[Architecture] Decompose the GPU audio-library mega branch into protected slices #368

Problem

PR #250 contains 26k+ added lines and combines independent trust boundaries: Rust filesystem mutation, iCloud File Provider staging, GPU transcription, TMK chunking, semantic title generation, dependency/runtime bootstrapping, and product documentation. The branch is valuable as research and implementation evidence, but it cannot be reviewed, rebased, rolled back, or released safely as one change.

Canonical source

Preserve branch feat/gpu-transcription-rust-backend and exact head 12fda4c7d5c0a98f6f96642a6c4eefe6ccd4318c as read-only extraction evidence. New work must start from protected current main; do not merge or force-update the mega branch.

Required delivery order

Slice 1 — Rust inventory and immutable evidence

• bounded-buffer SHA-256 inventory;
• regular-file, owner, symlink/hard-link, and root-containment checks;
• source/time/TMK metadata manifest;
• descriptor-relative state writes and recovery journal;
• deterministic JSON schema and Python/Rust parity;
• Linux/macOS tests, fuzzing, 100% Rust line/function coverage and zero uncovered production lines.

Slice 2 — Transactional rename and exact-duplicate quarantine

• dry-run by default;
• no-overwrite descriptor-relative mutation;
• rollback journal and crash recovery;
• current-byte SHA revalidation immediately before mutation;
• reversible quarantine, never deletion;
• hostile parent swap, destination race, malformed journal, and stale-plan tests.

Slice 3 — File Provider materialization

• macOS-only native NSFileCoordinator/FileManager adapter behind a platform-neutral port;
• bounded one-file and rolling-prefetch staging budgets;
• progress-aware stall detection, retry canary, and cancellation;
• durable checkpoint before optional eviction;
• Linux build excludes Apple frameworks;
• real iCloud integration evidence kept outside the public repository.

Slice 4 — GPU transcription compute plane

• Rust-owned work scheduling and memory budgets;
• Apple MLX/Metal and NVIDIA CUDA adapters with exact model/revision allowlists;
• CPU reference used only for numerical/contract validation, not hidden production fallback;
• descriptor-bound decoded PCM, no caller PATH executable selection;
• short-audio quality flags, word timestamps, deterministic cache keys;
• real-audio accuracy, throughput, peak RSS/VRAM, and failure-recovery benchmarks.

Slice 5 — TMK-aware long-form orchestration

• verified Sony TMK parser and linked-audio identity;
• bounded overlapping chunks with global timestamps and deterministic duplicate ownership;
• model loaded once per batch;
• chunk/whole-file parity and boundary regression tests;
• integrate with the recording-wide speaker reconciliation contract from PR feat(speakers): reconcile long-form diarized transcripts #366.

Slice 6 — Evidence-grounded description and naming

• separate from transcription and mutation;
• provider-neutral interface, with live tests using NVIDIA_NIM_API_KEY only where an LLM is required;
• contextual-orchestrator integration through a narrow port;
• quoted segment IDs, prompt-injection isolation, unsupported-claim rejection, confidence/abstention;
• no rename when evidence or current-byte verification is insufficient.

Cross-cutting gates

Every slice must be independently useful, independently revertible, and packaged as both a standalone capability and an importable module. Require current-main ancestry, minimal diff, 100% production statement/branch coverage for Python, complete public docstrings, Rust tests/Clippy/release build, CPU/GPU parity where applicable, realistic fixtures, security/SAST/supply-chain checks, ADR/ARCHITECTURE/CHANGELOG and APA 7 doctoring. Do not commit raw recordings, transcript text, personal locations, or local filesystem paths.

Release and version changes occur only after the accepted slices form a coherent product release.