@openparachute/vault 0.7.9-rc.6 → 0.7.9-rc.7

package/core/src/history.test.ts

@@ -227,3 +227,60 @@ describe("vault#524 history retention and blob integrity", () => {
     expect(await store.getNote(n.id)).toBeNull();
   });
 });
+
+describe("vault#743 whole-blob integrity", () => {
+  it("reads valid whole blobs including empty and multibyte text", async () => {
+    const empty = await store.createNote("placeholder");
+    await store.updateNote(empty.id, { content: "" });
+    await store.updateNote(empty.id, { content: "final" });
+    expect((await store.getNoteVersion(empty.id, 1))!.content).toBe("");
+
+    const multi = await store.createNote("é".repeat(1000));
+    await store.updateNote(multi.id, { content: "next" });
+    expect((await store.getNoteVersion(multi.id, 0))!.content).toBe("é".repeat(1000));
+
+    const plain = await store.createNote("whole body");
+    await store.updateNote(plain.id, { content: "updated" });
+    expect((await store.getNoteVersion(plain.id, 0))!.content).toBe("whole body");
+  });
+  it("rejects a corrupted whole blob on direct read", async () => {
+    const n = await store.createNote("original");
+    await store.updateNote(n.id, { content: "live" });
+    const hash = (await store.listNoteVersions(n.id))[0]!.content_hash;
+    db.prepare("UPDATE note_blobs SET content = ? WHERE hash = ?").run(
+      "tampered",
+      hash,
+    );
+    expect(() => history!.readBlobContent(db, hash!)).toThrow(
+      history!.HistoryDeltaOrphanError,
+    );
+  });
+  it("rejects a corrupted whole blob through version read", async () => {
+    const n = await store.createNote("original");
+    await store.updateNote(n.id, { content: "live" });
+    const hash = (await store.listNoteVersions(n.id))[0]!.content_hash;
+    db.prepare("UPDATE note_blobs SET content = ? WHERE hash = ?").run(
+      "tampered",
+      hash,
+    );
+    await expect(store.getNoteVersion(n.id, 0)).rejects.toMatchObject({
+      code: "HISTORY_UNRECOVERABLE",
+      reason: "delta_orphan",
+    });
+  });
+  it("rejects restoring a corrupted whole blob and leaves live note and history unchanged", async () => {
+    const n = await store.createNote("original");
+    await store.updateNote(n.id, { content: "live" });
+    const versionsBefore = await store.listNoteVersions(n.id);
+    const hash = versionsBefore[0]!.content_hash;
+    db.prepare("UPDATE note_blobs SET content = ? WHERE hash = ?").run(
+      "tampered",
+      hash,
+    );
+    await expect(store.restoreNoteVersion(n.id, 0, {})).rejects.toMatchObject({
+      code: "HISTORY_UNRECOVERABLE",
+    });
+    expect((await store.getNote(n.id))!.content).toBe("live");
+    expect(await store.listNoteVersions(n.id)).toEqual(versionsBefore);
+  });
+});

package/core/src/history.ts

@@ -438,8 +438,11 @@ interface BlobReadRow {
 function materialise(db: Database, hash: string, row: BlobReadRow): string | null {
   if (row.content === null)
     return null;
-  if (row.blob_encoding === null)
+  if (row.blob_encoding === null) {
+    if (hashContent(row.content) !== hash)
+      throw new HistoryDeltaOrphanError(hash, row.delta_of, "identity_mismatch");
     return row.content;
+  }
   if (row.blob_encoding !== "fossil-delta")
     throw new HistoryDeltaOrphanError(hash, row.delta_of, "unknown_encoding");
   const base = row.delta_of ? db.prepare("SELECT content, encoding FROM note_blobs WHERE hash = ?").get(row.delta_of) as {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.7.9-rc.6",
+  "version": "0.7.9-rc.7",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/attachment-tickets.test.ts

@@ -29,6 +29,7 @@ const { handleScopedMcp } = await import("./mcp-http.ts");
 const { getServerInstruction } = await import("./mcp-tools.ts");
 const { writeVaultConfig } = await import("./config.ts");
 const { getVaultStore } = await import("./vault-store.ts");
+const { clearScribeUrlCache } = await import("./scribe-discovery.ts");
 const {
   getSharedAttachmentTicketProvider,
   InProcessAttachmentTicketProvider,
@@ -275,33 +276,54 @@ describe("attachment tickets — upload lifecycle", () => {
   // exactly what a new box looks like. The upload must not come back looking
   // like an ordinary file: it carries a `failed` status and an actionable
   // reason, so the state is visible in the API and the admin SPA.
-  test("audio + auto-transcribe on + NO provider → attachment records the failure, not silence", async () => {
-    const vaultName = freshVault("tickets-no-provider");
-    const store = getVaultStore(vaultName);
-    const note = await store.createNote("# Voice memo\n", { path: "memo-noprov" });
-
-    const mint = await callTool(vaultName, "request-attachment-upload", {
-      note: note.id,
-      filename: "memo.webm",
-      size_bytes: 4,
-      // NO `transcribe: true` — this is the AUTO path, the one that used to
-      // silently do nothing.
-    });
-    const res = await routeReq(
-      new Request(mint.url, {
-        method: "PUT",
-        headers: { "content-type": "audio/webm" },
-        body: new Uint8Array([1, 2, 3, 4]),
-      }),
-    );
-    expect(res.status).toBe(201);
-    const attachment = (await res.json()) as any;
-    expect(attachment.metadata.transcribe_status).toBe("failed");
-    expect(attachment.metadata.transcribe_error).toMatch(/no transcription provider configured/i);
-    // The reason has to be actionable — naming both routes out of it.
-    expect(attachment.metadata.transcribe_error).toMatch(/TRANSCRIPTION_PROVIDER/);
-    expect(attachment.metadata.transcribe_error).toMatch(/SCRIBE_URL/);
-    expect(attachment.metadata.transcribe_origin).toBe("auto");
+  //
+  // Fixture: select the remote provider so the presence/absence of a local
+  // whisper-cpp install on the host cannot change the message. With no
+  // SCRIBE_URL configured, auto-transcribe is still unavailable and reports
+  // the same actionable no-provider error on every box.
+  test("audio + auto-transcribe on + scribe-http without URL → attachment records the failure, not silence", async () => {
+    const prevProvider = process.env.TRANSCRIPTION_PROVIDER;
+    const prevScribeUrl = process.env.SCRIBE_URL;
+    process.env.TRANSCRIPTION_PROVIDER = "scribe-http";
+    delete process.env.SCRIBE_URL;
+    clearScribeUrlCache();
+    try {
+      const vaultName = freshVault("tickets-no-provider");
+      const store = getVaultStore(vaultName);
+      const note = await store.createNote("# Voice memo\n", { path: "memo-noprov" });
+
+      const mint = await callTool(vaultName, "request-attachment-upload", {
+        note: note.id,
+        filename: "memo.webm",
+        size_bytes: 4,
+        // NO `transcribe: true` — this is the AUTO path, the one that used to
+        // silently do nothing.
+      });
+      const res = await routeReq(
+        new Request(mint.url, {
+          method: "PUT",
+          headers: { "content-type": "audio/webm" },
+          body: new Uint8Array([1, 2, 3, 4]),
+        }),
+      );
+      expect(res.status).toBe(201);
+      const attachment = (await res.json()) as any;
+      expect(attachment.metadata.transcribe_status).toBe("failed");
+      expect(attachment.metadata.transcribe_error).toMatch(/no transcription provider configured/i);
+      // The reason has to be actionable — naming both routes out of it.
+      expect(attachment.metadata.transcribe_error).toMatch(/TRANSCRIPTION_PROVIDER/);
+      expect(attachment.metadata.transcribe_error).toMatch(/SCRIBE_URL/);
+      expect(attachment.metadata.transcribe_origin).toBe("auto");
+      const unchanged = await store.getNote(note.id);
+      expect(unchanged!.content).toBe("# Voice memo\n");
+      expect((unchanged!.metadata as any)?.transcribe_stub).toBeUndefined();
+    } finally {
+      if (prevProvider === undefined) delete process.env.TRANSCRIPTION_PROVIDER;
+      else process.env.TRANSCRIPTION_PROVIDER = prevProvider;
+      if (prevScribeUrl === undefined) delete process.env.SCRIBE_URL;
+      else process.env.SCRIBE_URL = prevScribeUrl;
+      clearScribeUrlCache();
+    }
   });
 
