Prepare Oida 0.12.0 for the local repaired cohort

.github/workflows/ci.yml

@@ -1,6 +1,13 @@
 name: CI
 
 on:
+  workflow_call:
+    inputs:
+      release_ref:
+        description: Optional immutable release ref selected by the publishing workflow
+        required: false
+        type: string
+        default: ""
   pull_request:
   push:
     branches:
@@ -9,6 +16,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     name: Python, Web, and macOS checks
@@ -21,34 +32,23 @@ jobs:
       - name: Checkout Oída
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
+          ref: ${{ inputs.release_ref || github.ref }}
           path: oida
 
-      - name: Checkout Earworm
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: sonicfieldlabs/earworm
-          ref: v0.7.0
-          path: earworm
-
-      - name: Checkout AKOÚŌ contract
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: sonicfieldlabs/akouo
-          ref: v0.9.2
-          path: akouo
-
-      - name: Checkout Akousmata
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: sonicfieldlabs/akousmata
-          ref: v0.7.0
-          path: akousmata
-
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
+      - name: Verify reviewed canonical dependency wheels
+        run: shasum -a 256 -c vendor/SHA256SUMS
+
+      - name: Install audio fixture tools
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "1"
+        run: command -v ffmpeg >/dev/null || brew install ffmpeg
+
       - name: Install Python dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked
 
       # pytest collects the unittest.TestCase suite too; one runner is enough.
       - name: Run Python tests
@@ -60,18 +60,12 @@ jobs:
       - name: Compile Python modules
         run: uv run python -m compileall -q oida harness bench_adapter scripts tests
 
-      # The validated MOSS runtime uses PyTorch 2.10. PYSEC-2026-139 has no
-      # patched release; CVE-2025-3000 is fixed in unvalidated 2.13. Oída calls
-      # neither API. Both exceptions have a review deadline in SECURITY.md.
-      - name: Audit dependency graph
+      - name: Audit dependency graph with dated exceptions
         run: |
-          uv export --all-extras --no-emit-project --no-emit-local |
-            uvx --from pip-audit==2.10.1 pip-audit \
-              --requirement /dev/stdin \
-              --disable-pip \
-              --progress-spinner=off \
-              --ignore-vuln PYSEC-2026-139 \
-              --ignore-vuln CVE-2025-3000
+          uv export --locked --all-extras --no-emit-project --no-emit-local > "$RUNNER_TEMP/dependencies.txt"
+          uv run python scripts/audit_dependencies.py \
+            --requirements "$RUNNER_TEMP/dependencies.txt" \
+            --output "$RUNNER_TEMP/dependency-audit.json"
 
       - name: Check dashboard JavaScript
         run: |
@@ -82,9 +76,7 @@ jobs:
         run: |
           uv build
           mkdir -p "$RUNNER_TEMP/oida-wheels"
-          uv build --wheel --out-dir "$RUNNER_TEMP/oida-wheels" ../akouo
-          uv build --wheel --out-dir "$RUNNER_TEMP/oida-wheels" ../earworm/packages/py-akousma
-          uv build --wheel --out-dir "$RUNNER_TEMP/oida-wheels" ../akousmata
+          cp vendor/*.whl "$RUNNER_TEMP/oida-wheels/"
 
       - name: Check Python distribution metadata
         run: uv run twine check dist/*

.github/workflows/python-release.yml

@@ -13,39 +13,30 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  checks:
+    uses: ./.github/workflows/ci.yml
+    with:
+      release_ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
+
   build:
+    needs: checks
     name: Build and verify distributions
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout Oída
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
           fetch-depth: 0
           path: oida
 
-      - name: Checkout AKOÚŌ contract
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: sonicfieldlabs/akouo
-          ref: v0.9.2
-          path: akouo
-
-      - name: Checkout Earworm
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: sonicfieldlabs/earworm
-          ref: v0.7.0
-          path: earworm
-
-      - name: Checkout Akousmata
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: sonicfieldlabs/akousmata
-          ref: v0.7.0
-          path: akousmata
-
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
@@ -66,12 +57,16 @@ jobs:
           project_version="$(uv version --short)"
           test "$release_version" = "$project_version"
 
