mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 02:42:24 +03:00
2eab74b039
FU-05 core: caller-supplied Video Bridge transcripts can no longer self-assert "embedded"/"audio-bridge" provenance — normalizeVideoTranscript now reclassifies any caller-declared value to "client" by default, and only a server-owned adapter passing the code-only trustedSource option (never reachable from request-body JSON) can assign the trusted values. The dedicated audioTranscript fusion field is always labeled "audio-bridge" by the server regardless of what a cue declares, structurally separating it from the generic transcript field. Adds the missing FU-05 budgets (256 cues, 4096 input code units/cue, 4 KiB UTF-8/cue, 64 KiB total text), malformed-Unicode rejection, focus-window scoping, and deterministic cross-source cue reconciliation that preserves contributing-source metadata instead of silently dropping it on exact-match dedup. New logic lives in videoBridgeTranscriptContract.ts so the existing helper file only grows by a thin delegation. Bumps the Video Bridge result-cache contract version (v4 -> v5) so a cache entry computed under the old, less-restrictive normalization can never be served once the new contract is deployed. 3 of the 12 pre-existing provenance tests asserted the exact forged-source acceptance this ticket closes; updated in place with inline rationale.