omnius 1.0.641 → 1.0.643

package/docs/DISCOVERY.json

@@ -4473,7 +4473,7 @@
           "tags": [
             "Audio"
           ],
-          "description": "Managed inference contract: {session_id,file,asset_digest?,channel?,sample_rate_hz?,timeout_ms?}. It accepts only a retained mono PCM16/16 kHz WAV greater than 0 and at most 6 seconds. The persistent worker is limited to one active job plus one queued job; cancellation terminates it before clearing both. Output is omnius.speaker-diarization.v1 SpeakerTurnSpan[] with start_ms/end_ms/channel, explicit overlap, and labels scoped only to session_id; spans may populate audio_observation.diarizationClusterId but cannot create durable identities. Inference never installs, downloads, or starts an unready worker.",
+          "description": "Managed inference contract: {session_id,file,asset_digest?,channel?,sample_rate_hz?,timeout_ms?}. It accepts only a retained mono PCM16/16 kHz WAV greater than 0 and at most 6 seconds. The controller is limited to one active job plus one queued job; cancellation terminates its process group before clearing both. Output is omnius.speaker-diarization.v1 SpeakerTurnSpan[] with explicit overlap and session-local labels. Inference may activate an already-provisioned runtime but never installs packages, builds code, or downloads model bytes.",
           "responses": {
             "200": {
               "description": "Typed managed diarization spans."
@@ -4631,7 +4631,7 @@
           "tags": [
             "Audio"
           ],
-          "description": "Non-mutating readiness for NVIDIA diar_streaming_sortformer_4spk-v2. It never downloads, installs, creates environments, or loads a model. 200 requires a persistent worker that has proved it loaded the operator-verified local .nemo snapshot with the validated Orin CUDA Python runtime; otherwise this returns typed 503. The output contract is typed speaker-turn spans with explicit overlap and session-local labels only; those labels are never durable identities.",
+          "description": "Non-mutating readiness for NVIDIA diar_streaming_sortformer_4spk-v2. It never downloads, installs, creates environments, or loads a model. Managed JetPack setup pins NVIDIA's Q8 GGUF plus NeMo-Speech.cpp source revision and keeps one persistent worker/controller serialized; operator-provided .nemo/Python snapshots remain supported. 200 requires the verified runtime worker to be active. Session-local labels are never durable identities.",
           "responses": {
             "200": {
               "description": "Verified local snapshot and warm managed live worker."
@@ -4651,7 +4651,7 @@
       "id": "api.v1-audio-diarization-live-setup",
       "kind": "api",
       "title": "/v1/audio/diarization/live/setup",
-      "summary": "Verify and activate a local live-diarization runtime",
+      "summary": "Provision and activate live Sortformer on JetPack",
       "aliases": [
         "/v1/audio/diarization/live/setup"
       ],
@@ -4703,32 +4703,28 @@
       ],
       "operations": {
         "post": {
-          "summary": "Verify and activate a local live-diarization runtime",
+          "summary": "Provision and activate live Sortformer on JetPack",
           "tags": [
             "Audio"
           ],
-          "description": "Admin-only. Body requires absolute snapshot_path and an absolute python_path (or OMNIUS_DIAR_LIVE_PYTHON). The manifest must be omnius.audio-diarization-model-snapshot.v1 for nvidia/diar_streaming_sortformer_4spk-v2 with a full immutable 40- or 64-hex revision, relative artifact path, and sha256:<digest>. Setup streams those exact local bytes, validates the supplied Python imports plus Jetson Orin CUDA:0 CC 8.7, and warms the persistent worker. It never downloads NeMo, CUDA, model weights, or dependencies; exact runtime prerequisites are rejected rather than guessed.",
+          "description": "Admin-only and asynchronous. An empty JSON object provisions the pinned public Q8 Sortformer artifact and builds an immutable-revision CUDA NeMo-Speech.cpp runtime under ~/.omnius without modifying JetPack Torch. Poll readiness after HTTP 202. Advanced operators may instead provide snapshot_path/manifest_path plus python_path for a checksum-pinned .nemo runtime. Setup may download/build; inference never does.",
           "requestBody": {
             "required": true,
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
-                  "required": [
-                    "snapshot_path"
-                  ],
                   "properties": {
                     "snapshot_path": {
