Circe app review

 137   [41, "CirceTaskDesks", Migration0041],
 138   [42, "CirceTaskDeskAttention", Migration0042],
 139   [43, "CirceTaskDeskClarification", Migration0043],
 140   [44, "CirceProjectClarification", Migration0044],
 141   [45, "CirceProjectAliases", Migration0045],
 142   [46, "CirceReportOutbox", Migration0046],
 143   [47, "AuthSessionClientConnection", Migration0047],
 144   [48, "ProjectionThreadLinkedPullRequest", Migration0048],
 145   [49, "ProjectionThreadsUnsettledAt", Migration0049],
 146   [50, "CirceWorkStartedCandidates", Migration0050],
 147   [51, "CirceFollowUpQueue", Migration0051],
 148   [52, "CirceProjectAliasCurrentState", Migration0052],
 149   [53, "CirceTaskDeskCurrentState", Migration0053],
 150   [54, "CircePresentation", Migration0054],

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/server/src/persistence/Migrations.ts` around lines 137-154, The rebrand changes historical migration SQL to create circe_* tables but keeps the already-shipped IDs. runMigrations runs only IDs above the database ledger. An installation already through migration 65 therefore runs no rename and retains jarvis_project_aliases, jarvis_task_desks, jarvis_follow_up_queue, and jarvis_push_registrations while the current services query circe_*. Preserve shipped migration history and add a new migration after 65 that handles old and fresh schemas transactionally. Audit persisted Circe payload names as part of the same upgrade, and preserve aliases, task desks, queue identities, and push registrations. Reproduced: circeUpgrade.audit.test.ts fails against an in-memory database. No live data was read or written. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

 356 export function selectCirceSemanticNode(
 357   catalog: CirceMeshCatalog,
 358   ambientNodeId?: EnvironmentId,
 359 ): CirceMeshNode | undefined {
 360   const online = catalog.nodes.filter((node) => node.reachability === "online");
 361   if (online.length === 0) return undefined;
 362   if (ambientNodeId !== undefined) {
 363     const ambient = online.find((node) => node.nodeId === ambientNodeId);
 364     if (ambient !== undefined) return ambient;
 365   }
 366   return online[0];

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `packages/circe-client-runtime/src/circe/mesh.ts` around lines 356-366, selectCirceSemanticNode filters only reachability, then chooses the ambient node or first online entry. It ignores the advertised execution capability. The Circe RPC handler explicitly rejects circe.interpret on Controller nodes. Choose semantic nodes using the advertised capabilities and catalog readiness before applying the existing ambient preference. Keep execution targets separate from the interpretation host, and return a typed unavailable result when no eligible host exists. Reproduced: expected node-laptop (Headless), received node-desktop (Controller). Server rejection is at CirceWsRpc.ts lines 345-350. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

1257           const conversationsShell = yield* projections.getShellSnapshot();
1258           const conversations = conversationsShell.projects.find(
1259             (candidate) => candidate.title === CIRCE_CONVERSATIONS_PROJECT_TITLE,
1260           );
1261           if (conversations !== undefined) {
1262             interpretation = {
1263               ...interpretation,
1264               command: { ...interpretation.command, projectId: conversations.id },

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/server/src/circe/Layers/CirceController.ts` around lines 1257-1264, General-question execution searches the shell catalog for the first project titled Conversations. Startup creates the managed project by its canonical workspace root, so title matching is a different identity rule. A user project may have the same title, and the managed project may be renamed. Use the managed workspace identity from conversationsProject.ts when selecting the destination. Fail or recover explicitly when that project is unavailable; do not retain an ambient coding project silently. Cover duplicate titles and renamed managed projects. Reproduced through CirceController.execute: status started, projectId decoy-conversations instead of managed-conversations. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

 482           const activeDriver = resolveCirceActiveDriver(plan, providers);
 483           if (activeDriver === "codex") {
 484             const codexProposal = yield* tryCodexSupervisor(fastPrompt);
 485             if (codexProposal !== null) {
 486               return interpretCirceCommand(input, prepared, codexProposal);
 487             }
 488           }
 489           if (activeDriver === "opencode") {
 490             const opencodeProposal = yield* tryOpencodeSupervisor(fastPrompt, plan?.provider.model);
 491             if (opencodeProposal !== null) {
 492               return interpretCirceCommand(input, prepared, opencodeProposal);
 493             }
 494           }
 495           if (activeDriver === "grok") {

