Issue #1166 · verification evidence · 17 July 2026

Hosted audio transcription

Tegy now exposes a narrow, read-only TranscribeAudio capability to both supported agent runtimes. It accepts only audio already mounted in the active chat and reports the provider generation, duration, and exact billed cost.

Production E2E passed

Production proof

Chat: Decode Sentinel Words From Audio File
Uploaded fixture: transcription-sentinel-02.mp3
Expected / returned: copper meadow lantern
Hosted request: /audio/transcriptions returned HTTP 200 with generation gen-stt-1784290136-jhbLUstXR1DgPofbD2P6.
Exact provider usage: 2.784 seconds and $0.0000696, matching 2.784 / 60 × $0.0015.
Persisted ledger: Non-estimated openrouter_exact_response row for the same generation. The shared usage ledger stores money to six decimal places, so the persisted value is $0.000070.

Behavioral proof

Claude Agent SDK

Fixture: transcription-sentinel-01.mp3

Expected sentinel: violet harbor quartz

Assistant output: Violet Harbor Quartz

Endpoint hit · exact usage +$0.000072

Codex app-server

Fixture: transcription-sentinel-01.mp3

Expected sentinel: violet harbor quartz

Assistant output contained: Violet Harbor Quartz

Endpoint hit · exact usage +$0.000072

Each runtime received a randomly selected preset speech fixture, was asked to decode its sentinel, invoked the hosted /audio/transcriptions path, and returned the correct words. The endpoint event and usage event identify the same OpenRouter generation. For this 2.88-second fixture, both recorded costs equal 2.88 / 60 × $0.0015 = $0.000072.

Open the machine-readable E2E evidence

Security and accounting contract

File scope: Only regular files under the active chat’s /mnt/user-data/uploads root.
Rejected inputs: Traversal, sibling-chat paths, symlinks, empty files, files above 20 MiB, unsupported formats, and invalid language codes.
Runtime authorization: Claude uses its scoped in-process workspace tool. Codex uses a localhost MCP endpoint with a random per-session bearer token.
Provider boundary: The provider key remains in Tegy’s private server. It is not placed in the Codex sandbox.
Usage: A non-estimated provider_final event records the provider’s exact cost, audio duration, model, format, and generation ID.

Verification completed

npm run test:audio-transcription — protocol, authorization, filesystem isolation, endpoint telemetry, and exact-usage tests.
npm run verify:audio-transcription-live — real provider request and complete Tegy turns in Claude and Codex.
npm run lint, npx tsc -b, and git diff --check.

Production verification used the authenticated Chromium Profile 3 / tegy session. D1 was queried read-only for only the test chat’s endpoint and usage records; no user identity or secret data is included here.