   // The counter-case: turning auto-transcribe OFF must stay silent. The

package/src/auto-transcribe-integration.test.ts

@@ -0,0 +1,82 @@
+import { test, expect } from "bun:test";
+import { writeVaultConfig } from "./config.ts";
+import { getVaultStore, defaultHookRegistry } from "./vault-store.ts";
+import { handleNotes } from "./routes.ts";
+import { handleScopedMcp } from "./mcp-http.ts";
+import { route } from "./routing.ts";
+import { registerTranscriptionHook } from "./transcription-worker.ts";
+import { getTranscriptionWorker, getTranscriptionWorkerProvider, setTranscriptionWorker } from "./transcription-registry.ts";
+
+// Fake the wired worker, not module imports or real ASR. Exercise both upload
+// doors and the actual attachment-created hook without network/subprocess work.
+for (const door of ["rest", "ticket"] as const) {
+  for (const mode of ["local", "remote", "missing", "mismatch", "unready", "disabled", "explicit", "non-audio"] as const) {
+    test(`${door}: ${mode} automatic worker eligibility`, async () => {
+      const previous = { provider: process.env.TRANSCRIPTION_PROVIDER, url: process.env.SCRIBE_URL, model: process.env.TRANSCRIPTION_MODEL, assets: process.env.ASSETS_DIR };
+      const oldWorker = getTranscriptionWorker();
+      const oldProvider = getTranscriptionWorkerProvider();
+      const vault = `auto-worker-${crypto.randomUUID()}`;
+      const kicks: string[] = [];
+      const worker = { stop: async () => {}, tick: async () => 0,
+        kick: async (_vault: string, attachment: { id: string }) => { kicks.push(attachment.id); } };
+      writeVaultConfig({ name: vault, api_keys: [], created_at: new Date().toISOString(),
+        auto_transcribe: { enabled: mode !== "disabled" && mode !== "explicit" } });
+      const store = getVaultStore(vault);
+      const unregister = registerTranscriptionHook(defaultHookRegistry, worker, (s) => s === store ? vault : undefined);
+      try {
+        // Sibling files may set a process-global storage root. These uploads
+        // belong only to this unique vault, not that shared test directory.
+        delete process.env.ASSETS_DIR;
+        process.env.TRANSCRIPTION_PROVIDER = mode === "remote" ? "scribe-http" : mode === "unready" ? "whisper-cpp" : "transcribe-cpp";
+        // A stale URL must never make an absent/mismatched local worker ready.
+        if (mode === "local") delete process.env.SCRIBE_URL;
+        else process.env.SCRIBE_URL = "http://unused.invalid";
+        if (mode === "unready") process.env.TRANSCRIPTION_MODEL = "not-a-real-model";
+        setTranscriptionWorker(mode === "missing" ? null : worker,
+          mode === "mismatch" ? "scribe-http" : process.env.TRANSCRIPTION_PROVIDER);
+        const note = await store.createNote("original body", { path: "memo" });
+        const mime = mode === "non-audio" ? "image/png" : "audio/wav";
+        let response: Response;
+        if (door === "rest") {
+          response = await handleNotes(new Request(`http://localhost/notes/${note.id}/attachments`, {
+            method: "POST", headers: { "content-type": "application/json" },
+            body: JSON.stringify({ path: "memos/audio.wav", mimeType: mime,
+              ...(mode === "explicit" ? { transcribe: true } : {}) }),
+          }), store, `/${note.id}/attachments`, vault);
+        } else {
+          const mint = await handleScopedMcp(new Request(`http://localhost/vault/${vault}/mcp`, {
+            method: "POST", headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: {
+              name: "request-attachment-upload", arguments: { note: note.id, filename: "memo.wav", size_bytes: 4,
+                mime_type: mime, ...(mode === "explicit" ? { transcribe: true } : {}) },
+            } }),
+          }), vault, { permission: "full", scopes: ["vault:read", "vault:write"], legacyDerived: false, scoped_tags: null } as any);
+          const rpc = await mint.json() as any;
+          expect(rpc.error).toBeUndefined();
+          const ticket = JSON.parse(rpc.result.content[0].text);
+          const req = new Request(ticket.url, { method: "PUT", headers: { "content-type": mime }, body: new Uint8Array([1, 2, 3, 4]) });
+          response = await route(req, new URL(req.url).pathname);
+        }
+        expect(response.status).toBe(201);
+        const attachment = await response.json() as any;
+        await defaultHookRegistry.drain();
+        const eligible = ["local", "remote", "explicit"].includes(mode);
+        const unavailable = ["missing", "mismatch", "unready"].includes(mode);
+        expect(attachment.metadata?.transcribe_status).toBe(eligible ? "pending" : unavailable ? "failed" : undefined);
+        expect(kicks).toEqual(eligible ? [attachment.id] : []);
+        if (unavailable) expect(attachment.metadata.transcribe_error).toContain("transcription status");
+        if (eligible || unavailable) expect(attachment.metadata.transcribe_origin).toBe(mode === "explicit" ? "legacy" : "auto");
+        const current = await store.getNote(note.id);
+        expect(current!.content).toBe("original body");
+        if (mode !== "explicit") expect((current!.metadata as any)?.transcribe_stub).toBeUndefined();
+      } finally {
+        await defaultHookRegistry.drain();
+        unregister();
+        setTranscriptionWorker(oldWorker, oldProvider);
+        for (const [key, value] of [["TRANSCRIPTION_PROVIDER", previous.provider], ["SCRIBE_URL", previous.url], ["TRANSCRIPTION_MODEL", previous.model], ["ASSETS_DIR", previous.assets]] as const) {
+          if (value === undefined) delete process.env[key]; else process.env[key] = value;
+        }
+      }
+    });
+  }
+}

