@openparachute/vault 0.7.9-rc.6 → 0.7.9-rc.8

package/src/auto-transcribe.ts

@@ -1,247 +1,75 @@
-/**
- * Auto-transcribe trigger decision (vault#353, design 2026-05-21 Part 2).
- *
- * One pure function: given an attachment's mime-type + the operator's
- * settings + whether scribe is reachable, decide whether to enqueue the
- * attachment for the transcription worker. Lives in its own module so the
- * attachment-write code path (`routes.ts`) and the retry endpoint share the
- * same gate without duplicating logic.
- */
-
+/** Automatic uploads follow the selected, wired transcription worker (#751). */
 import { readGlobalConfig } from "./config.ts";
-import { getCachedScribeUrl } from "./scribe-discovery.ts";
 import { buildTranscriptionSnapshot } from "./transcription-routes.ts";
+import { getTranscriptionWorkerProvider } from "./transcription-registry.ts";
 
-/**
- * The name of a local provider that is INSTALLED on this box, or null.
- *
- * Delegates to the same snapshot `transcription status` and the admin SPA
- * answer from, so these surfaces share one implementation and cannot drift.
- *
- * Keyed on `binary.path`, deliberately, NOT on `snap.ready`. Readiness also
- * demands ffmpeg, so it varies box to box in a way this message shouldn't: a
- * machine with the provider installed but ffmpeg missing is still a machine
- * where "no transcription provider configured — set TRANSCRIPTION_PROVIDER to
- * a local provider" is false. `installed` answers the question the sentence
- * actually asks, and answers it the same way everywhere.
- * (Caught by running the real probe rather than the injected one — the unit
- * tests inject `localProviderImpl` and would never have shown the difference.)
- *
- * Errors swallow to null: a broken probe must degrade to the old, flat message,
- * never take down an attachment upload.
- */
-function installedLocalProvider(): string | null {
+type ProviderState = { ready: boolean; localProvider: string | null };
+function providerState(): ProviderState {
   try {
-    const snap = buildTranscriptionSnapshot();
-    if (snap.provider === "scribe-http") return null;
-    return snap.binary.path ? snap.provider : null;
+    const snapshot = buildTranscriptionSnapshot();
+    return {
+      ready: snapshot.active && snapshot.ready &&
+        getTranscriptionWorkerProvider() === snapshot.provider,
+      // The snapshot's binary field describes whisper.cpp tools, not every
+      // provider. Do not use it to claim a Python/transcribe-cpp install exists.
+      localProvider: snapshot.provider === "whisper-cpp" && snapshot.binary.path
+        ? snapshot.provider : null,
+    };
   } catch {
-    return null;
+    // A failed readiness probe must not break attachment upload.
+    return { ready: false, localProvider: null };
   }
 }
-
-/**
- * Pre-vault#353 callers passed `transcribe: true` explicitly on the
- * attachment POST. The auto-transcribe path inlines the decision: if the
- * upload is an audio mime-type AND the toggle is on AND scribe is reachable,
- * the worker is enqueued. This function is the single decision site.
- *
- * Returns `true` only when ALL three conditions hold:
- *   1. mime-type starts with `audio/` (case-insensitive).
- *   2. The resolved auto-transcribe toggle is not `false`. Resolution is
- *      **per-vault → global → true**:
- *        - `perVaultEnabled` (the owning vault's own `auto_transcribe.enabled`)
- *          wins when set — this is what makes scribe's "link to vault X" affect
- *          only X, not the whole server.
- *        - else the server-wide `globalConfig.auto_transcribe?.enabled`.
- *        - else `true` (default ON — once scribe is reachable, audio
- *          transcribes without a separate config step). Operators who want it
- *          OFF set `auto_transcribe.enabled: false` explicitly (per-vault or
- *          globally).