                       "type": "string",
-                      "description": "Absolute local directory containing the operator-provided snapshot."
+                      "description": "Optional absolute operator snapshot; omit for managed Q8 setup."
                     },
                     "manifest_path": {
-                      "type": "string",
-                      "description": "Optional absolute manifest path; defaults to snapshot_path/omnius-model-manifest.json."
+                      "type": "string"
                     },
                     "python_path": {
                       "type": "string",
-                      "description": "Absolute pre-provisioned Python with NeMo and Jetson CUDA imports."
+                      "description": "Optional absolute external NeMo Python for an operator .nemo snapshot."
                     }
                   }
                 }
@@ -4737,10 +4733,13 @@
           },
           "responses": {
             "200": {
-              "description": "Snapshot, runtime imports, and worker all verified/warm."
+              "description": "Already ready."
+            },
+            "202": {
+              "description": "Managed single-flight setup accepted; poll readiness."
             },
             "400": {
-              "description": "Snapshot, Python runtime, immutable manifest/digest validation, or worker warmup failed."
+              "description": "Setup request or prerequisite validation failed before launch."
             },
             "403": {
               "description": "Admin scope required."
@@ -4812,7 +4811,7 @@
           "tags": [
             "Audio"
           ],
-          "description": "Managed offline/dream contract: {file,observation_ids,episode_id?,timeout_ms?}. file is a retained local asset and may be longer than the live six-second window. The supplied IDs refer to role-isolated AudioObservation records. The pyannote worker returns only OfflineReconciliationProposal records: a proposed diarization_cluster_id, review requirement, and durable_identity:forbidden. Inference never installs, downloads, or starts an unready worker.",
+          "description": "Managed offline/dream contract: {file,observation_ids,episode_id?,timeout_ms?}. file is a retained uncompressed PCM16 WAV and may be longer than the live six-second window. The supplied IDs refer to role-isolated AudioObservation records. The pyannote worker returns only OfflineReconciliationProposal records with durable_identity:forbidden. Inference may activate the already-provisioned private CPU runtime but never installs, downloads, or modifies runtime dependencies or model bytes.",
           "responses": {
             "200": {
               "description": "Typed review-required reconciliation proposals and spans."
@@ -4970,7 +4969,7 @@
           "tags": [
             "Audio"
           ],
-          "description": "Non-mutating readiness for pyannote/speaker-diarization-community-1. It never downloads, installs, creates environments, or loads a model. 200 requires a persistent worker that proved it loaded the operator-supplied offline local snapshot. Community-1 snapshots must carry a deterministic files checksum map for every regular pipeline/model/config file; readiness checks that complete manifest metadata without rehashing. Reconciliation makes only reviewable cluster proposals, never durable identity claims.",
+          "description": "Non-mutating readiness for pyannote/speaker-diarization-community-1. It never downloads, installs, creates environments, or loads a model. Managed setup creates a private CPU-only PyTorch/pyannote environment, leaving JetPack CUDA Torch untouched, and stores a complete checksummed offline model tree. Reconciliation makes reviewable cluster proposals, never durable identity claims.",
           "responses": {
             "200": {
               "description": "Verified complete local Community-1 snapshot and warm managed worker."
@@ -4990,7 +4989,7 @@
       "id": "api.v1-audio-diarization-reconcile-setup",
       "kind": "api",
       "title": "/v1/audio/diarization/reconcile/setup",
-      "summary": "Verify and activate a local reconciliation runtime",
+      "summary": "Provision and activate offline Community-1 reconciliation",
       "aliases": [
         "/v1/audio/diarization/reconcile/setup"
       ],
@@ -5042,11 +5041,11 @@
       ],
       "operations": {
         "post": {
-          "summary": "Verify and activate a local reconciliation runtime",
+          "summary": "Provision and activate offline Community-1 reconciliation",
