#134 - P0 release gate — prove Zara daemon can replace the core ChatGPT Voice workflow safely - nsaspy/zara

lost-rob0t commented

2026-08-21 23:42:36 +00:00

(Migrated from github.com)

Parent epic: #127
Depends on: #130, #131, #132, #133
Integrates with: #31 and existing Zara latency/soak benchmarks
Research: docs/research/001-daemon-zeromq-voice-service.md

Auto-RAGE blocker reconciliation — 2026-08-24

Iteration 2 research/adversarial review on draft PR #190 rejected realization at the current repository state. This preserves the release contract instead of manufacturing a false green.

Discovered blockers:

#132 has been reopened: its acceptance requires daemon clients to receive partial/final transcript events, but current RuntimeVoiceIngress discards speech-start/partial/speech-end events and converts the final transcript directly into SubmitTurn without a client-visible STT event contract.
#191 now owns the missing authenticated ZARA/1 tool lifecycle + explicit approval interaction required by item 12 below. It reuses existing runtime ApproveTool / RejectTool and tool/user-input events; it must not become the future #150 semantic/device capability plane.
The existing voice/provider release chain remains owned by #17 -> #28 -> #29 -> #30 -> #31. Epic #127/roadmap #1 say the daemon release work reuses those slices rather than reimplementing them here.

#134 remains the final proof/composition gate and PR #190 remains draft/unmerged. Standalone behavior remains retained. Re-enter #134 ADADR only after the owning blockers are resolved; do not weaken the matrices below or substitute synthetic transport events for missing production producer behavior.

Evidence: rage/134-daemon-release-research.org, rage/134-daemon-release-design.org, and the append-only rage/134-daemon-release-gate.org on PR #190.

Goal

Create the release matrix that decides whether the daemon/client architecture is actually good enough to become Zara's canonical interaction boundary and replace the core daily ChatGPT Voice workflow. This is a proof gate, not a demo checklist.

Minimum Voice-replacement contract

Prove one authenticated client can keep a long-lived conversation with:

persistent daemon session;
streamed microphone input;
fast speech start/end detection;
visible partial/final transcription;
multiple turns without reconnecting;
streamed assistant text;
phrase/audio output before the full response completes;
natural barge-in that immediately stops playback and cancels stale daemon work;
typed text and voice in the same durable conversation;
durable transcript/history across client restart;
principal-scoped long-term memory retrieval;
tools/search and explicit approval events during a voice session;
reconnect preserving durable conversation while honestly reporting lost/non-resumable in-flight work;
background daemon operation with no foreground chat window required;
multiple authenticated users without memory/event/audio leakage;
bounded failure behavior under slow/broken clients;
end-to-end latency targets integrated with existing Zara metrics.

This is feature-parity targeting from public Voice behavior, not a claim about ChatGPT/OpenAI internals.

Multi-user concurrency gate

At minimum exercise:

multiple simultaneous principals;
multiple sessions/devices for one principal where supported;
independent conversations and memories;
simultaneous text turns;
simultaneous voice streams;
tool approval for one user while another is active;
one slow/disconnected client while others continue normally;
no event, transcript, audio, memory, tool result, or conversation identifier delivered across principals.

Security gate

Mandatory cases:

unknown CURVE key;
revoked key;
wrong server pin;
spoofed owner/user fields;
unauthorized runtime/tool/admin command;
wildcard/public bind without secure configuration;
request replay/idempotency for side effects;
malformed multipart frames;
truncated/extra payload frames;
oversized JSON envelope;
oversized binary payload;
invalid UTF-8/JSON/schema;
unknown protocol major/message type;
sequence gap/duplicate/late audio;
resource/rate quota exhaustion;
reconnect storm;
slow-reader/slow-writer clients;
audit/log redaction of transcripts, audio, credentials, provider secrets and CURVE private keys.

Fuzz/property tests

Add deterministic protocol fuzz/property coverage around the parser/state machine without requiring live external providers:

arbitrary frame counts;
boundary-size fields and payloads;
invalid state transitions;
duplicate message IDs;
session/turn/stream correlation mismatches;
malformed content types;
cancellation races;
disconnect/reconnect between every important protocol state.

