serverAppConfigs-docs/Dankclaw/Frank TTS Engine.md

@@ -1,6 +1,6 @@
 ---
 type: reference
-description: "frank-tts-engine is the arm A TTS engine on Dankclaw: qwentts.cpp's resident tts-server with the 1.7 B base talker, on a private podman bridge behind frank-tts — repo-owned, not yet deployed."
+description: "frank-tts-engine is the arm A TTS engine on Dankclaw: qwentts.cpp's resident tts-server with the 1.7 B base talker, on a private podman bridge behind frank-tts — deployed 2026-10-18, and it publishes no port on purpose."
 tags:
   - dankclaw
   - tts
@@ -14,7 +14,7 @@ timestamp: 2026-10-18
 
 `frank-tts-engine` is the **arm A text-to-speech engine** on Dankclaw: [qwentts.cpp](https://github.com/ServeurpersoCom/qwentts.cpp)'s resident `tts-server` HTTP process, holding the Qwen3-TTS **1.7 B base talker (Q4_K_M)** and the **12 Hz tokenizer (Q8_0)** in RAM once and synthesizing from there. It listens on container port **8880** and is **deliberately not a fleet endpoint** — the endpoint consumers address is `frank-tts` on **7772**, which resolves voice names, re-encodes to mp3 and owns the timeout budget. This page is the engine runbook; the endpoint's contract lives with its own page.
 
-**Nothing here is deployed.** This page documents repo-owned configuration — the Quadlet unit and network, the image build, the weight fetcher, the boot warmer, the deployer path — and the measured facts those files were written against. No container, image, weight file or network exists on Dankclaw yet, and the engine publishes no port at all, so there is nothing for the homepage checker or a browser to reach. Deploying it is a deliberate next step, in the order at the bottom of this page.
+**Deployed 2026-10-18.** The chain ran in the order at the bottom of this page — fetch (1.4 GiB, byte + LFS oid verified, 18 s), image build against the pinned commit, unit + network install, container-health gate, warm pass — and the live state still reads the way this page describes it: unit `active` with no drop-ins, container healthy 31 s after the build, **4.0 GiB** resident on a host that kept 17 GiB available, `3 voice(s) registered and warm` in the journal, and no published port anywhere. Two things the first real boot taught: the warm hook's registration body must reach curl through a **file**, not an argument (Troubleshooting), and `STEP 3/13 RUN useradd` is the first honest proof of the image's non-root user.
 
 **Host:** Dankclaw (`192.168.0.143`), rootless Podman, user `dank` — **Port:** 8880, **never published** — **Network:** the private `systemd-frank-tts-engine` bridge (10.89.5.0/24) and no other — **Deployer:** `frank-tts-engine` — **Consumers:** `frank-tts` (7772) and, through it, every voice request in the fleet including [[Open Notebook]]'s podcast renders.
 
@@ -96,25 +96,27 @@ The **façade** on 7772 is the pair's public surface and carries the probe. Note
 |---|---|
 | `dankclaw/voiceservice/Containerfile.engine` | two-stage build of the pinned commit, proven cmake line, digest-pinned base, ships both scripts |
 | `dankclaw/voiceservice/tts-engine-start.sh` | image entrypoint (`/app/start.sh`): env → flags, refuses to boot without weights |
-| `dankclaw/voiceservice/tts-engine-warm.sh` | boot warmer (`/app/warm-voices.sh`): register from `reference.wav`, speak one sentence, report cold/warm |
+| `dankclaw/voiceservice/tts-engine-warm.sh` | boot warmer (`/app/warm-voices.sh`): register from `reference.wav` (body via a temp file), speak a fixed sentence twice, report cold/warm |
 | `dankclaw/voiceservice/quadlet/frank-tts-engine.container` | the unit: bridge only, no publish, env file, two read-only mounts, health probe, warm hook, `Restart=always` |
 | `dankclaw/voiceservice/quadlet/frank-tts-engine.network` | the private 10.89.5.0/24 bridge, with the subnet registry |
-| `scripts/frank-tts-engine.env` | paths and numbers only, with the thread law and the cold-voice law in its header |
+| `scripts/frank-tts-engine.env` | paths and numbers only, with the thread law and the registry law in its header |
 | `scripts/download-frank-tts-engine-qwentts.sh` | weight fetcher: no resume, byte count + LFS oid check, `--verify-only` |
 | `scripts/deploy-remote.sh` → `deploy_frank_tts_engine` | weights gate → build → quadlet → restart → container health → warm |
 | `tests/frank_tts_engine.bats` | the seam: generator output, entrypoint argv, warmer against a stub engine, planner and routing maps |
 
-## Deploy order (host steps, in order)
+## Deploy record (host steps, in the order they ran)
 
-Nothing below has been run. Steps 1–5 are this service; 6–7 are what unblocks the podcast pipeline.
+Run 2026-10-18 as `./scripts/deploy.sh dankclaw --service frank-tts-engine`, then
+`--service frank-tts`. Steps 1–6 are this service and the façade; only step 7 is
+still open.
 