           "tags": [
             "Audio"
           ],
-          "description": "Admin-only. Body requires absolute snapshot_path and an absolute python_path (or OMNIUS_DIAR_RECONCILE_PYTHON), plus pyannote_terms_accepted=true to attest the operator already accepted Community-1's gated terms. Omnius does not accept or persist a token: the snapshot must already be local. The manifest must pin a full immutable 40- or 64-hex revision, the primary artifact digest, and a complete files object mapping every regular pipeline/model/config file to sha256:<digest>. Setup streams/verifies those bytes, validates local pyannote imports, and warms the offline CPU worker. It never downloads pyannote, weights, or dependencies.",
+          "description": "Admin-only and asynchronous. With pyannote_terms_accepted=true and OMNIUS_HF_TOKEN in the daemon environment, setup creates a private CPython 3.10 CPU runtime with pinned PyTorch/Torchaudio/pyannote versions, downloads the immutable Community-1 revision, removes setup credentials, checksums the complete offline model tree, and warms the worker. TorchCodec is deliberately omitted because it has no CPython 3.10/aarch64 wheel; the worker uses pyannote's supported in-memory waveform input for retained PCM16 WAV instead. It never modifies JetPack CUDA Torch. Operator-provided snapshot_path/python_path remains supported. Credentials are rejected in the HTTP body and are never persisted or passed to inference.",
           "requestBody": {
             "required": true,
             "content": {
@@ -5054,19 +5053,19 @@
                 "schema": {
                   "type": "object",
                   "required": [
-                    "snapshot_path",
                     "pyannote_terms_accepted"
                   ],
                   "properties": {
                     "snapshot_path": {
-                      "type": "string"
+                      "type": "string",
+                      "description": "Optional operator snapshot; omit for managed gated download."
                     },
                     "manifest_path": {
                       "type": "string"
                     },
                     "python_path": {
                       "type": "string",
-                      "description": "Absolute pre-provisioned Python with pyannote.audio."
+                      "description": "Optional pre-provisioned external pyannote Python."
                     },
                     "pyannote_terms_accepted": {
                       "type": "boolean",
@@ -5081,10 +5080,13 @@
           },
           "responses": {
             "200": {
-              "description": "Complete snapshot, runtime imports, and worker all verified/warm."
+              "description": "Already ready."
+            },
+            "202": {
+              "description": "Managed single-flight setup accepted; poll readiness."
             },
             "400": {
-              "description": "Terms attestation, snapshot tree, Python runtime, immutable manifest validation, or worker warmup failed."
+              "description": "Terms attestation, setup request, or prerequisite validation failed before launch."
             },
             "403": {
               "description": "Admin scope required."
@@ -5399,7 +5401,7 @@
           "tags": [
             "Audio"
           ],
-          "description": "Admin-only. Requires kind=acoustic|speaker|semantic in the query (canonical) or JSON body. acoustic reuses the pinned JetPack YAMNet/TensorRT setup; speaker creates a private CPython 3.10 CPU-only WeSpeaker CAM++ venv, installs only checksum-pinned NumPy, ONNX Runtime, and its locked CPU support wheels with --no-deps/--no-index, then downloads the pinned model. Its 80-bin Kaldi-compatible NumPy fbank is validated with a versioned cross-platform numeric-invariant probe before readiness. The speaker path never imports, links, replaces, or otherwise depends on JetPack Torch/Torchaudio, so an incompatible generic Torchaudio wheel cannot affect CUDA-enabled Egg Torch. semantic installs the isolated JetPack CUDA CLAP dependencies and pinned model. This is the only REST operation allowed to provision. It activates and warms only the requested role worker; no role is substituted for another.",