package/src/auto-transcribe.test.ts

@@ -1,388 +1,140 @@
-/**
- * Auto-transcribe gating decisions (vault#353).
- *
- * Three independent guards: mime-type prefix, enabled toggle, scribe URL
- * present. Pure function — exercise the truth table.
- */
-
 import { describe, test, expect } from "bun:test";
-import {
-  _resetNoProviderWarnForTest,
-  classifyAutoTranscribe,
-  NO_PROVIDER_ERROR,
-  noProviderErrorFor,
-  shouldAutoTranscribe,
-  warnNoTranscriptionProvider,
-} from "./auto-transcribe.ts";
-
-function readGlobalConfig(enabled: boolean | undefined) {
-  return () => ({
-    port: 1940,
-    ...(enabled !== undefined ? { auto_transcribe: { enabled } } : {}),
-  }) as any;
-}
-
-describe("shouldAutoTranscribe", () => {
-  const scribePresent = () => "http://127.0.0.1:1943";
-  const scribeAbsent = () => undefined;
-
-  test("triggers on audio/* mime-type when enabled + scribe reachable", () => {
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(true);
-  });
-
-  test("triggers on audio/mp4 (m4a)", () => {
-    expect(shouldAutoTranscribe("audio/mp4", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(true);
-  });
-
-  test("triggers on audio/webm", () => {
-    expect(shouldAutoTranscribe("audio/webm", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(true);
-  });
-
-  test("triggers case-insensitively (AUDIO/WAV)", () => {
-    expect(shouldAutoTranscribe("AUDIO/WAV", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(true);
-  });
-
-  test("skips non-audio mime-types (image/png, application/pdf, video/mp4)", () => {
-    expect(shouldAutoTranscribe("image/png", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
-    expect(shouldAutoTranscribe("application/pdf", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
-    expect(shouldAutoTranscribe("video/mp4", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
-  });
-
-  test("skips when enabled is false (default off)", () => {
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(false),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
-  });
-
-  test("fires when enabled is unset — unset config means ON", () => {
-    // Default behavior (no `auto_transcribe` block in config) is opt-out:
-    // once an operator has scribe reachable, audio attachments transcribe
-    // automatically. Operators wanting it OFF set
-    // `auto_transcribe.enabled: false` explicitly. Previously default-off;
-    // flipped to default-on so installing scribe is the only opt-in signal.
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(undefined),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(true);
-  });
-
-  test("skips when scribe URL is undefined (no services.json entry, no env)", () => {
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribeAbsent,
-    })).toBe(false);
-  });
-
-  test("skips when scribe URL is empty string", () => {
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: () => "",
-    })).toBe(false);
-  });
-
-  test("skips on garbage mime-type input", () => {
-    expect(shouldAutoTranscribe("", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
-    expect(shouldAutoTranscribe("not-a-mime", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-    })).toBe(false);
-  });
-
-  test("respects enabledOverride when present", () => {
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(false),
-      getCachedScribeUrlImpl: scribePresent,
-      enabledOverride: true,
-    })).toBe(true);
-    expect(shouldAutoTranscribe("audio/wav", {
-      readGlobalConfigImpl: readGlobalConfig(true),
-      getCachedScribeUrlImpl: scribePresent,
-      enabledOverride: false,
-    })).toBe(false);
-  });
-
-  describe("per-vault precedence (per-vault → global → true)", () => {
-    test("per-vault true wins even when global is false", () => {
-      expect(shouldAutoTranscribe("audio/wav", {
-        readGlobalConfigImpl: readGlobalConfig(false),
-        getCachedScribeUrlImpl: scribePresent,
-        perVaultEnabled: true,
-      })).toBe(true);
-    });
-
-    test("per-vault false wins even when global is true", () => {
-      // The whole point: linking scribe to vault X (perVault true) elsewhere
-      // must not force-on a vault that set its own false.
-      expect(shouldAutoTranscribe("audio/wav", {
-        readGlobalConfigImpl: readGlobalConfig(true),
-        getCachedScribeUrlImpl: scribePresent,
-        perVaultEnabled: false,
-      })).toBe(false);
-    });
-
-    test("per-vault unset falls back to global", () => {
-      expect(shouldAutoTranscribe("audio/wav", {
-        readGlobalConfigImpl: readGlobalConfig(true),
-        getCachedScribeUrlImpl: scribePresent,
-        perVaultEnabled: undefined,
-      })).toBe(true);
-      expect(shouldAutoTranscribe("audio/wav", {
-        readGlobalConfigImpl: readGlobalConfig(false),
-        getCachedScribeUrlImpl: scribePresent,
-        perVaultEnabled: undefined,
-      })).toBe(false);
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { findModel } from "./transcription/models.ts";
+import { classifyAutoTranscribe, shouldAutoTranscribe, noProviderErrorFor,
+  NO_PROVIDER_ERROR, warnNoTranscriptionProvider, _resetNoProviderWarnForTest } from "./auto-transcribe.ts";
+import { getTranscriptionWorker, getTranscriptionWorkerProvider, setTranscriptionWorker } from "./transcription-registry.ts";
+
+const config = (enabled?: boolean) => () => ({ port: 1940, auto_transcribe: { enabled } }) as any;
+const ready = () => ({ ready: true, localProvider: "whisper-cpp" });
+const absent = () => ({ ready: false, localProvider: null });
+
+describe("automatic transcription eligibility", () => {
+  for (const mime of ["audio/wav", "audio/mp4", "audio/webm", "AUDIO/WAV"]) {
+    test(`ready worker accepts ${mime}`, () => {
+      expect(shouldAutoTranscribe(mime, { readGlobalConfigImpl: config(), providerStateImpl: ready })).toBe(true);
     });
-
-    test("both per-vault and global unset falls back to true (no regression)", () => {
-      expect(shouldAutoTranscribe("audio/wav", {
-        readGlobalConfigImpl: readGlobalConfig(undefined),
-        getCachedScribeUrlImpl: scribePresent,
-        perVaultEnabled: undefined,
-      })).toBe(true);
+  }
+  for (const mime of ["image/png", "video/mp4", "application/pdf", "", null as any]) {
+    test(`non-audio ${mime} never probes readiness`, () => {
+      expect(classifyAutoTranscribe(mime, { providerStateImpl: () => { throw Error("unexpected probe"); } }).kind).toBe("not-audio");
     });
-
-    test("enabledOverride still hard-overrides the per-vault value", () => {
-      // The explicit caller-opt-in path beats everything.
-      expect(shouldAutoTranscribe("audio/wav", {
-        readGlobalConfigImpl: readGlobalConfig(true),
-        getCachedScribeUrlImpl: scribePresent,
-        perVaultEnabled: false,
-        enabledOverride: true,
-      })).toBe(true);
+  }
+  for (const global of [undefined, true, false]) {
+    for (const vault of [undefined, true, false]) {
+      for (const override of [undefined, true, false]) {
+        test(`precedence global=${global} vault=${vault} override=${override}`, () => {
+          const enabled = override ?? vault ?? global ?? true;
+          const d = classifyAutoTranscribe("audio/wav", { readGlobalConfigImpl: config(global),
+            perVaultEnabled: vault, enabledOverride: override, providerStateImpl: ready });
+          expect(d.kind).toBe(enabled ? "transcribe" : "disabled");
+        });
+      }
+    }
+  }
+  test("disabled bypasses readiness entirely", () => {
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: false,
+      providerStateImpl: () => { throw Error("unexpected probe"); } }).kind).toBe("disabled");
+  });
+  for (const local of [null, "whisper-cpp"]) {
+    test(`not ready remains unavailable with installed=${local}`, () => {
+      expect(classifyAutoTranscribe("audio/wav", { readGlobalConfigImpl: config(),
+        providerStateImpl: () => ({ ready: false, localProvider: local }) })).toEqual({ kind: "unavailable", localProvider: local });
     });
+  }
+  test("unavailable is false, not an enqueue", () => {
+    expect(shouldAutoTranscribe("audio/wav", { readGlobalConfigImpl: config(), providerStateImpl: absent })).toBe(false);
   });
 });
 
