feat: transcription v1 — cloud STT (Groq / OpenAI / OpenAI-compatible) end-to-end

.github/workflows/ci.yml

@@ -100,6 +100,24 @@ jobs:
             librsvg2-dev \
             patchelf
 
+      # WHY (T12): tauri-build validates `bundle.externalBin` paths
+      # during EVERY cargo compile of `perima-desktop` (not just
+      # `tauri build` — issue tauri-apps/tauri#14602). With
+      # `externalBin = ["binaries/ffmpeg"]` declared in tauri.conf.json,
+      # `cargo {build,clippy,test} -p perima-desktop` fails immediately
+      # without `crates/desktop/binaries/ffmpeg-{target-triple}` on
+      # disk. The fetch script downloads a pinned static build on Linux
+      # (johnvansickle.com release-amd64-static) and writes a
+      # zero-byte stub on macOS+Windows so the compile passes; runtime
+      # transcription on those platforms surfaces a clear
+      # `BinaryNotFound` until the T12-followup macOS+Windows fetchers
+      # land. The script is idempotent (skips download if the binary is
+      # already present) so Swatinem/rust-cache hits don't redo work.
+      # MUST run BEFORE `just ci` — otherwise tauri-build aborts.
+      - name: Fetch ffmpeg sidecar
+        shell: bash
+        run: just sidecar
+
       - name: Run just ci
         shell: bash
         run: just ci
@@ -129,6 +147,13 @@ jobs:
             librsvg2-dev \
             patchelf
 
+      # WHY (T12): same rationale as the matrix job's sidecar fetch —
+      # `just bindings` runs `cargo build -p perima-desktop --features
+      # specta-export`, which compiles tauri-build, which validates the
+      # externalBin path. Must run before `just bindings`.
+      - name: Fetch ffmpeg sidecar
+        run: just sidecar
+
       # WHY: regenerate bindings.ts via the specta-export feature and
       # fail the job if `git diff` shows the committed copy is stale.
       # Catches every Rust-side change to a #[tauri::command] signature,

.github/workflows/mutants.yml

@@ -65,6 +65,18 @@ jobs:
             librsvg2-dev \
             patchelf
 
+      # WHY (T12): cargo-mutants' baseline-build pass compiles the
+      # WHOLE workspace including perima-desktop (exclude_globs only
+      # filters mutation generation, not baseline compile). tauri-build
+      # validates `bundle.externalBin` paths during compile (issue
+      # tauri-apps/tauri#14602), so the binary must exist on disk
+      # before any cargo invocation.
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
+      - name: Fetch ffmpeg sidecar
+        run: just sidecar
+
       # WHY `| tee git.diff` (vs `> git.diff`): tee echoes the diff into
       # the CI log so reviewers can see what cargo-mutants will operate
       # on without downloading the artifact. Matches the canonical

.gitignore

@@ -1,12 +1,18 @@
+# =============================================================================
+# DO NOT RE-ENABLE TRACKING FOR CLAUDE.md OR docs/.
+#
+# CLAUDE.md and docs/ are LOCAL-ONLY by intentional decision (autonomous-mode
+# user preference). Both files have been `git rm --cached` and remain on disk
+# for local agent state. Do not add `!CLAUDE.md` or `!docs/...` exception
+# lines below. Do not "helpfully" re-track these so cloud agents can read
+# them. The user has reverted that pattern repeatedly. This rule is final.
+# =============================================================================
+
 **/*.md
 !CHANGELOG.md
-!CLAUDE.md
-# WHY exception for docs/superpowers + CLAUDE.md: cloud agents
-# (scheduled remote triggers) clone the repo fresh and need spec/plan
-# artifacts + binding rules to continue autonomous work across
-# sessions. Local WIP .md files elsewhere in the repo remain gitignored.
-!docs/superpowers/**/*.md
-!docs/routines/**/*.md
+CLAUDE.md
+docs/
+.claude
 !.claude/**/*.md
 # WHY: issue templates (.yml) and any future workflow docs live under
 # .github/; the blanket **/*.md rule would otherwise exclude markdown
@@ -23,3 +29,11 @@ node_modules/
 apps/desktop/dist/
 apps/desktop/dist-types/
 .codex
+# WHY: Tauri externalBin sidecar binaries (ffmpeg + future helpers) are
+# fetched at CI build time, named per-target-triple (e.g.
+# `ffmpeg-x86_64-unknown-linux-gnu`), and can be 50-100 MB. Never commit
+# them — they are platform-specific, large, and CI provisions them
+# fresh each run. The `.gitkeep` is preserved so the directory exists
+# at clone time (Tauri's externalBin resolver expects the path).
+crates/desktop/binaries/*
+!crates/desktop/binaries/.gitkeep