ADR-v2-131 — What cloud escalation could ever cover, once the privacy rules are applied¶

Status: Accepted (2026-08-16) · supersedes the scope of [[adr-v2-126-cloud-escalation]]; no implementation is scheduled Context links: [[adr-011]] (offline by default, opt-in cloud, no silent fallback), [[adr-019-egress-inventory-and-escalation]] (§2 escalation rules, §3 what may never escalate), [[adr-v2-126-cloud-escalation]] (the deferred design this narrows), [[adr-v2-128-meeting-minutes-generation]] (defers cloud minutes to ADR-126 — the conflict this ADR resolves), [[adr-016-dependency-budget]]

Context¶

ADR-v2-126 designed provider-pluggable cloud transcription and deferred it, recording guardrails so the offline feature would not be built in a way that precluded it. It is a good decision document and a poor build spec, and it was written before [[adr-019-egress-inventory-and-escalation]] existed.

ADR-019 changed the picture in two ways ADR-126 could not anticipate.

First, §3 names three categories that may never leave the machine at all, whatever guardrails are offered: voiceprint embeddings ("biometric, irrevocable, and derived without the speaker necessarily being the consenting user"), the learning corpus in whole or in part ("a consent prompt at upload time cannot be informed consent about data gathered before the prompt existed"), and anything captured from a third party who did not consent — explicitly "Meeting Mode audio and any speaker other than the operator. The operator can consent for themselves and cannot consent for the room."

Second, tests/test_egress_inventory.py makes the two send-paths a pinned number. test_only_two_paths_can_send_what_the_user_said asserts len(SEND) == 2 and says in its own failure message that a third "needs an ADR, not a test edit". Registering a cloud adapter honestly fails that test by construction, which is the intended behaviour.

Applying §3 to the list of features that are actually compute-bound produces a result worth stating plainly, because it is narrower than anyone assumed:

Everything heavier than batch transcription is heavy because it processes the corpus, the room, or the screen. That is not a coincidence to be engineered around: the same property that makes a workload expensive here — lots of accumulated personal audio — is the property that makes it unsendable.

A second, smaller finding matters for the design. YazSes already ships a two-step, off-by-default, warns-loudly path for sending dictated text to an arbitrary host. postprocess/llm_cleanup.py is confined to loopback by is_loopback_endpoint(), checked per call rather than at construction, with llm_allow_remote_endpoint = False as a documented escape hatch that yazses doctor warns about. ADR-019's table describes that path as "confined to loopback" and understates it. Whatever cloud escalation eventually looks like, that is the shape to copy rather than a new consent system to invent.

Decision¶

1. Escalation, if it is ever built, covers exactly one thing: yazses transcribe on a file the operator asserts is their own voice. Not the daemon, not dictation, not meetings, not the corpus, not the screen. ADR-126's provider adapter design stands for that scope; its scope does not.

2. Meeting minutes may not escalate, and [[adr-v2-128-meeting-minutes-generation]] is amended here rather than left in conflict. ADR-128 defers cloud minutes to ADR-126; ADR-019 §3 forbids uploading Meeting Mode audio. §3 wins — it is the later and more specific rule, and it is the one enforced by a test. Local minutes stay as designed, and "slow" is the honest answer for a one-hour meeting, not "send it somewhere".

3. Landing it is one commit that edits five things, and the ADR must say so up front: the SEND list in tests/test_egress_inventory.py, ADR-019's inventory table, the sentence in docs/privacy-statement.md that reads "There is no third path", the README's privacy claim, and RecimportConfig. A change that edits the test without the prose is the failure mode this enumeration exists to prevent.

4. The consent mechanism is the llm_cleanup shape, not a new one. Off by default; a per-invocation flag; the key from a user-named environment variable, never config.toml; a syntactic check before any socket is opened; a warning that names the destination host. ADR-011's "Yes / Yes-for-session / No" prompt describes machinery that does not exist in this codebase — its Implementation section still refers to yazses-core/src/cloud_consent.rs from the abandoned Rust v1, and there is no privacy-gate CI job either. Anyone reviving this builds from zero; they should not believe otherwise because an ADR says it is there.

5. ADR-019's "visible while it happens" requirement needs a CLI equivalent. It reasons from the tray's state colour, and yazses transcribe never touches the tray. A progress line naming the host, printed for the duration, is the equivalent — decided here so the requirement is satisfiable rather than quietly dropped.

6. Still not scheduled. This ADR narrows what would be acceptable. It does not ask for the work, and docs/research/directions.md continues to list cloud escalation under "deliberately not pursued", with the reasoning that it "would trade the only durable advantage for an accuracy delta nobody has measured". Measuring that delta is the honest prerequisite, and nobody has.

Consequences¶

Good. The contradiction between two accepted ADRs is resolved in writing rather than discovered by whoever tries to implement one of them. The scope is now small enough to reason about: one CLI command, one file at a time, the operator's own voice.

Accepted cost. Meeting minutes on a slow machine stay slow. That is a real limitation for a real use case, and the alternative was uploading other people's speech.

What would reverse this. For §1: a measured WER delta on hard audio large enough to justify the trade, plus a provider whose retention policy survives reading. For §2: nothing short of every participant consenting individually, which is not a feature, it is a legal arrangement.

What this does not do. It writes no code, adds no dependency, and changes no default. The egress inventory still enumerates seven connections and two send paths, and the test still fails anyone who quietly adds a third.