+          "description": "Admin-only. Requires kind=acoustic|speaker|semantic in the query (canonical) or JSON body. acoustic reuses pinned JetPack YAMNet/TensorRT. speaker creates a private CPU-only WeSpeaker CAM++ venv with checksum-pinned NumPy/ONNX Runtime wheels and no Torch/Torchaudio dependency. semantic installs a checksum-locked CPython 3.10/aarch64 dependency closure plus the immutable CLAP revision while leaving vendor Torch untouched. Omnius never imports, links, replaces, or resolves a generic Torch package over JetPack Torch for either isolated runtime. JetPack daemon bootstrap provisions all three roles by default; OMNIUS_AUDIO_AUTO_SETUP=0 disables all and OMNIUS_SEMANTIC_AUDIO_AUTO_SETUP=0 disables CLAP. Semantic provisioning may finish under memory pressure, while activation/inference still requires the 8 GiB admission threshold and never evicts another workload. This is the only REST operation allowed to provision, and no role is substituted for another.",
           "parameters": [
             {
               "name": "kind",
@@ -6163,6 +6165,11 @@
                       "default": 1,
                       "description": "Maximum daemon-tool planning rounds. The default executes one tool round, then removes daemon schemas for lower-latency final synthesis."
                     },
+                    "agent_prefetch_web_search": {
+                      "type": "boolean",
+                      "default": false,
+                      "description": "Explicitly execute authorized web_search with the latest user text before one backend synthesis. factual-first enables this automatically."
+                    },
                     "max_turns": {
                       "type": "integer",
                       "description": "Q2 — agent_loop max iterations (default 8, max 64)."
@@ -6172,7 +6179,7 @@
                       "enum": [
                         "factual-first"
                       ],
-                      "description": "Q8 — prepended system policy template. 'factual-first' instructs model to call web_search FIRST for any factual question."
+                      "description": "Factual-first prefetches authorized web_search from the latest user turn and performs one grounded synthesis generation."
                     }
                   }
                 }
@@ -16814,7 +16821,7 @@
           "tags": [
             "Vision"
           ],
-          "description": "Non-mutating status for the isolated ~/.omnius/runtimes/vision/open-clip runtime. It never imports Python, installs dependencies, downloads weights, or loads a model. Returns 503 until the checksum-manifested CUDA runtime and model artifacts are ready.",
+          "description": "Non-mutating status for the isolated ~/.omnius/runtimes/vision/open-clip runtime. It never imports Python, installs dependencies, downloads weights, or loads a model. It distinguishes installed/weightsReady from inferenceAvailable: a fully provisioned runtime remains HTTP 503 while Jetson unified-memory admission is temporarily blocked.",
           "responses": {
             "200": {
               "description": "Verified OpenCLIP runtime is ready"
@@ -16889,10 +16896,10 @@
           "tags": [
             "Vision"
           ],
-          "description": "Admin-only single-flight setup. It creates a --system-site-packages venv, requires pre-existing CUDA Torch, installs only pinned non-Torch packages with --no-deps, and fetches/verifies the OpenCLIP checkpoint. It never resolves Torch or torchvision from generic PyPI. torchvision must be inherited from the JetPack vendor stack or supplied as a checksum-pinned local wheel via OMNIUS_VISION_TORCHVISION_WHEEL and OMNIUS_VISION_TORCHVISION_WHEEL_SHA256. Poll readiness for completion or failure; the setup request never makes an embedding inference request provision dependencies.",
+          "description": "Admin-only single-flight setup, also daemon-bootstrapped by default on JetPack (OMNIUS_VISION_AUTO_SETUP=0 disables). It creates a --system-site-packages venv, inherits existing CUDA Torch and vendor torchvision, installs a fully pinned non-Torch wheel closure with --no-deps, and then validates the managed runtime with user-site packages disabled. It downloads the OpenCLIP checkpoint from immutable revision 1a25a446712ba5ee05982a381eed697ef9b435cf with a fixed SHA-256. It never resolves Torch/torchvision from generic PyPI. A checksum-pinned local torchvision wheel override remains supported. Provisioning completes despite transient memory pressure; only model loading/inference applies the 8 GiB admission gate.",
           "responses": {
             "200": {
-              "description": "Already ready"
+              "description": "Provisioned; readiness may still report memory-blocked until model loading is admitted"
             },
             "202": {
               "description": "Single-flight setup accepted; poll readiness"

