feat(room): DARKXSIDE room voice loading — manifest repair, MCP bridge mount, UTS wiring

pmoves/config/rooms/catalog.json

@@ -94,7 +94,7 @@
       "stage": "rehearsal",
       "manifest": "darkxsides.room.json",
       "summary": "Private, owner-only persona room (co-creator + witness -> eventual digital twin). Uncensored/unrestricted authentic expression; houses the dedicated publish-gate surfaced in Open Notebook, with a fail-closed public-egress redaction floor.",
-      "current_stage": "archive",
+      "current_stage": "rehearsal",
       "stage_source": "inferred: private persona room, not serving external traffic (defaulted to archive; operator can flip to 'live' if active). See open-room-lane spec §6 stretch checklist.",
       "stage_verified_at": "2026-07-20T18:00:00Z"
     },

pmoves/config/rooms/darkxsides.room.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "stage": "rehearsal",
   "display_name": "DARKXSIDES",
-  "description": "Private, owner-only room. A window into the mind of the Founder where the DARKXSIDE persona resides \u2014 co-creator and witness, eventual digital twin. Uncensored/unrestricted: real, not corporate-speak-pretty-CHIT. Houses the dedicated publish-gate, surfaced in Open Notebook.",
+  "description": "Private, owner-only room. A window into the mind of the Founder where the DARKXSIDE persona resides — co-creator and witness, eventual digital twin. Uncensored/unrestricted: real, not corporate-speak-pretty-CHIT. Houses the dedicated publish-gate, surfaced in Open Notebook.",
   "agent_id": "darkxside-persona",
   "alter": "darkxside",
   "room_type": "creator",
@@ -13,7 +13,7 @@
     "owner_only": true,
     "invite_list": [],
     "content_rating": "uncensored",
-    "rating_note": "Unrestricted expression inside the room. NOT a porn flag \u2014 content is authentic/real. Public egress is governed separately by policies.publish.egress_redaction_floor."
+    "rating_note": "Unrestricted expression inside the room. NOT a porn flag — content is authentic/real. Public egress is governed separately by policies.publish.egress_redaction_floor."
   },
   "shell": {
     "theme": {
@@ -62,7 +62,7 @@
       "poetic",
       "bronx"
     ],
-    "glyph": "\u25c8",
+    "glyph": "◈",
     "resonance": [
       "founder-mind",
       "shape-attribution",
@@ -115,228 +115,34 @@
       "pinned": true
     },
     {
-      "binding_id": "pinokio-launch-comfyui",
-      "skill_id": "pinokio-bridge",
-      "room_id": "darkxsides.room",
-      "display_name": "Launch ComfyUI Render",
-      "intent": [
-        "creator",
-        "render",
-        "image",
-        "video"
-      ],
-      "activation": {
-        "invocation_mode": "workflow",
-        "trigger_phrases": [
-          "render this",
-          "generate image",
-          "launch comfyui",
-          "create visual"
-        ],
-        "requires_selection": false
-      },
-      "surface": {
-        "app_id": "hyperdimensions-viewer",
-        "target": "panel",
-        "route": "/hyperdimensions/app"
-      },
-      "execution": {
-        "mode": "workflow",
-        "run_as": "agent",
-        "stream": "status",
-        "max_steps": 8
-      },
-      "context": {
-        "sources": [
-          "room-state",
-          "notebook-thread",
-          "persona"
-        ],
-        "include_last_turns": 4,
-        "notebook_writeback": true,
-        "artifact_types": [
-          "text",
-          "json",
-          "image"
-        ]
-      },
-      "outputs": [
-        {
-          "target": "artifact-store",
-          "delivery": "append",
-          "path": "renders/comfyui-output",
-          "artifact_type": "image"
-        },
-        {
-          "target": "nats-event",
-          "delivery": "emit",
-          "subject": "studio.render.completed.v1",
-          "artifact_type": "json"
-        }
-      ],
-      "guardrails": {
-        "require_approval": false,
-        "max_runtime_sec": 600,
-        "fail_open": true,
-        "one_active_run": true
-      },
-      "enabled": true,
-      "tags": [
-        "creator",