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/server/src/circe/Layers/CirceController.ts` around lines 482-496, The direct supervisor is selected by driver family after resolving a provider instance, but receives only the prompt, and optionally the model. Its credential loader independently reads process-wide overrides or default home-directory credentials. The chosen instance ID and its configuration never reach that loader. Use the ordinary selected-instance adapter for supervision unless a public contract can establish that the direct path belongs to that exact instance. Do not infer credentials from the family or add instance-specific branches inside T3 providers. Add same-driver, different-account regression coverage. Source trace: Codex auth candidates at CirceCodexSupervisor.ts lines 93-106; OpenCode uses ~/.local/share/opencode/auth.json. No real credential files or external provider APIs were accessed. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

  36   const liveSink = getCirceLiveVoiceSink();
  37   if (liveSink !== null) {
  38     liveSink.speak(text);
  39     return Promise.resolve({ status: "played" });
  40   }
  41   // No session is live. On a node with a live voice key, open a muted
  42   // announcement session so the finished work still speaks without leaving
  43   // the voice channel open while the task ran.
  44   if (getCirceLiveVoiceEnabled()) {
  45     requestCirceLiveVoiceAnnouncement(text);
  46     return Promise.resolve({ status: "played" });

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/web/src/components/circe/CirceVoiceReporter.tsx` around lines 36-46, The live branch converts a presentation to plain text, calls speak, and immediately reports played. The playback queue loses ownership even when the live session is still connecting. Its cancel callback only cancels browser speech; it cannot remove the live controller’s pending append. Carry presentation and turn identity into the one live speech owner and give it bounded cancellation and honest local outcome semantics. Route disconnect, new-input interruption, terminal supersession, and teardown through that owner. Keep this ephemeral; do not add a durable delivery ledger. Reproduced: “Obsolete report from disconnected node” is sent after queue.clear(). Regression patch includes the real reporter-to-controller composition. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

 910       if (readStatus() !== "requesting") return;
 911       setStatus("connecting");
 912       const context = options.context?.()?.trim();
 913       const started = await cancellable(
 914         options.start({
 915           sdpOffer: nextPeer.localDescription?.sdp ?? offer.sdp,
 916           ...(context === undefined || context.length === 0 ? {} : { context }),

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/web/src/components/circe/CirceLiveVoice.logic.ts` around lines 910-916, The context callback is evaluated once during session startup. It includes current project, current task, running-task count, provider names, and default model. No subsequent catalog, target, or settings update sends replacement context to the live model. Either supply bounded event-driven context updates through the live owner or delegate questions requiring current state to the existing deterministic backend. Do not restart the voice session on every UI update or treat startup data as current. Verified call sites: options.context is read only at startup; CirceLiveVoiceRuntime.tsx supplies its snapshot; CirceLiveVoice.ts directs overview answers to reference data. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

   4 export function areCirceVoiceReportsEnabled(): boolean {
   5   return localStorage.getItem(VOICE_REPORTS_ENABLED_KEY) !== "false";
   6 }
   7 
   8 export function setCirceVoiceReportsEnabled(enabled: boolean): void {
   9   localStorage.setItem(VOICE_REPORTS_ENABLED_KEY, String(enabled));
  10   window.dispatchEvent(new Event(CIRCE_PREFERENCES_CHANGED_EVENT));

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/web/src/circePreferences.ts` around lines 4-10, Voice reports default to enabled, but setCirceVoiceReportsEnabled has no production caller. The current control-center button toggles a live session only. It does not change the report preference. Expose the persisted report preference in the Circe settings or control center and wire it to the reporter lifetime. Keep session start/stop semantics clear, and make both mute and unmute reachable. Reconcile the browser fallback with the documented live-only voice policy. Knip and a full web-source caller search find only the setter definition. Report auto-activation is in CirceVoiceReporter.tsx lines 44-46. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

