Prepare v0.6.3 real ASR dictation release

README.md

@@ -6,14 +6,14 @@ Local-first Vietnamese/English speech-to-text PWA with private voice-model workf
 
 ## Current status
 
-The current implementation target is the v0.6.2 CDN/Xet CSP hotfix on package version `0.6.2`, superseding the v0.6.1 CSP hotfix without moving the v0.6.0 or v0.6.1 tags/assets. It preserves the v0.5.0 speech, enrollment, browser-training, profile, portability, privacy, security, and compatibility contracts while keeping the v0.6 task-first interface and fixing production model-download CSP for the explicit **Install model** action:
+The current implementation target is the v0.6.3 real-ASR production dictation hotfix on package version `0.6.3`, superseding the v0.6.2 CDN/Xet CSP hotfix without moving the v0.6.0, v0.6.1, or v0.6.2 tags/assets. It preserves the v0.5.0 enrollment, browser-training, profile, portability, privacy, security, and compatibility contracts while keeping the v0.6 task-first interface and publishing the worker-owned real ASR path verified by an opt-in production fake-microphone dictation smoke:
 
 - **Dictate** — install the required speech model, record, edit, copy, download, or clear local transcript text.
 - **Vocabulary** — create sets, enable/disable them, add words, and use Advanced only for steering and diagnostics.
 - **Models** — create a voice model, record prompts, train/check candidates, activate or roll back, import `.speechmodel`, export encrypted `.speechmodel`, and manage local model data.
 - **Settings menu** — Audio, Storage, Privacy, Keyboard shortcuts, Diagnostics, About, and install/update actions.
 
-v0.6.2 changes only deployment/release metadata around the Hugging Face CDN/Xet CSP redirect hotfix. It does not change UI, model-pack, profile, adapter, portable-bundle, storage, training, or privacy schemas.
+v0.6.3 changes the production dictation runtime path and release metadata only. Dictate now sends captured PCM to the ASR worker, which reads installed model files through model-manager storage, runs worker-owned ONNX encoder/predictor/joiner inference, decodes RNN-T output, and commits final transcript text. It does not change model-pack, profile, adapter, portable-bundle, vocabulary, training, import/export, or privacy schemas.
 
 Production ASR weights, private recordings, speech corpora, and personal profiles are intentionally not committed. The current VietASR catalog entry is a metadata-only external candidate; it is not yet advertised as a low-latency streaming model because its inspected encoder does not expose streaming cache tensors.
 