 1. **Fetch the weights** — `scripts/download-frank-tts-engine-qwentts.sh` (1.4 GiB, byte + sha256 verified, idempotent; `--verify-only` is what the deployer calls).
-2. **Deploy the engine** — `./scripts/deploy.sh dankclaw --service frank-tts-engine` (`--service` is the only way to name one service; `deploy-remote.sh` is the remote half and takes `<target> <git-revision> [service]...`, so never call it by hand with a bare service name). Builds the image (needs github.com once), installs the unit and the network file, restarts, gates on the container's health status, then warms.
+2. **Deploy the engine** — `./scripts/deploy.sh dankclaw --service frank-tts-engine` (`--service` is the only way to name one service; `deploy-remote.sh` is the remote half and takes `<target> <git-revision> [service]...`, so never call it by hand with a bare service name). It builds the image (needs github.com once), installs the unit and the network file, gates on the container's health status, then warms.
 3. **Confirm the endpoint is alive** — `podman exec frank-tts-engine curl -fsS http://127.0.0.1:8880/health` → `{"status":"ok"}`, and `systemctl --user status frank-tts-engine` showing the unit `active` with the warm pass behind it.
-4. **Confirm the voices are known** — the warmer's journal lines must name every pack; once the façade is up, `curl http://127.0.0.1:7772/v1/audio/voices` is the authoritative list (the façade has exactly three routes: `/health`, `/v1/audio/voices`, `/v1/audio/speech`).
+4. **Confirm the voices are known** — the warmer's journal lines name every pack, and once the façade is up `curl http://127.0.0.1:7772/v1/audio/voices` is the authoritative list (the façade has exactly three routes: `/health`, `/v1/audio/voices`, `/v1/audio/speech`).
-5. **Prove the cold-voice law is paid at boot, not by a listener** — two identical synthesis requests for one voice, back to back, from inside the engine's namespace; the **second** must answer well under a second (`warm=` in the journal is already that number; the manual pair is the confirmation on the real artifact).
+5. **Measure the ladder instead of trusting the trial** — two identical requests for one voice back to back. The design expected 6.2-8.0 s then 0.5 ms; the deployed container gave **1,883 ms then 1,226-1,283 ms**, so the hook buys ~0.6 s and stays only for the registry reason (law 1). The retired numbers must not be quoted.
-6. Then the façade on **7772** (its own page): nothing may be published there until the engine answers, because open-notebook's render fails the moment the façade is up and the engine is not.
+6. **Then the façade on 7772** (its own page), after the engine answered — that order is the whole point of step 6: publishing the façade in front of a dead engine would make every consumer fail at the first voice line.
-7. Nothing on 7772 exists yet — that is why open-notebook's podcast render cannot run. See [[Open Notebook]].
+7. **Open:** [[Open Notebook]] is still not installed, so nothing renders a podcast yet; the voice leg it waits on now exists.
 
 ## Troubleshooting
 

serverAppConfigs-docs/Dankclaw/Frank TTS.md

@@ -1,6 +1,6 @@
 ---
 type: reference
-description: "frank-tts is the fleet's cloned-voice speech endpoint on Dankclaw :7772 — the one voice surface consumers address, in front of frank-tts-engine; repo-owned, not yet deployed."
+description: "frank-tts is the fleet's cloned-voice speech endpoint on Dankclaw :7772 — the one voice surface consumers address, in front of frank-tts-engine; deployed 2026-10-18 and wired as the harness speech role."
 tags:
  - dankclaw
  - tts
@@ -16,10 +16,15 @@ audio in that cloned voice. Everything else in the voice stack sits behind it
 the engine ([[Frank TTS Engine]]) publishes no port on purpose, and consumers
 never learn a path.
 
