vetcoders · div0-space · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,78 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.1] - 2026-08-18
+
+> Patch: everyday-stable 0.14.x. Same slim public SKU as 0.14.0, plus the two
+> Settings/auth probes that were still lying on a daily machine, and one
+> command that installs the notarized .app instead of re-signing it.
+
+### Fixed
+
+- **STT Test is a file probe.** Settings Test no longer POSTs to a live
+  Voice Lab WebSocket (`STT_ENDPOINT`). Known live sockets map to
+  `/v1/audio/transcriptions`; loopback `:8446` → `:8444`.
+- **ChatGPT sign-in no longer requires Responses write.** OAuth persists
+  identity after exchange. `api.responses.write` stays a lane Test, so
+  Codex public tokens can sign in.
+- **STT remapper test names loopback explicitly** so `make check` Semgrep
+  does not treat a templated live-socket URL as an open WebSocket.
+- **Overlay copy stays evidence-only in the quality-chain test.** Isolated
+  `make verify` no longer greened that path by reading a leftover host
+  lexicon. Voice Lab finalize is still the teach gesture.
+
+### Changed
+
+- **`make release-stable`** is the everyday cut: slim sign + notarize +
+  `verify-dmg`, then install that stapled Developer ID `.app` to
+  `/Applications` without re-signing. `make install-app` remains the
+  local-release / Lab path.
+- **`make release-full` is fail-closed.** Whisper embed no longer falls
+  back to a slim dylib when the HF snapshot is weights-only. It uses the
+  composed `~/.codescribe/models` tree from `make download-model`.
+- `SITE_VERSION` stays `0.13.3` until a published GitHub release.
+
+## [0.14.0] - 2026-08-17
+
+> Minor: developer Lab surface, Dictionary helper file-pass, bus word pins,
+> and a 30-minute Whisper idle. Production DMG still has no Lab menu.
+
+### Added
+
+- **Developer Lab on keyed `make install-app`.** `CSDeveloperSurface` bakes
+  only when Sparkle + production license public keys resolve on the machine.
+  Public `git clone && make` stays Lab-off. Production DMG refuses the bit.
+- **Lab mode overlay-off.** Developer veto hides the daily HUD without
+  flipping the tray "Transcription Overlay" toggle. Leftover UserDefaults
+  cannot hide overlay on a production bundle.
+- **Dictionary helper Retranscribe.** Follows Settings `asr_mode`:
+  `local_power` → `hq:` candle file pass, `cloud` → `cloud:` file pass,
+  `apple_only` disabled. Missing archive refuses — never `last_session.wav`.
+- **Voice Lab on the website** (`/voice/lab`). Teacher + Seal Atlas as a
+  Codescribe module, not a sidecar: same `teach()` triangle as
+  `codescribe-teacher`, idle until Run; Atlas HTML loads only on demand.
+- **Overlay stays the canvas.** Assistive hold/toggle stays on the live
+  overlay (composer mic is the only Agent-owned capture). Action row whispers
+  at rest. Retranscribe runs Full HQ / Cloud on `last_session.wav`. Forest
+  glass drinks the desktop; the panel stays non-key until you click FINAL.
+
+### Changed
+
+- **Whisper idle is 30 minutes after the last finished decode**, not 60
+  seconds from load. The running process only picks this up after
+  `install-app` + relaunch.
+- **Settings matches the live STT contract.** Dictation owns the ASR mode
+  picker (`apple_only` / `local_power` / `cloud`) and writes
+  `CODESCRIBE_ASR_MODE` plus explicit Cloud consent. Final pass is no longer
+  an engine control. Active STT is the last serving take (`local_apple` →
+  Apple). `STT_ENDPOINT` is the live WSS socket on Dictation. Retranscribe
+  toasts the real error, including a missing `last_session.wav`.
+- **Quality HTML is Seal Atlas.** `codescribe-corpus` writes
+  `quality/seal-atlas.{profile}.html` as the report (handshake in
+  `docs/quality-reports/CONTRACT.md`). Qube scores move to
+  `quality/qube.{profile}.html` and stay a footnote. Gold take 01 remains
+  `docs/quality-reports/seal-atlas.take01.html`.
+
 ## [0.13.3] - 2026-08-13
 
