[tang-vu]

Ready for independent review (2026-09-15). Candidate d69a89993269fde0d50883f96980114875d64601 has a successful GitHub check rollup and no base-branch conflict at this review snapshot. This supersedes earlier draft-status wording only. All validation gaps, migration requirements, live gates and independent human review requirements below remain in force; this is not a merge-ready approval.

Why this matters

ODS writing tools and automations currently have no optional local spelling/grammar endpoint. Add a complete LanguageTool recipe reachable through the existing extension catalog/install lifecycle, with documentation for /v2/languages and /v2/check. The dashboard labels it as an API service rather than advertising a nonexistent editor.

Contract and implementation

• Pin the community image recommended in LanguageTool's repository to meyay/languagetool:6.8-10@sha256:d9f15384ea3febbe9b24ed9cfc05e912c5154d031354397e5de5e699cb15cd6b (LanguageTool 6.8; upstream tag inspected). It is not an official hosted/premium LanguageTool service.
• Run as UID/GID 783 with a read-only root, dropped capabilities, loopback port 7826, 2 CPU/2 GB limits, an explicit Java heap and writable temporary directory. Disable automatic n-gram downloads and fastText; local dictionaries/rules perform the checks. Requests are limited to 20,000 characters and two checking threads.
• Existing producer/consumer path: library manifest/recipe -> generated catalog -> Extensions install -> copied Compose service -> API health -> explicitly configured writing client. No editor integration or cloud-account setup is implied. State is disposable; reinstall/rollback removes the service without migrating user data.
• Canonical catalog regeneration also restores metadata for the already tracked, disabled-by-default pixel-inference manifest. It does not enable that service.

Overlap check

Searched open and closed upstream PRs for LanguageTool, grammar checking/proofreading, and the new production recipe paths; no matching service exists. Reviewed shared Extensions.jsx, catalog generator and library README path history. #1613 covers a general headless metadata/link contract; this PR uses the existing headless-service mechanism for one new API service and does not replace that work. #4961 (Aider launch guidance), #4982 (credential instructions), and #4997 (Frigate HTTPS) touch shared catalog/UI surfaces but preserve independent behaviors. Combined validation will retain all four changes.

Validation

• Exact-image Linux x86-64 installed Compose test: 2 passed (21-live-network, 318.50 seconds of pytest). Validated healthy startup, loopback HTTP language discovery, real spelling/grammar matches and replacements, invalid-language rejection and the 20,000-character limit, then container replacement and repeated checks.
• For each running instance, disconnected its normal bridge and attached only a Docker Internal=true network. Real HTTP requests via the image's wget still returned spelling and grammar replacements; no model/generation functions were stubbed. Both fixture containers and networks were cleaned up.
• The first isolated-network fixture could not resolve a published endpoint because Docker does not publish ports on that internal-only network. The final fixture tests the actual published endpoint first, then removes egress and exercises the same HTTP boundary from inside the container. That earlier failure is not counted as application evidence.
• Full Extensions page tests: 16 passed. Dashboard lint: 0 errors, 598 existing warnings. Production build passed. All 36 library manifests, scoped pre-commit hooks and git diff --check passed.
• Full local make gate retains the recorded WSL/root no-sudo baseline failure, separately addressed by existing fix(installer): honor unavailable sudo in Docker fallback #3158; a local full-gate pass is not claimed. The new path-filtered CI job runs the real Docker/API test.

Review and limits

Awaiting independent recipe review and CI. The image advertises amd64/arm64, but live evidence here is Linux amd64 under WSL only. Native Windows/macOS, ARM, real editor/browser integration and large-language workloads are unverified. Supplemental statistical models, hosted premium rules and automatic downloads are not included. API clients must be explicitly configured; remote exposure requires the operator's protected network/TLS setup. No authentication is supplied by this upstream API.

Final candidate d69a89993269fde0d50883f96980114875d64601: 33 successful CI checks, 4 conditionally skipped; no pending or failed checks.

Batch integration receipt

This is one of 30 independently branched public-beta PRs. The published synthetic integration head is 61f4c6fccc81bea697f4941683fefb5089ba77f4, built from baseline d49ad4bbc760be319de7f4c9b9a93b1f18fe3922 in this reproducible order:

#4946 → #4948 → #4951 → #4954 → #4972 → #4960 → #4961 → #4957 → #4964 → #4967 → #4968 → #4971 → #4975 → #4976 → #4984 → #4982 → #4990 → #4988 → #4989 → #4997 → #5003 → #5006 → #5007 → #5009 → #5012 → #5011 → #5013 → #5014 → #5020 → #5021

Reconciliation preserved all 146 files owned by a single PR byte-for-byte against their exact candidate heads. The eight shared paths preserve both CLI STT/TTS commands and help, every added Makefile test, both environment schema additions and all Extensions UI behavior. LanguageTool and Kroki both remain headless API entries. Canonical regeneration yields 76 catalog entries and 47 library manifests; all README rows are retained. Shared-file changes need these additive resolutions when merged independently.

Combined validation: 2,852 API tests passed / 1 skipped; 1,082 UI tests passed; 47 manifests passed; all 12 added Makefile commands passed; 12 catalog boundary tests passed / 12 opt-in runtime tests skipped in this combined run. Individual exact-image results remain documented above. UI lint/build, scoped secret hooks, diff checks, four platform smoke tests and installer simulation passed. Compose plans for NVIDIA/AMD/Apple each contain 20 services and no duplicate published bindings across the core plus 12 new recipes; this is static plan evidence, not simultaneous startup or GPU inference.

The first unrestricted UI run timed out in two tests under concurrent load; the complete rerun used --maxWorkers=2 with unchanged assertions and timeouts and passed. ESLint reports zero errors and 603 warnings, including the existing JSX usage-detection pattern. Full local make gate still fails the no-sudo Docker baseline covered by #3158. BATS records 416 passed / 5 failed on this root/WSL host (platform detection, root preflight and a 15 GiB versus 20 GiB free-space expectation). Neither full local gate nor BATS is described as green.

This integration receipt supplements each PR's own regression and does not waive its independent review, live hardware/browser/upgrade gates or rollback requirements. The PRs remain drafts; none was merged upstream.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.