@@ -113,7 +113,7 @@ pnpm chromium-smoke
 PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/path/to/chrome pnpm chromium-smoke
 ```
 
-Release-validation coverage includes accessibility naming/section checks, keyboard focus through primary actions, rapid push-to-talk stress cycles, no fetch/XHR/websocket requests while push-to-talk is active, offline reload, model lifecycle inspection, screenshot-attachment visual regression checks, and diagnostics/support bundle schema checks. Shared CI timing is informational; hard latency gates require declared reference hardware.
+Release-validation coverage includes accessibility naming/section checks, keyboard focus through primary actions, rapid push-to-talk stress cycles, no fetch/XHR/websocket requests while push-to-talk is active, offline reload, model lifecycle inspection, screenshot-attachment visual regression checks, diagnostics/support bundle schema checks, and an opt-in deployed-app production dictation smoke. Shared CI timing is informational; hard latency gates require declared reference hardware.
 
 ## Documentation map
 
@@ -171,7 +171,7 @@ v0.6 documentation must keep the release-usability gate open until issue #255 ha
 
 ## Known limitations
 
-- v0.6.0/v0.6.1/v0.6.2 release-usability participant evidence remains open in issue #255. The v0.6.2 hotfix may be published as a CSP-only patch over the human-approved v0.6.0 release, but closing #255 still requires aggregate participant evidence or a separate explicit decision recorded in `docs/research/v0.6-release-usability-study.json`.
+- v0.6.0/v0.6.1/v0.6.2/v0.6.3 release-usability participant evidence remains open in issue #255. The v0.6.3 hotfix may be published as a production dictation patch over the human-approved v0.6.0 release, but closing #255 still requires aggregate participant evidence or a separate explicit decision recorded in `docs/research/v0.6-release-usability-study.json`.
 - v0.5.0 does not yet publish user-approved 30-speaker bilingual cohort evidence; do not claim production Personal Voice Model accuracy or quality gates pass until ADR 0004 is resolved.
 - v0.5.0 does not yet publish declared reference-hardware Personal Voice Model benchmark evidence; do not claim production memory, storage, latency, RTF, export/import, offline, or zero-network performance gates pass until ADR 0005 is resolved.
 - Synthetic fixtures, CI smoke tests, local diagnostics, semantic tests, and contract tests are regression evidence only.

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@speech/web",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "private": true,
   "description": "Installable local-first speech-to-text PWA shell.",
   "type": "module",

apps/web/src/app/PersonalModelsPanel.tsx

@@ -779,7 +779,7 @@ export function PersonalModelsPanel() {
       const result = await exportPortableSpeechModel({
         profileId: primarySummary.profile.id,
         exactBaseModel: portableExportBaseModel.exactBaseModel,
-        sourceAppVersion: '0.6.2',
+        sourceAppVersion: '0.6.3',
         mode: portableExport.encrypted ? 'encrypted' : 'unencrypted',
         timeoutMs: 60_000,
         ...(portableExport.encrypted ? { passphrase: portableExport.passphrase } : {}),

apps/web/src/app/about-screen.test.ts

@@ -13,9 +13,9 @@ const basePwa: PwaLifecycleSnapshot = {
 
 describe('about-screen helpers', () => {
   it('builds source, license, provenance, acknowledgements, and update state without marketing copy', () => {
-    const model = buildAboutScreenModel({ appVersion: '0.6.2', pwa: basePwa });
+    const model = buildAboutScreenModel({ appVersion: '0.6.3', pwa: basePwa });
 
-    expect(model.version).toBe('0.6.2');
+    expect(model.version).toBe('0.6.3');
     expect(model.sourceRepository).toEqual({
       label: 'WilsonLe/speech',
       href: speechSourceRepository,

docs/instructions/privacy-data.instructions.md

@@ -65,3 +65,4 @@ applyTo: 'apps/**,packages/**,model-packs/**,tools/**,training/**,MODEL_LICENSES
 - #258 release publication artifacts must remain aggregate and public: release notes, checklist placeholders, checksums, tag names, GitHub release URLs, Vercel deployment URLs, and validation command names are allowed, but do not include participant data, real transcripts/audio/vocabulary/profile/model artifacts, private storage paths, tokens, browser storage dumps, support bundles, screenshots, or #255 pass claims without consented aggregate evidence.
 
 - Patch-release artifacts for CSP/model-download fixes may include public origin names, tag names, checksums, deployment URLs, and validation command names only. Do not broaden network allowances beyond exact committed model origins or imply telemetry, analytics, participant evidence, audio/transcript/profile/model artifact publication, or closure of unrelated release-usability gates.
