Finalize release downloads, installation prompt and verified handoff

2026-10-13 22:42:06 +02:00
1 parent f72767395b
commit 01279a6b25
@@ -8,8 +8,8 @@ same actual Rust/Google search engine.
 ## Configure an existing index

 Windows x64 users can download the optional
-[CLI/MCP ZIP](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.6/searchi-cli-windows-0.1.6.zip)
-and verify its [separate checksum file](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.6/searchi-cli-windows-0.1.6.zip.sha256).
+[CLI/MCP ZIP](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.7/searchi-cli-windows-0.1.6.zip)
+and verify its [separate checksum file](https://tea.karlcom.de/karl/searchi/releases/download/v0.1.7/searchi-cli-windows-0.1.6.zip.sha256).
 Extract it alongside the installed desktop's runtime helpers. Use
 `searchi-cli.exe`; keep `searchi-extract-worker.exe` beside it for PDF/DOCX indexing.
 Use the desktop to finish model setup and semantic indexing before connecting.
@@ -99,8 +99,8 @@ screenshots and worker inference; those are different release gates.

 ## Headless Linux Google search

-These are the current script and CLI interfaces, not evidence of an executed
-Linux release. On a native Linux build host with Vulkan development libraries
+The published headless archive is documented in [Linux setup](LINUX-HEADLESS.md).
+The commands below describe a source build. On a native Linux build host with Vulkan development libraries
 and `glslc`, run from the repository root:

 On Ubuntu 24.04, the native worker build prerequisites are `build-essential`,
@@ -248,8 +248,9 @@ python tools/package_windows.py --cli target/release/searchi.exe

 The additional binary is named `searchi-cli.exe`; `searchi.exe` remains the
 desktop launcher. Its model cache and database must be selected explicitly,
-as described in [agent integration](AGENT-INTEGRATION.md). This option does not
-add the CLI to the already published v0.1.0 installer.
+as described in [agent integration](AGENT-INTEGRATION.md). Published Windows
+installers provide the desktop app; the optional CLI/MCP ZIP is a separate
+download linked in the README.

 The generated `.searchi/packages/searchi-windows.zip` contains the desktop,
 matching-architecture Google worker, FFmpeg/FFprobe and notices. It excludes
@@ -0,0 +1,46 @@
+# Initial release handoff — 2026-10-13
+
+Karl requested finishing the usable Windows delivery and publishing the already
+validated Linux packages, without further feature/platform expansion.
+[Final release v0.1.7](https://tea.karlcom.de/karl/searchi/releases/tag/v0.1.7)
+is published as a regular release and is returned by Gitea's latest-release API.
+Its eight assets include installers/archives and their checksums:
+
+| Artifact | Actual version | SHA-256 |
+| --- | --- | --- |
+| Windows desktop | 0.1.7 | `5ca8ad982113d086190ecf8ea684a504a4277099a377124bdffa8ca9fed6595e` |
+| Windows CLI/MCP | 0.1.6 | `876dc88b9f55d7e8c4f5572868f2076b99436a6cfe12af44c1696fa8dc0178a1` |
+| Linux headless | 0.1.6 | `9ae7fa9a203c6471cfd6bdd82ac5bf81683813c15fe652595976344fbbf96084` |
+| Ubuntu desktop preview | 0.1.4 | `75566915bfe67d3b60fc3658f9d68fad40840d4e53b3c3aeb22fbf8450f43687` |
+
+All four complete public downloads matched published checksums and local bytes,
+including the copies attached to the final release. Linux and CLI artifacts were
+not renamed to imply a new build. Existing published tags remain unchanged.
+
+The README and installation-agent prompt were audited against actual packages,
+CLI flags and platform differences. Links now point to this release. The prompt
+preserves existing data, distinguishes desktop from headless verification,
+sets up Windows login/background launching, keeps cloud answers disabled and
+lets users choose indexed folders. Public command-line download requests need
+a browser user-agent under the current Cloudflare policy; tested Linux commands
+and the agent prompt account for this without requiring private credentials.
+
+Final Windows check passed: installed 0.1.7 matches the installer executable;
+resident background process, forced-CPU query worker, login launcher, unchanged
+settings and SQLite integrity were verified. Genuine filename and Google speech
+retrieval on the existing four-file fixture returned the expected file/passage;
+the source excerpt was verified and a forged handle rejected. The measured
+semantic request was 79.24 ms in this small prepared fixture, not startup, p95
+or large-library evidence. Ignored report SHA-256:
+`dc3cf39d46a91de6b5730768c48da29d85a91fdf4ba49ea4ca201806769b6e2c`.
+
+The origin protection value exposed during diagnostics was rotated using a new
+protected Infisical reference. All matching Cloudflare/NPM consumers were
+updated; the retired value returns 403 and public browser requests work. No
+secret values are committed. Gitea Actions remain disabled as requested.
+
+This initial delivery is complete. Native keyboard/tray interaction was not
+automated; actual GPU, macOS, broader Linux/clean-machine checks and broader
+search-quality work remain deferred. Media/speech stay usable experimental
+features with imperfect recognition, estimated times and known absent-content
+false positives. This handoff does not claim all-platform production readiness.
@@ -17,15 +17,15 @@ Download into a new dedicated directory and verify before extracting:
 ```sh
 mkdir -p "$HOME/Applications/searchi"
 cd "$HOME/Applications/searchi"
-curl -fLO https://tea.karlcom.de/karl/searchi/releases/download/v0.1.4/searchi-headless_0.1.0_linux-x86_64-014.tar.xz
-curl -fLO https://tea.karlcom.de/karl/searchi/releases/download/v0.1.4/LINUX-SHA256SUMS-0.1.4.txt
-sha256sum -c LINUX-SHA256SUMS-0.1.4.txt
-tar -xf searchi-headless_0.1.0_linux-x86_64-014.tar.xz
+curl -A "Mozilla/5.0" -fLO https://tea.karlcom.de/karl/searchi/releases/download/v0.1.7/searchi-headless_0.1.6_linux-x86_64.tar.xz
+curl -A "Mozilla/5.0" -fLO https://tea.karlcom.de/karl/searchi/releases/download/v0.1.7/searchi-headless_0.1.6_linux-x86_64.tar.xz.sha256
+sha256sum -c searchi-headless_0.1.6_linux-x86_64.tar.xz.sha256
+tar -xf searchi-headless_0.1.6_linux-x86_64.tar.xz
 ./searchi --help
 ./searchi setup --model-dir ./models
 ```