 > The agent-stability and STT-truth-layer wave: one dictation pipeline with an
@@ -51,7 +123,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **Whisper residency is bounded and observable** — the normal idle-weight TTL
-  is now 300 seconds (five minutes), while `CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=0`
+  is now 60 seconds (one minute), while `CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=0`
   remains the explicit power-user keep-warm override. INFO lifecycle events now
   expose the effective TTL plus load/unload/reclaim counts and durations without
   logging audio or transcript content. Host `vmmap` reclaim remains a release

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = [".", "core", "bridge"]
 
 [workspace.package]
-version = "0.13.3"
+version = "0.14.1"
 edition = "2024"
 authors = ["Vetcoders <hello@vetcoders.io>"]
 
@@ -18,7 +18,7 @@ tracing = "0.1"
 
 [package]
 name = "codescribe"
-version = "0.13.3"
+version = "0.14.1"
 edition = "2024"
 description = "Speech-to-text for macOS — SwiftUI front-end over a Rust engine (UniFFI bridge)"
 authors = ["Vetcoders <hello@vetcoders.io>"]

diff --git a/Makefile b/Makefile
@@ -11,7 +11,7 @@
         test-engine test-engine-apple test-engine-candle test-teacher \
         demo demo-raw demo-assistive check verify semgrep fix clean help corpus-census test-corpus-parity \
         dist-preflight dist-preflight-signed verify-canaries smoke-canaries \
-        dmg dmg-signed release-standard release-full release-dmgs notarize verify-dmg download-model download-e5 download-embedder ensure-models \
+        dmg dmg-signed release-standard release-full release-dmgs release-stable install-app-release notarize verify-dmg download-model download-e5 download-embedder ensure-models \
         hooks
 
 SHELL := /bin/bash
@@ -182,7 +182,11 @@ config:
 install-app:
 	@echo "Building $(CODESCRIBE_APP_NAME).app (SwiftUI, optimized local profile) via scripts/build-app.sh ..."
 	@echo "Local install uses the development license verifier; CODESCRIBE_LICENSE_PUBLIC_KEY_HEX is reserved for distribution builds."
-	@env -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX $(MAKE) --no-print-directory app PROFILE=local-release
+	@BIT=$$(./scripts/developer-surface-gate.sh); \
+	echo "Developer surface: $$BIT (1 needs legit Sparkle + license public keys on this machine)."; \
+	env -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX \
+	  CODESCRIBE_DEVELOPER_SURFACE=$$BIT \
+	  $(MAKE) --no-print-directory app PROFILE=local-release
 	@APP_SRC="macos/build/Build/Products/Release/Codescribe.app"; \
 	if [ ! -d "$$APP_SRC" ]; then \
 		echo "Build product missing: $$APP_SRC — 'make app PROFILE=local-release' did not produce the app."; \
@@ -256,7 +260,11 @@ bump:
 	esac; \
 	new="$$major.$$minor.$$patch"; \
 	sed -i '' "s/^version = \"$$current\"/version = \"$$new\"/" $(VERSION_FILE); \
-	echo "Bumped: v$$current -> v$$new"
+	if [ -f README.md ]; then \
+		sed -i '' "s/badge\/version-$$current-/badge\/version-$$new-/" README.md; \
+		sed -i '' "s/current source version is \`$$current\`/current source version is \`$$new\`/" README.md; \
+	fi; \
+	echo "Bumped: v$$current -> v$$new (Cargo.toml + README). Update CHANGELOG by hand. Do not bump site/src/lib/release.ts here."
 
 bump-patch:
 	@$(MAKE) bump TYPE=patch
@@ -1179,7 +1187,8 @@ help:
 	@printf '%s\n' '  make install-no-embed DEV/RECOVERY: no optional embeds (runtime paths only)'
 	@printf '%s\n' '  make release-codescribe-embedded Fat dylib with Whisper baked in (not daily)'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'config' 'Edit ~/.codescribe/.env'
-	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'install-app' 'Install to /Applications'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'install-app' 'Local-release install to /Applications (may re-sign; Lab if keys resolve)'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'release-stable' 'Everyday: notarize slim DMG + install that stapled .app'
 	@printf '\n'
 	@printf '  $(HELP_C_YELLOW)%s$(HELP_C_RESET)\n' 'RELEASE & DISTRIBUTION'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'dmg' 'Build DMG (ad-hoc signed)'
@@ -1308,6 +1317,40 @@ release-standard: dist-preflight-signed
 	fi; \
 	./scripts/verify-dmg-payload.sh "$$DMG" --variant slim --version "$$VERSION"
 
