swarm-stt: the deploy module (deploy.stt.*, sandboxed container, store leaf, queue grants) and its docs
This commit is contained in:
damocles
mara
parent
423860cadc
commit
96b5b83fa4
4 changed files with 594 additions and 5 deletions
|
|
@ -35,6 +35,9 @@ grafana, the controller, authelia, …) →
|
|||
they concern: assigned, unassigned, cleared on close; and the classifier's
|
||||
review requested on a push. →
|
||||
[`notify-router.md`](../../4-implementation/swarm/notify-router.md)
|
||||
- **speech-to-text** — voice memos agents receive, turned into text once per
|
||||
memo for the whole swarm. →
|
||||
[`stt.md`](../../4-implementation/swarm/stt.md)
|
||||
- **swarm UI** — the operator's day-to-day surface, on the swarm apex,
|
||||
`admins` only. → [`ui.md`](ui.md)
|
||||
- **shared services** — one forge, homeserver, SSO, queue and metrics/logs
|
||||
|
|
|
|||
|
|
@ -128,6 +128,7 @@ look before you switch them on.
|
|||
| Review classifier | Checks PRs against a repo's review rules. | `deploy.review-classifier.enable` | [Review classifier](#review-classifier) |
|
||||
| Claude login minter | Runs the **log in** button on an agent's card. | `deploy.claude-login.enable` | [Claude login minter](#claude-login-minter) |
|
||||
| Notification router | Turns forge events into notifications for agents. | `deploy.notify-router.enable` | [Notification router](#notification-router) |
|
||||
| Speech to text | Turns voice memos into text for agents. | `deploy.stt.enable` | [Speech to text](#notification-router) |
|
||||
|
||||
### SSO (authelia)
|
||||
|
||||
|
|
@ -416,3 +417,26 @@ It reaches the queue and the secret store by name, under its own
|
|||
`notify-router` leaf. On a host without the store, that leaf is the one file to
|
||||
copy, as for the CI runner. The flows and the delivery path are in
|
||||
[`notify-router.md`](../../4-implementation/swarm/notify-router.md).
|
||||
|
||||
### Speech to text
|
||||
|
||||
The speech-to-text service, in a `swarm-stt` container on the host that sets
|
||||
`deploy.stt.enable`. `allSwarmServices` defaults it on wherever the host has the
|
||||
service's store identity, on the router's terms. Run it where the inference
|
||||
hardware is: it transcribes with whisper.cpp.
|
||||
|
||||
An agent that receives a voice memo sends the audio to the service over the
|
||||
queue, on its own subject, and gets the text back. The service keeps each
|
||||
transcript for a day, keyed by a hash of the audio, so the same memo sent to several agents costs
|
||||
one whisper run. `deploy.stt.settings.modelSize` picks the
|
||||
model (`small` by default, or `base`), and `modelFile` takes any other ggml
|
||||
model. The cache time, the limits on file size, audio length and run time, and
|
||||
how many requests it holds at once are settings next to it.
|
||||
|
||||
The audio comes from rooms with outside people, so the service runs as its own
|
||||
unprivileged user under a tight systemd sandbox, with a memory ceiling and
|
||||
a CPU quota, and the container reaches the queue, the store and authelia
|
||||
and nothing else. The file's first bytes must look like an audio container
|
||||
before anything decodes it. Its leaf and its queue client work as the router's
|
||||
do. The design, the settings and the reasons are in
|
||||
[`stt.md`](../../4-implementation/swarm/stt.md).
|
||||
|
|
|
|||
|
|
@ -186,6 +186,7 @@ login minter's, the forge host's and Grafana's, which reach more than one:
|
|||
| `swarm-review-classifier`, in its container | `reviewClassifierClientCertFile` / `reviewClassifierClientKeyFile` | `swarm/services/review-classifier/anthropic-api-key`, `swarm/services/review-classifier/acp-provider` and `swarm/services/<classifier client id>/oidc/client` |
|
||||
| `swarm-claude-login`, in its container | `claudeLoginClientCertFile` / `claudeLoginClientKeyFile` | creates and updates `swarm/agents/+/claude-credentials`, reads and deletes its metadata; reads `swarm/services/<minter client id>/oidc/client` |
|
||||
| `swarm-notify-router`, in its container | `notifyRouterClientCertFile` / `notifyRouterClientKeyFile` | `swarm/services/<router client id>/oidc/client` |
|
||||
| `swarm-stt`, in its container | `sttClientCertFile` / `sttClientKeyFile` | `swarm/services/<service client id>/oidc/client` |
|
||||
| `swarm-builder`, in its container | `builderClientCertFile` / `builderClientKeyFile` | `swarm/services/builder/forge/token`, `swarm/services/attic/push-token` and `swarm/services/<builder client id>/oidc/client` |
|
||||
| `swarm-bao-attic-secret` and `swarm-bao-attic-tokens` | `atticClientCertFile` / `atticClientKeyFile` | creates and reads `swarm/services/attic/jwt-secret`, `swarm/services/attic/push-token` and `swarm/services/attic/pull-token` |
|
||||
| `swarm-archive-users`, `swarm-archive-prune` and, with an S3 bucket, `swarm-archive` | `archiveClientCertFile` / `archiveClientKeyFile` | reads `swarm/services/archive/users/*`, `swarm/services/archive/restic/*` and `swarm/services/archive/s3/*`, lists `swarm/services/archive/users/` |
|
||||
|
|
|
|||
|
|
@ -49,6 +49,7 @@ in
|
|||
(pair "forwarderOidc" "forwarder-oidc")
|
||||
(pair "reviewClassifier" "review-classifier")
|
||||
(pair "notifyRouter" "notify-router")
|
||||
(pair "stt" "stt")
|
||||
(pair "claudeLogin" "claude-login")
|
||||
(pair "ciMetrics" "ci-metrics")
|
||||
];
|
||||
|
|
|
|||
Loading…
Reference in a new issue