stackchain/timmy-talking-turd
2
0 Fork 0
Code Issues 21 Pull Requests 7 Actions 4 Packages Projects Releases 41 Wiki Activity

41 Releases 41 Tags

RSS Feed
  • daily-2026-10-22 3565ce87a4
    Compare

    Timmy daily 2026-10-22 — versioned backups and AI provenance
    Quality gates / quality (push) Successful in 16m30s
    Details
    Pre-Release

    rockachopa released this 2026-10-22 12:53:48 +00:00 | 35 commits to main since this release

    What ships

    Backups are portable records now, not a blind JSON dump.

    • Versioned export (schema 2). Export JSON writes your confirmed logs and your training-contribution receipts, including withdrawn tombstones, through an allowlist — unknown keys and credentials never leave the browser.
    • Migration on import. A version 1 file is upgraded, the on-screen notice names the version it came from, and logs that predate provenance keep provenance: null instead of being given a source they never recorded.
    • Fail closed. A file written by a newer Timmy is refused with an update instruction; malformed, oversized, and over-limit files are refused too. A refused import leaves the ledger exactly as it was.
    • Provenance on the record. A log saved from a confirmed or corrected AI suggestion states that on its entry sheet: which visible fields were suggested, whether you confirmed or corrected them, and the model that answered. Never a diagnosis.

    Completed ticket / PR

    • Issue #35 — Version ledger migrations and harden JSON portability (closed by this release).
    • PR #84 feat(portability): versioned backups, v1 migration, and AI provenance on the record — merged as 5a15fa6 after a full diff review (APPROVED) and a green CI quality gate.
    • Two follow-up fixes in this release commit: the import notice no longer restates the restored count as a second sentence (4ac7191), and the release builder now fails closed when the acceptance port is already served by another checkout, then verifies the served app.js / src/domain.js bytes against the clone under test before any gate runs (3565ce8). Without that guard two builds reported green while recording a foreign tree.

    Gates (21/21 passed)

    Unit/security suite, mobile green path, photo-first acceptance, sleek Hermes chat, manual fallback draft recovery, provisional suggestion state, hard-stool follow-up, vision corpus refusal, worker container receipts, worker post-load readiness, longitudinal pattern summary, grounded chat citations, training contribution consent, portable backup restore, dependency audit (0 high), syntax checks, secret scan, forbidden-artifact scan, release-delta-visible-on-camera, H.264 720×1280 media probe, full MP4 decode.

    Demonstrated on camera (5:15, vertical 720×1280)

    1. Export writes version 2 and reports exactly what it carries — 1 log and 1 training receipt.
    2. The export still carries the withdrawn contribution as a tombstone naming its derived artifacts.
    3. A version 1 backup is imported and reported as upgraded, with the source version named.
    4. A version 3 backup is refused with an update instruction, and the ledger it would have replaced is byte-identical afterwards.
    5. The restored log still shows it began as an AI suggestion you corrected, naming the model.

    Artifacts

    • timmy-talking-turd-2026-10-22-3565ce87a47e.tar.gz — sha256 f916031b283e9d780a9a1cf571216ccf5eaa7317f0c0dff0d6d20ead3726786b
    • timmy-talking-turd-2026-10-22-3565ce87a47e-demo.mp4 — sha256 e1387b645c00a1b5a7d98c2409b5d5dddf100996b297209495b51070cb0e3121
    • Source commit: 3565ce87a47e65e76b0c11741c45035875973868

    Model / profile

    • Vision worker: SmolVLM2-2.2B-Instruct (self-hosted, pinned).
    • Acceptance server ran with live vision and live Hermes disabled; every AI step in the recording replays a deterministic fixture, and the demo data is synthetic.
    • Hermes profile: default.

    Known accuracy limitation

    Timmy reads only visible Bristol form and broad colour, with bounded confidence, and abstains when a field is unreadable or out of range. It does not diagnose disease, does not read symptoms from a photo, and every suggestion is provisional until the person confirms or corrects it themselves. The restored-provenance scene replays a synthetic SmolVLM2-2.2B-Instruct reply rather than a live model call.

    Downloads
  • daily-2026-10-21 baabeb0f4f
    Compare

    Timmy daily 2026-10-21 — training contribution is a separate opt-in consent
    Quality gates / quality (push) Successful in 3m52s
    Details
    Pre-Release

    timmy released this 2026-10-21 12:26:57 +00:00 | 39 commits to main since this release

    What is new in this drop

    Training contribution is a separate, second consent (issue #24 → PR #83, merged today). A journal save still records nothing for training. Contributing one confirmed photo is an opt-in you have to read and accept:

    • Off by default, in its own store. Receipts live in timmy:<base>:training-contributions-v1; saving a log leaves it null. The recording throws if a save queues anything.
    • The consent version and the receipt are on screen before the control works. The sheet names training-consent-v1, the receipt id, what is included (this one photo's bytes; the confirmed Bristol form, broad color, image quality) and what is never included (note text, symptom answers, urgency/discomfort ratings, anything identifying you or the device). Contribute this photo and label stays disabled until the terms box is ticked — and no receipt exists before that.
    • On this device only. The receipt is queued locally; this build transmits nothing. No photo bytes are copied into the receipt (asserted in the test and re-asserted on camera).
    • Withdrawal keeps a tombstone. Withdrawing flips the receipt to withdrawn and keeps a tombstone naming every derived artifact (raw-image, confirmed-label) by contribution id, so a future corpus pipeline can address each one. Delete-all clears receipts with the ledger and photos.

    One finish fix rode along (baabeb0): the new receipt and tombstone rows rendered as one run-on line — Type 4 · brownReceipt contrib-…, Withdrawn Oct 21, 12:09 PMraw image, … — because nothing styled .contribution-row. Labels, detail lines and the row action are now separated, tombstones muted, long receipt ids wrap inside the card. Verified at a 390px viewport and re-recorded; frames inspected at full resolution.

