# Audio Provenance

This file records where every audio byte in this project came from, what was done to it, and how the findings were established. All processing ran locally. No audio was sent to any external service.

## Source inventory

Two surviving source recordings, preserved byte for byte in `source_audio/`. They are opened read-only by every script; `scripts/derive_audio.mjs` verifies these hashes before doing anything and refuses to run on other bytes.

| File | SHA-256 | Decoded PCM MD5 | Duration | Format |
| --- | --- | --- | --- | --- |
| `source_audio/consent.m4a` | `dab43f25b9f85a0bb5702aa5b8ced59620f558ceccdf41c9d38e4f16e3370bad` | `61052ddee1b3c8e9144f498f3e022c18` | 28.212 s | AAC LC, 44.1 kHz, stereo (dual mono) |
| `source_audio/conversation.m4a` | `d7d8e45a91e9b0514a5e3a1898a8aa592d76f85b3c0644486d20b24b91d0e076` | `aa79ece038e5f5428dd3db057411c3ca` | 174.846 s | AAC LC, 44.1 kHz, stereo (dual mono) |

Container creation timestamps: `consent.m4a` 2026-07-22T14:59:30Z, `conversation.m4a` 2026-07-22T15:00:21Z. Both files are dual mono: left and right channels are sample-identical (correlation 1.000000, difference RMS 0.000), consistent with a single-microphone phone capture. An earlier `unabridged.m4a` was deleted before this work began and is not referenced by anything here.

## Findings

### 1. The surviving `conversation.m4a` is the master recording

The decoded PCM MD5 of `conversation.m4a` computed now (`ffmpeg -i conversation.m4a -f md5 -`) is `aa79ece038e5f5428dd3db057411c3ca`, which matches the value recorded when the deleted full-length recording was still available for comparison. The surviving file decodes to the same audio as the full-length recording did. It is treated as the master.

### 2. `consent.m4a` is a separate take, not an excerpt of the master

Cross-correlation of the consent audio against the entire master (FFT correlation on the raw 16 kHz mono waveform, and separately on smoothed energy envelopes) found no alignment anywhere: best raw-waveform correlation 0.032, best envelope correlation 0.21, both noise level. A re-encoded excerpt of the same capture would correlate above 0.8. The creation timestamps (consent finalized 51 seconds before the conversation file) are consistent with two back-to-back recordings: the consent statement captured first as its own file, then the conversation started as a new recording.

### 3. The master contains no consent preamble

This was the release-blocking question, because the build brief warned the master might still open with the consent statement. Verification, all local:

- Transcription with whisper.cpp 1.9.1 (ggml `base.en` and `small.en` models, run offline) shows the master opening directly on the scenario line "So imagine we need to plan a birthday party for about 12 people next Saturday" and containing only the planning conversation end to end.
- The energy profile of the head shows room tone from 0.0 to 0.6 s, then speech onset at about 0.65 s. No cut-off syllables precede the scenario line.
- Duration accounting: the transcribed conversation spans the full 174.8 s file (speech ends about 170.6 s, room tone to the end). A master that also contained the 28 s consent statement would leave only about 146 s for this conversation, which does not match.
- Finding 2 already established that the consent audio does not appear anywhere in the master.

Conclusion: the consent statement exists only in `consent.m4a`, which stays private. The master needed no consent-removal cut. The public clip below is a trim, fade, and re-encode of the master with metadata stripped, not a content edit. The verification mattered anyway: the file inventory's assumption about `conversation.m4a` was wrong, and release decisions here are made from decoded-audio evidence, not filenames.

### 4. One natural pause trips the dropout check

The deterministic dead-air check flags a single 540 ms span at 159.94 to 160.48 s of the public clip (2:39.9 to 2:40.5), which the transcript places between "That sounds good." and "Okay, I'll send you some options tomorrow". It is a natural inter-turn pause in a quiet room, not transmission loss. This genuine false positive is preserved deliberately: it is the human-override exception the site walks through, and the site's copy describes it truthfully.

### 5. Human listening corrected an unsupported timing label

The first site build treated the 48.2 to 58.2 second transcript segment as if the entire segment measured one silence. It does not. The segment is a complete utterance containing speech and a natural hesitation. Both speakers listened through the recordings, and Erika checked the transcript against the audio. That review caught the unsupported timing label before release.

The corrected release rule keeps measured timing separate from interpretation and requires a listen-through before contextual audio labels ship. The public site calls this moment a natural hesitation and does not replace the discarded claim with another guessed duration.

