Adds defence-in-depth against npm-worm attacks (Shai-Hulud / mini-Shai-Hulud).
- run.sh: gates dev launch on `npm audit signatures` whenever package-lock.json
is newer than .lumotia-last-audit. Fails loud on signature mismatch. Skip
with LUMOTIA_SKIP_AUDIT=1 for offline dev.
- README: documents `npm ci --ignore-scripts` as the install discipline
(blocks the postinstall vector worms exploit) and explains the audit hook.
- .gitignore: excludes the per-clone audit stamp.
Lumotia's current tree (192 packages) cross-references clean against the
mini-Shai-Hulud affected-package list — this is preventive, not remedial.
The 2026-05-12 engine-slop pass removed runtime std::env::set_var mutation from src-tauri/src/lib.rs and replaced it with warn_if_x11_env_unset_on_wayland. With no launcher owning the contract, Linux Wayland dogfood was about to regress.
run.sh:
- now owns Linux launcher env defaults via case "$(uname -s)"
LIBCLANG_PATH=/usr/lib64/llvm21/lib64 (user-set wins)
WEBKIT_DISABLE_DMABUF_RENDERER=1 (always on Linux; user-set wins)
GDK_BACKEND=x11, WINIT_UNIX_BACKEND=x11 (Wayland only; user-set wins)
- 60s Vite readiness timeout
- detects early Vite exit (kill -0 + wait) instead of hanging forever
- trap installed before wait so Ctrl-C cleans up
- args forwarded: ./run.sh --release etc.
- non-exec final Tauri launch preserved so cleanup trap fires
package.json:
- "dev:tauri": "./run.sh" — canonical discoverable dev command
Docs:
- README, dev-setup, architecture-map runtime + launcher pages updated with the new contract; canonical command is npm run dev:tauri (./run.sh as direct equivalent)
- dev-launcher-and-scripts.md replaces the incorrect "kills process group" claim with honest "kills the spawned npm process"
- dev-setup.md path /CORBEL-Projects/magnotia → /CORBEL-Projects/transcription-app
- gpu-tuning/plan.md gets a superseded note rather than rewriting the original rationale
- engine-slop-residuals.md gains Area F (packaged-binary launcher contract) with honest wrapper-vs-.desktop trade-off documented
Verification: bash -n run.sh; shellcheck clean; cargo check -p magnotia green; npm pkg get 'scripts.dev:tauri' returns "./run.sh"; stale-ref sweep clean across living docs.
PowerAssertion file-level doc previously claimed Linux logind and
Windows SetThreadExecutionState implementations in present tense.
Both are no-ops; the macOS path compiles but is unverified on
Apple Silicon (RB-08). Rewrite top doc to state present vs
planned posture and reference KNOWN-ISSUES.md.
Surfaced as tracked limitations:
- KI-01: macOS App Nap guard pending Apple Silicon verification
- KI-02: Linux power assertion is a no-op
- KI-03: Windows power assertion is a no-op
- KI-04: magnotia-cloud-providers crate not user-exposed in v0.1
(in-memory keystore needs OS keychain before any save-key UX)
README links to KNOWN-ISSUES.md from Status, Platform support
table, and Project documentation. Platform support table notes
adjusted per OS to reflect actual idle-inhibit posture.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
README LLM-formatting section now states four Qwen tiers (Qwen3.5 2B /
4B / 9B + Qwen3.6 27B) and the magnotia-llm crate row reflects the
four-tier registry. The whisper-ecosystem context doc gets the same
refresh and cites unsloth as the GGUF source.
Older roadmap and Phase-0 audit docs left untouched — they are dated
historical artefacts and rewriting them would muddy the audit trail.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace all instances of the legacy product names "Kon" and "Corbie" with
"Magnotia" across user-facing copy, code identifiers, package names, bundle
ids, file paths, and documentation. Preserves the unrelated "konsole" (KDE
terminal) reference and the parent CORBEL company name.
- Renames 10 Rust crates (kon-* → magnotia-*) and the tauri binary
- Updates package.json, tauri.conf.json (productName + identifier)
- Renames CSS classes (kon-rh-* → magnotia-rh-*) and animations
- Renames brand and roadmap docs
- Regenerates Cargo.lock and package-lock.json
Verified: svelte-check passes; pure-rust crates compile under new names.
2026-04-22 review MINORs and NITs:
- crates/core/src/providers.rs: delete entire module. SpeechToText /
TextProcessor / ProviderRegistry were forward-looking traits that
never got wired — the Transcriber trait in kon-transcription
(A.2 #13) has since superseded SpeechToText, and the Registry
pattern was redundant against LocalEngine. Keeping them as dead
public surface signalled future direction that is no longer
accurate.
- crates/core/src/types.rs: delete TranscriptMetadata. Forward-
looking struct with an unfulfilled TODO; storage has evolved
independently through v7/v8 migrations without adopting it.
- crates/ai-formatting/src/llm_client.rs: remove #[allow(dead_code)]
from CLEANUP_PROMPT and format_dictionary_suffix. Both are
actively called; the suppressions would hide future genuine
dead-code warnings in this regression-sensitive prompt file.
- src-tauri/src/commands/live.rs: remove #[allow(dead_code)] from
LiveStatusMessage. Every variant (Warning, Overload, Error,
Finished) is constructed in the module today.
- README.md: update kon-transcription row from "SpeechToText
trait" to "Transcriber trait" and mention the new streaming/
module.
Workspace test gate green (225 lib tests across all crates).
Previously the repo had no root README. Pitch + architecture + crate-level
breakdown + routes + runtime stack + roadmap all lived in dated HANDOVER
docs + docs/brief/ + memory. This pulls the canonical overview into the
single place a new contributor / investor / cursory browser will actually
land first.
Sections: design principles, what Kon does today (shipped capabilities),
architecture (3-layer: Rust workspace → Tauri commands → Svelte UI),
crate-by-crate responsibilities, Tauri command surface, frontend shape,
runtime stack with pinned versions, platform support matrix, build + dev
setup, testing, pointers into docs/, roadmap, contributing notes, licence
placeholder, contact.
All claims are grounded in current code state (136 tests, 9 crates, 18
Tauri command modules, Tauri 2.10.3, whisper-rs 0.16, llama-cpp-2
0.1.144, sqlx 0.8.6). No marketing puff; preserves the ideology-firm
stance from memory.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