- *      `enabledOverride`, when present, hard-overrides the whole chain (used
- *      by the explicit caller-opt-in path).
- *   3. Scribe is discoverable (services.json entry OR SCRIBE_URL env).
- *
- * The three conditions are independent guards: a single `false` is sufficient
- * to skip enqueuing. The audio stays as a regular attachment in that case.
- */
-export function shouldAutoTranscribe(
-  mimeType: string,
-  opts: {
-    /** Injection seam for tests — defaults to live globals. */
-    readGlobalConfigImpl?: typeof readGlobalConfig;
-    getCachedScribeUrlImpl?: () => string | undefined;
-    /**
-     * The owning vault's per-vault `auto_transcribe.enabled` (vault.yaml).
-     * Takes precedence over the global toggle when set, so enabling/disabling
-     * one vault doesn't move the rest. `undefined` (the vault left it unset)
-     * falls through to the global toggle.
-     */
-    perVaultEnabled?: boolean;
-    /**
-     * Hard override of the entire per-vault→global→true chain. Used by the
-     * explicit caller-opt-in path; not part of the normal precedence ladder.
-     */
-    enabledOverride?: boolean;
-  } = {},
-): boolean {
-  if (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("audio/")) {
-    return false;
-  }
-  return classifyAutoTranscribe(mimeType, opts).kind === "transcribe";
-}
-
-/**
- * Why an audio attachment is (or isn't) being transcribed. The three outcomes
- * are NOT interchangeable, which is the whole point of this type:
- *
- *   - `transcribe`  — enqueue it.
- *   - `disabled`    — the operator turned auto-transcribe off. Silence is
- *                     correct: they asked for nothing to happen.
- *   - `unavailable` — auto-transcribe is ON, but no provider is reachable.
- *                     This is a MISCONFIGURATION, and silence is wrong.
- *
- * vault#643: `shouldAutoTranscribe` collapsed the last two into `false`, so a
- * box with transcription enabled and no reachable provider accepted audio,
- * transcribed nothing, wrote no marker, logged nothing, and left an attachment
- * indistinguishable from a plain upload. Observed on a fresh install: the
- * provider resolves to `scribe-http` by default, nothing sets `SCRIBE_URL`, and
- * voice memos silently never transcribe.
- *
- * The hosted door already gets this right — `workers/vault/src/vault-do.ts`
- * marks a terminal state ("voice not enabled for this plan", "monthly voice
- * limit reached") rather than skipping quietly, precisely so the operator never
- * faces an eternal spinner. This brings self-host to the same posture.
- */
+type AutoTranscribeOptions = {
+  readGlobalConfigImpl?: typeof readGlobalConfig;
+  /** Test seam; production uses the registered worker and shared status probe. */
+  providerStateImpl?: () => ProviderState;
+  /** Per-vault → global → true; explicit caller overrides still win. */
+  perVaultEnabled?: boolean;
+  enabledOverride?: boolean;
+};
 export type AutoTranscribeDecision =
   | { kind: "transcribe" }
   | { kind: "not-audio" }
   | { kind: "disabled" }
-  /**
-   * `localProvider` names a local provider INSTALLED on this box (its binary
-   * resolves), or null when there is nothing local here.
-   *
-   * Installation, deliberately, and not the configured provider NAME. The name
-   * is a trap: `resolveTranscriptionProviderName` returns `whisper-cpp` on a
-   * box where nothing at all is set up, because that is the default when no
-   * scribe URL resolves. Keying the message off the name would tell a
-   * fresh-install operator their whisper-cpp install is present when they have
-   * never installed one — trading one false sentence for another.
-   *
-   * It does NOT change the decision: `unavailable` is `unavailable` either way,
-   * because this path resolves a scribe URL and nothing else. It exists purely
-   * so the error can be true. See `noProviderErrorFor`.
-   */
   | { kind: "unavailable"; localProvider: string | null };
 
