE
+          $targetDir = "$drive\t"
+          New-Item -ItemType Directory -Force -Path $targetDir | Out-Null
+          "CARGO_TARGET_DIR=$targetDir" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "CMAKE_GENERATOR=Ninja" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "TrackFileAccess=false" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Lint frontend
+        run: bun run lint
+
+      - name: Check TypeScript
+        run: bun run check
+
+      - name: Compile frontend app
+        run: bun run build
+
+      - name: Check backend
+        shell: pwsh
+        run: powershell -NoProfile -ExecutionPolicy Bypass -File scripts/cargo-check-windows.ps1
+
+      - name: Test Rust library
+        shell: pwsh
+        run: powershell -NoProfile -ExecutionPolicy Bypass -File scripts/cargo-test-windows.ps1 --lib
+
+      - name: Check generated TypeScript bindings
+        run: bun run check:bindings

.github/workflows/native-backend.yml

@@ -2,12 +2,13 @@ name: "native backend"
 
 on:
   workflow_dispatch:
-  push:
-    branches: [main]
-    paths:
-      - "src-tauri/**"
-      - "scripts/cargo-*.ps1"
-      - ".github/workflows/native-backend.yml"
+  # Runs on PRs only: the pull_request event builds the test merge commit
+  # (PR head merged into main), so a passing PR already validated the native
+  # build against main. The ruleset has strict=false and this is a solo repo,
+  # so a post-merge rebuild on push:main is near-pure duplication of the most
+  # expensive job (macOS 10x + Windows 2x native whisper.cpp compile). Trimmed
+  # to cut Actions spend; direct pushes to main are only lint-gated by
+  # code-quality — open a PR to get native coverage.
   pull_request:
     paths:
       - "src-tauri/**"

.github/workflows/test.yml

@@ -1,10 +1,10 @@
 name: "test"
 on:
   workflow_dispatch:
-  push:
-    branches: [main]
-    paths:
-      - "src-tauri/**"
+  # PR-only: the pull_request event already runs these Rust tests against the
+  # test merge commit (PR head + main), so re-running on push:main duplicates
+  # work the PR just did (strict=false ruleset, solo repo => no base drift to
+  # catch). code-quality remains the required check gating main.
   pull_request:
     paths:
       - "src-tauri/**"

package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
+    "check": "tsc --noEmit",
     "build": "tsc && vite build",
     "preview": "vite preview",
     "tauri": "tauri",
@@ -34,6 +35,7 @@
     "check:public-hygiene": "bun scripts/check-public-hygiene.ts",
     "check:cargo-git-pins": "bun scripts/check-cargo-git-pins.ts",
     "check:branch-protection": "bun scripts/check-branch-protection.ts",
+    "check:bindings": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/check-bindings-windows.ps1",
     "check:rust-dependency-policy": "cargo deny --manifest-path src-tauri/Cargo.toml check",
     "check:tauri-security": "bun scripts/validate-tauri-security.ts",
     "check:model-benchmark-evidence": "bun scripts/check-model-benchmark-evidence.ts",

scripts/check-bindings-windows.ps1

@@ -0,0 +1,123 @@
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$manifestPath = Join-Path $repoRoot "src-tauri\Cargo.toml"
+$testManifestPath = Join-Path $repoRoot "src-tauri\windows\test-common-controls.manifest"
+$targetDir = if ($env:CARGO_TARGET_DIR) {
+  $env:CARGO_TARGET_DIR
+} else {
+  "C:\t\verbatim"
+}
+
+if (-not (Test-Path -LiteralPath $testManifestPath)) {
+  throw "Windows test manifest is missing: $testManifestPath"
+}
+
+New-Item -ItemType Directory -Force -Path $targetDir | Out-Null
+$env:CARGO_TARGET_DIR = $targetDir
+
+if (-not $env:TrackFileAccess) {
+  $env:TrackFileAccess = "false"
+}
+
+if (-not $env:CMAKE_GENERATOR) {
+  if (Get-Command ninja -ErrorAction SilentlyContinue) {
+    $env:CMAKE_GENERATOR = "Ninja"
+  } else {
+    throw "Ninja is required for Windows native builds. Install Ninja or put ninja.exe on PATH."
+  }
+}
+
+if ($env:CMAKE_GENERATOR -ne "Ninja") {
+  Write-Warning "CMAKE_GENERATOR=$env:CMAKE_GENERATOR; Verbatim's Windows native build is verified with Ninja."
+}
+
+Write-Host "Building ignored TypeScript bindings exporter"
+$cargoMessages = @(
+  & cargo test --manifest-path $manifestPath --test export_bindings --no-run --message-format=json
+)
+$cargoExitCode = $LASTEXITCODE
+
+if ($cargoExitCode -ne 0) {
+  foreach ($line in $cargoMessages) {
+    try {
+      $message = $line | ConvertFrom-Json
+      if ($message.reason -eq "compiler-message" -and $message.message.rendered) {
+        Write-Host $message.message.rendered.TrimEnd()
+      }
+    } catch {
+      Write-Host $line
+    }
+  }
+  exit $cargoExitCode
+}
+
+$exporterExecutables = @(
+  @(
+    foreach ($line in $cargoMessages) {
+      try {
+        $message = $line | ConvertFrom-Json
+      } catch {
+        continue
+      }
+
+      if (
+        $message.reason -eq "compiler-artifact" -and
+        $message.target.name -eq "export_bindings" -and
+        $message.executable
+      ) {
+        $message.executable
+      }
+    }
+  ) | Select-Object -Unique
+)
+
+if ($exporterExecutables.Count -ne 1) {
+  throw "Expected one bindings exporter executable, found $($exporterExecutables.Count)."
+}
+
+$manifestTool = Get-Command mt.exe -ErrorAction SilentlyContinue
+if ($null -eq $manifestTool) {
+  $windowsKitsRoot = Join-Path ([Environment]::GetFolderPath("ProgramFilesX86")) "Windows Kits\10\bin"
+  $manifestTool = @(
+    Get-ChildItem -LiteralPath $windowsKitsRoot -Directory -ErrorAction SilentlyContinue |
+      Sort-Object Name -Descending |
+      ForEach-Object {
+        $candidate = Join-Path $_.FullName "x64\mt.exe"
+        if (Test-Path -LiteralPath $candidate) {
+          $candidate
+        }
+      }
+  ) | Select-Object -First 1
+}
+
+if ($null -eq $manifestTool) {
+  throw "mt.exe is required to apply the Windows test manifest to the bindings exporter."
+}
+
+$manifestToolPath = if ($manifestTool -is [string]) {
+  $manifestTool
+} else {
+  $manifestTool.Source
+}
+$exporterExecutable = $exporterExecutables[0]
+
+Write-Host "Applying Windows test manifest to bindings exporter"
+& $manifestToolPath "-manifest" $testManifestPath "-outputresource:$exporterExecutable;#1"
+if ($LASTEXITCODE -ne 0) {
+  exit $LASTEXITCODE
+}
+
+Push-Location -LiteralPath (Join-Path $repoRoot "src-tauri")
+try {
+  & $exporterExecutable "--ignored"
+  if ($LASTEXITCODE -ne 0) {
+    exit $LASTEXITCODE
+  }
+} finally {
+  Pop-Location
+}
+
+& git -C $repoRoot diff --exit-code -- src/bindings.ts
+exit $LASTEXITCODE