    Gates (all passed)

    unit/security 207 pass / 0 fail · mobile green path · photo-first acceptance · sleek Hermes chat · manual fallback draft recovery · provisional suggestion state · hard-stool follow-up · vision corpus refusal · worker container receipts · worker post-load readiness · longitudinal pattern summary · grounded chat citations · training contribution consent · dependency audit (0 high) · syntax · secret scan · forbidden-artifact scan · actual browser recording · H.264 720x1280 yuv420p probe · complete MP4 decode · release delta painted on camera.

    First build attempt (11c63a8) failed one gate on a load-related flake (staging-health: a spawned server missed its 800 ms deadline at load 5.9 on 4 cores; the file then passed 3/3 in isolation); the gate was re-run in full, not bypassed. QC on that build's frames found the row-layout defect above, so it was never published.

    Demonstrated on camera (65/65 captions measured as painted, on-top, in-frame bars)

    Training contribution: nothing queued after an ordinary save → consent version + receipt + include/exclude lists with the confirm button visibly disabled → one receipt queued on the device → withdrawal leaving a tombstone naming both derived artifacts by contribution id → delete-all clearing receipts too.

    Plus the standing path: photo-first consent gate and provisional suggestion; Type 2 follow-up asking soreness/hydration/blood/black-or-tarry (dark brown not escalated, true black/tarry escalated in the app's fixed words); vision-offline and model-not-loaded states with manual entry one tap away; corpus refusals and fail-closed out-of-range replies; pattern summary citing its confirmed logs and refusing a trend on two; saved-photo lifecycle (label, reveal, remove photo and keep the log); grounded chat citations; Hermes chat with the safety override intercepted before the provider.

    Artifacts

    • Source archive timmy-talking-turd-2026-10-21-baabeb0f4f91.tar.gz — 254,710 bytes — SHA-256 7358b2aa177582d8c8ed83ed1f6f5328a2abde61e9e13e9043edef79a75a90b9 (129 entries; no model weights, .env, real medical images, raw corpora or provider logs)
    • Demo timmy-talking-turd-2026-10-21-baabeb0f4f91-demo.mp4 — 18,845,637 bytes — 720x1280 H.264/yuv420p, 25 fps, 4m47s — SHA-256 3a4dd74f1d524d2b29fbc17e09982425e9fc425fce3f8c4a7685f9f5e3be14f4

    Model / profile

    Vision profile selfhost (SmolVLM2-2.2B-Instruct banner). The recording drives the real app server in Chromium at phone width with TIMMY_VISION_ENABLED=false; the provider-facing endpoints (/api/vision-status, /api/analyze, /api/agent/status, /api/agent/chat) are fulfilled at the network layer from deterministic synthetic fixtures, so no model inference and no Hermes call happened during recording. Fixtures are synthetic: a synthetic Type-4 photo, a committed non-stool .jpg that is really text, fictional multi-day sample logs, and a synthetic saved photo for the contribution flow.

    Known accuracy limitation

    The vision layer only ever suggests visible Bristol form, broad color and image quality, with bounded confidence and abstention. It cannot judge urgency, pain, symptoms, blood, or a diagnosis, and a photo never rules out bleeding; sensitive visual fields stay low-confidence and non-stool images are refused rather than guessed. User confirmation is mandatory before anything is saved, and training contribution is a separate consent on top of that — nothing is transmitted by this build. Bristol accuracy is not clinically validated. Server-side ingress hardening for hostile uploads (#16, PR #82) is not in this release.

    Downloads
  • daily-2026-10-20 d0b3c10aea
    Compare

    Timmy daily 2026-10-20 — verified rebuild; no source change Pre-Release

    rockachopa released this 2026-10-20 12:13:15 +00:00 | 42 commits to main since this release

    Verified rebuild of the current user-visible feature path. No source change since daily-2026-10-19 — main is still d0b3c10, and no PR was merged for this release.

    What this release is

    daily-2026-10-19 shipped a confirmed log whose saved photo is kept separate from the log itself: a label instead of a thumbnail, revealed only on request, removable without touching the log. That path is unchanged and was re-verified end to end on camera today, so this drop is honest book-keeping, not a new claim: verified rebuild; no source change.

    Held back, deliberately

    Nightly PR #82 (timmy/16-image-ingress-hardening, closes #16) was reviewed and not merged. Its own new release gate fails in the release builder's environment: scripts/build_release.py starts the server with TIMMY_VISION_ENABLED=false, server.mjs answers 503 from the provider-disabled branch before ingressGuard runs, and tests/ingress-capture.acceptance.mjs asserts 400 — AssertionError: the server must refuse non-image bytes, saw 503. CI is green only because the workflow does not set that variable. Detail and the suggested ordering fix are on the PR: comment 17291. Nothing from that branch is in this release.

    Gates (all passed)

    unit/security 193 pass 0 fail · mobile green path · photo-first acceptance · sleek Hermes chat · manual fallback draft recovery · provisional suggestion state · hard-stool follow-up · vision corpus refusal · worker container receipts · worker post-load readiness · longitudinal pattern summary · grounded chat citations · dependency audit (0 high) · syntax · secret scan · forbidden-artifact scan · actual browser recording · H.264 720x1280 yuv420p probe · complete MP4 decode · release delta painted on camera.