-**Nothing here is deployed.** No host was touched while this was written: no
+**Deployed 2026-10-18** — `./scripts/deploy.sh dankclaw --service frank-tts`,
-image built, no container started, nothing listening on 7772. That is also why
+both units `active`, no drop-ins, and the homepage card's `wip` gate came off in
-[[Open Notebook]] cannot render a podcast episode yet — its pipeline calls this
+the same change. Probes on the deployed endpoint: `/health` answers
-endpoint.
+`{"status":"ok","backend":"omni-http","voices":["narrator1","narrator2","narrator3"]}`,
+and two different voices rendered the same sentence into **different** bytes
+(24 kHz mono PCM16, 4.24 s, healthy RMS) — so name resolution is real, not a
+pass-through of one default. The operator harness routes its `speech` role here;
+see [[#The harness speech role]]. What still waits is [[Open Notebook]]: its
+render needs the app installed, not this endpoint.
 
 | | |
 | --- | --- |
@@ -138,8 +143,51 @@ A `/health` probe job would therefore be structurally never-green, and because
 `frank-tts` target would page on Signal every few minutes for an endpoint that
 is fine — the frank-archon lesson pointed the other way. The engine cannot be
 scraped at all: it publishes nothing. Status lives in `systemctl --user status`,
-`podman healthcheck run`, the two unit journals, and the homepage card, which is
+`podman healthcheck run`, the two unit journals, and the homepage card, which
-gated `wip: down` until the deploy and probes `127.0.0.1:7772`.
+probes `127.0.0.1:7772` for real now — the `wip: down` gate came off with the
+2026-10-18 deploy.
+
+## The harness speech role
+
+The operator harness reaches this endpoint through
+`~/.omp/agent/models.yml` — provider `frank-tts (dankclaw)`,
+`baseUrl: http://192.168.0.143:7772/v1`, `auth: none`, and the runner api
+`openai-speech` on the **model** row (naming a runner api at *provider* level
+fails the whole file's validation and disables every custom provider, which is
+how the fleet's chat endpoints disappear) — plus `config.yml`
+`modelRoles.speech: frank-tts (dankclaw)/frank-tts`. Four laws, read out of the
+harness bundle and measured the day of the flip:
+
+- **The only voice the harness can send is the `voice_id` argument of the call.**
+  The transport builds `{model, input, response_format, voice?}` and adds `voice`
+  **only** when the caller passed `voice_id`; no setting feeds it.
+  `tts.localVoice` is the *local Kokoro backend's* voice (it is what answered
+  `voice=kokoro/bm_george, backend=local` in the control test), and
+  `speech.voice` is the TUI's **speak-aloud** voice — its enum is Kokoro's list,
+  and it never reaches an HTTP request. So a harness call arrives voice-less by
+  default, which is exactly why the endpoint grew `DEFAULT_VOICE`: the declared
+  pack answers a voice-less request and the journal marks that line `(default)`,
+  while an **unknown** name still 400s with the list that exists.
+- **`speech.voice` must stay a Kokoro name.** Setting it to a pack name does not
+  select a pack; it hands the vocalizer a value outside its enum. (The first
+  draft of this section said the opposite and was reverted the same day, after a
+  fresh session's call came back `unknown voice None`.)
+- **There is no silent fallback.** An explicitly configured `modelRoles.speech`
+  yields exactly one candidate, so a dead 7772 fails the speech device with
+  *"No available speech model matches the speech role"* instead of quietly
+  degrading to Kokoro. That is the price of `auth: none` (which makes a dead
+  endpoint read as available) and it is the wanted shape: a narration job should
+  fail loudly rather than ship a voice Frank never asked for.
+- **A session older than the models.yml row cannot see it.** `models.yml` loads
+  at process start while `config.yml` is read live, so a long-lived session
+  carrying the flipped role fails exactly like a dead endpoint while a fresh
+  process succeeds in the same minute. Measured 2026-10-18: the open session
+  failed twice (provider/id form, then the bare id), `local/kokoro` succeeded in
+  that same session, and a fresh `omp -p --tools tts` returned `Saved 180524
+  bytes (model=frank-tts (dankclaw)/frank-tts, voice=narrator1, codec=wav)`
+  while the façade logged the matching `speech voice=narrator1 format=wav
+  chars=51 -> 180524 bytes` from the podman bridge. Rule the stale registry out
+  before blaming the service.
 