-/** The full decision behind `shouldAutoTranscribe`. Same inputs, more answer. */
 export function classifyAutoTranscribe(
   mimeType: string,
-  opts: {
-    readGlobalConfigImpl?: typeof readGlobalConfig;
-    getCachedScribeUrlImpl?: () => string | undefined;
-    perVaultEnabled?: boolean;
-    enabledOverride?: boolean;
-    /**
-     * Injectable, same shape as the two impls above. Returns the name of a
-     * local provider installed here, or null. Defaults to the shared
-     * transcription snapshot.
-     */
-    localProviderImpl?: () => string | null;
-  } = {},
+  opts: AutoTranscribeOptions = {},
 ): AutoTranscribeDecision {
   if (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("audio/")) {
     return { kind: "not-audio" };
   }
-  const enabled = opts.enabledOverride
-    ?? opts.perVaultEnabled
-    ?? (opts.readGlobalConfigImpl ?? readGlobalConfig)().auto_transcribe?.enabled
-    ?? true;
+  const enabled = opts.enabledOverride ?? opts.perVaultEnabled ??
+    (opts.readGlobalConfigImpl ?? readGlobalConfig)().auto_transcribe?.enabled ?? true;
   if (!enabled) return { kind: "disabled" };
-  const url = (opts.getCachedScribeUrlImpl ?? getCachedScribeUrl)();
-  if (!url || !url.trim()) {
-    // Still unavailable — this path reads a scribe URL and nothing else, and
-    // that is deliberately unchanged here. We only ask whether something local
-    // would run, so the message can name the real situation instead of telling
-    // an operator to do what they have already done.
-    return {
-      kind: "unavailable",
-      localProvider: (opts.localProviderImpl ?? installedLocalProvider)(),
-    };
-  }
-  return { kind: "transcribe" };
+  const state = (opts.providerStateImpl ?? providerState)();
+  return state.ready
+    ? { kind: "transcribe" }
+    : { kind: "unavailable", localProvider: state.localProvider };
+}
+export function shouldAutoTranscribe(mimeType: string, opts: AutoTranscribeOptions = {}): boolean {
+  return classifyAutoTranscribe(mimeType, opts).kind === "transcribe";
 }
-
-/**
- * The `transcribe_error` written when auto-transcribe is on but no provider is
- * reachable AND nothing local is configured. Deliberately actionable — the
- * operator needs to know which of the two things to do, not just that something
- * went wrong.
- *
- * Correct only when the resolved provider is `scribe-http`. On a box that HAS a
- * local provider this sentence is false in the most expensive way — see
- * `noProviderErrorFor`.
- */
 export const NO_PROVIDER_ERROR =
-  "no transcription provider configured — set TRANSCRIPTION_PROVIDER to a local " +
-  "provider (see `parachute-vault transcription install`), or point SCRIBE_URL at " +
-  "a transcription service";
-
-/**
- * The `transcribe_error` for an `unavailable` decision, told truthfully.
- *
- * Found live: a box with `TRANSCRIPTION_PROVIDER=whisper-cpp`, `parakeet-cli` on
- * PATH, the model downloaded, and `[transcribe] worker started → whisper-cpp` in
- * the same boot was writing `NO_PROVIDER_ERROR` onto its attachments — telling
- * the operator to set the variable they had set and install the provider that
- * was already running. Same failure mode as the `transcription status` bug
- * (#643): a diagnostic that lies during the exact task it exists for, and this
- * one sends someone to re-download a 400 MB model to fix nothing.
- *
- * The asymmetry is real and worth naming in the message rather than hiding:
- * `server.ts` starts a local worker with no scribe URL anywhere in the branch,
- * but this path resolves ONLY a scribe URL. So a local provider genuinely does
- * serve explicit `transcribe: true` requests while genuinely being invisible
- * here. An operator who is not told that will reasonably conclude their install
- * is broken.
- *
- * Deliberately NOT a fix for the asymmetry itself — teaching this path to see
- * local providers changes what gets transcribed, which is a behaviour question
- * and not this diff's to answer.
- */
+  "no transcription provider configured or ready — check `parachute-vault transcription status` " +
+  "and TRANSCRIPTION_PROVIDER. For local transcription use `parachute-vault transcription install`. " +
+  "For an explicitly selected legacy remote provider, check its SCRIBE_URL and worker status. " +
+  "The standalone Scribe service is retired.";
 export function noProviderErrorFor(localProvider: string | null): string {
   if (!localProvider) return NO_PROVIDER_ERROR;
-  return (
-    `auto-transcribe found no reachable provider: it resolves only a scribe URL ` +
-    `(SCRIBE_URL, or a \`parachute-scribe\` entry in services.json), and neither is set. ` +
-    `A local ${localProvider} install IS present here and explicit transcription requests ` +
-    `are routed to it — this path does not consult it. Reinstalling ${localProvider} will ` +
-    `not change this. To auto-transcribe uploads, point SCRIBE_URL at a transcription ` +
-    `service; otherwise request transcription explicitly on the attachment. ` +
-    `\`parachute-vault transcription status\` reports the local install's own state.`
-  );
+  return `auto-transcribe is unavailable: a local ${localProvider} binary is installed, ` +
+    "but the selected worker is not active and ready. Check `parachute-vault transcription status` " +
+    "for missing model/runtime dependencies or a required server restart. " +
+    "A binary alone does not establish readiness; reinstalling it is not necessarily the fix.";
 }
-
-/** Throttle for {@link warnNoTranscriptionProvider}. */
 const NO_PROVIDER_WARN_INTERVAL_MS = 60_000;
 let lastNoProviderWarnAt = 0;
-
-/**
- * Warn (at most once a minute) that audio is arriving with nowhere to send it.
- *
- * Throttled because it fires per-upload: a bulk import of a hundred voice
- * memos should produce one actionable line, not a hundred. Silence was the old
- * behaviour and it is what made this invisible — a box can accept audio for
- * months and never say that transcription isn't wired up.
- */
 export function warnNoTranscriptionProvider(now: () => number = Date.now): void {
   const t = now();
   if (t - lastNoProviderWarnAt < NO_PROVIDER_WARN_INTERVAL_MS) return;
   lastNoProviderWarnAt = t;
-  console.warn(`[transcribe] audio attachment accepted but ${NO_PROVIDER_ERROR}.`);
-}
-
-/** Test seam: forget the throttle window. */
-export function _resetNoProviderWarnForTest(): void {
-  lastNoProviderWarnAt = 0;
+  console.warn(`[transcribe] audio attachment accepted but ${NO_PROVIDER_ERROR}`);
 }
+export function _resetNoProviderWarnForTest(): void { lastNoProviderWarnAt = 0; }