The parser must fail boundedly and must never dynamically deserialize Python objects or dispatch unknown types.

Voice/latency gate

Extend existing Zara voice benchmarks rather than creating unrelated numbers. Measure at least:

client speech start -> daemon speech-start recognition;
speech end -> final transcript;
final transcript -> first assistant text delta;
final transcript -> first playable TTS audio;
server audio chunk -> client playback start;
user interruption -> local playback stopped;
interruption -> stale daemon turn cancellation completed;
reconnect -> usable session;
p50/p95/p99 where sample sizes are sufficient.

Use deterministic/fake providers for CI and optional real/local providers for benchmark runs. Keep transcript/audio out of structured latency metrics.

Soak and lifecycle gate

long-lived daemon session over many turns;
repeated connect/disconnect;
daemon restart and client recovery;
active-turn shutdown;
bounded memory/mailbox growth;
no orphan actor/tasks/sockets after clients leave;
no stale audio speaking after cancellation;
provider/tool failure does not kill unrelated principal sessions.

Comparison matrix

Document pass/fail for the practical Voice replacement surface:

Capability	Zara daemon target
Live voice conversation	required
Interruption/barge-in	required
Text visible alongside voice	required
Durable chat history	required
Memory	required, principal-scoped
Tools/search	required
Background operation	required
Reconnect	required
Multi-user	required and isolated
Image attachments	follow-up acceptable
Screen/visual context	follow-up via explicit Local Recall/context work
Live video/screen stream	later protocol extension; not v1 blocker

Migration decision

Only after this gate passes may normal zara default to daemon-client operation and/or standalone behavior be deprecated. If the gate exposes regressions, retain standalone and create focused blocker issues rather than weakening the gate.

Automation

Add one non-interactive top-level daemon release command/script that composes the protocol, auth, isolation, reconnect, voice, fuzz and soak fixtures, and include its deterministic subset in the full repository/Nix CI gate.

Acceptance

all required matrices are automated and green;
multi-user privacy has adversarial regression coverage;
voice interruption and latency are measured end-to-end across the process boundary;
malformed/hostile clients remain bounded;
there is a written evidence-based decision on whether daemon-client becomes the canonical default;
no parity claim is made for image/video/screen capabilities not actually implemented.