package/docs/DISCOVERY.md

@@ -104,11 +104,11 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `api.v1-audio-diarization-live` | /v1/audio/diarization/live | Diarize live/session-local speaker turns |
 | `api.v1-audio-diarization-live-cancel` | /v1/audio/diarization/live/cancel | Cancel live diarization work |
 | `api.v1-audio-diarization-live-readiness` | /v1/audio/diarization/live/readiness | Read managed live speaker-turn diarization readiness |
-| `api.v1-audio-diarization-live-setup` | /v1/audio/diarization/live/setup | Verify and activate a local live-diarization runtime |
+| `api.v1-audio-diarization-live-setup` | /v1/audio/diarization/live/setup | Provision and activate live Sortformer on JetPack |
 | `api.v1-audio-diarization-reconcile` | /v1/audio/diarization/reconcile | Reconcile offline/dream diarization observations |
 | `api.v1-audio-diarization-reconcile-cancel` | /v1/audio/diarization/reconcile/cancel | Cancel offline diarization reconciliation work |
 | `api.v1-audio-diarization-reconcile-readiness` | /v1/audio/diarization/reconcile/readiness | Read offline/dream speaker-reconciliation readiness |
-| `api.v1-audio-diarization-reconcile-setup` | /v1/audio/diarization/reconcile/setup | Verify and activate a local reconciliation runtime |
+| `api.v1-audio-diarization-reconcile-setup` | /v1/audio/diarization/reconcile/setup | Provision and activate offline Community-1 reconciliation |
 | `api.v1-audio-embed` | /v1/audio/embed | Create a managed role-typed audio embedding |
 | `api.v1-audio-embed-health` | /v1/audio/embed/health | Read role-typed audio embedding readiness |
 | `api.v1-audio-embed-setup` | /v1/audio/embed/setup | Provision and activate one role-typed audio embedding runtime |

package/docs/reference/configuration.md

@@ -22,6 +22,15 @@ Configuration is layered from environment, global user settings, project setting
 | `OMNIUS_VIBEVOICE_PYTHON` | Host Python used to create the VibeVoice venv; its CUDA-enabled Torch is inherited with `--system-site-packages` |
 | `OMNIUS_VIBEVOICE_ATTN` | VibeVoice attention implementation (`sdpa` by default; use a host-supported implementation) |
 | `OMNIUS_VIBEVOICE_MAX_NEW_TOKENS` | Explicit VibeVoice structured-transcript generation ceiling (default `32768`) |
+| `OMNIUS_AUDIO_PYTHON` | Preferred JetPack CPython 3.10 interpreter containing vendor CUDA Torch; bounded workspace discovery is used when unset |
+| `OMNIUS_AUDIO_AUTO_SETUP` | Set to `0` to disable daemon-owned acoustic, speaker, and semantic audio setup |
+| `OMNIUS_SEMANTIC_AUDIO_AUTO_SETUP` | Set to `0` to disable CLAP setup specifically; JetPack default is enabled |
+| `OMNIUS_VISION_AUTO_SETUP` | Set to `0` to disable managed OpenCLIP provisioning on JetPack |
+| `OMNIUS_VISION_PYTHON` | Explicit vendor CUDA Python for the isolated OpenCLIP runtime |
+| `OMNIUS_NEMO_SPEECH_BIN` | Optional existing CUDA-enabled NeMo-Speech.cpp binary; otherwise live diarization builds the pinned source revision |
+| `OMNIUS_DIARIZATION_AUTO_SETUP` | Set to `0` to disable managed diarizer provisioning; live Sortformer defaults on for JetPack |
+| `OMNIUS_HF_TOKEN` | Setup-only Hugging Face token for gated Community-1 download; never persisted or passed to inference |
+| `OMNIUS_PYANNOTE_TERMS_ACCEPTED` | Set to `1` only after accepting Community-1 terms; permits gated daemon bootstrap when a token is present |
 
 ## Provider Key Precedence
 
@@ -41,6 +50,13 @@ The first defined value wins. `OMNIUS_REST_API_KEY` and
 `OMNIUS_REST_API_KEYS` authenticate callers to the Omnius daemon; they are not
 upstream provider credentials.
 