package/src/history-import-routes.test.ts

@@ -45,6 +45,24 @@ async function call(path: string, method = "GET", body?: unknown, verb = "admin"
 }
 
 import { applyImportedNote, beginImportRun, importTargetDigest } from "../core/src/history-import.ts";
+test("authenticated history REST redacts scoped provenance for read/write/admin tokens", async () => {
+  const note = await store.createNote("before", { tags: ["journal"] });
+  await store.updateNote(note.id, { content: "after", actor: "HISTORICAL_EDITOR", via: "HISTORICAL_INTERFACE" });
+  for (const verb of ["read", "write", "admin"]) {
+    for (const scoped of [false, true]) {
+      for (const suffix of ["/versions", "/versions/0"]) {
+        const got = await call(`/notes/${note.id}${suffix}`, "GET", undefined, verb, scoped);
+        expect(got.status).toBe(200);
+        const row = got.body.versions?.[0] ?? got.body;
+        expect(Object.hasOwn(row, "actor")).toBe(!scoped);
+        expect(Object.hasOwn(row, "via")).toBe(!scoped);
+        if (!scoped) expect(row.actor).toBe("HISTORICAL_EDITOR");
+        expect(row.version_ix).toBe(0);
+      }
+    }
+  }
+  expect((await store.getNoteVersion(note.id, 0))!.actor).toBe("HISTORICAL_EDITOR");
+});
 test("imported REST references restore by ID or encoded path and preserve native keys", async () => {
   const note = await store.createNote("native", { path: "folder/imported", tags: ["journal"] });
   await store.updateNote(note.id, { content: "current" });
@@ -66,7 +84,11 @@ test("imported REST references restore by ID or encoded path and preserve native
   expect(list.body.versions.map((v: any) => v.version_ix ?? v.origin)).toEqual([0, "git-import"]);
   for (const body of [{ origin: "git-import" }, { import_ix: 0 }, { origin: "git-import", import_ix: 0, version_ix: 0 }, { origin: "git-import", import_ix: -1 }]) expect((await call(`/notes/${note.id}/restore`, "POST", body)).status).toBe(400);
   expect((await call(`/notes/${note.id}/versions/-1`)).status).toBe(400);
-  const restored = await call(`/notes/${note.id}/restore`, "POST", { origin: "git-import", import_ix: 0 });
+  const beforeRestore = await store.getNote(note.id);
+  const missingStamp = await call(`/notes/${note.id}/restore`, "POST", { origin: "git-import", import_ix: 0 });
+  expect(missingStamp.status).toBe(428);
+  expect(await store.getNote(note.id)).toEqual(beforeRestore);
+  const restored = await call(`/notes/${note.id}/restore`, "POST", { origin: "git-import", import_ix: 0, if_updated_at: beforeRestore!.updatedAt });
   expect(restored.status).toBe(200);
   expect(restored.body.restored_from).toEqual({ origin: "git-import", import_ix: 0 });
   expect((await store.getNote(note.id))!.content).toBe("archive");

package/src/history-import.test.ts

@@ -1,6 +1,6 @@
-import { test, expect } from "bun:test";
+import { test, expect, spyOn } from "bun:test";
 import { createHash } from "node:crypto";
-import { Database } from "bun:sqlite";
+import { Database, SQLiteError } from "bun:sqlite";
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -119,6 +119,38 @@ test("ambiguous sidecars quarantine both identities; malformed YAML diagnostics
   } finally { stage.close(); rmSync(dir, { recursive: true, force: true }); }
 });
 
