Files
施工员2号
aba2aebeb0
HEL-877: wire the audited .12 voice base into the one CyberGril chat chain as backend-only code (no deploy, no real voice call) - new independent src/cybergril/voice module: session+router add POST /api/voice/session / DELETE end / GET honest status on the unified instance (server-side room + dedicated cybergril-voice-agent dispatch + short-TTL join token via zero-new-dependency livekit_wire HS256/Twirp matching the installed SDK's wire format verified claim-for-claim on the .12 agent venv stdin-only; keys never reach the browser; unconfigured/no-profile/TTS-down refuse honestly and capabilities.voice stays false), chat_api_client speaks the exact real.ts RealChatAdapter protocol (per-turn health epoch, bounded 409 resync, robust incremental SSE parsing across multibyte/CRLF/multi-data chunk splits, fixed turn_id idempotency, immediate HTTP-stream close on barge-in without waiting for the next ASR final), llm_chat_api is a livekit llm.LLM adapter whose only backend is POST /api/chat so persona/mood/dyad/memory/life-sharing/budget gates and the one same-turn chat_lock govern text and voice identically (phi spoken verbatim via ChatChunk, never archived, no receipt), receipt.py confirms a sharing receipt only after real SDK playback completion with every negative (interrupted/failed/mid-playout/phi/incomplete/stale-epoch) fail-closed and exactly once per turn, stt_funasr/tts_cosyvoice reuse the proven .12 adapters verbatim with provenance, worker.py assembles the dedicated worker (independent voice_state_cybergril.json so D1 stays undecided, no second persona, cg.subtitle data-channel contract for the visual lead, CG-011 proactive seam left as an explicit no-op hook, built-in health port 8082); app.py keeps a minimal registration with voice_service injection for isolated tests; deployment drafts only (config/voice.example.yaml, worker.env.example, restart_cybergril.sh.example with exact-pattern process matching, serve_dual_8360_8361.py keeping HTTP 8360 and the HTTPS voice entry on ONE process sharing state/locks, runbook-hel877-voice.md contract+startup+rollback incl. the >=6GB GPU precondition and the do-not-copy historical fuser warning) - verification: 281 pytest pass on 3.11 venv + requirements.lock after merging the chief engineer's mid-flight HEL-874 rework e978e87 in full (parallel work preserved), verify_hel877_voice_chain.py 8/8 offline full-chain incl. socket-level barge-in fail-close and text/voice mutual same-gate cancellation, real-SDK check on the .12 livekit-agents 1.8.8 venv 8/8 ALL PASS via SSH stdin with zero writes zero network, dual-port single-process smoke on loopback 18360/18361 with a throwaway self-signed cert then stopped, ruff clean on all new code, dual-target requirement checks pass vs origin/hel-870-assembly (current tip e978e87) and origin/main with handoff-HEL-877.json; zero real LLM/embed/TTS/ASR requests, no mic/camera, no downloads/installs, no service start/stop, no 4080 access, no third-account or profile writes, web/ untouched, not merged, not deployed
Co-authored-by: multica-agent <github@multica.ai> ## HEL-877 交付摘要（R5 后台施工，未部署未合并） - 新独立模块 src/cybergril/voice/：专属 livekit worker（agent_name=cybergril-voice-agent，复用 .12 FunASR/CosyVoice/silero 底座，不 fork 不另搭平台，无第二人格/记忆，不直连 LLM）；llm_chat_api 适配器与文字前端 real.ts 同协议走 POST /api/chat（epoch 409 有界重同步、SSE 分片、turn_id 幂等、打断即断流）；/api/voice/session 建房+专属派发+短时限 token 全服务端（密钥不进浏览器；缺配置/无档案/TTS 停机诚实拒绝；capabilities.voice 不伪造）；receipt 仅在 SDK 真实播放完成后确认（打断/失败/φ 轮/旧 epoch 全 fail-closed）。 - 部署草案：/opt/voice-agent-cybergril 目录、worker 健康端口 8082、HTTP 8360 + HTTPS 8361 同进程双入口（deploy/voice/serve_dual_8360_8361.py，共用同一状态/锁）、启动顺序含 TTS GPU≥6GB 前置与回滚；本卡未执行任何启停。契约（开关/字幕/失败/打断/挂断 + CG-011 主动开口接缝）见 docs/runbook-hel877-voice.md §3。 - 自测（零真实请求）：281 pytest 全过（含语音 25 例：socket 级打断断流、SSE 边界、重放零调用、文字/语音同门互打断、回执全负例、token 房间隔离）；scripts/verify_hel877_voice_chain.py 8/8；.12 agent venv（livekit-agents 1.8.8）真 SDK 检查 8/8（stdin-only 零写入零网络）；双端口同进程本地冒烟通过；ruff 干净；需求检查双目标通过（含 handoff-HEL-877.json）。 - 施工中总工 HEL-874（e978e87）推上同分支，本卡已完整并入，不覆盖并行成果。未验证如实列明：端到端语音（TTS 停机/GPU 3.9GB<5.6GB）、真 LiveKit server 的 dispatch/delete、移动端实机——待接线/审核卡真机验收，未经真实验收不称 R5 完成。