-// ---------------------------------------------------------------------------
-// vault#643 — "disabled" and "unavailable" are not the same answer.
-//
-// `shouldAutoTranscribe` collapsed both into `false`, so a box with
-// auto-transcribe ON and no reachable provider accepted audio, transcribed
-// nothing, wrote no marker, and logged nothing. The attachment was
-// indistinguishable from a plain upload.
-//
-// That is the DEFAULT state of a fresh install: the provider resolves to
-// `scribe-http`, nothing sets SCRIBE_URL, and voice memos silently never
-// transcribe. The hosted door already marks a terminal state rather than
-// skipping quietly (workers/vault/src/vault-do.ts — "voice not enabled for
-// this plan" / "monthly voice limit reached"); this is the self-host twin.
-// ---------------------------------------------------------------------------
-describe("classifyAutoTranscribe (vault#643)", () => {
-  const audio = "audio/webm";
-  const withProvider = () => "http://127.0.0.1:1943";
-  const noProvider = () => undefined;
-
-  test("non-audio → not-audio, whatever else is true", () => {
-    expect(
-      classifyAutoTranscribe("image/png", { getCachedScribeUrlImpl: withProvider }).kind,
-    ).toBe("not-audio");
-  });
-
-  test("operator turned it off → disabled (silence is CORRECT here)", () => {
-    expect(
-      classifyAutoTranscribe(audio, {
-        perVaultEnabled: false,
-        getCachedScribeUrlImpl: withProvider,
-      }).kind,
-    ).toBe("disabled");
-  });
-
-  test("enabled + no provider → unavailable, NOT disabled — the whole point", () => {
-    expect(
-      classifyAutoTranscribe(audio, {
-        perVaultEnabled: true,
-        getCachedScribeUrlImpl: noProvider,
-      }).kind,
-    ).toBe("unavailable");
-  });
-
-  test("a blank provider URL is unavailable, not a provider", () => {
-    expect(
-      classifyAutoTranscribe(audio, {
-        perVaultEnabled: true,
-        getCachedScribeUrlImpl: () => "   ",
-      }).kind,
-    ).toBe("unavailable");
-  });
-
-  test("the default (no toggle set) with no provider is unavailable — the fresh-install case", () => {
-    expect(
-      classifyAutoTranscribe(audio, {
-        readGlobalConfigImpl: (() => ({})) as never,
-        getCachedScribeUrlImpl: noProvider,
-      }).kind,
-    ).toBe("unavailable");
-  });
-
-  test("enabled + provider → transcribe", () => {
-    expect(
-      classifyAutoTranscribe(audio, {
-        perVaultEnabled: true,
-        getCachedScribeUrlImpl: withProvider,
-      }).kind,
-    ).toBe("transcribe");
-  });
-
-  test("shouldAutoTranscribe stays a faithful boolean view of the classifier", () => {
-    for (const opts of [
-      { perVaultEnabled: false, getCachedScribeUrlImpl: withProvider },
-      { perVaultEnabled: true, getCachedScribeUrlImpl: noProvider },
-      { perVaultEnabled: true, getCachedScribeUrlImpl: withProvider },
-    ]) {
-      expect(shouldAutoTranscribe(audio, opts)).toBe(
-        classifyAutoTranscribe(audio, opts).kind === "transcribe",
-      );
-    }
-  });
+test("real gate requires a matching registered worker; stale URL cannot enable a missing local worker", () => {
+  const previous = { provider: process.env.TRANSCRIPTION_PROVIDER, url: process.env.SCRIBE_URL };
+  const worker = getTranscriptionWorker();
+  const provider = getTranscriptionWorkerProvider();
+  const fake = { stop: async () => {}, tick: async () => 0, kick: async () => {} };
+  try {
+    process.env.TRANSCRIPTION_PROVIDER = "transcribe-cpp";
+    process.env.SCRIBE_URL = "http://stale.invalid";
+    setTranscriptionWorker(null);
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("unavailable");
+    setTranscriptionWorker(fake, "scribe-http");
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("unavailable");
+    setTranscriptionWorker(fake, "transcribe-cpp");
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("transcribe");
+    process.env.TRANSCRIPTION_PROVIDER = "scribe-http";
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("unavailable");
+    setTranscriptionWorker(fake, "scribe-http");
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("transcribe");
+  } finally {
+    setTranscriptionWorker(worker, provider);
+    if (previous.provider === undefined) delete process.env.TRANSCRIPTION_PROVIDER;
+    else process.env.TRANSCRIPTION_PROVIDER = previous.provider;
+    if (previous.url === undefined) delete process.env.SCRIBE_URL;
+    else process.env.SCRIBE_URL = previous.url;
+  }
 });
 
-describe("warnNoTranscriptionProvider throttle (vault#643)", () => {
-  test("warns once per window — a bulk import gets one line, not a hundred", () => {
-    _resetNoProviderWarnForTest();
-    const seen: string[] = [];
-    const orig = console.warn;
-    console.warn = (...args: unknown[]) => seen.push(String(args[0]));
-    try {
-      let now = 1_000_000;
-      const clock = () => now;
-      for (let i = 0; i < 50; i++) warnNoTranscriptionProvider(clock);
-      expect(seen.length).toBe(1);
-      expect(seen[0]).toMatch(/no transcription provider configured/i);
-      // Past the window → one more.
-      now += 61_000;
-      warnNoTranscriptionProvider(clock);
-      expect(seen.length).toBe(2);
-    } finally {
-      console.warn = orig;
-      _resetNoProviderWarnForTest();
-    }
-  });
+test("diagnostics distinguish installed from ready without reviving Scribe", () => {
+  expect(noProviderErrorFor(null)).toBe(NO_PROVIDER_ERROR);
+  expect(NO_PROVIDER_ERROR).toContain("transcription status");
+  expect(NO_PROVIDER_ERROR).toContain("standalone Scribe service is retired");
+  const message = noProviderErrorFor("whisper-cpp");
+  expect(message).toContain("binary is installed");
+  expect(message).toContain("not active and ready");
+  expect(message).toContain("transcription status");
+  expect(message).not.toContain("point SCRIBE_URL");
+  expect(message).not.toContain("resolves only a scribe URL");
 });
 