4092   if (bundlesCirceFxResources(options)) {
4093     yield* Effect.tryPromise({
4094       try: () =>
4095         stageCirceFxResources({
4096           platform: options.platform,
4097           arch: options.arch === "arm64" ? "arm64" : "x64",
4098           stageProdResourcesDir,
4099         }),
4100       catch: (cause) => new CirceFxStagingError({ cause }),
4101     }).pipe(Effect.orDie);

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `scripts/build-desktop-artifact.ts` around lines 4092-4101, CirceFastSupervisorLive is absent from the production server composition and has no runtime consumer. Production Knip identifies the whole layer as unused. Desktop artifact construction still downloads, verifies, extracts, and bundles the pinned fx executable on supported targets. Remove the disconnected layer, fx-specific service code, plan field, binary staging, and resource packaging in one focused cleanup. Move or rename the still-used prompt without changing its consumers. Keep credential compatibility reads separate from binary execution. Verified by production Knip plus production composition and packaging searches. Existing fx packaging tests pass, but test a product path with no runtime consumer. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

  55 export function getLocalLiveVoiceRecognizer(): LocalLiveVoiceRecognizer | null {
  56   if (!isCirceLocalAsrAvailable()) return null;
  57   const locale = getDeviceLocale();
  58   return { prepare: (options) => prepareLiveRecognition(locale, options) };
  59 }
  60 
  61 /**
  62  * Android owns no file transcription path. The shared file transcriber stays
  63  * null here so callers cannot pass a fake URI; iOS provides the real file
  64  * transcriber through its own module.
  65  */
  66 export function getLocalVoiceTranscriber(): VoiceTranscriber | null {
  67   return null;

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/mobile/src/native/voiceTranscription.android.ts` around lines 55-67, The Android CirceLocalAsr module and getLocalLiveVoiceRecognizer implementation remain in the app, but the live recognizer has no non-test caller. The only voice-input UI consumes getLocalVoiceTranscriber, which returns null on Android. Decide the intended Android product capability and either connect the existing on-device recognizer through Circe-owned mobile composition or remove its native module and unused wrapper. Preserve the working iOS dictation path and avoid inventing file-URI sentinels. Caller trace: useVoiceInputController.ts lines 16, 107 and 209 use only getLocalVoiceTranscriber. All getLocalLiveVoiceRecognizer consumers are tests. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

 474 export function appendCirceChoice(utterance: string, choice: string): string {
 475   const instruction = utterance.trim();
 476   const selection = choice.trim();
 477   if (instruction.length === 0) return selection;
 478   if (selection.length === 0) return instruction;
 479   return `${instruction}\n${selection}`;
 480 }
 481 

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `apps/web/src/components/circe/CirceManager.logic.ts` around lines 474-481, appendCirceChoice and applyCirceClarificationChoice implement the older string-rewriting approach to clarification. They are referenced only by each other and tests. circeManagerCatalogIsReady and presentationStatus likewise have no production consumers. Remove the proven orphan helpers and their obsolete tests, preserving current typed clarification logic and meaningful caller-level tests. Limit deletion to confirmed unused behavior rather than the entire Knip export list. Verified normal and production Knip output, then full web-source caller searches excluding tests. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.

  34 # When set, linked environments can mint speech-to-speech sessions with this
  35 # deployment key instead of a per-node key. The key never leaves the relay.
  36 # OPENAI_LIVE_API_KEY=sk-...
  37 # LIVE_VOICE_MODEL=gpt-live-1
  38 # LIVE_VOICE_VOICE=marin

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate.

In `infra/relay/.env.example` around lines 34-38, The relay exposes authenticated create/release live-voice APIs, usage limits, persistence, and an optional deployment API key. The source-built node’s CirceLiveVoice service always uses its own stored key and calls OpenAI directly. No server or client-runtime production call site invokes the relay create/release endpoints. Confirm whether relay-funded voice is intended to ship. If so, connect it through Circe-owned session composition with explicit authority and lifecycle handling; otherwise document the endpoint as staged and remove misleading setup claims. Repository-wide createLiveVoiceSession/releaseLiveVoiceSession searches find relay handlers and contracts, but no shipped node caller. No relay was deployed or contacted. Keep the repair in Circe ownership. Check each affected client and preset, preserve node-qualified identities, and use focused tests. Do not modify inherited T3 implementations, delete shipped migration IDs, or operate on the live database. Update this review sidecar only after validating the fix.