HEL-877: wire the audited .12 voice base into the one CyberGril chat chain as backend-only code (no deploy, no real voice call) - new independent src/cybergril/voice module: session+router add POST /api/voice/session / DELETE end / GET honest status on the unified instance (server-side room + dedicated cybergril-voice-agent dispatch + short-TTL join token via zero-new-dependency livekit_wire HS256/Twirp matching the installed SDK's wire format verified claim-for-claim on the .12 agent venv stdin-only; keys never reach the browser; unconfigured/no-profile/TTS-down refuse honestly and capabilities.voice stays false), chat_api_client speaks the exact real.ts RealChatAdapter protocol (per-turn health epoch, bounded 409 resync, robust incremental SSE parsing across multibyte/CRLF/multi-data chunk splits, fixed turn_id idempotency, immediate HTTP-stream close on barge-in without waiting for the next ASR final), llm_chat_api is a livekit llm.LLM adapter whose only backend is POST /api/chat so persona/mood/dyad/memory/life-sharing/budget gates and the one same-turn chat_lock govern text and voice identically (phi spoken verbatim via ChatChunk, never archived, no receipt), receipt.py confirms a sharing receipt only after real SDK playback completion with every negative (interrupted/failed/mid-playout/phi/incomplete/stale-epoch) fail-closed and exactly once per turn, stt_funasr/tts_cosyvoice reuse the proven .12 adapters verbatim with provenance, worker.py assembles the dedicated worker (independent voice_state_cybergril.json so D1 stays undecided, no second persona, cg.subtitle data-channel contract for the visual lead, CG-011 proactive seam left as an explicit no-op hook, built-in health port 8082); app.py keeps a minimal registration with voice_service injection for isolated tests; deployment drafts only (config/voice.example.yaml, worker.env.example, restart_cybergril.sh.example with exact-pattern process matching, serve_dual_8360_8361.py keeping HTTP 8360 and the HTTPS voice entry on ONE process sharing state/locks, runbook-hel877-voice.md contract+startup+rollback incl. the >=6GB GPU precondition and the do-not-copy historical fuser warning) - verification: 281 pytest pass on 3.11 venv + requirements.lock after merging the chief engineer's mid-flight HEL-874 rework
e978e87 in full (parallel work preserved), verify_hel877_voice_chain.py 8/8 offline full-chain incl. socket-level barge-in fail-close and text/voice mutual same-gate cancellation, real-SDK check on the .12 livekit-agents 1.8.8 venv 8/8 ALL PASS via SSH stdin with zero writes zero network, dual-port single-process smoke on loopback 18360/18361 with a throwaway self-signed cert then stopped, ruff clean on all new code, dual-target requirement checks pass vs origin/hel-870-assembly (current tip e978e87) and origin/main with handoff-HEL-877.json; zero real LLM/embed/TTS/ASR requests, no mic/camera, no downloads/installs, no service start/stop, no 4080 access, no third-account or profile writes, web/ untouched, not merged, not deployed