Parent epic: #127 Depends on: #130, #131, #132, #133 Integrates with: #31 and existing Zara latency/soak benchmarks Research: `docs/research/001-daemon-zeromq-voice-service.md` ## Auto-RAGE blocker reconciliation — 2026-08-24 Iteration 2 research/adversarial review on draft PR #190 **rejected realization at the current repository state**. This preserves the release contract instead of manufacturing a false green. Discovered blockers: - #132 has been reopened: its acceptance requires daemon clients to receive partial/final transcript events, but current `RuntimeVoiceIngress` discards speech-start/partial/speech-end events and converts the final transcript directly into `SubmitTurn` without a client-visible STT event contract. - #191 now owns the missing authenticated `ZARA/1` tool lifecycle + explicit approval interaction required by item 12 below. It reuses existing runtime `ApproveTool` / `RejectTool` and tool/user-input events; it must not become the future #150 semantic/device capability plane. - The existing voice/provider release chain remains owned by #17 -> #28 -> #29 -> #30 -> #31. Epic #127/roadmap #1 say the daemon release work reuses those slices rather than reimplementing them here. `#134` remains the final proof/composition gate and PR #190 remains draft/unmerged. Standalone behavior remains retained. Re-enter #134 ADADR only after the owning blockers are resolved; do not weaken the matrices below or substitute synthetic transport events for missing production producer behavior. Evidence: `rage/134-daemon-release-research.org`, `rage/134-daemon-release-design.org`, and the append-only `rage/134-daemon-release-gate.org` on PR #190. ## Goal Create the release matrix that decides whether the daemon/client architecture is actually good enough to become Zara's canonical interaction boundary and replace the core daily ChatGPT Voice workflow. This is a proof gate, not a demo checklist. ## Minimum Voice-replacement contract Prove one authenticated client can keep a long-lived conversation with: 1. persistent daemon session; 2. streamed microphone input; 3. fast speech start/end detection; 4. visible partial/final transcription; 5. multiple turns without reconnecting; 6. streamed assistant text; 7. phrase/audio output before the full response completes; 8. natural barge-in that immediately stops playback and cancels stale daemon work; 9. typed text and voice in the same durable conversation; 10. durable transcript/history across client restart; 11. principal-scoped long-term memory retrieval; 12. tools/search and explicit approval events during a voice session; 13. reconnect preserving durable conversation while honestly reporting lost/non-resumable in-flight work; 14. background daemon operation with no foreground chat window required; 15. multiple authenticated users without memory/event/audio leakage; 16. bounded failure behavior under slow/broken clients; 17. end-to-end latency targets integrated with existing Zara metrics. This is feature-parity targeting from public Voice behavior, not a claim about ChatGPT/OpenAI internals. ## Multi-user concurrency gate At minimum exercise: - multiple simultaneous principals; - multiple sessions/devices for one principal where supported; - independent conversations and memories; - simultaneous text turns; - simultaneous voice streams; - tool approval for one user while another is active; - one slow/disconnected client while others continue normally; - no event, transcript, audio, memory, tool result, or conversation identifier delivered across principals. ## Security gate Mandatory cases: - unknown CURVE key; - revoked key; - wrong server pin; - spoofed owner/user fields; - unauthorized runtime/tool/admin command; - wildcard/public bind without secure configuration; - request replay/idempotency for side effects; - malformed multipart frames; - truncated/extra payload frames; - oversized JSON envelope; - oversized binary payload; - invalid UTF-8/JSON/schema; - unknown protocol major/message type; - sequence gap/duplicate/late audio; - resource/rate quota exhaustion; - reconnect storm; - slow-reader/slow-writer clients; - audit/log redaction of transcripts, audio, credentials, provider secrets and CURVE private keys. ## Fuzz/property tests Add deterministic protocol fuzz/property coverage around the parser/state machine without requiring live external providers: - arbitrary frame counts; - boundary-size fields and payloads; - invalid state transitions; - duplicate message IDs; - session/turn/stream correlation mismatches; - malformed content types; - cancellation races; - disconnect/reconnect between every important protocol state. The parser must fail boundedly and must never dynamically deserialize Python objects or dispatch unknown types. ## Voice/latency gate Extend existing Zara voice benchmarks rather than creating unrelated numbers. Measure at least: - client speech start -> daemon speech-start recognition; - speech end -> final transcript; - final transcript -> first assistant text delta; - final transcript -> first playable TTS audio; - server audio chunk -> client playback start; - user interruption -> local playback stopped; - interruption -> stale daemon turn cancellation completed; - reconnect -> usable session; - p50/p95/p99 where sample sizes are sufficient. Use deterministic/fake providers for CI and optional real/local providers for benchmark runs. Keep transcript/audio out of structured latency metrics. ## Soak and lifecycle gate - long-lived daemon session over many turns; - repeated connect/disconnect; - daemon restart and client recovery; - active-turn shutdown; - bounded memory/mailbox growth; - no orphan actor/tasks/sockets after clients leave; - no stale audio speaking after cancellation; - provider/tool failure does not kill unrelated principal sessions. ## Comparison matrix Document pass/fail for the practical Voice replacement surface: | Capability | Zara daemon target | |---|---| | Live voice conversation | required | | Interruption/barge-in | required | | Text visible alongside voice | required | | Durable chat history | required | | Memory | required, principal-scoped | | Tools/search | required | | Background operation | required | | Reconnect | required | | Multi-user | required and isolated | | Image attachments | follow-up acceptable | | Screen/visual context | follow-up via explicit Local Recall/context work | | Live video/screen stream | later protocol extension; not v1 blocker | ## Migration decision Only after this gate passes may normal `zara` default to daemon-client operation and/or standalone behavior be deprecated. If the gate exposes regressions, retain standalone and create focused blocker issues rather than weakening the gate. ## Automation Add one non-interactive top-level daemon release command/script that composes the protocol, auth, isolation, reconnect, voice, fuzz and soak fixtures, and include its deterministic subset in the full repository/Nix CI gate. ## Acceptance - all required matrices are automated and green; - multi-user privacy has adversarial regression coverage; - voice interruption and latency are measured end-to-end across the process boundary; - malformed/hostile clients remain bounded; - there is a written evidence-based decision on whether daemon-client becomes the canonical default; - no parity claim is made for image/video/screen capabilities not actually implemented.