-The package is approximately 104 MB. First model setup downloads approximately
+The package is approximately 109 MB. First model setup downloads approximately
 865 MB and reuses verified cached assets. Keep the runtime libraries and media
 helpers alongside the CLI. To use graphics acceleration, the system needs a
 compatible Vulkan loader and graphics driver; otherwise search uses CPU.
@@ -44,6 +44,21 @@ to search source implementations. For filenames/content without model inference,
 omit both model arguments. `--json --performance` reports basic measurements;
 `--debug-performance` enables detailed traces.

+### Search spoken passages
+
+Version 0.1.6 includes experimental local speech search. Download the additional
+recognition assets (about 149 MB), then encode recognized passages alongside
+Google's media embeddings:
+
+```sh
+./searchi setup --speech --model-dir ./speech-models
+./searchi embed --db ./searchi.sqlite --model-dir ./models --embedding-worker ./searchi-gemma-worker --speech-worker ./speech-runtime/searchi-speech-worker --speech-model-dir ./speech-models
+```
+
+Use the same `search` command above. Spoken passages include estimated timestamps;
+recognition can miss words, and results can be irrelevant when no matching content
+exists. After changing files, repeat `index` and this speech-enabled `embed` command.
+
 ## Connect your local agent

 Configure a stdio MCP client to run the absolute path to `searchi`, with these
@@ -58,8 +73,9 @@ index or mutate files. See [agent integration](AGENT-INTEGRATION.md).

 ## Recorded package evidence, 2026-10-13

-Current package: [Linux update alongside 0.1.4](LINUX-0.1.4.md), including the
-archived-date correction. The following records retain older release evidence.
+Current package: [Linux headless 0.1.6](LINUX-SPEECH-0.1.6.md), including genuine
+packaged Google/speech CPU retrieval and public download verification. The
+following records retain older release evidence.

 Headless component version 0.1.0 is supplied alongside desktop release 0.1.1.
 All 89 selected engine/CLI and workspace lock/manifest files matched current
@@ -173,6 +173,8 @@ origin header. Gitea Actions remain disabled. Cloudflare's separate external
 upload cap is not changed by these local settings; public downloads work.

 The configuration diagnostics accidentally exposed an origin protection value
-in tool output. No value is recorded here or committed. Rotation remains a
-separate open security follow-up. Native Linux desktop 0.1.6, GPU, macOS,
+in tool output. No value is recorded here or committed. It was subsequently
+rotated through protected Infisical storage; all matching Cloudflare/NPM
+consumers were updated, the old value is rejected and public access verified.
+Native Linux desktop 0.1.6, GPU, macOS,
 clean-machine installation and broader quality gates remain open.
@@ -64,8 +64,9 @@ open and deferred; do not continue expanding them without a renewed request.
    public speech archive delivery remain open.
  - [x] Genuine packaged Linux Google/speech retrieval and public headless archive
    delivery; full-byte public download verified. See [evidence](LINUX-SPEECH-0.1.6.md).
-  - [ ] Rotate the origin protection value exposed during upload-limit diagnostics;
-    keep values out of Git and coordinate its Cloudflare/Infisical configuration.
+  - [x] Rotate the exposed origin protection value using protected Infisical
+    storage and coordinated Cloudflare/NPM updates; old value rejected on all
+    three affected services, public access verified, no values committed.
  - [x] Genuine shared-service ASR/Google lifecycle passed: verified speech
    excerpts, zero raw reencodes through policy failure/retry, and retained
    query reader; [proof](SPEECH-INTEGRATION.md).