Transcribe private recordings through explicit recoverable review - #2891
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Bounded independent review: backend found no HIGH/CRITICAL; two MEDIUM transport limits are documented in AUDIO_TRANSCRIPTION.md. Frontend review found HIGH stale consent after configuration refresh. Fixed in ffd96e0 by binding consent to the displayed configuration hash and clearing it whenever refreshed configuration changes, including A→B→A. The same independent reviewer verified the narrow fix and reports resolved with no remaining HIGH/CRITICAL. Final 34 affected component tests, vue-tsc, scoped ESLint and diff check pass. cdcadd6 only reconciles documentation; doc-links and operations governance pass. Exact-head hosted CI and head aging still apply. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d0f00d9b0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (value.attempts.some(x => x.audioAnswerId !== id)) throw new Error('Unexpected recording receipts') | ||
| status.value = value; needsRefresh.value = false | ||
| if (retry.value && value.attempts.some(x => x.requestId === retry.value?.requestId)) { retry.value = null; consent.value = false } | ||
| if (!value.configuration.enabled || (retry.value && retry.value.configurationHash !== value.configuration.configurationHash)) consent.value = false |
There was a problem hiding this comment.
If an operator changes the speech configuration while this panel is open—for example across an API restart—a user who checked consent for destination A can refresh into destination B and retain the checked box because consent is cleared only for disabled configurations or an outstanding retry. start() then constructs the request from B's new configuration hash, so one click sends the private recording to a destination the user did not consent to; compare the previous configuration before replacing status and clear consent whenever its hash changes.
AGENTS.md reference: AGENTS.md:L96-L97
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in ffd96e0: consent is bound to the displayed configuration hash and cleared whenever a refreshed hash changes, including A-to-B-to-A. All 34 affected component tests, typecheck and lint pass; the independent narrow fix review confirms resolution. The fix is also included in the combined #2886 head fce97dc. No remaining HIGH consent finding is being deferred.
ea8c0cb
into
codex/2808-overhaul-followthrough
1 participant
Owners can explicitly request a transcript of a saved private recording from Thinking Decks or the original-recording library. The destination/model and allowance are disclosed before consent. A durable request receipt prevents duplicate sends during retries; generated text stays provisional until the owner reviews a written draft and separately confirms an answer. Reviewed and confirmed versions retain source lineage. Uploading a recording never sends it automatically.
Continues #2808 on #2886. The speech provider is disabled by default and uses the protected HTTP transport, existing kill switches/circuit, bounded input/output, transactional daily attempt/byte admission, deadline recovery and owner/access checks. Both account-export formats and account/source erasure cover the new tables. All four experiences share the same panel.
Validation:
One bounded backend review found no HIGH/CRITICAL; its two MEDIUM limits are documented: erasure cannot guarantee cancellation at the final network-dispatch interval, and 429/malformed successful bodies do not open the transport circuit. The frontend review found a HIGH stale-consent defect after configuration refresh; ffd96e0 binds consent to the displayed configuration and clears it on changes. All 34 affected component tests, typecheck and ESLint pass; the bounded fix review confirms resolution with no remaining HIGH/CRITICAL. Exact-head hosted CI remains the merge gate.
No paid/live-provider quality, physical-microphone, generic worker supervisor, minute/currency guarantee or source-storage import claim is made. Provider setup and limits are in docs/product/AUDIO_TRANSCRIPTION.md; human choices remain in OUTSTANDING_TASKS.md. The primary checkout and working database remain untouched.