    Demonstrated features (61/61 captions measured as painted bars)

    • Photo-first path: consent gate, provisional suggestion, explicit confirm, user overrule clears AI-confirmed state.
    • Type 2 follow-up asking soreness/hydration/blood/black-or-tarry — never inferred from the photo; mild self-care copy; deterministic red-flag path on a truly black/tarry answer; dark brown not escalated.
    • Worker offline and model-still-loading states: no AI control, no consent, no upload; manual entry one tap away; kept draft survives.
    • Corpus refusals: non-stool photo refused, unreadable-fields abstention, out-of-range fail-closed (with and without a filled field).
    • Pattern summary cites its confirmed logs and refuses to describe a trend on two logs.
    • Saved-photo lifecycle: presence as a label, reveal on request, remove photo and keep the log.
    • Threat-model surface live: local ledger, consent-gated upload, portable export, delete-all clears ledger and photos.
    • Grounded local chat citations plus Hermes chat with credentials/tools server-side and deterministic urgent-language interception before Hermes.

    Artifacts

    • Source archive timmy-talking-turd-2026-10-20-d0b3c10aea2f.tar.gz — 246,045 bytes — SHA-256 2ab3df629ff1d6363e3454f397547f8a0dc9244bb5d1cfdf2f7c9f29098aaa18
    • Demo timmy-talking-turd-2026-10-20-d0b3c10aea2f-demo.mp4 — 16,543,563 bytes — 720x1280 H.264/yuv420p, 25 fps, 4m19s — SHA-256 61b093cf632d82c7fe15287d33c053c3a77c124bc899eb692d78e0dd8f1a3989

    Model / profile

    Vision profile selfhost (SmolVLM2-2.2B-Instruct banner in the app). The recording drives the real app server in Chromium at 405x720; the three provider-facing endpoints (/api/vision-status, /api/analyze, /api/agent/status, /api/agent/chat) are fulfilled at the network layer from deterministic synthetic fixtures, so no model inference and no Hermes call happened during recording. Every fixture is synthetic: a committed text file named .jpg, a synthetic Type-4 photo, and fictional multi-day sample logs seeded into the browser's own storage.

    Known accuracy limitation

    The vision layer only ever suggests visible Bristol form, broad color, and image quality, with bounded confidence and abstention; it cannot judge urgency, pain, symptoms, blood, or a diagnosis, and a photo never rules out bleeding. Sensitive visual fields remain low-confidence, screenshots and non-stool images are refused rather than guessed, and user confirmation is mandatory before anything is saved. Server-side ingress hardening for hostile uploads (#16) is not in this release.

    Downloads
  • daily-2026-10-19 d0b3c10aea
    Compare

    Timmy 2026-10-19-d0b3c10aea2f (daily-2026-10-19) Pre-Release

    rockachopa released this 2026-10-19 12:48:18 +00:00 | 42 commits to main since this release

    Release 2026-10-19-d0b3c10aea2f — built from commit d0b3c10aea2f (America/New_York date 2026-10-19).

    Tangible change

    A saved photo is now separate from the confirmed log it belongs to:

    • the journal marks a log that holds a photo with a Photo saved label and renders no thumbnail (nothing sensitive on screen by default);
    • Show photo reveals the stored bytes only when the person asks, from this browser's storage;
    • Remove photo, keep log clears the image and leaves every confirmed field (form, colour, urgency, discomfort, note, date) untouched;
    • Delete this log and its photo is a separate two-step decision (first tap arms it);
    • Delete all local data now removes the ledger and every stored photo, with a regression asserting no data:image bytes survive.

    Completed work

    • Issue #36 (priority/P1, type/feature) — closed by PR #80, merge commit 0e4dde5.
    • PR #81 — release-quality fix: the demo's caption CSS was injected per-document and stripped by the recording's own reloads, so later captions (including this release's photo captions) painted as clipped body text while the gate accepted the string. Captions and touch indicators now use inline styles and every caption is pixel-verified on camera before the build passes.

    Gates (all passed)

    unit/security suite (193 tests), mobile green path, photo-first acceptance, sleek Hermes chat, manual fallback + draft recovery, provisional suggestion state, hard-stool follow-up, vision corpus refusal, worker container receipts, post-load readiness, longitudinal pattern summary, grounded chat citations, photo lifecycle acceptance, dependency audit (high), syntax, secret scan, forbidden artifacts, H.264 720x1280 probe, complete MP4 decode, release-delta-visible-on-camera (per-caption pixel evidence: 61/61 captions painted).

    Artifacts

    • source archive: timmy-talking-turd-2026-10-19-d0b3c10aea2f.tar.gz — SHA-256 bec1dec9a9c18e017a9388d1eda7b092a429d6a76df72df184035131d2131d07
    • feature demo: timmy-talking-turd-2026-10-19-d0b3c10aea2f-demo.mp4 — SHA-256 93523628d7aeebdc69f5a9db8e0bb713be5f52c9e491e4d076b48ed69050d945 (720x1280, h264, yuv420p, 16341875 bytes)

    Model / profile

    Local-first PWA; no model weights are bundled in the archive. The recording runs with TIMMY_VISION_ENABLED=false, replays the committed CC0 synthetic vision corpus for refusal paths, and uses a deterministic recorded Hermes-agent reply for the chat scene. Hermes profile: default.

    Demo fixture data

    All on-camera data is synthetic: a Type-4 synthetic log, the corpus replays, fictional multi-day sample logs, a synthetic test-card image (checkerboard "SYNTHETIC DEMO PHOTO") — no real medical images, no real health data, no credentials.

    Known accuracy limitation

    Open-weight VLM acceptance is proven; Bristol-form accuracy is not clinically validated. The assistant describes visible form, broad colour, quality, and bounded confidence only, abstains or refuses otherwise, never diagnoses, and every suggestion requires explicit user confirmation.

    Downloads
  • daily-2026-10-18 fe5c3d40c0
    Compare

    Timmy review release daily-2026-10-18 Pre-Release

    rockachopa released this 2026-10-18 12:10:11 +00:00 | 48 commits to main since this release

    Timmy review release 2026-10-18-fe5c3d40c0f2

    New user-visible feature shipped: every chat answer now cites the confirmed logs behind it. Nightly PR #78 (issue #37) passed its gates and merged at 12:02Z, so this is a real feature release, not a rebuild.