-/**
- * The `unavailable` error must be TRUE, not merely actionable.
- *
- * Found live: a box with `TRANSCRIPTION_PROVIDER=whisper-cpp`, `parakeet-cli`
- * on PATH, the model downloaded, and `[transcribe] worker started →
- * whisper-cpp` in the same boot log was writing "no transcription provider
- * configured — set TRANSCRIPTION_PROVIDER to a local provider" onto its
- * attachments. Every clause of that is false there, and the fix it prescribes
- * is a 400 MB re-download that changes nothing.
- *
- * The decision is deliberately unchanged — `unavailable` stays `unavailable`,
- * because this path resolves a scribe URL and nothing else. Only the sentence
- * moves.
- */
-describe("the unavailable message tells the truth about the local install", () => {
-  const audio = "audio/webm";
-  const noScribe = () => undefined;
-
-  test("nothing runnable locally → the original message, unchanged", () => {
-    // The fresh-install case the old string was written for, and it is still
-    // exactly right there. Byte-identical so a fresh install sees no churn.
-    const d = classifyAutoTranscribe(audio, {
-      perVaultEnabled: true,
-      getCachedScribeUrlImpl: noScribe,
-      localProviderImpl: () => null,
-    });
-    expect(d.kind).toBe("unavailable");
-    expect(noProviderErrorFor(d.kind === "unavailable" ? d.localProvider : null)).toBe(
-      NO_PROVIDER_ERROR,
-    );
-  });
-
-  test("a runnable local provider → a message that does not contradict the box", () => {
-    const d = classifyAutoTranscribe(audio, {
-      perVaultEnabled: true,
-      getCachedScribeUrlImpl: noScribe,
-      localProviderImpl: () => "whisper-cpp",
-    });
-    expect(d.kind).toBe("unavailable");
-    const msg = noProviderErrorFor(d.kind === "unavailable" ? d.localProvider : null);
-
-    // The three false claims the old string made on such a box.
-    expect(msg).not.toContain("no transcription provider configured");
-    expect(msg).not.toContain("set TRANSCRIPTION_PROVIDER to a local provider");
-    expect(msg).not.toContain("transcription install");
-    // And what it must say instead: the local install is fine, this path just
-    // doesn't read it, and don't go reinstalling anything.
-    expect(msg).toContain("whisper-cpp");
-    expect(msg).toContain("SCRIBE_URL");
-    expect(msg).toMatch(/does not consult it/);
-    expect(msg).toMatch(/Reinstalling whisper-cpp will not change this/);
-  });
-
-  test("the decision itself is untouched — this diff moves no behaviour", () => {
-    // Same inputs, both local-provider states: still `unavailable` either way.
-    // If this ever diverges, the change stopped being diagnostic-only and
-    // started deciding what gets transcribed.
-    for (const local of [null, "whisper-cpp"]) {
-      expect(
-        classifyAutoTranscribe(audio, {
-          perVaultEnabled: true,
-          getCachedScribeUrlImpl: noScribe,
-          localProviderImpl: () => local,
-        }).kind,
-      ).toBe("unavailable");
+test("whisper-cpp real readiness requires model plus matching active worker, without Scribe", () => {
+  const keys = ["PARACHUTE_HOME", "WHISPER_CPP_BIN_DIR", "TRANSCRIPTION_PROVIDER", "TRANSCRIPTION_MODEL", "SCRIBE_URL"] as const;
+  const original = Object.fromEntries(keys.map((key) => [key, process.env[key]]));
+  const home = mkdtempSync(join(tmpdir(), "auto-whisper-"));
+  const oldWorker = getTranscriptionWorker();
+  const oldProvider = getTranscriptionWorkerProvider();
+  try {
+    process.env.PARACHUTE_HOME = home;
+    process.env.WHISPER_CPP_BIN_DIR = join(home, "bin");
+    process.env.TRANSCRIPTION_PROVIDER = "whisper-cpp";
+    process.env.TRANSCRIPTION_MODEL = "whisper-base.en";
+    delete process.env.SCRIBE_URL;
+    mkdirSync(join(home, "bin"));
+    // Snapshot checks presence only; these are never executed.
+    writeFileSync(join(home, "bin", "whisper-cli"), "fixture");
+    writeFileSync(join(home, "bin", "ffmpeg"), "fixture");
+    const worker = { stop: async () => {}, tick: async () => 0, kick: async () => {} };
+    setTranscriptionWorker(worker, "whisper-cpp");
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("unavailable");
+    const models = join(home, "transcription", "models");
+    mkdirSync(models, { recursive: true });
+    writeFileSync(join(models, findModel("whisper-base.en")!.filename), "fixture");
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("transcribe");
+    setTranscriptionWorker(null);
+    expect(classifyAutoTranscribe("audio/wav", { perVaultEnabled: true }).kind).toBe("unavailable");
+  } finally {
+    setTranscriptionWorker(oldWorker, oldProvider);
+    for (const key of keys) {
+      if (original[key] === undefined) delete process.env[key]; else process.env[key] = original[key];
     }
-    // And a reachable scribe still wins outright, local install or not.
-    expect(
-      classifyAutoTranscribe(audio, {
-        perVaultEnabled: true,
-        getCachedScribeUrlImpl: () => "http://127.0.0.1:1943",
-        localProviderImpl: () => "whisper-cpp",
-      }).kind,
-    ).toBe("transcribe");
-  });
-
-  test("an installed provider with ffmpeg missing STILL gets the honest message", () => {
-    // The trap that cost a rewrite: `snap.ready` also demands ffmpeg, so it
-    // varies box to box. A machine with the provider installed and ffmpeg
-    // missing is still one where "no transcription provider configured" is
-    // false, so the discriminator is INSTALLED, not READY — it answers the
-    // question the sentence asks, identically everywhere.
-    const msg = noProviderErrorFor("whisper-cpp");
-    expect(msg).not.toBe(NO_PROVIDER_ERROR);
-    // And it must not over-claim in the other direction: with ffmpeg missing
-    // the install is present but not necessarily working, so the message says
-    // requests are ROUTED to it and points at status for the real state.
-    expect(msg).toMatch(/routed to it/);
-    expect(msg).toContain("transcription status");
-    expect(msg).not.toMatch(/is fine/);
-  });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
 
-  test("the provider NAME is not the discriminator — the fresh-install trap", () => {
-    // `resolveTranscriptionProviderName` returns "whisper-cpp" on a box where
-    // nothing is set up at all, because that is the default when no scribe URL
-    // resolves. Keying off the name would tell a fresh-install operator their
-    // whisper-cpp install is fine when they have never installed one. The
-    // discriminator is RUNNABILITY, and null must produce the old message.
-    expect(noProviderErrorFor(null)).toBe(NO_PROVIDER_ERROR);
-    expect(noProviderErrorFor("whisper-cpp")).not.toBe(NO_PROVIDER_ERROR);
-  });
+test("missing-provider warning is throttled and resets", () => {
+  const previous = console.warn;
+  const messages: unknown[] = [];
+  console.warn = (...args) => { messages.push(args); };
+  try {
+    _resetNoProviderWarnForTest();
+    warnNoTranscriptionProvider(() => 60_000);
+    warnNoTranscriptionProvider(() => 60_001);
+    expect(messages).toHaveLength(1);
+    warnNoTranscriptionProvider(() => 120_000);
+    expect(messages).toHaveLength(2);
+    _resetNoProviderWarnForTest();
+    warnNoTranscriptionProvider(() => 120_001);
+    expect(messages).toHaveLength(3);
+  } finally { console.warn = previous; _resetNoProviderWarnForTest(); }
 });

