# Repository Agent Instructions ## Architecture and code quality - Keep code, comments and public documentation in English. - Preserve the provider boundary: application code depends on normalized transcription contracts, never on Palatine response arrays. - Preserve the Symfony-first contract: YAML creates named, non-shared, autowireable transcriber and stream services; custom providers remain normal Symfony services. - File transcription is a final-result API. Palatine polling may be used internally, but provider task identifiers must not leak into the primary `TranscriberInterface`. - Live transcription is a separate session API. Never expose a provider API token to a browser or include it in logs and exception messages. - Audio bytes, transcript text and credentials are sensitive. Log only operational metadata unless a host application explicitly opts into its own content logging. - Temporary media must use private permissions, must never modify the source file, and must be removed on both success and failure. - Document intent, state boundaries, security assumptions and non-obvious tradeoffs in new or significantly changed code. - Add scenario-oriented comments to tests. - Run `composer validate --strict` and `composer check` before pushing. ## Mandatory publication workflow - Completed changes are committed to `master` and pushed to `origin master`, unless the user explicitly requests a non-publishing draft. - Never create routine patch tags manually. A successful `CI` run for a push to `master` triggers `.github/workflows/release.yml`. - The release workflow increments the latest semantic patch version, creates an annotated tag and GitHub Release, and creates or updates the Packagist package. - Use `scripts/release.sh minor` or `scripts/release.sh major` only when an explicit non-patch increment is required. - Use `scripts/update-packagist.sh` only to repair or verify Packagist synchronization without creating a new version. - After publishing, verify the release workflow, `https://packagist.org/packages/errogaht/transcribe-bundle`, and a clean `composer require errogaht/transcribe-bundle:^VERSION` installation. ## Release credentials - Never commit, print, echo, or place Packagist tokens in command arguments. - GitHub Actions reads the token from the repository secret `PACKAGIST_TOKEN`. - Local recovery reads the encrypted machine-bound credential from `~/.config/transcribe-bundle/packagist-token.cred` through `systemd-creds`. - Do not ask the user for the token while either configured credential source is available. - If a credential is rotated, update both GitHub Actions Secret and the encrypted local credential, then run `scripts/update-packagist.sh`.

Repository Agent Instructions

Architecture and code quality

Keep code, comments and public documentation in English.
Preserve the provider boundary: application code depends on normalized transcription contracts, never on Palatine response arrays.
Preserve the Symfony-first contract: YAML creates named, non-shared, autowireable transcriber and stream services; custom providers remain normal Symfony services.
File transcription is a final-result API. Palatine polling may be used internally, but provider task identifiers must not leak into the primary TranscriberInterface.
Live transcription is a separate session API. Never expose a provider API token to a browser or include it in logs and exception messages.
Audio bytes, transcript text and credentials are sensitive. Log only operational metadata unless a host application explicitly opts into its own content logging.
Temporary media must use private permissions, must never modify the source file, and must be removed on both success and failure.
Document intent, state boundaries, security assumptions and non-obvious tradeoffs in new or significantly changed code.
Add scenario-oriented comments to tests.
Run composer validate --strict and composer check before pushing.

Mandatory publication workflow

Completed changes are committed to master and pushed to origin master, unless the user explicitly requests a non-publishing draft.
Never create routine patch tags manually. A successful CI run for a push to master triggers .github/workflows/release.yml.
The release workflow increments the latest semantic patch version, creates an annotated tag and GitHub Release, and creates or updates the Packagist package.
Use scripts/release.sh minor or scripts/release.sh major only when an explicit non-patch increment is required.
Use scripts/update-packagist.sh only to repair or verify Packagist synchronization without creating a new version.
After publishing, verify the release workflow, https://packagist.org/packages/errogaht/transcribe-bundle, and a clean composer require errogaht/transcribe-bundle:^VERSION installation.

Release credentials

Never commit, print, echo, or place Packagist tokens in command arguments.
GitHub Actions reads the token from the repository secret PACKAGIST_TOKEN.
Local recovery reads the encrypted machine-bound credential from ~/.config/transcribe-bundle/packagist-token.cred through systemd-creds.
Do not ask the user for the token while either configured credential source is available.
If a credential is rotated, update both GitHub Actions Secret and the encrypted local credential, then run scripts/update-packagist.sh.