    • Source commit: fe5c3d40c0f26196de88a729ddae481af8d9ab8a (this prerelease targets that exact commit)
    • Source commit date (UTC): 2026-10-18T12:02:02+00:00 — built 2026-10-18T12:08:34Z
    • Release delta (stated on camera): Chat answers now cite the confirmed logs behind them, and a citation opens that exact record

    Completed ticket / PR

    • PR #78 → issue #37, "Ground Timmy chat answers in the local ledger with citations" — merged to main as fe5c3d40. Issue #37 auto-closed on merge; the PR record was closed and re-read to confirm.

    What changed for the user

    • An answer that states a count, a date, or a visible form now has to show its work. "4 confirmed logs in the last 28 days" arrives with four chips naming the exact entries behind it (Oct 6 · T4, Oct 9 · T4, Oct 13 · T3, Oct 16 · T4).
    • Following a chip opens that single record — date, form, colour, urgency and discomfort — with the line "This is the confirmed log this answer was built from. Change or delete it and the answer changes with it."
    • Questions the journal cannot answer get boundary copy instead of reassurance, with zero citations. A window below the minimum refuses to describe a trend.
    • Hermes replies carry the same contract: each sanitized ledger record gets a positional ref (L1..Ln), and the browser resolves — or rejects — those refs. An invented ref renders as unverified with no citation.
    • Unchanged boundaries: urgent symptom language is still intercepted deterministically before Hermes, escalation bubbles carry no citations, no photographs reach chat, and no new medical claim was added (food, medicine and diagnosis questions are refused).

    Merge decision

    PR #78 was the only open PR that qualified. It links non-human-gate issue #37, reported mergeable: true, carried a focused 17-file / +556/−18 diff with no secrets, credentials, model weights or real medical images, and passed npm test (185/185) plus the grounded-chat, pattern-summary and sleek browser acceptance runs on its own head before merge. The six other open PRs (#60–#65) report mergeable: false against current main and were left open; verified main was not otherwise altered.

    Gates (all passed on the build that produced these artifacts)

    unit + security suite (185/185), mobile green path, photo-first acceptance, sleek shell + Hermes chat acceptance, manual-fallback draft recovery, provisional suggestion state, hard-stool follow-up, vision-corpus refusal (non-stool, unreadable fields, out-of-range, blank-plus-out-of-range), worker container receipts, worker post-load readiness, longitudinal pattern summary, grounded chat citations (new), npm audit --audit-level=high (0 vulnerabilities), node/bash/python syntax, secret scan, forbidden-artifact scan, H.264 720×1280 probe, full MP4 decode, and release-delta-visible-on-camera.

    • Source archive SHA-256: 6d6e9d1b6b94fff9e8f754e2cb574c68ce7e5ae67f020e1b2c27ea1a508890e7 (235,290 bytes)
    • Demo video SHA-256: c70b61736cd3e7068722f4437eae8c929cd44f4ab7e784627b000f238bf8e593 (11,766,223 bytes, 720×1280 h264/yuv420p, 201.80 s)

    Demonstrated on camera (55 captions, fictional/synthetic data only)

    Photo-first logging with manual fallback one tap away; consent-gated upload; provisional AI suggestion reviewed, confirmed, and corrected; hard-stool follow-up with non-diagnostic self-care and a confirmed black/tarry red flag; the CC0 synthetic vision corpus replaying non-stool, unreadable-fields and out-of-range fail-closed replies; offline vision status; fictional multi-day sample logs driving the explainable pattern summary and its citation sheet; a sparse window showing the insufficient-data copy; a grounded local chat answer whose four chips each open exactly the record it counted; a refusal that borrows no journal evidence; and a Hermes reply whose positional refs render as sources.

    Model / profile

    • Vision: SmolVLM2-2.2B-Instruct — self-hosted GGUF on a digest-pinned llama.cpp worker, unprivileged, loopback-only, plus the hosted vision profile; the AI surface only appears once the pinned model is loaded.
    • Chat: Hermes Agent (Hermes profile default, server-side session continuity). Credentials, tools and session stay server-side; photos never reach chat.

    Known accuracy limitation

    Citations are deterministic ledger lookups, not inference: they prove which confirmed entries an answer was built from, not that the answer is clinically meaningful. Bristol-form accuracy is not clinically validated, the app never diagnoses, and user confirmation remains mandatory for every suggestion. A citation chip shows what the journal recorded — if the log is wrong, the cited answer is wrong in the same way.

    Downloads
  • daily-2026-10-17 3b267c0fff
    Compare

    Timmy review release daily-2026-10-17 Pre-Release

    rockachopa released this 2026-10-17 12:08:40 +00:00 | 50 commits to main since this release

    Timmy review release 2026-10-17-3b267c0fff31

    Verified rebuild; no source change. No commit landed after the 2026-10-15 merge, so this release re-proves the current shipped feature path on camera from the same commit instead of claiming a new feature. No nightly PR was merged today: all six open PRs report mergeable: false against current main, so they were left open and verified main was released unchanged.

    • Source commit: 3b267c0fff31c36a5afdabd199ce2f7a7b1915aa (this prerelease targets that exact commit)
    • Source commit date (UTC): 2026-10-15T12:03:03+00:00 — built 2026-10-17T12:07:29Z
    • Release delta (on camera): Verified rebuild; no source change — the newest shipped path is re-proven on camera: a symptom you already reported can never be silently cleared, and red-flag wording still escalates deterministically

    Latest completed work carried by this commit

    • PR #77 / issue #21 — deterministic red-flag escalation fires for the wording people actually use (bleeding when wiping, tarry or black stools, severe belly pain, no gas), and a symptom already reported can never be silently cleared. This is the feature path the demo re-exercises on camera today.
    • Also carried in the same tree: #34 explainable pattern summaries with cited records (PR #76), #15 pinned self-hosted worker + post-load readiness, #73 fail-closed on an out-of-range filled field.