lost-rob0t commented

2026-08-24 03:13:28 +00:00

(Migrated from github.com)

RAGE consumption initialized on rage/134-daemon-release-gate from immutable master b9463faf4f69bcc92c0db16941ea27ae0c252327 (draft PR #190). Canonical ADADR control-plane discovery confirms Zara actively uses AGENTS.md + skills/rage/SKILL.md + append-only rage/, but there is still no durable repository selection of ADADR vs Auto-RAGE. Per the canonical ADADR skill, #134 is stopped before Analyze/design/TDD/implementation until that mode is explicitly selected and then persisted. No architecture or production behavior has been changed.

RAGE consumption initialized on `rage/134-daemon-release-gate` from immutable master `b9463faf4f69bcc92c0db16941ea27ae0c252327` (draft PR #190). Canonical ADADR control-plane discovery confirms Zara actively uses `AGENTS.md` + `skills/rage/SKILL.md` + append-only `rage/`, but there is still no durable repository selection of **ADADR** vs **Auto-RAGE**. Per the canonical ADADR skill, #134 is stopped before Analyze/design/TDD/implementation until that mode is explicitly selected and then persisted. No architecture or production behavior has been changed.

lost-rob0t commented

2026-08-24 16:33:23 +00:00

(Migrated from github.com)

Blocker reconciliation (2026-08-24): #191 is resolved. PR #213 merged the authenticated ZARA/1 tool lifecycle/approval boundary as 51356e3cee216c3fb7f51aae308463b7e8f15c55 after exact-head CI run 32748728581 passed the main test/flake/package job and both shared-mic jobs. Append-only RAGE outcome evidence landed through PR #214 as 8dc7448e3d130e1ad4600e27621e72d5cd772b53, with exact-head CI run 32750447665 also green.

This removes only the #191 blocker. #134 remains a rejected/deferred realization on draft PR #190 until its declared provider/voice release chain is complete; do not weaken the release matrices or treat this as authorization to merge #190.

Blocker reconciliation (2026-08-24): #191 is resolved. PR #213 merged the authenticated ZARA/1 tool lifecycle/approval boundary as `51356e3cee216c3fb7f51aae308463b7e8f15c55` after exact-head CI run `32748728581` passed the main test/flake/package job and both shared-mic jobs. Append-only RAGE outcome evidence landed through PR #214 as `8dc7448e3d130e1ad4600e27621e72d5cd772b53`, with exact-head CI run `32750447665` also green. This removes only the #191 blocker. #134 remains a rejected/deferred realization on draft PR #190 until its declared provider/voice release chain is complete; do not weaken the release matrices or treat this as authorization to merge #190.

nsaspy referenced this issue

2026-08-28 03:23:52 +00:00

P1 release gate — prove transcript normalization preserves intent, privacy and voice latency #215

nsaspy referenced this issue

2026-08-28 03:31:13 +00:00

docs: research Zara daemon and ZeroMQ voice service #135

nsaspy referenced this issue

2026-08-28 03:31:16 +00:00

RAGE #133: record merge closeout #189

nsaspy referenced this issue

2026-08-28 03:31:17 +00:00

RAGE #134: daemon release gate #190

nsaspy referenced this issue

2026-08-28 03:31:17 +00:00

RAGE #132: restore client-visible streaming STT events #192

nsaspy referenced this issue

2026-08-28 03:31:18 +00:00

RAGE #191: expose missing runtime approval prerequisite #210

nsaspy referenced this issue

2026-08-29 10:40:44 +00:00

[ORDER] ZARA-000 — Repository repair and real-time voice roadmap #1