+Linux installations load optional daemon-only overrides from
+`~/.config/omnius/daemon.env`. The postinstall creates this file with mode
+`0600` and the systemd unit references it with an optional `EnvironmentFile`.
+This is the appropriate place for `OMNIUS_AUDIO_PYTHON` or a setup-only gated
+model token; credentials do not need to be embedded in the unit or sent in a
+REST request.
+
 ## Provider Protocol
 
 Known provider presets select one of `ollama`, `openai-chat`, or

package/docs/rest/endpoints/chat.md

@@ -47,6 +47,7 @@ Important body fields:
 | `daemon_tool_names` | array | Exact daemon-tool allowlist; recommended for local models |
 | `agent_timeout_s` | number | Whole-loop deadline, default 45 seconds and maximum 600 |
 | `agent_max_tool_rounds` | integer | Daemon tool rounds before forced final synthesis; default 1 |
+| `agent_prefetch_web_search` | boolean | Explicit one-generation web-search prefetch; factual-first enables it automatically |
 | `max_turns` | integer | Server-side agent loop turn cap |
 | `prompt_template` | string | Optional template such as `factual-first` |
 
@@ -130,4 +131,4 @@ For ASR/TTS systems that only need the text brain, use `/realtime` or `/v1/realt
 
 `/v1/chat/completions` can run an internal tool loop when `agent_loop: true`. This lets clients collapse multiple model/tool round trips into one daemon request. Daemon tool calls execute inline; client-owned tool calls can still be yielded in OpenAI-compatible shape.
 
-Ollama-backed loops use its native `/api/chat` tool protocol. `timeout_s` applies to each backend round, while `agent_timeout_s` bounds the complete loop and defaults to 45 seconds. The planning turn is capped at 96 output tokens. By default Omnius executes one daemon-tool round, then removes daemon schemas for the final synthesis; set `agent_max_tool_rounds` only when a workflow genuinely needs deeper tool chaining. Omnius returns a typed HTTP 504 when the total budget expires and HTTP 508 when a model repeats the same daemon tool with identical arguments. Tool results are capped at 6,000 characters before the next prompt. Without `daemon_tool_names`, Omnius offers only a compact core catalog permitted by `include_daemon_tools`; `prompt_template: "factual-first"` narrows it further to `web_search` and `web_fetch`.
+Ollama-backed loops use its native `/api/chat` tool protocol. `timeout_s` applies to each backend round, while `agent_timeout_s` bounds the complete loop and defaults to 45 seconds. For a normal loop, the planning turn is capped at 96 output tokens; one daemon-tool round is the default, after which Omnius removes daemon schemas for final synthesis. `prompt_template: "factual-first"` skips that model-planning round entirely: Omnius executes the already-mandated, authorized `web_search` using the latest user turn, inserts the protocol-correct tool evidence, and performs one grounded synthesis generation. `agent_prefetch_web_search: true` opts into the same path directly. Generic/deeper tool workflows remain available through `agent_max_tool_rounds`. Omnius returns typed HTTP 504/508 failures, caps tool evidence at 6,000 characters, and limits the implicit catalog unless `daemon_tool_names` requests exact additions.

package/docs/rest/endpoints/voice-vision.md

@@ -83,16 +83,25 @@ HTTP 503 until the isolated runtime and checksum-manifested weights are ready.
 Use the admin-scoped `POST /v1/vision/embed/setup` to create the
 `--system-site-packages` runtime under
 `~/.omnius/runtimes/vision/open-clip`, install pinned non-Torch dependencies,
-and fetch/verify the checkpoint. It is single-flight; poll readiness for an
-in-progress or failed setup. Inference never installs packages or downloads
-artifacts, and its Python worker is network-denied.
+and fetch/verify the checkpoint from immutable revision
+`1a25a446712ba5ee05982a381eed697ef9b435cf`. Setup is single-flight and
+daemon-bootstrapped by default on JetPack; set `OMNIUS_VISION_AUTO_SETUP=0`
+to disable it. Inference never installs packages or downloads artifacts, and
+its Python worker is network-denied.
 