package/src/auto-transcribe.ts

@@ -1,247 +1,75 @@
-/**
- * Auto-transcribe trigger decision (vault#353, design 2026-05-21 Part 2).
- *
- * One pure function: given an attachment's mime-type + the operator's
- * settings + whether scribe is reachable, decide whether to enqueue the
- * attachment for the transcription worker. Lives in its own module so the
- * attachment-write code path (`routes.ts`) and the retry endpoint share the
- * same gate without duplicating logic.
- */
-
+/** Automatic uploads follow the selected, wired transcription worker (#751). */
 import { readGlobalConfig } from "./config.ts";
-import { getCachedScribeUrl } from "./scribe-discovery.ts";
 import { buildTranscriptionSnapshot } from "./transcription-routes.ts";
+import { getTranscriptionWorkerProvider } from "./transcription-registry.ts";
 
-/**
- * The name of a local provider that is INSTALLED on this box, or null.
- *
- * Delegates to the same snapshot `transcription status` and the admin SPA
- * answer from, so these surfaces share one implementation and cannot drift.
- *
- * Keyed on `binary.path`, deliberately, NOT on `snap.ready`. Readiness also
- * demands ffmpeg, so it varies box to box in a way this message shouldn't: a
- * machine with the provider installed but ffmpeg missing is still a machine
- * where "no transcription provider configured — set TRANSCRIPTION_PROVIDER to
- * a local provider" is false. `installed` answers the question the sentence
- * actually asks, and answers it the same way everywhere.
- * (Caught by running the real probe rather than the injected one — the unit
- * tests inject `localProviderImpl` and would never have shown the difference.)
- *
- * Errors swallow to null: a broken probe must degrade to the old, flat message,
- * never take down an attachment upload.
- */
-function installedLocalProvider(): string | null {
+type ProviderState = { ready: boolean; localProvider: string | null };
+function providerState(): ProviderState {
   try {
-    const snap = buildTranscriptionSnapshot();
-    if (snap.provider === "scribe-http") return null;
-    return snap.binary.path ? snap.provider : null;
+    const snapshot = buildTranscriptionSnapshot();
+    return {
+      ready: snapshot.active && snapshot.ready &&
+        getTranscriptionWorkerProvider() === snapshot.provider,
+      // The snapshot's binary field describes whisper.cpp tools, not every
+      // provider. Do not use it to claim a Python/transcribe-cpp install exists.
+      localProvider: snapshot.provider === "whisper-cpp" && snapshot.binary.path
+        ? snapshot.provider : null,
+    };
   } catch {
-    return null;
+    // A failed readiness probe must not break attachment upload.
+    return { ready: false, localProvider: null };
   }
 }
-
-/**
- * Pre-vault#353 callers passed `transcribe: true` explicitly on the
- * attachment POST. The auto-transcribe path inlines the decision: if the
- * upload is an audio mime-type AND the toggle is on AND scribe is reachable,
- * the worker is enqueued. This function is the single decision site.
- *
- * Returns `true` only when ALL three conditions hold:
- *   1. mime-type starts with `audio/` (case-insensitive).
- *   2. The resolved auto-transcribe toggle is not `false`. Resolution is
- *      **per-vault → global → true**:
- *        - `perVaultEnabled` (the owning vault's own `auto_transcribe.enabled`)
- *          wins when set — this is what makes scribe's "link to vault X" affect
- *          only X, not the whole server.
- *        - else the server-wide `globalConfig.auto_transcribe?.enabled`.
- *        - else `true` (default ON — once scribe is reachable, audio
- *          transcribes without a separate config step). Operators who want it
- *          OFF set `auto_transcribe.enabled: false` explicitly (per-vault or
- *          globally).
- *      `enabledOverride`, when present, hard-overrides the whole chain (used
- *      by the explicit caller-opt-in path).
- *   3. Scribe is discoverable (services.json entry OR SCRIBE_URL env).
- *
- * The three conditions are independent guards: a single `false` is sufficient
- * to skip enqueuing. The audio stays as a regular attachment in that case.
- */
-export function shouldAutoTranscribe(
-  mimeType: string,
-  opts: {
-    /** Injection seam for tests — defaults to live globals. */
-    readGlobalConfigImpl?: typeof readGlobalConfig;
-    getCachedScribeUrlImpl?: () => string | undefined;
-    /**
-     * The owning vault's per-vault `auto_transcribe.enabled` (vault.yaml).
-     * Takes precedence over the global toggle when set, so enabling/disabling
-     * one vault doesn't move the rest. `undefined` (the vault left it unset)
-     * falls through to the global toggle.
-     */
-    perVaultEnabled?: boolean;
-    /**
-     * Hard override of the entire per-vault→global→true chain. Used by the
-     * explicit caller-opt-in path; not part of the normal precedence ladder.
-     */
-    enabledOverride?: boolean;
-  } = {},
-): boolean {
-  if (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("audio/")) {
-    return false;
-  }
-  return classifyAutoTranscribe(mimeType, opts).kind === "transcribe";
-}
-
-/**
- * Why an audio attachment is (or isn't) being transcribed. The three outcomes
- * are NOT interchangeable, which is the whole point of this type:
- *
- *   - `transcribe`  — enqueue it.
- *   - `disabled`    — the operator turned auto-transcribe off. Silence is
- *                     correct: they asked for nothing to happen.
- *   - `unavailable` — auto-transcribe is ON, but no provider is reachable.
- *                     This is a MISCONFIGURATION, and silence is wrong.
- *
- * vault#643: `shouldAutoTranscribe` collapsed the last two into `false`, so a
- * box with transcription enabled and no reachable provider accepted audio,
- * transcribed nothing, wrote no marker, logged nothing, and left an attachment
- * indistinguishable from a plain upload. Observed on a fresh install: the
- * provider resolves to `scribe-http` by default, nothing sets `SCRIBE_URL`, and
- * voice memos silently never transcribe.
- *
- * The hosted door already gets this right — `workers/vault/src/vault-do.ts`
- * marks a terminal state ("voice not enabled for this plan", "monthly voice
- * limit reached") rather than skipping quietly, precisely so the operator never
- * faces an eternal spinner. This brings self-host to the same posture.
- */
+type AutoTranscribeOptions = {
+  readGlobalConfigImpl?: typeof readGlobalConfig;
+  /** Test seam; production uses the registered worker and shared status probe. */
+  providerStateImpl?: () => ProviderState;
+  /** Per-vault → global → true; explicit caller overrides still win. */
+  perVaultEnabled?: boolean;
+  enabledOverride?: boolean;
+};
 export type AutoTranscribeDecision =
   | { kind: "transcribe" }
   | { kind: "not-audio" }
   | { kind: "disabled" }
-  /**
-   * `localProvider` names a local provider INSTALLED on this box (its binary
-   * resolves), or null when there is nothing local here.
-   *
-   * Installation, deliberately, and not the configured provider NAME. The name
-   * is a trap: `resolveTranscriptionProviderName` returns `whisper-cpp` on a
-   * box where nothing at all is set up, because that is the default when no
-   * scribe URL resolves. Keying the message off the name would tell a
-   * fresh-install operator their whisper-cpp install is present when they have
-   * never installed one — trading one false sentence for another.
-   *
-   * It does NOT change the decision: `unavailable` is `unavailable` either way,
-   * because this path resolves a scribe URL and nothing else. It exists purely
-   * so the error can be true. See `noProviderErrorFor`.
-   */
   | { kind: "unavailable"; localProvider: string | null };
 