    Model / profile

    • Vision: SmolVLM2-2.2B-Instruct — self-hosted GGUF on a digest-pinned llama.cpp worker, unprivileged, loopback-only, plus the hosted vision profile; the AI surface only appears once the pinned model is loaded.
    • Chat: Hermes Agent (Hermes profile default, server-side session continuity). Credentials, tools, and session stay server-side; photos never reach chat.

    Gates (all passed on the build that produced these artifacts)

    unit + security suite, mobile green path, photo-first acceptance, sleek shell + Hermes chat acceptance, manual-fallback draft recovery, provisional suggestion state, hard-stool follow-up, vision-corpus refusal (non-stool, unreadable fields, out-of-range, blank-plus-out-of-range), worker container receipts, worker post-load readiness, longitudinal pattern summary, npm audit --audit-level=high (0 vulnerabilities), node/bash/python syntax, secret scan, forbidden-artifact scan, demo full decode, demo media probe, and release-delta-visible-on-camera.

    • Source archive SHA-256: 2bdeaeb2041be5e1b000c185f51ce3a08c1616d8f707d382e96df1a5ad439113 (227,025 bytes)
    • Demo video SHA-256: 360b127439983b3eb0cf50de5e68808f69547271eeef545ff91794d8cb6d1715 (10,767,344 bytes, 720x1280 h264/yuv420p, 177.20 s)

    Demonstrated on camera (50 captions, fictional/synthetic data only)

    Photo-first logging with manual fallback one tap away; consent-gated upload (nothing uploads before consent); provisional AI suggestion reviewed, confirmed, and corrected with the AI-confirmed state cleared on correction; user-reported hard-stool follow-up with non-diagnostic self-care and a confirmed black/tarry answer landing on the deterministic escalation path; vision worker offline and reachable-but-unloaded states falling back without a dead control; the CC0 synthetic vision corpus replaying non-stool refusal, unreadable-field abstention, out-of-range fail-closed, and blank-plus-out-of-range fail-closed; fictional seeded multi-day logs driving explainable pattern lines with a citation sheet that opens exactly the cited records, plus a sparse-window refusal; local ledger, portable export, and full local deletion; Hermes chat with urgent language intercepted deterministically before any provider call (bleeding-as-wiping, tarry/black wording, and an already-saved tarry note).

    Known accuracy limitation

    Open-weight VLM acceptance is proven; Bristol-scale accuracy is not clinically validated. Output is visible-form, broad-color, and image-quality guidance only — never a diagnosis, never symptom inference — and user confirmation remains mandatory.

    Provenance

    Package excludes model weights, medical-image corpora, raw research pages, generated screenshots, and video production assets. Local unreviewed work-in-progress (an untracked single-file bundle helper and its built dist/ page) was preserved outside the repository under _preserved-local-wip/2026-10-17/, not shipped.

    Downloads
  • daily-2026-10-16 3b267c0fff
    Compare

    Timmy nightly review 2026-10-16 (verified rebuild; no source change, 3b267c0fff31) Pre-Release

    timmy released this 2026-10-16 12:13:26 +00:00 | 50 commits to main since this release

    Timmy review release 2026-10-16-3b267c0fff31

    Verified rebuild; no source change. No new commit landed after the 2026-10-15 release, so this release re-proves the current released feature path on camera from the exact same commit rather than claiming a new feature.

    • Source commit: 3b267c0fff31c36a5afdabd199ce2f7a7b1915aa (this prerelease targets that exact commit)
    • Source commit date (UTC): 2026-10-15T12:03:03+00:00 — built 2026-10-16T12:12:29Z
    • Release delta (on camera): Verified rebuild; no source change — the released feature path is re-proven on camera: a red flag you actually describe escalates deterministically, and a symptom you already reported can never be silently cleared

    Latest completed work carried by this commit

    • PR #77 / issue #21 — deterministic red-flag escalation now fires for the wording people actually use (bleeding when wiping, tarry or black stools, severe belly pain, no gas), and a symptom already reported can never be silently cleared. This is the feature path the demo exercises on camera.
    • Also carried in the same tree: #34 explainable pattern summaries with cited records (PR #76), #15 pinned self-hosted worker + post-load readiness, #73 fail-closed on an out-of-range filled field.

    Model / profile

    • Vision: SmolVLM2-2.2B-Instruct — self-hosted GGUF on a digest-pinned llama.cpp worker, unprivileged, loopback-only, plus the hosted vision profile; the AI surface only appears once the pinned model is loaded.
    • Chat: Hermes Agent (Hermes profile default, server-side session continuity). Credentials, tools, and session stay server-side; photos never reach chat.

    Gates (all passed on the build that produced these artifacts)

    unit + security suite, mobile green path, photo-first acceptance, sleek shell + Hermes chat acceptance, manual-fallback draft recovery, provisional suggestion state, hard-stool follow-up, vision-corpus refusal (non-stool, unreadable fields, out-of-range, blank-plus-out-of-range), worker container receipts, worker post-load readiness, longitudinal pattern summary, npm audit --audit-level=high (0 vulnerabilities), node/bash/python syntax, secret scan, forbidden-artifact scan, demo full decode, demo media probe, and release-delta-visible-on-camera.