 JetPack Torch is inherited and never replaced. `torchvision` must either be
 present in the compatible vendor stack or be supplied explicitly with the local
 `OMNIUS_VISION_TORCHVISION_WHEEL` and immutable
 `OMNIUS_VISION_TORCHVISION_WHEEL_SHA256`; generic PyPI Torch/torchvision is
-blocked. On memory-constrained Jetson systems setup and embedding fail with a
-typed 503 rather than evicting a resident ASR/Ollama model.
+blocked. Bootstrap discovery may inspect the selected vendor interpreter, but
+the managed runtime installs its own pinned support closure and proves Torch,
+torchvision, and OpenCLIP with user-site packages disabled. On memory-constrained
+Jetson systems model loading and embedding fail with a typed 503 rather than
+evicting a resident ASR/Ollama model. Dependency and
+weight provisioning itself is allowed to finish under transient pressure;
+readiness separately reports `installed`, `weightsReady`,
+`inferenceAvailable`, and the current admission result. The model is loaded
+only after at least 8 GiB is available.
 
 ## Advanced OCR
 
@@ -128,9 +137,12 @@ needs `run` scope because optional
 
 The managed pipeline is bounded: it starts with high-yield preprocessing and
 expands variants only for low-evidence or larger images. Small crops avoid the
-former all-variant/all-PSM explosion. The REST default is 90 seconds (maximum
-180 seconds), while the worker has an 80-second internal deadline so it can
-return diagnostics. A timeout or cancellation returns
+former all-variant/all-PSM explosion and use a six-second cap per Tesseract
+attempt. If the first small-crop pass proves high-volume very-low-confidence or
+distinctly symbol-heavy garbage, recovery stops immediately; blanks and
+plausibly recoverable text still receive the second high-yield attempt. The
+REST default is 90 seconds (maximum 180 seconds), while the worker has an
+80-second internal deadline so it can return diagnostics. A timeout or cancellation returns
 `result.data.schema=omnius.ocr-diagnostic.v1` with code `ocr_timeout` or
 `ocr_cancelled`; cancellation terminates the Python/Tesseract process group
 with TERM followed by KILL.
@@ -263,8 +275,15 @@ It is the only endpoint that installs dependencies or retrieves pinned weights:
 acoustic reuses the pinned JetPack YAMNet/TensorRT setup, speaker provisions
 the isolated CPU-only WeSpeaker runtime, and semantic provisions the isolated
 JetPack CUDA CLAP runtime. It activates only the selected role. Normal Jetson
-startup follows `OMNIUS_AUDIO_AUTO_SETUP` for acoustic and speaker; semantic
-startup additionally requires `OMNIUS_SEMANTIC_AUDIO_AUTO_SETUP=1`.
+startup provisions acoustic, speaker, and semantic roles by default; set
+`OMNIUS_AUDIO_AUTO_SETUP=0` to disable all audio setup or
+`OMNIUS_SEMANTIC_AUDIO_AUTO_SETUP=0` to disable CLAP specifically.
+
+CLAP provisioning installs a checksum-locked CPython 3.10/aarch64 wheel
+closure and the immutable model revision without loading the model. It is
+allowed to finish while unified memory is busy. Worker activation and
+inference retain the 8 GiB admission gate and idle eviction, so setup cannot
+silently evict ASR, Ollama, or another CUDA workload.
 
 On JetPack, speaker setup deliberately leaves `OMNIUS_AUDIO_PYTHON` (including
 an Egg project `.venv`) unchanged. It creates a private, non-system-site
@@ -313,9 +332,9 @@ provision themselves during inference.
   WAV windows of at most six seconds. It returns typed turn spans with explicit
   overlap and labels scoped only to the supplied `session_id`.
 - `POST /v1/audio/diarization/reconcile` uses
-  `pyannote/speaker-diarization-community-1` over retained offline audio of any
-  length. It requires persisted observation IDs and returns review-required
-  cluster proposals, never an identity assertion.
+  `pyannote/speaker-diarization-community-1` over retained uncompressed PCM16
+  WAV audio of any length. It requires persisted observation IDs and returns
+  review-required cluster proposals, never an identity assertion.
 
 `GET /v1/audio/diarization/{live|reconcile}/readiness` is non-mutating: it
 does not download weights, install packages, create an environment, or load a
@@ -324,35 +343,60 @@ loaded the verified local model; otherwise it returns typed HTTP 503 with the
 exact remediation. Inference is likewise non-provisioning and returns typed
 `speaker_diarization_runtime_unavailable` until admin setup succeeds.
 