## Consent scope

Transcribed locally from `consent.m4a` with whisper.cpp. Both speakers listened to the recording and confirmed the spoken content and narrow public-demo consent. Erika checked the transcript against the audio:

> Erika: "Kris, before we start, are you comfortable with me recording this short conversation and using it in a publicly accessible job application demo?"
> Kris: "Yes."
> Erika: "The recording will be used to demonstrate audio quality checks and conversation timing. I may also create altered copies to demonstrate things like background noise or low audio quality. It will not be sold or used to train an AI model. Is that okay?"
> Kris: "Yes, that's okay."
> Erika: "Great."

Scope as operational data: public job-application demo use permitted; altered copies for demonstrating quality checks permitted; sale prohibited; AI model training prohibited. The site links every public asset to this scope. The consent audio itself is never shipped, played, or copied into the site.

## Derived public assets

Produced by `scripts/derive_audio.mjs` (Node v25.9.0, ffmpeg 8.1.1). All public assets are mono AAC 128k at 44.1 kHz with container metadata stripped. Levels are intentionally not normalized so the measurements shown on the site describe the recording as it was made.

### Public conversation clip

`site/public/audio/conversation_full.m4a`, SHA-256 `06a85365d43e279f3ca160c2acc77b73c9754cc4e3276e06accea287fca8d859`.

Derivation: decode master to 44.1 kHz mono PCM, trim to 0.000 through 172.000 s (dropping 2.8 s of trailing room tone), apply a 300 ms fade-out, encode. The clip begins at the master's own first sample because the scenario line opens the recording; no leading trim was needed.

### QA fixtures

Cut from the master excerpt 98.4 to 139.6 s (the segment containing the private-room proposal, the plan forming, and a real talk-over with repair), then transformed deterministically. Every fixture is a labeled synthetic derivative of the consented recording; none of the damage occurred in the wild.

| Fixture | Transform | SHA-256 |
| --- | --- | --- |
| `fx_clean.m4a` | none (excerpt as recorded) | `2755c9aabd3a7e48f799d2f2c86306eef4ab3ef521f5a1f24675ba626899668a` |
| `fx_quiet.m4a` | gain -18 dB | `d2e242e1147cc0d0b32d73129fce94b8007a8382b08c5c29e16fa8a03eeb0fcd` |
| `fx_clipped.m4a` | gain +21.6 dB, hard limit | `a40664eeca632d13483f594a7831ae3bbec5b0c98e5220d7dc9266b57745d4cb` |
| `fx_dropout.m4a` | three spans muted (400, 400, 450 ms) | `ca6273b894e12c60cc445dce775cb060a4cc5c178dec334491efec29fd4aa7db` |
| `fx_silence.m4a` | 14 s span muted | `bfde883ac1ef16f7155086b7e07caaef5dc0850ef16bccbf52ee5e40a9f7b52f` |
| `fx_hum.m4a` | 60 Hz tone added, amplitude 0.045 | `d71bc65a4998aa3d51f6599f18637ce8e02325cd9031b8ea1dc3c3bcd8d4c103` |
| `fx_duplicate.m4a` | byte copy of `fx_clean.m4a` | `2755c9aabd3a7e48f799d2f2c86306eef4ab3ef521f5a1f24675ba626899668a` |

Exact transform parameters, intermediate WAV hashes, per-file measurements, and spec evaluations are in `site/src/data/fixtures_manifest.json` (shipped with the site and driving its UI) and `audio_derived/derivation_record.json` (audit record). 16-bit WAV intermediates are kept in `audio_derived/fixtures_wav/`.

## Reproduction

```bash
node scripts/derive_audio.mjs
```

Re-running regenerates every derived asset from the verified sources and rewrites both manifests. Verification commands used for the findings above:

```bash
shasum -a 256 source_audio/consent.m4a source_audio/conversation.m4a
```

```bash
ffmpeg -v error -i source_audio/conversation.m4a -f md5 -
```

```bash
ffprobe -v error -show_format -show_streams source_audio/conversation.m4a
```

Transcription ran with whisper.cpp 1.9.1 (Homebrew) and the ggml `base.en` and `small.en` models fetched from the ggml-org Hugging Face repository; models and working WAVs lived in a session scratch directory outside this project. Cross-correlation and energy profiling used short numpy scripts, also in scratch. The private working copies contain consent audio and were not placed under the project directory.

## Boundaries

- `source_audio/` is never copied into `site/public/` or the production build. An automated test asserts the build output contains no source hashes and no consent audio.
- The consent recording has no public player and no public transcript beyond the scope quotation above.
- The site transcript was produced locally with an open-source model and checked against the audio. Both speakers confirmed the spoken content. The public transcript stays unattributed because the released recording is mono and does not reliably establish a named speaker for every turn.