+for (const format of ["inline", "sidecar"] as const) for (const cache of ["object_cache", "parsed_cache"] as const) {
+  test(`staging SQLite failure in ${format} ${cache} aborts without blaming source notes`, () => {
+    const dir = mkdtempSync(join(tmpdir(), "import-stage-failure-")), stage = new Database(":memory:");
+    const exec = stage.exec.bind(stage);
+    const setup = spyOn(stage, "exec").mockImplementation((sql) => {
+      const result = exec(sql);
+      if (sql.startsWith("CREATE TABLE selection_failures")) {
+        exec(`CREATE TRIGGER fail_cache BEFORE INSERT ON ${cache} BEGIN SELECT RAISE(ABORT, 'staging write failed'); END`);
+      }
+      return result;
+    });
+    try {
+      const repo = repoAt(join(dir, "repo"));
+      if (format === "inline") commit(repo, "valid body");
+      else {
+        mkdirSync(join(repo, ".parachute/notes-meta"), { recursive: true });
+        writeFileSync(join(repo, `.parachute/notes-meta/${noteId}.yaml`), `id: ${noteId}\npath: entry\nextension: json\n`);
+        writeFileSync(join(repo, "entry.json"), '{"valid":true}');
+        git(repo, "add", "."); git(repo, "commit", "-m", "valid sidecar");
+      }
+      let failure: unknown;
+      try { stageArchive(repo, git(repo, "rev-parse", "HEAD"), stage); }
+      catch (error) { failure = error; }
+      expect(failure).toBeInstanceOf(SQLiteError);
+      expect((failure as Error).message).toContain("staging write failed");
+      expect(stage.query("SELECT * FROM issues").all()).toEqual([]);
+      expect(stage.query("SELECT * FROM quarantine").all()).toEqual([]);
+      expect(stage.query("SELECT * FROM observations").all()).toEqual([]);
+    } finally { setup.mockRestore(); stage.close(); rmSync(dir, { recursive: true, force: true }); }
+  });
+}
+
 test("running daemon refuses prepare before creating a pause marker or backup", async () => {
   const dir = mkdtempSync(join(tmpdir(), "import-busy-")), saved = process.env.PARACHUTE_HOME;
   process.env.PARACHUTE_HOME = dir;

package/src/history-import.ts

@@ -1,5 +1,5 @@
 /** Offline git-history import. Git objects are data; no working tree is checked out. */
-import { Database } from "bun:sqlite";
+import { Database, SQLiteError } from "bun:sqlite";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fsyncSync, mkdirSync, mkdtempSync, openSync, readSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -182,6 +182,9 @@ export function stageArchive(repo: string, tip: string, stage: Database, inputSe
       collect(id, state, () => JSON.parse((parsedBody.get(cacheKey) as { row_json: string }).row_json), { git_path: entry.path, blob: entry.hash, sidecar });
     };
     const failure = (entry: typeof entries[number], error: unknown, id?: unknown) => {
+      // Staging/cache failures are operational, not evidence of malformed source.
+      // Abort so no diagnostic manifest can bless an incomplete archive walk.
+      if (error instanceof SQLiteError) throw error;
       const message = error instanceof Error ? error.message : "invalid_observation";
       const reason = /^[a-z_]+$/.test(message) ? message : "invalid_metadata_or_utf8";
       if (error instanceof GitArchiveError || message === "Archive byte limit exceeded" || message === "Archive note limit exceeded") throw error;

