Two Systems Stop Trying to Fix Themselves

Two unrelated parts of the codebase had the same disease: something going wrong used to trigger an automatic repair nobody asked for. Today both got cured the same way — stop repairing, start failing loudly.

The uglier one first. There used to be a login failure mode that wiped the vault — not logged you out, but deleted master_account, the thing every credential hangs off, as an “unrecoverable” recovery path. That’s gone. Login now runs through exactly one place, AuthService.login, returning one of three states — unlocked, locked, or none — and nothing downstream of it improvises. The preflight checks the cheap thing first: an already-unlocked vault with a valid session touches nothing else. Only a request without a session goes near credentials.json, and even then try_login does one job — read the file, attempt the login, mint a cookie once — with any miss falling through to the normal login screen instead of a workaround. user_auth.py lost 225 lines of duplicated login-and-wipe logic it never needed to own. New feature tests hit the real app, the real DB, and the real vault — not a mock in sight. Wrote up the optional credentials.json dev-login convenience in the security docs at the same time, since a login shortcut that isn’t documented is just a landmine for whoever finds it next.

Bigger deletion of the day: RuntimeDepsService is gone, all 417 lines. It used to run at boot and mid-request — sniffing for GPU/ROCm wheels, installing Playwright browsers, pulling voice models — trying to self-heal a broken environment live, in production, while you were using it. Nothing installs at boot or runtime anymore. Voice went from three dependency variants — CPU, CUDA, ROCm — collapsed into one unconditional base install; kokoro, moonshine, soundfile, and noisereduce ship for everyone now instead of branching on hardware detection that could itself go wrong. silero-vad-lite got swapped for an in-house wrapper on the same shared ONNX session everything else already uses. All the heavy fetching — Playwright browsers, five voice models — now happens once, at install time, atomic tmp-then-rename, loud on failure. Also dropped Intel Mac as a supported platform; if you’re on darwin x86_64, that’s the one to know about. The philosophy runs all the way to the health check: a broken runtime now throws a boot ERROR and 503s on /ready with a reinstall hint, instead of limping along and letting you find out three requests later.

Smaller cleanup rode alongside those two. Dispatch’s module-level dict, used as makeshift state, got folded into DispatchService proper. The compactor’s drop-list shrank to timestamps only, and a chunk of memory-prompt guidance about an “exact canonical key” got cut — it pointed at a concept lookup table the memory ability doesn’t have anymore. mcp_settings moved onto the Endpoint/Action contract too — singleton settings endpoint, a regenerate-token action with the revoke-then-mint order preserved, legacy files deleted outright. Last week’s log called chat “the last real straggler” on that migration. It wasn’t. One review catch worth naming: a /ready docstring was still describing raw exception text an earlier security pass had already stripped out. That endpoint is unauthenticated by design, so leaking exception text isn’t a docs nit — caught before it became one.

Nothing here is a feature. It’s two fewer ways the system can quietly decide to fix itself without telling you, and one more place that now shouts instead of shrugging.

• Removed the login path’s unrecoverable vault-wipe; auth now runs through a single AuthService.login call with a cheap-state-first preflight, cutting 225 lines of duplicated logic

• Deleted RuntimeDepsService outright (417 lines) — no more boot-time or mid-request self-healing of GPU wheels, Playwright, or voice models

• Collapsed three voice dependency variants (CPU/CUDA/ROCm) into one unconditional base install, and swapped silero-vad-lite for an in-house wrapper on the shared ONNX session

• Moved all first-time downloads (Playwright browsers, five voice models) to a single atomic, loud-failure install step; dropped Intel Mac support; /ready now fails loud with a reinstall hint instead of limping

• Moved mcp_settings onto the Endpoint/Action contract, folded dispatch’s module-level state into its service, and trimmed stale prompt guidance for a memory lookup table that no longer exists