+- v0.6.3 production dictation release artifacts may record public release metadata, exact public model origins, validation command names, and aggregate pass/fail evidence only. Do not commit generated WAVs, browser profiles, model files, raw audio, raw transcripts, signed model URLs, support bundles, private vocabulary, profile artifacts, or participant data; keep the production dictation smoke opt-in and its failure attachments redacted.

docs/instructions/release-process.instructions.md

@@ -18,4 +18,4 @@ applyTo: 'package.json,apps/web/package.json,packages/*/package.json,docs/instru
 - #257 may record local release-candidate PWA update/offline/rollback evidence before publication, but hosted production deployment, GitHub release assets, checksums, tag publication, and production alias verification remain release issue #258 work unless they are explicitly performed and validated on the published URL.
 - #258 final release-prep artifacts must distinguish prepared-before-publication placeholders from completed tag/GitHub-release/checksum/Vercel evidence. Do not tag or publish until the release-prep PR is merged, required CI passes on clean `main`, and any hosted deployment evidence is recorded from the production URL; keep #255 open unless aggregate participant evidence or a separate explicit human close decision exists.
 
-- Patch releases such as v0.6.1 or v0.6.2 must not move earlier release tags/assets. Add patch-specific release notes/checklists, bump package metadata consistently, tag the corrected commit, publish new checksums/assets, verify production headers and the exact hotfix behavior. For model-download CSP hotfixes, verify both the manifest origin and any exact redirect origin under the production document policy; keep unrelated open gates such as #255 explicit.
+- Patch releases such as v0.6.1, v0.6.2, or v0.6.3 must not move earlier release tags/assets. Add patch-specific release notes/checklists, bump package metadata consistently, tag the corrected commit, publish new checksums/assets, verify production headers and the exact hotfix behavior. For model-download CSP hotfixes, verify both the manifest origin and any exact redirect origin under the production document policy. For production dictation hotfixes, run the opt-in deployed-app fake-microphone smoke on a fresh profile and record any stale service-worker update guidance separately; keep unrelated open gates such as #255 explicit.

docs/instructions/testing.instructions.md

@@ -45,3 +45,4 @@ Performance gates must be measured from audio timestamps and documented with bro
 - Keep `tests/static/test_v06_release_usability_study.py` green when changing release usability artifacts. The #255 artifact must preserve required final tasks, 90% completion gates, comprehension gates, no-hover and high-severity gates, privacy flags, zero participant evidence counts, and `mayCloseIssue255: false` until consented participant evidence or an explicit human release decision is recorded.
 
 - Patch-release validation must include a static artifact/version consistency test for the new release notes/checklist, unchanged base-release immutability, exact production header expectations, and open release gates. Keep package versions, app About/version tests, and current-state gates aligned with the patch version.
+- Keep `training/tests/test_v0_6_3_real_asr_dictation_release.py` green when changing v0.6.3 patch-release artifacts, package/app version metadata, production dictation smoke behavior, ASR worker storage/decoder wiring, or current-state release gates. It must preserve v0.6.0/v0.6.1/v0.6.2 immutability, #255 openness, opt-in deployed-app fake-microphone dictation verification, redacted install-vs-ASR diagnostics, and exact model-download CSP origins.

docs/planning/CURRENT_STATE.json

@@ -1,15 +1,16 @@
 {
   "schemaVersion": 1,
   "title": "Current state for wilsonle/speech",
-  "asOf": "2026-06-29",
-  "status": "v0.6.2 CDN/Xet CSP hotfix prepared for publication; #255 usability evidence remains open",
-  "packageVersion": "0.6.2",
-  "currentRelease": "v0.6.2-cdn-csp-hotfix",
+  "asOf": "2026-06-30",
+  "status": "v0.6.3 real ASR production dictation hotfix prepared for publication; #255 usability evidence remains open",
+  "packageVersion": "0.6.3",
+  "currentRelease": "v0.6.3-real-asr-dictation-hotfix",
   "lineage": [
     "v0.5.0-browser-personal-models",
     "v0.6.0-minimal-ui-ux",
     "v0.6.1-csp-hotfix",
-    "v0.6.2-cdn-csp-hotfix"
+    "v0.6.2-cdn-csp-hotfix",
+    "v0.6.3-real-asr-dictation-hotfix"
   ],
   "appIdea": "A local-first installable browser PWA for Vietnamese/English dictation, vocabulary steering, guided voice-model enrollment, browser-side personal-model training, encrypted portable voice-model import/export, offline use, and privacy-preserving diagnostics.",
   "informationArchitecture": {
@@ -28,7 +29,7 @@
     "legacyRoutesRedirected": true
   },
   "workflows": {
-    "dictate": "The default screen is Dictate. If the required speech model is missing, setup appears in place with install/verify/activate progress and model details disclosed. When ready, the user records by holding the microphone button or Space, edits transcript text locally, and uses the transcript menu for new/download/clear actions.",