HEL-874 rework: bounded verbatim readback reaches the real provider input, real pinned Mem0 2.2.1 SDK contract verified live and the adapter's five wiring defects fixed, budget gates made provable (atomic reserve/settle embed ledger + independent llm_ops cap), definite-cap real-check execution table, 8360 isolated release package prepared (not deployed), 2026-10-26 user originals recorded source-only - semantic.context now quotes chain-verified archive rows (original words + role + when, <=200-char window with visible trim marker, summary demoted to a one-line pointer, same min(600,budget) cap) and episodic.context flips from gist-first-120-chars to verbatim-first (<=240) + role + date, both proven by tests/test_readback_hel874.py capturing the actual messages handed to the provider through the real API path: a detail absent from the gist yet quoted verbatim from a turn pushed outside the recent-20 window, the same for a semantic chain hit, and an unshared companion row never leaking through FTS, semantic or any anchor (AM-001); tools/verify_mem0_real_hel874.py runs the FIXED install itself (mem0ai 2.2.1 2c81af3, real embedded qdrant, real fastembed from the existing cache, deterministic 127.0.0.1 fake gateway, temp ledgers only): before=31970c4 dies at construction (second QdrantClient on the same path rejected by the SDK - recorded), and source-level findings confirmed live and fixed - unscoped search raises ValueError in 2.2.1 (add now carries user_id scope, search passes filters+top_k since limit is silently ignored), payload reads ride the SDK's own vector_store.client, the old outer search debit double-counted (wrapper is now the single accounting point), the SDK's internal extraction LLM was ungated (LlmLedgerGuard with its own llm_ops table, cap default 0) and check-then-debit could overshoot under concurrency (EmbedLedgerGuard now reserves atomically in BEGIN IMMEDIATE, releases on failure/cancel, purges stale holds); after fixes all 12 checks pass (construction/anchor payload/user scope/1 LLM + 2-3 embeds per add measured/extraction input set provably only prior gated batches incl. old memories and rolling history/unshared canary zero outbound/search single debit/concurrency never over cap/close-reopen intact/both zero caps refuse with ZERO outbound LLM requests), evidence in docs/rework/hel874/; mood sensitivity returns to the original repo's continuous rule 1.35-0.70*strength (bazi.sensitivity_from_strength, foundation commit
1012d8b) replacing HEL-870's invented 1.25/0.8 step and is labeled an engineering heuristic, never user-approved bazi science (external agent formulas remain not adopted); docs/budget-plan-hel874.md gives definite caps for the one-time team check (55 requests/0 embeds), first-week semantic activation (<=60 extract LLM / <=180 embeds) and user daily use with code-level hard-gate facts and authorization sources (old 20-30/100-200 were estimates, not approved quota; frozen 39/60 and 498/500 untouched and never挪用); deploy/hel874-release.md + cybergril-hel874-8360.service.example prepare the isolated fresh-empty-data-dir release with health capability matrix and data-preserving rollback (NOT executed, PR#11 not merged, no user-facing loop, no experience address); sources/comment-evidence-full-experience-20261026.json adds the two 2026-10-26 user originals (01a17806, 01a1780e full-experience-then-iterate) with authorship verified and manifest appended only - baseline/current/coverage/changes untouched; verification: 256 python tests pass on 3.11.16 venv + requirements.lock offline (3 new real-provider-input readback cases incl. AM-001 negative, mem0 fake rebuilt to mirror the real 2.2.1 surfaces, 9 cases), ruff clean, web tsc + 42 vitest + build pass, local 8360 stub smoke (loopback, isolated temp DB) health R4-assembly all green then stopped, real-SDK script re-run 12/12 after final edits, dual-target requirement checks 4/4 pass with handoff-HEL-874.json; zero real model calls, zero real embeddings, zero outbound (fake gateway on loopback + existing local model cache only), authoritative ledgers and freezes untouched, no existing services or profiles touched
