Native model portability and runtime hardening

Portability execution reviewed 23 October 2026; the current catalog summary below was refreshed 25 October 2026. The portability pass checked the automatic model-installation route against publisher wheel inventories and exercised actual inference on the available Linux CPU host. Its original measurements and regression results remain dated to that pass. It does not equate platform selection tests, published wheels, or source review with native Windows/macOS execution.

Corrected portability failures

Intel Mac runtime selection

The previous managed-runtime requirements selected ONNX Runtime 1.31.0 on every OS. Its release has Apple Silicon macOS wheels but no Intel macOS wheel. Faster Whisper now selects ONNX Runtime 1.23.2 on Intel macOS, retaining 1.31.0 elsewhere. The conditional requirement is part of the installer input and recorded installation provenance. Faster Whisper's primary runtime, CTranslate2 and tokenizer versions remain pinned.

The Intel route requires standard CPython 3.11–3.13 and macOS 13 or newer. ONNX Runtime 1.23.2 has no CPython 3.14 Intel Mac wheel. The CLI and browser can still run under another Python; a model-specific blocker is returned before model downloads. Exact Whisper GGUF models use a separate runtime and do not require ONNX Runtime.

We also tested the proposed older runtime against the real portable Fluid Mini weights. It failed correctly during graph initialization: the model uses 6-bit MatMulNBits, while ONNX Runtime 1.23.2 only supports 4-bit and 8-bit forms. Consequently Mini ONNX remains pinned to 1.31.0 and reports an explicit Intel Mac blocker. Olenji does not download unusable weights, quietly change the selected model, or claim that merely resolving an older package proves model compatibility.

Real Faster Whisper Tiny inference with ONNX Runtime 1.23.2 succeeded on Linux: the 11-second JFK fixture produced the expected text and 22 model word timestamps. This confirms that the selected older runtime can execute Faster Whisper's model/VAD path; native Intel Mac execution remains a release gate.

Primary evidence: ORT 1.31.0 files, ORT 1.23.2 files, validation/native-wheel-inventory.json, and validation/onnx-intel-compat-inference.json.

Machine-readable runtime requirements

models get, model list/plan items, and doctor backend records now expose runtime_support. This includes the process architecture, Python version, installation route, exact requirement strings, relevant OS/libc minimums and a human-readable blocker. Native execution is explicitly not implied by this metadata.

The reviewed automatic-install baseline is standard CPython 3.11–3.14 on a supported 64-bit desktop OS. PyPy, free-threaded Python, unknown CPU architectures, and glibc older than 2.28 are rejected for managed inference rather than falling into accidental source builds. The glibc baseline follows the intersection of the pinned binary dependencies; Alpine/musl requires a different runtime distribution and is outside this automatic installer.

On Windows, architecture selection follows the Python interpreter's wheel target. An x64 interpreter under Windows ARM emulation follows the x64 wheel lane even when the machine reports ARM hardware.

A wheel route is installer evidence, not a claim that every model or GPU combination was executed. CTranslate2 also requires the Microsoft Visual C++ runtime on Windows. Its installation documentation describes supported CPU architectures and prerequisites. The transcribe.cpp Windows build guide describes the source-build toolchain.

The managed transcribe.cpp native distribution is now explicitly pinned to transcribe-cpp-native==0.4.1; the wrapper's broad 0.4.1.* transitive requirement no longer chooses a different native patch without review. Normal managed installs require wheels; the existing transcribe.cpp fallback is a separate source build pinned to the reviewed source commit. Transitive packages still follow their declared resolver constraints; this change does not claim a complete per-platform dependency hash lock.

Default application dependency resolution on six targets

The final checked-in application dependency lock resolved successfully with binary packages only for all six CPython 3.12 targets. Each resolver input used the default dependencies from pyproject.toml, constrained to the frozen non-development export of uv.lock. Optional inference environments are separate from this application dependency check.

This verifies that the reviewed lock has suitable published artifacts without falling back to source builds. It does not execute those wheels on their native OS or prove native libraries, permissions, device drivers or hardware capture. The complete command, selected requirement lists, deployment targets and SHA-256 identities are recorded in validation/default-platform-resolution.json. The reviewed uv.lock SHA-256 is 656d22dd07ac8a7ef8bc318c91368d29c0c083b883a7f0f4d9469a1c8483703e.

The default microphone dependency now requires sounddevice>=0.5.6. The actual Windows ARM64 wheel contains libportaudioarm64.dll with the correct ARM64 PE machine identifier (0xAA64); the reviewed loader selects it from the interpreter's wheel platform. The wheel also bundles other CPU variants, so checking that every bundled DLL is ARM64 would give a false failure. This is binary/header and loader-source inspection, not a recording test.

