[tang-vu]

Ready for independent review (2026-09-15). Candidate a8afa21adf8a422bb0c7c11afcefccc00f2ab72c has a successful GitHub check rollup and no base-branch conflict at this review snapshot. This supersedes earlier draft-status wording only. All validation gaps, migration requirements, live gates and independent human review requirements below remain in force; this is not a merge-ready approval.

Make ods stt current, status and download read voice settings through the existing safe dotenv parser. Quoted values and inline comments must not become part of the model ID or HTTP port.

Why this matters

For example, WHISPER_PORT="9000" # local speech is valid dotenv configuration, but the CLI previously constructed http://127.0.0.1:"9000" # local speech. Likewise, quotes around AUDIO_STT_MODEL reached the model URL. This breaks diagnosis and model caching after an operator saves standard quoted configuration. The root cause is using _env_get_raw at a parsed-value boundary.

The fix stays inside cmd_stt and reuses load_env. Local setting variables preserve the old behavior for absent/empty keys and ignore unrelated ambient voice overrides. Explicit command-line model arguments retain precedence; the parser never evaluates configuration text.

Overlap check

Searched open/closed upstream PRs for stt quoted, env_get_raw, STT/cache/Whisper terms and PRs changing ods/ods-cli. #984/#985/#986 establish the existing STT model-management flow; #776 concerns the container entrypoint. #2645 parses environment diffs, and #2787/#3072 address atomic writes, not this CLI reader. #4889 covers an existing remote-provider help contract mismatch. This PR changes neither those writers nor other raw-value callers.

Regression and validation

• python3 ods/tests/test-cli-stt-env.py: real CLI subprocesses and a real loopback HTTP model-cache fixture. Four tests (including LF/CRLF and single/double-quote subcases) pass; six baseline assertions fail. Covers current/status/download, confirmed cached state after POST, explicit model precedence, missing/empty defaults, and literal command text remaining inert. Wired into make test.
• bash ods/tests/test-safe-env.sh: all 14 checks pass.
• Bash syntax, ShellCheck error severity, scoped pre-commit and git diff --check: pass.
• make gate reproduces the known baseline root/WSL no-sudo failure. The separate static CLI contract also reproduces the pre-existing remote-provider help mismatch addressed by test(cli): align the release contract with remote provider enable #4889. Neither is described as green.

Compatibility and limits

The shared Bash CLI serves Linux, macOS with supported Bash, and WSL. Tests exercise CRLF plus the common implementation under Linux/WSL; native Windows PowerShell has a separate implementation and is unchanged. No real model download, speech inference or native macOS execution is claimed. No persisted configuration is rewritten. Rollback restores the old reader without a data migration. The Makefile addition is additive with the batch's other contracts.

Final candidate a8afa21adf8a422bb0c7c11afcefccc00f2ab72c: 32 successful CI checks, 4 conditionally skipped; no pending or failed checks.

Batch integration receipt

This is one of 30 independently branched public-beta PRs. The published synthetic integration head is 61f4c6fccc81bea697f4941683fefb5089ba77f4, built from baseline d49ad4bbc760be319de7f4c9b9a93b1f18fe3922 in this reproducible order:

#4946 → #4948 → #4951 → #4954 → #4972 → #4960 → #4961 → #4957 → #4964 → #4967 → #4968 → #4971 → #4975 → #4976 → #4984 → #4982 → #4990 → #4988 → #4989 → #4997 → #5003 → #5006 → #5007 → #5009 → #5012 → #5011 → #5013 → #5014 → #5020 → #5021

Reconciliation preserved all 146 files owned by a single PR byte-for-byte against their exact candidate heads. The eight shared paths preserve both CLI STT/TTS commands and help, every added Makefile test, both environment schema additions and all Extensions UI behavior. LanguageTool and Kroki both remain headless API entries. Canonical regeneration yields 76 catalog entries and 47 library manifests; all README rows are retained. Shared-file changes need these additive resolutions when merged independently.

Combined validation: 2,852 API tests passed / 1 skipped; 1,082 UI tests passed; 47 manifests passed; all 12 added Makefile commands passed; 12 catalog boundary tests passed / 12 opt-in runtime tests skipped in this combined run. Individual exact-image results remain documented above. UI lint/build, scoped secret hooks, diff checks, four platform smoke tests and installer simulation passed. Compose plans for NVIDIA/AMD/Apple each contain 20 services and no duplicate published bindings across the core plus 12 new recipes; this is static plan evidence, not simultaneous startup or GPU inference.

The first unrestricted UI run timed out in two tests under concurrent load; the complete rerun used --maxWorkers=2 with unchanged assertions and timeouts and passed. ESLint reports zero errors and 603 warnings, including the existing JSX usage-detection pattern. Full local make gate still fails the no-sudo Docker baseline covered by #3158. BATS records 416 passed / 5 failed on this root/WSL host (platform detection, root preflight and a 15 GiB versus 20 GiB free-space expectation). Neither full local gate nor BATS is described as green.

This integration receipt supplements each PR's own regression and does not waive its independent review, live hardware/browser/upgrade gates or rollback requirements. The PRs remain drafts; none was merged upstream.