HEL-874 rework: bounded verbatim readback reaches the real provider input, real pinned Mem0 2.2.1 SDK contract verified live and the adapter's five wiring defects fixed, budget gates made provable (atomic reserve/settle embed ledger + independent llm_ops cap), definite-cap real-check execution table, 8360 isolated release package prepared (not deployed), 2026-10-26 user originals recorded source-only - semantic.context now quotes chain-verified archive rows (original words + role + when, <=200-char window with visible trim marker, summary demoted to a one-line pointer, same min(600,budget) cap) and episodic.context flips from gist-first-120-chars to verbatim-first (<=240) + role + date, both proven by tests/test_readback_hel874.py capturing the actual messages handed to the provider through the real API path: a detail absent from the gist yet quoted verbatim from a turn pushed outside the recent-20 window, the same for a semantic chain hit, and an unshared companion row never leaking through FTS, semantic or any anchor (AM-001); tools/verify_mem0_real_hel874.py runs the FIXED install itself (mem0ai 2.2.1 2c81af3, real embedded qdrant, real fastembed from the existing cache, deterministic 127.0.0.1 fake gateway, temp ledgers only): before=31970c4 dies at construction (second QdrantClient on the same path rejected by the SDK - recorded), and source-level findings confirmed live and fixed - unscoped search raises ValueError in 2.2.1 (add now carries user_id scope, search passes filters+top_k since limit is silently ignored), payload reads ride the SDK's own vector_store.client, the old outer search debit double-counted (wrapper is now the single accounting point), the SDK's internal extraction LLM was ungated (LlmLedgerGuard with its own llm_ops table, cap default 0) and check-then-debit could overshoot under concurrency (EmbedLedgerGuard now reserves atomically in BEGIN IMMEDIATE, releases on failure/cancel, purges stale holds); after fixes all 12 checks pass (construction/anchor payload/user scope/1 LLM + 2-3 embeds per add measured/extraction input set provably only prior gated batches incl. old memories and rolling history/unshared canary zero outbound/search single debit/concurrency never over cap/close-reopen intact/both zero caps refuse with ZERO outbound LLM requests), evidence in docs/rework/hel874/; mood sensitivity returns to the original repo's continuous rule 1.35-0.70*strength (bazi.sensitivity_from_strength, foundation commit
1012d8b) replacing HEL-870's invented 1.25/0.8 step and is labeled an engineering heuristic, never user-approved bazi science (external agent formulas remain not adopted); docs/budget-plan-hel874.md gives definite caps for the one-time team check (55 requests/0 embeds), first-week semantic activation (<=60 extract LLM / <=180 embeds) and user daily use with code-level hard-gate facts and authorization sources (old 20-30/100-200 were estimates, not approved quota; frozen 39/60 and 498/500 untouched and never挪用); deploy/hel874-release.md + cybergril-hel874-8360.service.example prepare the isolated fresh-empty-data-dir release with health capability matrix and data-preserving rollback (NOT executed, PR#11 not merged, no user-facing loop, no experience address); sources/comment-evidence-full-experience-20261026.json adds the two 2026-10-26 user originals (01a17806, 01a1780e full-experience-then-iterate) with authorship verified and manifest appended only - baseline/current/coverage/changes untouched; verification: 256 python tests pass on 3.11.16 venv + requirements.lock offline (3 new real-provider-input readback cases incl. AM-001 negative, mem0 fake rebuilt to mirror the real 2.2.1 surfaces, 9 cases), ruff clean, web tsc + 42 vitest + build pass, local 8360 stub smoke (loopback, isolated temp DB) health R4-assembly all green then stopped, real-SDK script re-run 12/12 after final edits, dual-target requirement checks 4/4 pass with handoff-HEL-874.json; zero real model calls, zero real embeddings, zero outbound (fake gateway on loopback + existing local model cache only), authoritative ledgers and freezes untouched, no existing services or profiles touched