    • Source archive SHA-256: b7c4930576bf9aa1816b4a594de2e90f13c1971ad3f934ff97bf4b01f145d8c4 (227,020 bytes)
    • Demo video SHA-256: 0f15fb2105b56e86adaf96f31c564034463f5dd3fc8e0c531b57d608ac3bb209 (11,388,161 bytes, 720x1280 h264/yuv420p, 207.84 s)

    Demonstrated on camera (50 captions, fictional/synthetic data only)

    Photo-first logging with manual fallback one tap away; consent-gated upload (nothing uploads before consent); provisional AI suggestion reviewed, confirmed, and corrected with the AI-confirmed state cleared on correction; user-reported hard-stool follow-up with non-diagnostic self-care and a confirmed black/tarry answer landing on the deterministic escalation path; vision worker offline and reachable-but-unloaded states falling back without a dead control; the CC0 synthetic vision corpus replaying non-stool refusal, unreadable-field abstention, out-of-range fail-closed, and blank-plus-out-of-range fail-closed; fictional multi-day logs driving explainable pattern lines with citations and a sparse-window refusal; local ledger, portable export, and full local deletion; Hermes chat with urgent language intercepted deterministically before any provider call (bleeding-as-wiping, tarry/black wording, and an already-saved tarry note).

    Known accuracy limitation

    Open-weight VLM acceptance is proven; Bristol-scale accuracy is not clinically validated. Output is visible-form, broad-color, and image-quality guidance only — never a diagnosis, never symptom inference — and user confirmation remains mandatory.

    Provenance

    Package excludes model weights, medical-image corpora, raw research pages, generated screenshots, and video production assets. Local unreviewed work-in-progress (an untracked single-file bundle helper) was preserved outside the repository, not shipped.

    Downloads
  • daily-2026-10-15 3b267c0fff
    Compare

    Timmy review release daily-2026-10-15 Pre-Release

    rockachopa released this 2026-10-15 12:19:46 +00:00 | 50 commits to main since this release

    Timmy the Talking Turd — daily review release daily-2026-10-15

    • Version: 2026-10-15-3b267c0fff31
    • Commit: 3b267c0fff31c36a5afdabd199ce2f7a7b1915aa (merge commit of PR #77, built from a clean checkout of main)
    • Built (UTC): 2026-10-15T12:12:25Z
    • Reviewed on: America/New_York 2026-10-15
    • Source archive SHA-256: 04c07fd4ba50df5d754b449e5474cf58e2a82faef181fd2095e0fbf9b7542dd4
    • Demo video SHA-256: 6c7762308fc18ee39520f7c351dd451c4ba94468978ebc0b9cbf8e216ca2f8b3
    • Model / profile: operator run — Hermes Agent cron (profile default, deepseek-flash). Product vision profiles — hosted VLM and self-hosted SmolVLM2 pinned bootstrap; the pinned model must be loaded, not merely reachable, before the app offers AI. No model weights ship in this release.

    Release delta — what visibly changed since daily-2026-10-14

    Red-flag escalation now fires for the wording people actually use — and a reported symptom can never be silently cleared.

    The deterministic red-flag detector (src/domain.js) matched a narrow set of literal phrases. Probing real clinical wording against the previous release showed 18 of 18 checked phrasings missed, so those turns reached the Hermes provider instead of Timmy's own fixed medical guidance:

    • There is blood when I wipe, bleeding from my back passage, blood mixed in my poo
    • I have tarry stools, my stool looks like tar, my poop is very dark red
    • my temperature is 103, I have a high temperature
    • I have severe pain in my belly, the pain in my stomach is severe
    • I am not passing any gas, I have not passed gas all day

    Before: a person typing one of those sentences got a provider answer. After: each produces Timmy's own byte-identical escalation copy, intercepted at the gateway before any provider call.

    The second half is the direction this boundary may never fail in. detectUrgentFlags read only the literal boolean true, so a symptom reported as 1, "yes", or "true" was read as not reported — a silently cleared symptom. The gateway's ledger sanitizer had the same strict check and could clear a browser-supplied symptom before the escalation check ran. Both now share isReportedSymptom: only an explicit clear (false, 0, "no", blank, absent) stays quiet, and escalation only ever gets broader on what the person reports.

    Near-miss wording stays quiet by test: a paper cut, blood pressure, ink on paper, black beans, black pants, dark red wine, "the road looks like tar", 98.6/37, feverfew, severe knee or back pain, mild stomach pain, "I passed gas this morning", "I have not passed my driving test", "the car has no gas".

    Completed ticket / PR

    • Issue #21 Expand deterministic symptom escalation regression suite (area/safety, priority/P0, type/test) — closed by this merge (Closes #21).
    • PR #77 fix: escalate the symptom phrasing people actually use, and never clear a reported symptom (#21) — merged to main as 3b267c0; 9 files, +430/−9, mergeable and verified before merge (its own suite run on the branch: 173/173 + syntax + diff checks). PR record closed after the merge commit landed.

    Demonstrated on camera (asserted in the browser, not just captioned)

    • There is blood when I wipe escalates — the demo types it into the real chat, then asserts exactly one new Timmy bubble carrying the app's own fixed string, with the Hermes call counter unmoved.
    • I have tarry stools escalates the same way — one red flag, one unchanging message.
    • A tarry note already saved in the journal escalates the next answer, even when the question itself is innocuous (What do my recent logs show?) — proving the ledger path is intercepted before the provider.
    • Standing paths re-verified in the same recording: photo-first consent-gated suggestion → explicit confirm → correction clearing the AI-confirmed state; hard-stool follow-up with non-diagnostic self-care and the deterministic red-flag handoff; CC0 synthetic-corpus refusals (non-stool, unreadable fields, out-of-range, blank-plus-out-of-range); vision-offline and reachable-but-unloaded fallbacks; explainable pattern summaries and the sparse-window refusal; data controls (local ledger, consent-gated upload, export, delete); Hermes chat with urgent-language interception.

    Honest boundary: this release is escalation coverage and truthfulness, not new clinical capability. No new inference, no diagnosis, no claim from the image. One acknowledged gap, noted not fixed: a provider can still place medical reassurance into the free-text observations string the suggestion card renders (escaped, beside Timmy's fixed warning) — that is a vision-response hardening item for #16/#18, deliberately outside this change.