package/src/mcp-tools.ts

@@ -6,6 +6,7 @@
  */
 
 import { generateMcpTools, resolveNote } from "../core/src/mcp.ts";
+import { projectHistoryProvenance } from "../core/src/history-visibility.js";
 import type { McpToolDef, GenerateMcpToolsOpts } from "../core/src/mcp.ts";
 import { getNote, getNoteTags, getVaultMap } from "../core/src/notes.ts";
 import { narrowLinkWarningsForVisibility } from "../core/src/wikilinks.ts";
@@ -579,8 +580,13 @@ function applyTagScopeWrappers(
     )) {
       const id = (params as any).versions.note_id;
       const note = resolveNote(store.db, id);
-      return note && noteWithinTagScope(note, allowed, rawTags)
-        ? result : { error: "Note not found", error_type: "not_found", id };
+      if (!note || !noteWithinTagScope(note, allowed, rawTags)) {
+        return { error: "Note not found", error_type: "not_found", id };
+      }
+      if ("versions" in result && Array.isArray(result.versions)) {
+        return { ...result, versions: result.versions.map(row => projectHistoryProvenance(row, true)) };
+      }
+      return projectHistoryProvenance(result, true);
     }
     // Possible response shapes (vault#550 added the `warnings` variants):
     //   - Array (legacy list, no cursor, no warnings)

package/src/routes.ts

@@ -13,6 +13,7 @@ import { getImportedVersion, importStorageIndex, parseHistorySelector, projectHi
  */
 
 import { HistoryNotFoundError, latestTombstone } from "../core/src/history.js";
+import { projectHistoryProvenance } from "../core/src/history-visibility.js";
 import { ULID_REGEX } from "../core/src/ulid.js";
 import type { Database } from "bun:sqlite";
 import type { Store, Note, QueryOpts, AggregateSpec } from "../core/src/types.ts";
@@ -268,6 +269,7 @@ function conflictResponse(e: any): Response | null {
       400,
     );
   }
+  if (e && e.code === "PRECONDITION_REQUIRED") return json({ error_type: "precondition_required", note_id: e.note_id, message: e.message }, 428);
   if (e && e.code === "HISTORY_NOT_FOUND") return json({ error: e.message, error_type: "not_found" }, 404);
   if (e && e.code === "HISTORY_OVERFLOW") return json({
     error_type: "history_overflow", note_id: e.note_id, byte_size: e.byte_size, limit: e.limit, message: e.message,
@@ -2942,7 +2944,7 @@ async function handleNotesInner(
         const offset = Math.max(0, Number.parseInt(url.searchParams.get("offset") ?? "0", 10) || 0);
         const versions = await store.listNoteVersions(id, { limit, offset });
         const total = await store.countNoteVersions(id);
-        return json({ versions: versions.map(projectHistoryRow), total });
+        return json({ versions: versions.map(row => projectHistoryProvenance(projectHistoryRow(row), tagScope.allowed !== null)), total });
       }
       if (method === "DELETE") {
         const result = await store.eraseNoteHistory(id);
@@ -2953,7 +2955,7 @@ async function handleNotesInner(
       if (!/^\d+$/.test(importMatch[1]!) || !Number.isSafeInteger(index) || index < 0) return json({ error: "Invalid import_ix", error_type: "invalid_request" }, 400);
       try {
         const version = getImportedVersion(db, id, index);
-        return version ? json(projectHistoryRow(version)) : json({ error: "Not found", error_type: "not_found", origin: "git-import", import_ix: index }, 404);
+        return version ? json(projectHistoryProvenance(projectHistoryRow(version), tagScope.allowed !== null)) : json({ error: "Not found", error_type: "not_found", origin: "git-import", import_ix: index }, 404);
       } catch (e) {
         const response = conflictResponse(e);
         if (response) return response;
@@ -2964,7 +2966,7 @@ async function handleNotesInner(
       if (!/^\d+$/.test(verMatch[1]!) || !Number.isInteger(ix) || ix < 0) return json({ error: "Invalid version_ix", error_type: "invalid_request" }, 400);
       try {
         const version = await store.getNoteVersion(id, ix);
-        return version ? json(version) : json({ error: "Not found", error_type: "not_found" }, 404);
+        return version ? json(projectHistoryProvenance(version, tagScope.allowed !== null)) : json({ error: "Not found", error_type: "not_found" }, 404);
       } catch (e) {
         const response = conflictResponse(e);
         if (response) return response;

package/src/server.ts

@@ -145,7 +145,7 @@ function wireTranscriptionWorker(worker: TranscriptionWorker): void {
     worker,
     (store) => getVaultNameForStore(store as never),
   );
-  setTranscriptionWorker(worker);
+  setTranscriptionWorker(worker, providerName);
 }
 