 ## Troubleshooting
 

serverAppConfigs-docs/Dankclaw/Open Notebook.md

@@ -59,7 +59,7 @@ podman exec open-notebook curl -sS http://frank-tts:7772/health
 podman exec open-notebook curl -sS http://host.containers.internal:7771/v1/models
 ```
 
-**The blocker to state plainly:** frank-tts is built, named and tested but **not deployed** — nothing answers on 7772 (`ss -ltn`, Dankclaw, 2026-10-18; [[Local TTS and Voice Cloning]] records the same census). open-notebook deployed today writes scripts and fails at the first voice line. frank-tts ships first, or podcast generation waits.
+**The blocker moved; it did not vanish.** frank-tts and frank-tts-engine are **deployed** (2026-10-18) and answer on 7772, so the voice leg works end to end — `podman exec open-notebook curl -sS http://frank-tts:7772/health` is the check to run the day the app exists. What still blocks a render is open-notebook itself: not installed on this host yet. When it is, the two provider rows above are the only wiring, and the seeded speaker profiles carrying OpenAI voice names are the first trap.
 
 **Why frank-zealot and not frank-dragoon:** podcast scriptwriting asks the model for a JSON-schema response (with a plain-JSON fallback). llama.cpp's OpenAI-compatible endpoint is a known-good target for that; frank-dragoon's halogen runtime has **unverified** structured-output behaviour, so it is the unproven alternative, not the fallback. `ESPERANTO_LLM_TIMEOUT=180` (the app's own default) covers an outline or transcript call on zealot comfortably; upstream's note is to keep it under 600 so a slow call fails with a clear error instead of a UI timeout.
 

serverAppConfigs-docs/index.md

@@ -80,8 +80,8 @@ macOS mini) as quadlets inside its podman machine — not on Dankserver.
 - [[Seerr]] — unified *arr request manager (guard-chained; fronts FrankBook-Pro's stack)
 - [[Marreta]] — content-cleaning proxy (guard-chained; shares SearXNG's Gluetun egress)
 - [[Open Notebook]] — podcast generator (scripts by frank-zealot, voices by frank-tts); repo-owned config, not deployed
-- [[Frank TTS Engine]] — the arm A TTS engine (`qwentts.cpp` resident `tts-server`, 1.7 B talker) behind frank-tts on a private bridge; repo-owned config, not deployed
+- [[Frank TTS Engine]] — the arm A TTS engine (`qwentts.cpp` resident `tts-server`, 1.7 B talker) behind frank-tts on a private bridge; deployed on Dankclaw, CPU-only, publishes no port by design
-- [[Frank TTS]] — the 7772 cloned-voice endpoint consumers address: voice naming, pack layout, why the upstream is a container name; repo-owned config, not deployed
+- [[Frank TTS]] — the 7772 cloned-voice endpoint consumers address: voice naming, pack layout, why the upstream is a container name; deployed, and it is the harness `speech` role
 - [[Voice Packs]] — how a frank-tts voice is built: reference.wav + the pinned engine's speaker artifacts, cut past the 10-second source-material gate
 
 ## Infrastructure

serverAppConfigs-docs/log.md

@@ -2690,3 +2690,47 @@ every restart since the cutover.
   measured claim: about **0.6 s**, and the 400-for-every-name reason the pages
   should have led with. The trial entry above is left as written — a dated worklog
   entry is a record — and this line is the correction that points at it.
+
+## 2026-10-18 — 7772 is live and the harness speaks through it
+
+- Merged **#15** (`0315a62`, the warmer's argument-cap fix) and **#16**
+  (`d2ce669`, the comment sweep), then deployed both voice services in order:
+  `--service frank-tts-engine` (image rebuilt from the fixed warmer, unit
+  `active`, zero drop-ins, warm pass in the unit's own start — `narrator1
+  cold=1542ms warm=1709ms`, `narrator2 1329/1405`, `narrator3 1451/1394`, `3
+  voice(s) registered and warm`) and `--service frank-tts`. The Playwright gate
+  ran at the end of each deploy: 33/33 twice.
+- Deployed-state proof from a LAN client: `/health` → `omni-http` with all three
+  voices; the same sentence in `narrator1` and `narrator2` came back with
+  **different sha256** and different RMS (4.24 s, 24 kHz mono PCM16), so the name
+  actually selects a voice. Engine-side ledger for the harness request:
+  `TTFA 67.5 ms`, `Total 2158.8 ms`, `audio 3.76 s, RTF 0.574`.
+- **The harness `speech` role moved off Kokoro**: `config.yml`
+  `modelRoles.speech: frank-tts (dankclaw)/frank-tts`. No voice key moves with it.
+  The bundle is unambiguous: the speech device forwards the call's `voice_id` and
+  nothing else, `tts.localVoice` belongs to the local backend (it is what answered
+  in the control test), and `speech.voice` is the TUI's speak-aloud enum.