+# Install the already-built Release .app without re-signing. Re-signing with
+# Apple Development (install-app) drops the notarization ticket and gives the
+# everyday machine a different identity than the public DMG.
+install-app-release:
+	@APP_SRC="macos/build/Build/Products/Release/$(CODESCRIBE_APP_NAME).app"; \
+	DEST="/Applications/$(CODESCRIBE_APP_NAME).app"; \
+	if [ ! -d "$$APP_SRC" ]; then \
+		echo "ERROR: no Release app at $$APP_SRC — run make release-standard first."; \
+		exit 1; \
+	fi; \
+	if ! codesign --verify --deep --strict "$$APP_SRC" >/dev/null 2>&1; then \
+		echo "ERROR: Release app is not strictly signed. Refusing to install it."; \
+		exit 1; \
+	fi; \
+	echo "Stopping running $(CODESCRIBE_APP_NAME) (if any) ..."; \
+	pkill -x "$(CODESCRIBE_APP_NAME)" 2>/dev/null || true; \
+	sleep 1; \
+	echo "Installing stapled Release app to $$DEST (no re-sign) ..."; \
+	mkdir -p /Applications; \
+	rsync -a --delete "$$APP_SRC/" "$$DEST/"; \
+	echo "Installed: $$DEST"; \
+	defaults read "$$DEST/Contents/Info" CFBundleShortVersionString; \
+	defaults read "$$DEST/Contents/Info" CSBuildCommit; \
+	if stapler validate "$$DEST" >/dev/null 2>&1; then \
+		echo "staple: valid"; \
+	else \
+		echo "WARNING: staple not valid yet — run make release-standard (it notarizes) before treating this as everyday-stable."; \
+	fi
+
+# Everyday stable cut: the slim public DMG and the same stapled .app in
+# /Applications. Does not bake Lab. Does not touch SITE_VERSION / tags / GitHub.
+release-stable: release-standard install-app-release
+	@echo "Everyday stable is local (slim DMG + /Applications). Tag, push, gh release, and SITE_VERSION stay the operator button."
+
 # Optional fat SKU: bake Whisper (~1GB+) into the app. Not the daily path.
 # Ends with the fail-closed payload gate (full = Silero + Whisper embedded,
 # MiniLM runtime resource).

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # ⌜ Codescribe ⌟
 
-[![Version](https://img.shields.io/badge/version-0.13.3-6a9bcc)](Cargo.toml)
+[![Version](https://img.shields.io/badge/version-0.14.1-6a9bcc)](Cargo.toml)
 [![License: FSL-1.1-ALv2](https://img.shields.io/badge/license-FSL--1.1--ALv2-d97757)](LICENSE)
 [![CI](https://github.com/vetcoders/codescribe/actions/workflows/rust.yml/badge.svg)](https://github.com/vetcoders/codescribe/actions/workflows/rust.yml)
 [![Landing](https://img.shields.io/badge/site-vetcoders.github.io%2Fcodescribe-788c5d)](https://vetcoders.github.io/codescribe/)
@@ -59,7 +59,7 @@ flowchart TB
 
 > **Current runtime truth:** live overlay preview is local Whisper. Cloud STT is configurable in Settings, but in the current build it is still a **post-capture** path rather than live cloud preview.
 
-> **Status:** current source version is `0.13.3` (see `Cargo.toml`) and ships as a native macOS tray/settings/overlay app with local live preview, tiered settings (`settings.json` + Keychain + optional `.env`), and quality-loop tooling.
+> **Status:** current source version is `0.14.1` (see `Cargo.toml`) and ships as a native macOS tray/settings/overlay app with local live preview, tiered settings (`settings.json` + Keychain + optional `.env`), and quality-loop tooling.
 
 See: [`docs/WHISPER_LIVE.md`](docs/WHISPER_LIVE.md) | [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)
 
@@ -405,7 +405,8 @@ make format         # cargo fmt
 ```
 make app              # Debug SwiftUI app build
 make app PROFILE=local-release # Optimized local SwiftUI app build
-make install-app      # Build + install /Applications/Codescribe.app
+make install-app      # Local-release install (may re-sign; Lab only if keys resolve)
+make release-stable   # Everyday: notarize slim DMG + install that stapled .app
 make release-qube     # Build qube CLI tools
 make install          # Install qube CLI tools + repo-local hooks
 make release-dmgs     # Build both signed + notarized release DMGs