 // Fields the worker needs regardless of provider (queue/retention/context).
@@ -157,8 +157,8 @@ const commonWorkerOpts = {
   getContextPredicates: (vault: string) => readVaultConfig(vault)?.transcription?.context,
 };
 
-// Provider selection (scribe-fold Phase 2a). Default is `scribe-http` — unset
-// TRANSCRIPTION_PROVIDER means the existing scribe-http path runs unchanged.
+// Provider selection uses the shared resolver (local whisper-cpp by default
+// without legacy remote discovery). Bind this identity when wiring the worker.
 const providerName = resolveTranscriptionProviderName();
 if (providerName === "whisper-cpp") {
   // whisper.cpp's prebuilt CLIs — the local, no-Python path that actually
@@ -289,9 +289,10 @@ if (providerName === "whisper-cpp") {
     console.warn(
       "[transcribe] NO transcription provider is reachable — audio attachments " +
         "will be accepted but never transcribed. " +
-        `Provider resolved to "${providerName}". Fix with either: ` +
-        "`parachute-vault transcription install` + TRANSCRIPTION_PROVIDER=<local provider>, " +
-        "or point SCRIBE_URL at a transcription service. " +
+        `Provider resolved to "${providerName}". The standalone Scribe service is retired. ` +
+        "For explicit transcription, use `parachute-vault transcription install` and " +
+        "check `parachute-vault transcription status`. Automatic uploads require " +
+        "the selected worker to be active and ready. " +
         "Set `auto_transcribe.enabled: false` to silence this if you don't want transcription.",
     );
   }
@@ -756,4 +757,3 @@ setInterval(() => {
   }
   void shutdown("STOP_SIGNAL");
 }, STOP_POLL_MS).unref();
-

package/src/transcription-registry.ts

@@ -1,22 +1,24 @@
 /**
  * Process-singleton holder for the active TranscriptionWorker (vault#353).
  *
- * Mirrors `mirror-registry.ts`: `server.ts` constructs the worker on boot
- * (when scribe is discoverable), and the REST retry endpoint
- * (`/api/notes/:id/retry-transcription`) picks it up here to call `kick()`
- * for an event-driven re-run. Absent the worker (no scribe), the retry
- * endpoint still flips the attachment back to `pending` so the sweep would
- * pick it up — but it'll just sit there until scribe shows up.
+ * The server registers its selected local or remote worker at boot after
+ * wiring the attachment hook. Retry endpoints use the worker to kick jobs;
+ * automatic-upload eligibility also checks the startup provider identity.
  */
 
 import type { TranscriptionWorker } from "./transcription-worker.ts";
 
 let activeWorker: TranscriptionWorker | null = null;
+let activeProvider: string | null = null;
 
-export function setTranscriptionWorker(worker: TranscriptionWorker | null): void {
+export function setTranscriptionWorker(worker: TranscriptionWorker | null, provider: string | null = null): void {
   activeWorker = worker;
+  activeProvider = worker ? provider : null;
 }
 
+/** Provider bound at worker startup, not a newly edited environment value. */
+export function getTranscriptionWorkerProvider(): string | null { return activeProvider; }
+
 export function getTranscriptionWorker(): TranscriptionWorker | null {
   return activeWorker;
 }

package/src/vault-compact-routes.test.ts

@@ -64,7 +64,7 @@ test("P9/P18 compacted REST and MCP versions roundtrip with exact keys", async (
   expect(mcp).toEqual(get.body);
   const ml = await query()({ versions: { note_id: n.id, limit: 2 } }) as any;
   expect(ml.total).toBe(list.body.total);
-  const restore = await call(`/notes/${n.id}/restore`, "POST", { version_ix: 0 });
+  const restore = await call(`/notes/${n.id}/restore`, "POST", { version_ix: 0, if_updated_at: (await store.getNote(n.id))!.updatedAt });
   expect(restore.status).toBe(200);
   expect((await store.getNote(n.id))!.content).toBe(before.content);
 });