Windows system audio now includes SoundCard>=0.4.6 in the default application install. The reviewed 0.4.6 capture source uses numpy.frombuffer(...).copy(), avoiding the removed binary numpy.fromstring path, and loads the OS's ole32 through CFFI without bundling a fixed x86/x64 DLL. Windows ARM64 resolution also selects an ARM64 CFFI wheel. Physical WASAPI capture remains a native hardware release gate. Wheel identities and the scope of this review are recorded in validation/windows-arm-audio-wheel.json; the upstream releases are sounddevice 0.5.6 and SoundCard 0.4.6.

Unicode in worker protocols and model files

A UTF-8 parent pipe can otherwise be decoded using a Windows ANSI code page by the child interpreter. This can corrupt Turkish/Japanese text and Unicode file paths. Managed environments now set PYTHONIOENCODING=utf-8 and PYTHONUTF8=1; the standalone worker explicitly configures its stdin/stdout/stderr to UTF-8 before processing input. Model manifests, installer metadata, tokenizer vocabularies and Mini configuration files are also read explicitly as UTF-8.

A real subprocess regression starts with ASCII stdio and UTF-8 mode disabled, sends a Turkish/Japanese path, and verifies an exact UTF-8 JSONL round-trip. Another subprocess reads a non-ASCII installation manifest under an ASCII locale. These execute on Linux and specifically reproduce locale/protocol hazards; they are not labeled as Windows native tests. Python's encoding environment documentation explains the underlying pipe behavior.

Cancellation owns the whole installer process tree

olenji.processes.terminate_process operates on a known, currently live Popen child, never on a PID read from a stale service file. Tree cancellation uses an isolated POSIX session/process group and Windows taskkill /PID … /T /F, followed by bounded wait/kill cleanup. A pip/CMake child can no longer continue changing an installation after the installer reports cancellation just because only its parent was stopped. Audio capture adopts the same helper.

A real subprocess test starts a parent with a child that ignores SIGTERM, verifies the child's heartbeat, cancels the private tree and confirms the heartbeat stops and parent is reaped. Windows command selection has a separate simulated regression, including CREATE_NO_WINDOW so a background service's cleanup does not open a console window. Microsoft documents /T as including child processes.

Apple helper identity and PCM contract

Managed Apple helpers now record and compare the interpreter target architecture as well as source identity and binary size. A runtime copied from a different architecture is not reported ready solely because its source revision matches.

ScreenCaptureKit output validates 16 kHz Float32 before writing bytes and handles interleaved as well as planar float channels when downmixing. Unsupported sample formats produce a clear failure instead of feeding wrongly interpreted audio into the transcript clock. Apple explicitly documents 16 kHz capture support. The native Swift compiler and physical system-audio path were not available on this Linux host; the checked-in native macOS job must compile and exercise them.

Recorded inference measurements — 23 October 2026

The same public 11-second JFK recording was transcribed twice with five real installed model implementations, using CPU and four requested threads. First calls include worker/model initialization; warm calls reuse the loaded model. These measurements characterize this host and fixture. They are not a quality benchmark, a throughput guarantee, or a before/after speedup claim.

Every model recognized the expected phrase. The small Mini ONNX sessions now also disable idle thread spinning. Evidence is in validation/deep-native-inference.json.

The native Core ML helper still starts a process and loads a model for each bounded window/utterance. It bounds input memory but does not promise a persistent native decoder or low live latency for large Core ML models. A persistent Swift worker should be implemented and benchmarked on a compatible Mac; it was deliberately not introduced without a compiler/native validation path in this pass.

Regression evidence and remaining gates

The focused model/native suite passes 102 tests, including 33 new regressions in tests/test_native_portability.py. It covers Python/OS/architecture support boundaries, wrong-architecture Apple helper reuse, conditional dependency selection, Unicode pipes/manifests, early blockers, owned process-tree shutdown, existing model-integrity checks and bounded audio clocks.

Native Windows x64/ARM64 inference, macOS Intel/Apple Silicon inference, Swift compilation/runtime, native hardware capture and GPU drivers remain distinct release gates.

As of the 25 October source and publisher review, the catalog contains all 17 current exact FluidVoice identities and 13 additional identities, including one speaker model. The added parity member is the already-catalogued Qwen3 ASR 1.7B Q8_0 GGUF; its pinned artifact and existing portable runtime route are unchanged. Seven exact choices have transcribe.cpp routes and ten retain Apple-specific requirements. This refresh adds no native execution claim to the measurements above. See current model coverage, the dated audit and competitive acceptance gaps.