    Tests and gates (all passed, from the release builder)

    • unit_security — npm test, 173/173 passing (adds tests/escalation-regression.test.js, 16 tests)
    • mobile_green_path, photo_first_acceptance, sleek_hermes_chat_acceptance, manual_fallback_draft_recovery, provisional_suggestion_state, hard_stool_followup, vision_corpus_refusal, worker_container_receipts, worker_post_load_readiness, longitudinal_pattern_summary — all passed
    • dependency_audit_high — npm audit --audit-level=high, 0 vulnerabilities
    • syntax, secret_scan, forbidden_artifacts — passed
    • feature_demo_media_probe — H.264 / yuv420p / 720×1280, 187.2 s, 10.77 MB; feature_demo_full_decode — complete decode, no errors
    • release_delta_visible_on_camera — the declared delta is the second caption, verified against the recording's own caption receipt (50 captions; the three new escalation captions are hard build gates)

    Video

    Recorded from the real app running at 127.0.0.1:4173 (mobile viewport 405×720, re-encoded 720×1280 H.264 yuv420p, video only, 187.2 s). Complete decode verified; contact sheet spans the whole recording; no black or blank frames. All fixtures are synthetic (CC0 corpus, fabricated ledger entries, fabricated red-flag sentences); there are no real photos, no patient data, and no credentials in the video or the archive.

    Known limitations

    • Bristol accuracy is not clinically validated. Vision output is observable-field assistance only — visible form, broad colour, image quality — with bounded confidence and abstention. It never reports symptoms or a diagnosis, and user confirmation remains mandatory.
    • Escalation is deterministic phrase coverage, so it will over-trigger before it under-triggers (fever still matches "fever blister"); narrowing is a copy question, not a safety one.
    • Pattern summaries describe correlations in your own logs, not causes; they intentionally make no claim about diet, disease, or urgency.
    • The archive intentionally excludes model weights, medical-image corpora, raw research pages, generated screenshots, and video production assets.
    Downloads
  • daily-2026-10-14 a033cb3ae9
    Compare

    Timmy review release daily-2026-10-14 Pre-Release

    rockachopa released this 2026-10-14 12:11:59 +00:00 | 52 commits to main since this release

    Timmy the Talking Turd — daily review release daily-2026-10-14

    • Version: 2026-10-14-a033cb3ae9e9
    • Commit: a033cb3ae9e9993300a61eba18b499d80da798bc (merge commit of PR #76, built from a clean checkout of main)
    • Built (UTC): 2026-10-14T12:09:05Z
    • Reviewed on: America/New_York 2026-10-14
    • Source archive SHA-256: 165ec91d45cc9f1d40e55c01f9c3f76254b63c893f77f1a28e7a3cc9ab847e48
    • Demo video SHA-256: 8150ffbacd4309c188a8803828b3ee1767a218165ffe4ea7397ce6d710b92baa
    • Model / profile: operator run — Hermes Agent cron (profile default, deepseek-flash). Product vision profiles — hosted VLM and self-hosted SmolVLM2 pinned bootstrap; the pinned model must be loaded, not merely reachable, before the app offers AI. No model weights ship in this release.

    Release delta — what visibly changed since daily-2026-10-13

    The home "Timmy noticed" line was a single assertive sentence. It is now an explainable pattern summary, and it refuses to speak when the data is too thin:

    • src/summary.js builds a windowed (last 28 days) summary from confirmed ledger records only. A frequency line plus one line per Bristol grouping present in the window — and every line carries the exact confirmed record IDs it was built from.
    • Following a citation (3 records ›) opens a pattern-source sheet listing exactly those records, with the window restated and the note that changing or deleting one of them changes the line with it.
    • A window with both firm and loose logs is reported as mixed — it no longer silently reports whichever side is marginally larger.
    • Fewer than 3 confirmed logs in the window returns insufficient: true, no statements, and copy that says it is too sparse ("Not enough confirmed logs in this window yet — N of 3 needed before Timmy describes a pattern").
    • Boundary copy travels with the card: Timmy reports what you logged and when, never a cause, a food ruling, or a health verdict.

    Before: buildTimmySummary(entries) asserted a trend from whatever data existed, with no citation and no minimum. After: every claim is traceable to named records and the summary abstains below the minimum.

    Completed ticket / PR

    • Issue #34 Implement explainable longitudinal pattern summaries (area/data, area/frontend, priority/P1, type/feature) — closed by this merge (auto-closed via Closes #34).
    • PR #76 feat: explainable longitudinal pattern summaries with cited records (#34) — merged to main as a033cb3; 15 files, +398/−5, one focused commit on top of the previous release commit. PR record closed after the merge commit landed.

    Demonstrated on camera (asserted in the browser, not just captioned)

    • The journal explains its own pattern lines instead of just asserting a trend.
    • Fictional sample logs seeded into this browser's own storage — no real health data appears anywhere in the recording.
    • Every pattern line names the confirmed logs behind it, and following one shows exactly those records — the demo asserts in-browser that the "typical" citation lists exactly demo-typical-1/2/3 and throws if it does not.
    • Two logs is not a pattern: the summary refuses to describe a trend it cannot support (sparse window shows "2 of 3 needed").
    • Standing paths re-verified in the same recording: photo-first consent-gated suggestion → explicit confirm → correction clearing the AI-confirmed state; hard-stool follow-up with non-diagnostic self-care and the deterministic red-flag handoff; CC0 synthetic-corpus refusals (non-stool, unreadable fields, out-of-range, blank-plus-out-of-range); vision-offline and reachable-but-unloaded fallbacks; data controls (local ledger, consent-gated upload, export, delete); Hermes chat with urgent-language interception.

