v0.2.0 — WS4 cloud (dual-region staging validated)

Cloud delivery. Engine IAM via EKS Pod Identity; OIDC/PKCE auth at the Go gateway (Cognito id_token, custom:tenant_id).

Dual-region staging E2E validated (2026-06-19): gateway /healthz, engine model-fetch (Pod Identity → S3, whisper-tiny-en), OIDC 5-face BVA, PKCE, real audio→text transcription. Ephemeral env, torn down after.

🤖 Generated with Claude Code

v0.1.0-demo-lan — LAN demo snapshot

Scope: LAN-only demonstration build. Single machine + same-WiFi phone viewer. Not a production release. Not a cloud release. This build should NOT be exposed to the public internet.

What this is

A technical demo snapshot at the conclusion of Phase 3. Everything runs on a single laptop + a phone on the same LAN:

• Engine (C++) — whisper-tiny.en ASR + bge-m3 Q4_K_M embedder + Qdrant retriever
• Gateway (Go) — session registry, WebRTC ingest, viewer fan-out, gRPC-Web bridge
• UI (React) — host page + viewer page; rolling transcript + RAG hint panel; QR-code LAN join

One command brings it up:

./tools/scripts/download_models.sh    # 75 MB whisper + 438 MB bge-m3
./tools/scripts/lan-smoke.sh          # supervises local Qdrant + seeds
# second terminal:
export QDRANT_URL=localhost:6334
./tools/bazelisk/bazelisk run //:app_local -- --with-frontend

Then open http://localhost:5173/host, pick "Taiwan (zh-TW Wikipedia demo)" from the corpus dropdown, scan the QR with a phone on the same WiFi, and speak.

Known Gaps — read before treating this as anything more than a demo

Deliberate LOCAL-mode design decisions (tracked for Phase 4+). This is the honest descope:

Axis	This release	Future tracked in
TLS / mTLS	OFF by design (ADR-0031 LOCAL posture — plaintext over LAN)	Cloud mode C-2 with cert-manager
AuthN / AuthZ	None; local mode has no caller identity	ADR-0022 / Phase 4 Cognito
Tenant isolation	Hardcoded tenant="demo" in gateway	Phase 4 JWT-derived tenant
VAD (voice activity detection)	NOT implemented — transcript window is a fixed 5 s clock	Phase 2+ (engine_cpp/src/session/session.cc:32-42)
ASR model	whisper-tiny.en only (~75 MB, English-only)	whisper-large-v3-turbo-q4 manifest entry pending pin
Dependabot backlog	6 high + 11 moderate alerts outstanding	Follow-up sweep
Observability	/metrics Prometheus endpoint exists; no Grafana panels / alerting	ADR-0028 Phase 4d
Session persistence	In-memory only; host disconnect + grace-window expiry ends meeting	ADR-0006
Multi-model / A/B / runtime model swap	Single whisper + single embedder per process	Phase 4+

What landed this week (#66–#75)

Polish round on top of Phase 3c exit:

• Retrieval quality — min_score=0.42 gate + consecutive-same-topic dedupe (#66); markdown-aware chunker + sentence-aware overlap walk (#67); 13 topic-scoped corpus sub-sections (#70); hint excerpts strip ## markdown (#71)
• Transcription feel — window 3 s → 5 s for more coherent segments (#72); viewer UI stitches segments at sentence boundaries (#73)
• Ergonomics — download_models.sh default flip covers bge-m3 automatically (#68); lan-smoke.sh supervises local Qdrant with trap cleanup (#69)
• UX truthfulness — Host dropdown dropped 4 never-seeded placeholders (#74); dynamic ListCorpora RPC populates from live Qdrant state with ADR-0022 aegis_<tenant>_<corpus> naming (#75)

Do NOT use this for

• Public internet exposure — no TLS, no auth; anyone on your LAN can join meetings
• Multi-tenant workloads — isolation is a prefix convention only
• Sensitive real-world transcripts — ephemeral-audio policy (ADR-0005) IS enforced in code, but no SOC2 / HIPAA controls, no audit surface, no retention tests

What's next

The cloud-mode equivalent (EKS deployment per ADR-0022 / ADR-0031) is Phase 4's subject. This tag does not imply cloud-mode is wired or validated.

---

Generated at the conclusion of Phase 3 LAN demo validation — four human-in-the-loop LAN re-drive passes between 2026-04-21 and 2026-04-22, all passed.