-Admin setup requires a retained local snapshot, an absolute pre-provisioned
-Python interpreter path (or the matching `OMNIUS_DIAR_*_PYTHON` setting), and
-the immutable manifest. It validates imports and warms the worker before
-returning HTTP 200; a snapshot registration that cannot warm a worker is a
-setup failure, not an accepted deployment.
+Admin setup is asynchronous and single-flight. It returns HTTP 202 while it
+provisions, and readiness exposes the exact phase or terminal error. Existing
+ready workers return HTTP 200. Inference never performs these setup actions.
+
+On JetPack, live setup with an empty object downloads the immutable,
+checksum-pinned Q8 Sortformer artifact and builds NVIDIA NeMo-Speech.cpp at a
+pinned source revision under `~/.omnius`. Build tooling is isolated and the
+JetPack Torch installation is not imported or modified:
 
 ```json
 POST /v1/audio/diarization/live/setup
-{
-  "snapshot_path": "/srv/omnius-models/diar-live-sortformer",
-  "manifest_path": "/srv/omnius-models/diar-live-sortformer/omnius-model-manifest.json",
-  "python_path": "/opt/omnius-diar-live/bin/python"
-}
+{}
+```
+
+The native build requires the JetPack CUDA compiler plus `git` and a C++17
+compiler. Omnius installs pinned CMake/Ninja only in its private build-tools
+venv and never invokes `sudo`; missing native prerequisites are reported by
+readiness for operator installation outside inference. Set
+`OMNIUS_NEMO_SPEECH_BIN` to reuse a prebuilt CUDA-enabled binary.
+
+Managed Community-1 setup creates a separate CPU-only CPython environment, so
+its PyTorch/Torchaudio packages cannot replace or conflict with JetPack CUDA
+Torch. TorchCodec is deliberately omitted because it has no CPython
+3.10/aarch64 wheel; the worker decodes retained PCM16 WAV itself and passes
+pyannote its supported in-memory waveform mapping. After accepting the gated
+model conditions, expose `OMNIUS_HF_TOKEN` to the daemon and submit:
+
+```json
+POST /v1/audio/diarization/reconcile/setup
+{ "pyannote_terms_accepted": true }
 ```
 
+The token is used only for the pinned setup download, is rejected in HTTP
+bodies, is never written to disk, and is removed from the offline worker
+environment. `OMNIUS_PYANNOTE_TERMS_ACCEPTED=1` may persist only the terms
+attestation, not the credential.
+
 Every manifest is `omnius.audio-diarization-model-snapshot.v1` and pins the
 exact role model, a full immutable 40- or 64-hex revision, a relative artifact, and its
 `sha256:<digest>`. Community-1 is a directory pipeline: its manifest also
 needs a complete `files` checksum object for every regular model/config file.
 Setup streams and verifies all declared bytes; later readiness and inference
 reject changed, missing, or added snapshot files by metadata before a worker
-can load them. No Hugging Face token is accepted or persisted by Omnius. For
-Community-1 the admin instead attests `pyannote_terms_accepted: true` after
-accepting the gated model terms and supplies an already-downloaded snapshot.
+can load them. Advanced operators may still provide `snapshot_path`,
+`manifest_path`, and a role-specific `python_path`; those paths retain the
+same immutable manifest validation.
 
 Both roles allow one active request plus one queued request. A third request is
 typed busy. `POST /v1/audio/diarization/{live|reconcile}/cancel` terminates the
-worker before clearing both active and queued work. A daemon restart may warm
-only a previously verified binding; it never downloads or installs anything.
+worker process group before clearing both active and queued work. Inference and
+readiness may warm only a previously verified binding and never download or
+install anything. The separate JetPack daemon bootstrap may provision the
+public live model by default; gated Community-1 is provisioned only when both
+the terms attestation and setup-only token are configured.
 
 Live responses are `omnius.speaker-diarization.v1` `SpeakerTurnSpan[]` with
 `start_ms`, `end_ms`, `channel`, explicit overlap, and session-local

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.641",
+  "version": "1.0.643",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.641",
+      "version": "1.0.643",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.641",
+  "version": "1.0.643",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",