-/** The full decision behind `shouldAutoTranscribe`. Same inputs, more answer. */
 export function classifyAutoTranscribe(
   mimeType: string,
-  opts: {
-    readGlobalConfigImpl?: typeof readGlobalConfig;
-    getCachedScribeUrlImpl?: () => string | undefined;
-    perVaultEnabled?: boolean;
-    enabledOverride?: boolean;
-    /**
-     * Injectable, same shape as the two impls above. Returns the name of a
-     * local provider installed here, or null. Defaults to the shared
-     * transcription snapshot.
-     */
-    localProviderImpl?: () => string | null;
-  } = {},
+  opts: AutoTranscribeOptions = {},
 ): AutoTranscribeDecision {
   if (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("audio/")) {
     return { kind: "not-audio" };
   }
-  const enabled = opts.enabledOverride
-    ?? opts.perVaultEnabled
-    ?? (opts.readGlobalConfigImpl ?? readGlobalConfig)().auto_transcribe?.enabled
-    ?? true;
+  const enabled = opts.enabledOverride ?? opts.perVaultEnabled ??
+    (opts.readGlobalConfigImpl ?? readGlobalConfig)().auto_transcribe?.enabled ?? true;
   if (!enabled) return { kind: "disabled" };
-  const url = (opts.getCachedScribeUrlImpl ?? getCachedScribeUrl)();
-  if (!url || !url.trim()) {
-    // Still unavailable — this path reads a scribe URL and nothing else, and
-    // that is deliberately unchanged here. We only ask whether something local
-    // would run, so the message can name the real situation instead of telling
-    // an operator to do what they have already done.
-    return {
-      kind: "unavailable",
-      localProvider: (opts.localProviderImpl ?? installedLocalProvider)(),
-    };
-  }
-  return { kind: "transcribe" };
+  const state = (opts.providerStateImpl ?? providerState)();
+  return state.ready
+    ? { kind: "transcribe" }
+    : { kind: "unavailable", localProvider: state.localProvider };
+}
+export function shouldAutoTranscribe(mimeType: string, opts: AutoTranscribeOptions = {}): boolean {
+  return classifyAutoTranscribe(mimeType, opts).kind === "transcribe";
 }
-
-/**
- * The `transcribe_error` written when auto-transcribe is on but no provider is
- * reachable AND nothing local is configured. Deliberately actionable — the
- * operator needs to know which of the two things to do, not just that something
- * went wrong.
- *
- * Correct only when the resolved provider is `scribe-http`. On a box that HAS a
- * local provider this sentence is false in the most expensive way — see
- * `noProviderErrorFor`.
- */
 export const NO_PROVIDER_ERROR =
-  "no transcription provider configured — set TRANSCRIPTION_PROVIDER to a local " +
-  "provider (see `parachute-vault transcription install`), or point SCRIBE_URL at " +
-  "a transcription service";
-
-/**
- * The `transcribe_error` for an `unavailable` decision, told truthfully.
- *
- * Found live: a box with `TRANSCRIPTION_PROVIDER=whisper-cpp`, `parakeet-cli` on
- * PATH, the model downloaded, and `[transcribe] worker started → whisper-cpp` in
- * the same boot was writing `NO_PROVIDER_ERROR` onto its attachments — telling
- * the operator to set the variable they had set and install the provider that
- * was already running. Same failure mode as the `transcription status` bug
- * (#643): a diagnostic that lies during the exact task it exists for, and this
- * one sends someone to re-download a 400 MB model to fix nothing.
- *
- * The asymmetry is real and worth naming in the message rather than hiding:
- * `server.ts` starts a local worker with no scribe URL anywhere in the branch,
- * but this path resolves ONLY a scribe URL. So a local provider genuinely does
- * serve explicit `transcribe: true` requests while genuinely being invisible
- * here. An operator who is not told that will reasonably conclude their install
- * is broken.
- *
- * Deliberately NOT a fix for the asymmetry itself — teaching this path to see
- * local providers changes what gets transcribed, which is a behaviour question
- * and not this diff's to answer.
- */
+  "no transcription provider configured or ready — check `parachute-vault transcription status` " +
+  "and TRANSCRIPTION_PROVIDER. For local transcription use `parachute-vault transcription install`. " +
+  "For an explicitly selected legacy remote provider, check its SCRIBE_URL and worker status. " +
+  "The standalone Scribe service is retired.";
 export function noProviderErrorFor(localProvider: string | null): string {
   if (!localProvider) return NO_PROVIDER_ERROR;
-  return (
-    `auto-transcribe found no reachable provider: it resolves only a scribe URL ` +
-    `(SCRIBE_URL, or a \`parachute-scribe\` entry in services.json), and neither is set. ` +
-    `A local ${localProvider} install IS present here and explicit transcription requests ` +
-    `are routed to it — this path does not consult it. Reinstalling ${localProvider} will ` +
-    `not change this. To auto-transcribe uploads, point SCRIBE_URL at a transcription ` +
-    `service; otherwise request transcription explicitly on the attachment. ` +
-    `\`parachute-vault transcription status\` reports the local install's own state.`
-  );
+  return `auto-transcribe is unavailable: a local ${localProvider} binary is installed, ` +
+    "but the selected worker is not active and ready. Check `parachute-vault transcription status` " +
+    "for missing model/runtime dependencies or a required server restart. " +
+    "A binary alone does not establish readiness; reinstalling it is not necessarily the fix.";
 }
-
-/** Throttle for {@link warnNoTranscriptionProvider}. */
 const NO_PROVIDER_WARN_INTERVAL_MS = 60_000;
 let lastNoProviderWarnAt = 0;
-
-/**
- * Warn (at most once a minute) that audio is arriving with nowhere to send it.
- *
- * Throttled because it fires per-upload: a bulk import of a hundred voice
- * memos should produce one actionable line, not a hundred. Silence was the old
- * behaviour and it is what made this invisible — a box can accept audio for
- * months and never say that transcription isn't wired up.
- */
 export function warnNoTranscriptionProvider(now: () => number = Date.now): void {
   const t = now();
   if (t - lastNoProviderWarnAt < NO_PROVIDER_WARN_INTERVAL_MS) return;
   lastNoProviderWarnAt = t;
-  console.warn(`[transcribe] audio attachment accepted but ${NO_PROVIDER_ERROR}.`);
-}
-
-/** Test seam: forget the throttle window. */
-export function _resetNoProviderWarnForTest(): void {
-  lastNoProviderWarnAt = 0;
+  console.warn(`[transcribe] audio attachment accepted but ${NO_PROVIDER_ERROR}`);
 }
+export function _resetNoProviderWarnForTest(): void { lastNoProviderWarnAt = 0; }

package/src/server.ts

@@ -145,7 +145,7 @@ function wireTranscriptionWorker(worker: TranscriptionWorker): void {
     worker,
     (store) => getVaultNameForStore(store as never),
   );
-  setTranscriptionWorker(worker);
+  setTranscriptionWorker(worker, providerName);
 }
 