    Tests and gates (all passed, from the release builder)

    • unit_security — npm test, 154/154 passing (adds tests/summary.test.js)
    • longitudinal_pattern_summary — tests/pattern-summary.acceptance.mjs, real Chromium at 390×844
    • mobile_green_path, photo_first_acceptance, sleek_hermes_chat_acceptance, manual_fallback_draft_recovery, provisional_suggestion_state, hard_stool_followup, vision_corpus_refusal, worker_container_receipts, worker_post_load_readiness — all passed
    • dependency_audit_high — npm audit --audit-level=high, 0 vulnerabilities
    • syntax, secret_scan, forbidden_artifacts — passed
    • feature_demo_media_probe — H.264 / yuv420p / 720×1280, 163.6 s, 9.95 MB; feature_demo_full_decode — complete decode, no errors
    • release_delta_visible_on_camera — the declared delta is the second caption, verified against the recording's own caption receipt

    Video

    Recorded from the real app running at 127.0.0.1:4173 (mobile viewport 405×720, re-encoded 720×1280 H.264 yuv420p, video only, 163.6 s). Complete decode verified; contact sheet spans the whole recording. All fixtures are synthetic (CC0 corpus, fabricated multi-day ledger entries); there are no real photos, no patient data, and no credentials in the video or the archive.

    Known limitations

    • Bristol accuracy is not clinically validated. Vision output is observable-field assistance only — visible form, broad colour, image quality — with bounded confidence and abstention. It never reports symptoms or a diagnosis, and user confirmation remains mandatory.
    • Pattern summaries describe correlations in your own logs, not causes; they intentionally make no claim about diet, disease, or urgency.
    • The archive intentionally excludes model weights, medical-image corpora, raw research pages, generated screenshots, and video production assets.
    Downloads
  • daily-2026-10-13 5744969faf
    Compare

    Timmy review release 2026-10-13-5744969faf18 Pre-Release

    rockachopa released this 2026-10-13 12:13:00 +00:00 | 54 commits to main since this release

    Timmy review release 2026-10-13-5744969faf18

    Commit: 5744969faf18036ccee1757d9d0fc2e859a72bef
    Tag: daily-2026-10-13 (America/New_York release date)
    Built (UTC): 2026-10-13T12:11:14.566739+00:00

    Release delta - what visibly changed since daily-2026-10-12

    A reachable-but-unloaded vision worker is no longer reported ready: the app shows a distinct loading state with no consent card and no AI control, and manual Bristol entry stays one tap away. (issue #15)

    Previously a worker that answered /v1/models was treated as ready - llama.cpp opens its listener before the weights are resident - so the app offered consent and Analyze visible form + color, which could only fail after the upload. Readiness now requires the pinned model to be loaded, and that state lands on manual Bristol entry in one tap.

    Demonstrated on camera (asserted in the browser, not just captioned)

    • Reachable is not loaded: no AI control, no consent, and no upload until the pinned model is resident
    • One tap still reaches manual Bristol entry while the model finishes loading
    • Once the pinned model is loaded, the same screen offers the AI analysis again
    • The pinned bootstrap verifies both model files before starting on private loopback
    • Standing paths re-verified in the same recording: photo-first consent-gated suggestion, confirmed prefill and correction; provisional suggestion states; hard-stool follow-up with deterministic red-flag handoff; CC0 synthetic-corpus refusals (non-stool, unreadable fields, out-of-range, blank-plus-out-of-range); offline vision fallback with resumable draft; Hermes chat with deterministic urgent-language interception; privacy and data-lifetime controls.

    Completed ticket / PR

    • PR #75 - feat: pin the worker container and gate readiness on the loaded model - merged to main as 5744969faf18036ccee1757d9d0fc2e859a72bef (Refs #15).
    • Issue #15 deliberately stays open: its target-GPU latency/VRAM measurement criterion is instrumented but not measured (no GPU host available, buying compute out of bounds). The container image's runtime behaviour on a CUDA host is not verified here; its pins are enforced by contract tests. No benchmark receipt is bundled.
    • Issue #73 remained verified from daily-2026-10-12.

    Model / profile

    • Vision: self-hosted SmolVLM2-2.2B-Instruct, llama.cpp pinned at 6d05498314db1b57f81c271080018aa2d0b89be9. No hosted provider is used in the recorded path.

    Gates (all passed)

    unit_security, mobile_green_path, photo_first_acceptance, sleek_hermes_chat_acceptance, manual_fallback_draft_recovery, provisional_suggestion_state, hard_stool_followup, vision_corpus_refusal, worker_container_receipts, worker_post_load_readiness, dependency_audit_high, syntax, secret_scan, forbidden_artifacts, feature_demo_full_decode, feature_demo_media_probe, release_delta_visible_on_camera.

    • Unit/security tests: 146/146
    • Browser acceptance suites: 9/9
    • Staging deploy tests: 20/20
    • npm audit --audit-level=high: 0 vulnerabilities
    • Demo re-encoded to 720x1280 H.264/yuv420p, fully decoded, media-probed.

    Artifacts and SHA-256

    • timmy-talking-turd-2026-10-13-5744969faf18.tar.gz - f412e049d96235e3d6b49ab9ed62f3591b4e478f4949de1532493eabd67cc2ba (216790 bytes)
    • timmy-talking-turd-2026-10-13-5744969faf18-demo.mp4 - d7c08e1cb47f9445aa5307dcbbc7aa253ddcf199638d728660cfc2df2e301af6 (9235200 bytes, 720x1280, H.264, yuv420p, 146.8 s)

    Known accuracy limitation

    Open-weight VLM acceptance is proven; Bristol-form accuracy is not clinically validated. Suggestions cover visible form, broad color, and image quality only - never symptoms or a diagnosis. User confirmation remains mandatory.

    Privacy

    Package excludes model weights, medical-image corpora, raw research pages, generated screenshots, and video production assets. Every visual fixture in the demo is synthetic; the corpus contains no real photos.

    Downloads