package/src/vault-history-routes.test.ts

@@ -11,6 +11,8 @@ import {
 import { getVaultStore, clearVaultStoreCache } from "./vault-store.ts";
 import { generateScopedMcpTools } from "./mcp-tools.ts";
 import { runDoctorScan } from "../core/src/doctor.ts";
+import { applyImportedNote, beginImportRun, importTargetDigest } from "../core/src/history-import.ts";
+import { resolveHistoryPolicy } from "../core/src/history.ts";
 let taskDir: string,
   savedHome: string | undefined,
   store: ReturnType<typeof getVaultStore>;
@@ -78,9 +80,56 @@ async function fixture() {
   await store.updateNote(n.id, { content: "two" });
   return n;
 }
+test("tag-scoped REST and MCP history omit provenance without changing stored rows", async () => {
+  const n = await store.createNote("original", { path: "history-visible", tags: ["journal"] });
+  await store.updateNote(n.id, { content: "current", actor: "PRIVATE_EDITOR", via: "PRIVATE_INTERFACE" });
+  const run = { run_id: "visibility", source_fingerprint: "source", tip: "tip", options_digest: "options" };
+  beginImportRun(store.db, run);
+  applyImportedNote(store.db, { run, noteId: n.id, targetDigest: importTargetDigest(store.db, n.id),
+    policy: resolveHistoryPolicy({ min_versions: 20 }), now: Date.now(),
+    observations: [{ content: "archive", path: "old/path", metadata: {}, extension: "md", created_at: null,
+      observed_at: new Date().toISOString(), commit: "commit", blob: "blob" }] });
+  const before = await store.listNoteVersions(n.id);
+  const full = (await call(n.id, "/versions")).body;
+  expect(full.versions[0]).toMatchObject({ actor: "PRIVATE_EDITOR", via: "PRIVATE_INTERFACE" });
+  for (const scoped of [false, true]) {
+    const rest = (await call(n.id, "/versions", "GET", undefined, scoped)).body;
+    const mcp = await query(scoped ? ["journal"] : null)({ versions: { note_id: n.id } });
+    expect(mcp).toEqual(rest);
+    expect(rest.total).toBe(2);
+    expect(rest.versions[0].version_ix).toBe(0);
+    expect(rest.versions[1]).toMatchObject({ origin: "git-import", import_ix: 0 });
+    for (const row of rest.versions) {
+      expect(Object.hasOwn(row, "actor")).toBe(!scoped);
+      expect(Object.hasOwn(row, "via")).toBe(!scoped);
+    }
+    for (const [path, selector, content] of [
+      ["/versions/0", { version_ix: 0 }, "original"],
+      ["/imports/0", { origin: "git-import", import_ix: 0 }, "archive"],
+    ] as const) {
+      const one = await call(n.id, path, "GET", undefined, scoped);
+      expect(one.status).toBe(200);
+      expect(one.body.content).toBe(content);
+      expect(await query(scoped ? ["journal"] : null)({ versions: { note_id: n.id, ...selector } })).toEqual(one.body);
+      expect(Object.hasOwn(one.body, "actor")).toBe(!scoped);
+      expect(Object.hasOwn(one.body, "via")).toBe(!scoped);
+    }
+  }
+  expect(await store.listNoteVersions(n.id)).toEqual(before);
+  expect((await store.getNote(n.id))!.content).toBe("current");
+  // Empty tag lists mean unrestricted in the existing authorization contract.
+  expect(await query([])({ versions: { note_id: n.id } })).toEqual(full);
+  const denied = await query(["unrelated"])({ versions: { note_id: n.id } });
+  expect(denied).toMatchObject({ error_type: "not_found" });
+});
 test("P5 REST restore rejects stale optimistic tokens without capture", async () => {
   const n = await fixture();
   const before = await store.listNoteVersions(n.id);
+  for (const extra of [{}, { force: true }]) {
+    const missing = await call(n.id, "/restore", "POST", { version_ix: 0, ...extra });
+    expect(missing.status).toBe(428);
+    expect(missing.body.error_type).toBe("precondition_required");
+  }
   const r = await call(n.id, "/restore", "POST", {
     version_ix: 0,
     if_updated_at: "1999-01-01T00:00:00.000Z",
@@ -393,7 +442,7 @@ test("P24 migration bypass restores, captures once, and emits the bypass log", a
   const n = await strictFixture();
   const log = spyOn(console, "warn").mockImplementation(() => {});
   try {
-    const r = await call(n.id, "/restore", "POST", { version_ix: 0 }, false, {
+    const r = await call(n.id, "/restore", "POST", { version_ix: 0, if_updated_at: (await store.getNote(n.id))!.updatedAt }, false, {
       actor: "migrator",
       via: "api",
       bypassStrict: true,