+    "dictate": "The default screen is Dictate. If the required speech model is missing, setup appears in place with install/verify/activate progress and model details disclosed. When ready, the user records by holding the microphone button or Space; captured PCM is sent to the worker-owned ASR runtime, final transcript text is committed locally, and transcript menu actions handle new/download/clear.",
     "vocabulary": "Vocabulary uses a compact set list with search, on/off state, word counts, row menus, basic word editing, and a single Advanced disclosure for steering, category, prompt inclusion, pronunciation/diagnostic tokenization details, and expert controls.",
     "models": "Models uses a compact voice-model list with state-dependent actions, focused create/enroll/train/results/import/export routes, model detail accordions, blocker-first readiness, four-stage training progress, outcome-first candidate results, and dedicated storage/deletion routes.",
     "enrollment": "Enrollment is one prompt at a time with current voice condition, progress, one recording control, concise quality feedback, and Recording details for SNR, clipping, VAD, alignment, language, storage, and diagnostics.",
@@ -79,7 +80,7 @@
   },
   "capabilitiesPreserved": {
     "speech": [
-      "local Vietnamese/English/automatic/mixed-language streaming transcription",
+      "local Vietnamese/English/automatic/mixed-language dictation through worker-owned ASR over installed model graphs",
       "stable committed/provisional transcript rendering",
       "offline model-pack installation and atomic activation",
       "WebGPU inference with multithreaded WASM fallback where supported"
@@ -137,9 +138,10 @@
     "prototypeUsabilityBlocker": "docs/research/v0.6-prototype-usability-study.json",
     "releaseUsabilityBlocker": "docs/research/v0.6-release-usability-study.json",
     "updateOfflineRollback": "docs/planning/v0.6.0-update-offline-rollback-verification.json",
-    "releaseNotes": "docs/planning/v0.6.2-cdn-csp-hotfix-release-notes.json",
-    "releasePublicationChecklist": "docs/planning/v0.6.2-release-publication-checklist.json",
-    "issue255VerificationChecklist": "docs/planning/v0.6.0-issue-255-verification-checklist.json"
+    "releaseNotes": "docs/planning/v0.6.3-real-asr-dictation-release-notes.json",
+    "releasePublicationChecklist": "docs/planning/v0.6.3-release-publication-checklist.json",
+    "issue255VerificationChecklist": "docs/planning/v0.6.0-issue-255-verification-checklist.json",
+    "productionDictationSmoke": "apps/web/e2e/production-dictation.spec.ts"
   },
   "intentionalProductBoundaries": [
     "No production telemetry, account system, cloud sync, remote support collection, browser extension, native companion, new language/localization, model-quality claim, decorative marketing dashboard, gamification, or generic feature-card home screen was added.",
@@ -149,7 +151,7 @@
   "openReleaseGates": [
     "Issue #255 remains open for final moderated release-usability participant evidence or a separate explicit human release decision that updates the #255 artifact.",
     "Production accuracy/performance claims remain bounded by ADR 0004 and ADR 0005 until evidence exists.",
-    "Publication/deployment evidence is issue #314 work and must be completed on the tagged v0.6.2 hotfix release commit before closing #314."
+    "Publication/deployment evidence is issue #323 work and must be completed on the tagged v0.6.3 hotfix release commit before closing #323."
   ],
   "nextPlanningInstruction": "Plan only the user's next requested delta against this current state. Preserve #255, ADR 0004, and ADR 0005 evidence limitations unless the user provides the missing evidence or an explicit human decision. After the next delta completes, generate another cumulative successor snapshot.",
   "privacy": {
@@ -161,7 +163,8 @@
     "containsModelWeights": false
   },
   "intentionalBoundaries": [
-    "v0.6.2 is a CSP-only patch release over v0.6.1; it does not change UI, model, profile, adapter, portable-bundle, storage, training, or privacy schemas.",
-    "v0.6.0 and v0.6.1 release tags/assets remain immutable; v0.6.2 supersedes them only for the Hugging Face CDN/Xet CSP redirect fix."
+    "v0.6.3 is a real-ASR production dictation patch release over v0.6.2; it does not change model-pack, profile, adapter, portable-bundle, vocabulary, training, import/export, or privacy schemas.",
+    "v0.6.0, v0.6.1, and v0.6.2 release tags/assets remain immutable; v0.6.3 supersedes them for the worker-owned production dictation fix and opt-in deployed-app smoke evidence.",
+    "Production dictation smoke artifacts must remain opt-in, redacted, and free of committed WAVs, model files, browser profiles, raw audio, signed URLs, and transcript artifacts."
   ]
 }