-      - name: Build all canonical distributions
+      - name: Verify reviewed canonical wheels
+        working-directory: oida
+        run: shasum -a 256 -c vendor/SHA256SUMS
+
+      - name: Assemble reviewed canonical wheels and build Oída
         run: |
           mkdir -p release/akouo release/akousma release/akousmata release/oida
-          uv build --out-dir "$GITHUB_WORKSPACE/release/akouo" akouo
-          uv build --out-dir "$GITHUB_WORKSPACE/release/akousma" earworm/packages/py-akousma
-          uv build --out-dir "$GITHUB_WORKSPACE/release/akousmata" akousmata
+          cp oida/vendor/akouo_contract-*.whl release/akouo/
+          cp oida/vendor/akousma-*.whl release/akousma/
+          cp oida/vendor/akousmata-*.whl release/akousmata/
           uv build --out-dir "$GITHUB_WORKSPACE/release/oida" oida
 
       - name: Check distribution metadata
@@ -98,7 +93,7 @@ jobs:
   publish:
     name: Publish ${{ matrix.project }} to PyPI
     needs: build
-    if: ${{ vars.PYPI_PUBLISH_ENABLED == 'true' }}
+    if: ${{ github.event_name == 'workflow_dispatch' && vars.PYPI_PUBLISH_ENABLED == 'true' }}
     strategy:
       fail-fast: false
       matrix:
@@ -113,6 +108,7 @@ jobs:
             directory: akousmata
             environment: pypi-akousmata
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     environment: ${{ matrix.environment }}
     permissions:
       contents: read
@@ -137,8 +133,9 @@ jobs:
     needs:
       - build
       - publish
-    if: ${{ vars.PYPI_PUBLISH_ENABLED == 'true' && vars.PYPI_OIDA_PUBLISH_ENABLED == 'true' }}
+    if: ${{ github.event_name == 'workflow_dispatch' && vars.PYPI_PUBLISH_ENABLED == 'true' && vars.PYPI_OIDA_PUBLISH_ENABLED == 'true' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     environment: pypi-sonicfield-oida
     permissions:
       contents: read

.gitignore

@@ -46,3 +46,21 @@ akousmata/
 generations/
 settings/
 exports/
+
+# Private local output; maintained fixtures remain in their source directories
+/audits/
+/local-plans/
+/reports/
+/screenshots/
+/receipts/
+/recordings/
+/captures/
+/output/
+/runtime/
+/settings.json
+/*.sqlite
+/*.sqlite-*
+/*.sqlite3
+/*.sqlite3-*
+/*.db
+/docs/audits/

CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## 0.12.0 — 2026-10-08
+
+- Add bounded local owner event notifications, finite-playlist admission, and native audio-decoder diagnostics. Preserve model and real-source qualification as separate gates.
+- Require patched fsspec in the optional model environment and patched multidict in song identification; retain the two narrowly reviewed Torch exceptions.
+- Source release only; no package registry publication or service activation.
+
+## Unreleased — observation freshness at reception
+
+- Package 0.11.2 with receiving-time freshness, repaired owner packages and updated registry dependencies.
+- Add `effective_freshness` to observation reception and its persisted source-admission metadata, evaluated against the receiving clock and declared expiry.
+- Preserve source snapshots, hashes, producer freshness and receiving claim boundaries. Stale/future/archive observations remain attributable accounts; reception requests no execution and does not make them current.
+
+## 0.11.1 — Station aperture integration and phases 0–3 audit
+
+- Preserve the selected gateway route while adding native DSP from the same frozen excerpt.
+- Add source-bound read-only previews, band-specific measurements and explicit retained-view deadlines.
+- Publish ordinary listening and native evidence in one governed record; expose actual Mac ring bounds.
+- Require distinct Akousma/Akousmata 0.8.1 artifacts for the atomic publication API.
+
+
+## 0.11.0 — local expansion Phase 2
+
+- Add owner-resolved apertures, bounded multiwindow DSP, native evidence reports
+  and atomic Akousmata 0.8 audio/derivative publication with retention gates.
+- Add revision-bound runtime radio registration with pinned public fetching,
+  revocation and playlist refusal; expose the configured system-output lifecycle.
+- Add optional, isolated NSGT/Kymatio workers through installer qualification;
+  project retained measurements into the existing situated-reasoning policy path.
+- Preserve legacy model routes and separate digital measurements from physical
+  capture, model competence and human access. See `docs/native-listening.md`.
+
+## Unreleased — full-model source hardware qualification
+
+- Add an offline MPS profiling tool with decoder preflight, bounded synthetic
+  inputs and sampled driver/tensor memory alongside wall timing.
+- Record full-weight Instruct/Thinking and actual owner-API measurements. Retain
+  single residency and one source worker; document the FFmpeg 8 library requirement
+  for the pinned TorchCodec runtime and observed cold-load control latency.
+
+## Unreleased — bounded source scheduling
+
+- Add a bounded FIFO source-job API with independent expiry, queued cancellation,
+  dispatch-time covenant checks and durable restart outcomes. Reuse capture
+  supervision and the existing gateway without changing model residency.
+- Record observed queue/capture/listening timing and explicitly scoped process
+  peak RSS. Full-model/GPU hardware qualification remains separate.
+
+## Unreleased — source acquisition and observations
+
+- Add owner-configured bounded radio, AVFoundation and ALSA capture through
+  FFmpeg, with native-format checks, pre-capture covenant gates, cancellation,
+  restart recovery and linked acquisition receipts. Reuse the existing gateway.
+- Receive Cosmoaudition MASA snapshots through the existing MASA validator and
+  AKOÚŌ/Earworm observation constructors, preserving complete source attribution
+  without an audio asset or new measurement claim.
+
+## Unreleased — bounded source admission
+
+- Accept source identity, source time, declared apparatus and consent on existing
+  listen routes; check adapter/type, effective retention and measured window size
+  before inference. Preserve the source receipt in canonical listening records.
+- Keep capture bandwidth unknown unless separately evidenced; source declarations
+  alone do not establish device support or physical capture performance.
+
+## Unreleased — prepared input binding
+
+- Add bounded, no-inference preflight for already-loaded local adapters and expose
+  actual input descriptors in spectral decisions without granting claim authority.
+- Record preprocessed-array identities in pass receipts. Provide a request-local
+  execution guard that rejects model/input drift and incompatible fallback before
+  generation. Preserve unknown states for opaque or unloaded adapters.
+
+## Unreleased — source links and operator evidence
+
+- Bind report passes to source and submitted-file hashes, sample-aligned windows
+  and unique pass IDs; reject audio changes instead of retaining stale attribution.
+- Resolve bounded operator-selected capture/representation evidence and expose
+  expiry/mismatch results. Close reference-aliasing permission bypasses by keeping
+  actual model-input support unresolved until loaded-adapter binding exists.
+
+## Unreleased — runtime attribution foundations
+
+- Compose the existing spectral gate before explicit spectral listening attempts;
+  reject unsupported or unresolved apparatus support independently of model prose.
+- Preserve every pass's model/provider attribution across aggregation and fallback;
+  capture local processor input and safetensors inventory without inferring hidden
+  provider details. See docs/runtime-attribution.md for evidence and open limits.
+
+
 ## 0.10.0 - 2026-08-11
 
 - Advanced the gateway to `oida/gateway/v0.6` and aligned the complete core

CITATION.cff

@@ -4,8 +4,7 @@ message: "If you use Oída in research, please cite this software release."
 type: software
 authors:
   - name: "Sonic Field Labs"
-version: 0.10.0
-date-released: 2026-08-03
+version: 0.12.0
 license: Apache-2.0
 repository-code: "https://github.com/sonicfieldlabs/oida"
 url: "https://sonicfield.org/stack"