+- Two harness laws learned by breaking it first (both now on [[Frank TTS]]): an
+  explicit speech role has **no fallback candidate**, so a dead endpoint errors
+  instead of degrading; and `models.yml` loads at process start while
+  `config.yml` is read live, so a session older than the `frank-tts` row fails
+  exactly like a dead endpoint. Fresh-process proof in the same minute:
+  `Saved 180524 bytes (model=frank-tts (dankclaw)/frank-tts, voice=narrator1)`
+  with the matching façade log line `speech voice=narrator1 format=wav chars=51
+  -> 180524 bytes`. This window's own session is that stale case and knows it.
+- Status sweep, because six pages still said the endpoint did not exist: both
+  vault descriptions, the two `index.md` bullets, the Open Notebook blocker (the
+  voice leg works; open-notebook itself is what is missing), the engine page's
+  "Deploy order — nothing below has been run" is now a **Deploy record**, and the
+  homepage card lost `wip: down` so the admin panel probes 7772 for real.
+- Corrected the same evening, by breaking it in a restarted session: a harness
+  call that names no voice reaches 7772 with **no `voice` key at all** — `400
+  unknown voice None; available voices: narrator1, narrator2, narrator3` —
+  because no setting feeds one. The earlier `Saved 180524 bytes
+  (voice=narrator1)` succeeded only because that run was *told* to pass
+  `voice_id`. The endpoint therefore grew `DEFAULT_VOICE` (its own PR): a
+  voice-less request speaks the declared pack and the journal line carries
+  `(default)`, while an unknown name still 400s with the list. Reverting the role
+  to Kokoro is one key, not two, and `speech.voice: narrator1` — briefly recorded
+  above as wiring — went back to `am_fenrir`: that key is the vocalizer's Kokoro
+  enum, so a pack name there breaks speak-aloud and does nothing for synthesis.

shared/homepage/services.json

@@ -541,12 +541,12 @@
     "name": "frank-tts",
     "category": "admin",
     "section": "AI",
-    "description": "The fleet's cloned-voice speech endpoint: POST /v1/audio/speech with voice=<name>, audio back in that voice. Public on 7772; the engine behind it (frank-tts-engine) is unpublished on purpose. Hidden until deployed.",
+    "description": "The fleet's cloned-voice speech endpoint: POST /v1/audio/speech with voice=<name>, audio back in that voice. Published on 7772; the engine behind it (frank-tts-engine) is unpublished on purpose. It is also the harness speech role.",
     "url": "",
     "docs": "",
     "probe": "127.0.0.1:7772",
     "method": "http",
-    "wip": "down",
+    "wip": false,
     "showLink": false,
     "art": "/img/apps/mono-ft.svg"
   }

tests/frank_tts_engine.bats

@@ -943,10 +943,14 @@ DRV
         || { echo "editing app.py must rebuild the façade image"; false; }
 }
 
-@test "the voice stack's homepage state: one card for the pair, and it is hidden while undeployed" {
+@test "the voice stack's homepage state: one probed card for the pair, and no link" {
     # The engine is not on the homepage and must not be: it publishes no port, so
     # there is no address the checker could dial, and a card that can never be
-    # green is worse than no card. The façade carries the pair's signal.
+    # green is worse than no card. The façade carries the pair's signal — and
+    # since the 2026-10-18 deploy that signal is a real probe (`wip: false`), not
+    # a placeholder. It stays `showLink: false` and admin-only: an HTTP API has no
+    # page to open, and the checker counts ANY HTTP response as up, so the card is
+    # honest without a link and without a `/health` path in the probe.
     python3 - "$REPO_ROOT" <<'PY'
 import json, os, sys
 root = sys.argv[1]
@@ -955,8 +959,12 @@ assert "frank-tts-engine" not in cards, \
     "the engine publishes no port: a card for it could never be probed green"
 fts = cards["frank-tts"]
 assert fts["probe"] == "127.0.0.1:7772", fts["probe"]
-assert fts["wip"] == "down" and fts["showLink"] is False, \
+assert fts["wip"] is False, \
-    "nothing listens on 7772 until the deploy, so a visible card reads as down forever"
+    "the endpoint is deployed; a wip card would hide its real state: " + repr(fts.get("wip"))
+assert fts["showLink"] is False and fts["url"] == "", \
+    "an API endpoint has no UI to link to — it is a status card, not a tile"
+assert fts["category"] == "admin", \
+    "consumers dial this; it is not an app the user homepage should advertise"
 assert os.path.exists(f"{root}/shared/homepage{fts['art']}"), f"missing art {fts['art']}"
 PY
 }