 // Fields the worker needs regardless of provider (queue/retention/context).
@@ -157,8 +157,8 @@ const commonWorkerOpts = {
   getContextPredicates: (vault: string) => readVaultConfig(vault)?.transcription?.context,
 };
 
-// Provider selection (scribe-fold Phase 2a). Default is `scribe-http` — unset
-// TRANSCRIPTION_PROVIDER means the existing scribe-http path runs unchanged.
+// Provider selection uses the shared resolver (local whisper-cpp by default
+// without legacy remote discovery). Bind this identity when wiring the worker.
 const providerName = resolveTranscriptionProviderName();
 if (providerName === "whisper-cpp") {
   // whisper.cpp's prebuilt CLIs — the local, no-Python path that actually
@@ -289,9 +289,10 @@ if (providerName === "whisper-cpp") {
     console.warn(
       "[transcribe] NO transcription provider is reachable — audio attachments " +
         "will be accepted but never transcribed. " +
-        `Provider resolved to "${providerName}". Fix with either: ` +
-        "`parachute-vault transcription install` + TRANSCRIPTION_PROVIDER=<local provider>, " +
-        "or point SCRIBE_URL at a transcription service. " +
+        `Provider resolved to "${providerName}". The standalone Scribe service is retired. ` +
+        "For explicit transcription, use `parachute-vault transcription install` and " +
+        "check `parachute-vault transcription status`. Automatic uploads require " +
+        "the selected worker to be active and ready. " +
         "Set `auto_transcribe.enabled: false` to silence this if you don't want transcription.",
     );
   }
@@ -756,4 +757,3 @@ setInterval(() => {
   }
   void shutdown("STOP_SIGNAL");
 }, STOP_POLL_MS).unref();
-

package/src/transcription-registry.ts

@@ -1,22 +1,24 @@
 /**
  * Process-singleton holder for the active TranscriptionWorker (vault#353).
  *
- * Mirrors `mirror-registry.ts`: `server.ts` constructs the worker on boot
- * (when scribe is discoverable), and the REST retry endpoint
- * (`/api/notes/:id/retry-transcription`) picks it up here to call `kick()`
- * for an event-driven re-run. Absent the worker (no scribe), the retry
- * endpoint still flips the attachment back to `pending` so the sweep would
- * pick it up — but it'll just sit there until scribe shows up.
+ * The server registers its selected local or remote worker at boot after
+ * wiring the attachment hook. Retry endpoints use the worker to kick jobs;
+ * automatic-upload eligibility also checks the startup provider identity.
  */
 
 import type { TranscriptionWorker } from "./transcription-worker.ts";
 
 let activeWorker: TranscriptionWorker | null = null;
+let activeProvider: string | null = null;
 
-export function setTranscriptionWorker(worker: TranscriptionWorker | null): void {
+export function setTranscriptionWorker(worker: TranscriptionWorker | null, provider: string | null = null): void {
   activeWorker = worker;
+  activeProvider = worker ? provider : null;
 }
 
+/** Provider bound at worker startup, not a newly edited environment value. */
+export function getTranscriptionWorkerProvider(): string | null { return activeProvider; }
+
 export function getTranscriptionWorker(): TranscriptionWorker | null {
   return activeWorker;
 }

package/src/vault.test.ts

@@ -17,6 +17,7 @@ import type { TagScopeCtx } from "./routes.ts";
 import { extractApiKey } from "./auth.ts";
 import { startTranscriptionWorker } from "./transcription-worker.ts";
 import { setTranscriptionWorker } from "./transcription-registry.ts";
+import { clearScribeUrlCache } from "./scribe-discovery.ts";
 import type { Store } from "../core/src/types.ts";
 
 let db: Database;
@@ -3314,23 +3315,45 @@ describe("HTTP /notes", async () => {
     // left looking like an ordinary upload — it records WHY nothing happened.
     // It is still not `pending` (nothing was enqueued) and the note is still
     // untouched (no stub, since the caller never asked for one).
-    test("audio with no flag + no provider records the failure; note untouched", async () => {
-      await store.createNote("note body", { id: "v2" });
-      const res = await handleNotes(
-        mkReq("POST", "/notes/v2/attachments", {
-          path: "memos/memo-2.webm",
-          mimeType: "audio/webm",
-        }),
-        store,
-        "/v2/attachments",
-      );
-      expect(res.status).toBe(201);
-      const att = await res.json() as any;
-      expect(att.metadata?.transcribe_status).toBe("failed");
-      expect(att.metadata?.transcribe_error).toMatch(/no transcription provider configured/i);
-
-      const note = await store.getNote("v2");
-      expect((note!.metadata as any)?.transcribe_stub).toBeUndefined();
+    //
+    // Fixture: select the remote provider so the presence/absence of a local
+    // whisper-cpp install on the host cannot change the message. With no
+    // SCRIBE_URL configured, auto-transcribe is still unavailable and reports
+    // the same actionable no-provider error on every box.
+    test("audio with no flag + scribe-http without URL records the failure; note untouched", async () => {
+      const prevProvider = process.env.TRANSCRIPTION_PROVIDER;
+      const prevScribeUrl = process.env.SCRIBE_URL;
+      process.env.TRANSCRIPTION_PROVIDER = "scribe-http";
+      delete process.env.SCRIBE_URL;
+      clearScribeUrlCache();
+      try {
+        await store.createNote("note body", { id: "v2" });
+        const res = await handleNotes(
+          mkReq("POST", "/notes/v2/attachments", {
+            path: "memos/memo-2.webm",
+            mimeType: "audio/webm",
+          }),
+          store,
+          "/v2/attachments",
+        );
+        expect(res.status).toBe(201);
+        const att = await res.json() as any;
+        expect(att.metadata?.transcribe_status).toBe("failed");
+        expect(att.metadata?.transcribe_error).toMatch(/no transcription provider configured/i);
+        expect(att.metadata?.transcribe_error).toMatch(/TRANSCRIPTION_PROVIDER/);
+        expect(att.metadata?.transcribe_error).toMatch(/SCRIBE_URL/);
+        expect(att.metadata?.transcribe_origin).toBe("auto");
+
+        const note = await store.getNote("v2");
+        expect(note!.content).toBe("note body");
+        expect((note!.metadata as any)?.transcribe_stub).toBeUndefined();
+      } finally {
+        if (prevProvider === undefined) delete process.env.TRANSCRIPTION_PROVIDER;
+        else process.env.TRANSCRIPTION_PROVIDER = prevProvider;
+        if (prevScribeUrl === undefined) delete process.env.SCRIBE_URL;
+        else process.env.SCRIBE_URL = prevScribeUrl;
+        clearScribeUrlCache();
+      }
     });
 
     // The explicit opt-out. `transcribe: false` is a caller saying no, and it