feat: voice-driven compliance console (opt-in)

[kkmookhey]

Summary

Adds an optional voice-driven compliance console at python -m shasta.voice. Users run a scan via the /scan Claude Code skill, then talk to their compliance posture across SOC 2 / ISO 27001 / HIPAA / ISO 42001 / EU AI Act. Voice handles read-side queries (findings, scores, controls, scans) plus light writes (risk-register operations). Heavy operations (scans, reports, Terraform, policy generation) stay in Claude Code skills — voice redirects to them.

• New sibling module src/shasta/voice/ (FastAPI sub-app, OpenAI Realtime API, React frontend)
• Pre-built React bundle ships in the wheel — no Node.js required at runtime
• Read-only over ShastaDB + risk-register writes via existing save_risk_items
• pip install shasta[voice] extra; default install unchanged
• 74 voice tests, ~85% coverage on src/shasta/voice/
• Existing 426 Shasta tests still passing — no regressions

Why a voice console

Compliance posture is a query-heavy workflow (status checks, drilldowns, "what's CC6.1 looking like?"). Voice is faster than scrolling dashboards for daily check-ins and exec briefs. The dashboard cards mount in response to the assistant's tool calls, so the screen tracks the conversation hands-free.

Architecture

Browser (React, localhost:8090)  ◄── WebRTC ──►  OpenAI Realtime API
        │                                                │
        │ POST /tools/{name}            tool_call events │
        ▼                                                ▼
FastAPI sub-app (shasta.voice)
        │
        ▼
Store facade  →  ShastaDB + compliance scoring/mapper functions

The Store facade in src/shasta/voice/store.py is the only seam into Shasta core — it composes existing ShastaDB, compliance.scorer, compliance.mapper, and the ISO/HIPAA equivalents. No new domain logic; no duplication of compliance scoring.

What's in this PR

Change	Files
Voice module (Python)	src/shasta/voice/ — 14 modules + 14 tools across models.py, store.py, realtime_config.py, session.py, tools/*.py, app.py, cli.py, observability.py
Voice module (React)	src/shasta/voice/web/ — Vite + React + TypeScript + Zustand + Framer Motion
Pre-built bundle	src/shasta/voice/web/dist/ — committed for zero-Node distribution (90 KB gzipped JS)
Tests	tests/voice/ — 74 tests, store + tool functions + endpoints + CLI; ~85% coverage
pyproject.toml	New [voice] optional-dependency, force-include for the React bundle
src/shasta/db/schema.py	One-line: check_same_thread=False on the SQLite connection (lets FastAPI share the connection across worker threads; behavior unchanged for the existing single-threaded dashboard)
CI	.github/workflows/voice-bundle.yml — verifies the committed React bundle stays in sync with web/src/
Docs	README.md — Voice Console section. TRUST.md — test count 632 → 706 (74 voice tests added). CHANGELOG.md — [Unreleased] entry. docs/superpowers/specs/2026-05-05-shastavoice-design.md — design spec. docs/superpowers/plans/2026-05-05-shastavoice.md — implementation plan.

How to test

pip install -e ".[dev,voice]"
export OPENAI_API_KEY=sk-...   # required for OpenAI Realtime API

# In Claude Code:
/scan                          # populate data/shasta.db

# In your shell:
python -m shasta.voice         # opens browser at http://localhost:8090

Demo phrases that exercise the full surface:

• "What's my SOC 2 score?" → ComplianceScore card
• "Show me my critical findings." → FindingsList card
• "Tell me about that one." → FindingDetail card
• "How am I doing across the board?" → MultiFrameworkScore card
• "What's CC6.1 looking like?" → ControlSummary card
• "Show me my open risks." → RiskList card
• "Add a risk for the CloudTrail thing." → ActionToast confirms a new risk row
• "Run a scan." → assistant redirects to /scan (proves the redirect rules work)
• Try interrupting mid-response → barge-in stops within ~200ms

Test plan

• Voice tool layer unit tests passing (74/74, ~85% coverage)
• Tool endpoint integration tests passing
• Existing Shasta test suite still passing (426/426 — no regressions)
• All 15 doc-integrity tests passing (TRUST.md test count updated)
• Manual rehearsal against real scan + real OpenAI key (user-confirmed: "this works pretty well")
• React production build succeeds (90 KB gzipped JS bundle)

Cost note

OpenAI Realtime API: ~$0.06/min input, ~$0.24/min output. Light usage is a few cents per session. The README documents the per-minute cost so users can budget. Build + rehearsals across this PR's development consumed ~$25 in OpenAI charges.

References

• Design spec: docs/superpowers/specs/2026-05-05-shastavoice-design.md
• Implementation plan: docs/superpowers/plans/2026-05-05-shastavoice.md

🤖 Generated with Claude Code