-        "render",
-        "comfyui",
-        "visual"
-      ]
-    },
-    {
-      "binding_id": "pinokio-launch-tts",
-      "skill_id": "pinokio-bridge",
-      "room_id": "darkxsides.room",
-      "display_name": "Launch TTS Studio",
-      "intent": [
-        "voice",
+      "app_id": "tts-studio",
+      "kind": "media",
+      "route": "/dashboard/voice",
+      "provider": "flute-gateway",
+      "action_namespace": "voice",
+      "capabilities": [
         "tts",
-        "audio",
-        "persona"
+        "engine-status",
+        "audition",
+        "prosody"
       ],
-      "activation": {
-        "invocation_mode": "workflow",
-        "trigger_phrases": [
-          "voice this",
-          "read it aloud",
-          "launch tts",
-          "synthesize voice",
-          "narrate"
-        ],
-        "requires_selection": true
-      },
-      "surface": {
-        "app_id": "persona-console",
-        "target": "composer",
-        "route": "/darkxside/mind"
-      },
-      "execution": {
-        "mode": "workflow",
-        "run_as": "agent",
-        "stream": "status",
-        "max_steps": 5
-      },
-      "context": {
-        "sources": [
-          "notebook-selection",
-          "persona",
-          "room-state"
-        ],
-        "include_last_turns": 4,
-        "notebook_writeback": true,
-        "artifact_types": [
-          "audio",
-          "text"
-        ]
-      },
-      "outputs": [
-        {
-          "target": "artifact-store",
-          "delivery": "append",
-          "path": "voice/spoken-summaries",
-          "artifact_type": "audio"
-        },
-        {
-          "target": "nats-event",
-          "delivery": "emit",
-          "subject": "voice.synth.request.v1",
-          "artifact_type": "json"
-        }
-      ],
-      "guardrails": {
-        "require_approval": true,
-        "max_runtime_sec": 300,
-        "fail_open": false,
-        "one_active_run": true
-      },
-      "enabled": true,
-      "tags": [
-        "voice",
-        "tts",
-        "persona",
-        "provenance-gated"
-      ]
+      "pinned": false,
+      "status": "planned"
     },
     {
-      "binding_id": "e2b-shared-desktop",
-      "skill_id": "e2b-desktop",
-      "room_id": "darkxsides.room",
-      "display_name": "Shared Desktop (E2B)",
-      "intent": [
-        "review",
-        "desktop",
-        "browser",
-        "co-review",
-        "transform"
-      ],
-      "activation": {
-        "invocation_mode": "workflow",
-        "trigger_phrases": [
-          "open shared desktop",
-          "show me the browser",
-          "co-review this",
-          "launch desktop view"
-        ],
-        "requires_selection": true
-      },
-      "surface": {
-        "app_id": "hyperdimensions-viewer",
-        "target": "panel",
-        "route": "/hyperdimensions/app"
-      },
-      "execution": {
-        "mode": "workflow",
-        "run_as": "agent",
-        "stream": "status",
-        "max_steps": 10
-      },
-      "context": {
-        "sources": [
-          "notebook-selection",
-          "room-state",
-          "persona"
-        ],
-        "include_last_turns": 4,
-        "notebook_writeback": true,
-        "artifact_types": [
-          "text",
-          "json",
-          "image"
-        ]
-      },
-      "outputs": [
-        {
-          "target": "nats-event",
-          "delivery": "emit",
-          "subject": "room.desktop.session.opened.v1",
-          "artifact_type": "json"
-        },
-        {
-          "target": "notebook-entry",
-          "delivery": "append",
-          "path": "threads/desktop-sessions",
-          "artifact_type": "text"
-        }
+      "app_id": "voice-vault",
+      "kind": "custom",
+      "route": "/dashboard/voice/vault",
+      "provider": "pmoves-ui",
+      "action_namespace": "voice.vault",
+      "capabilities": [
+        "voice-library",
+        "consent-artifacts",
+        "provenance-view",
+        "rights-basis"
       ],
-      "guardrails": {
-        "require_approval": true,
-        "max_runtime_sec": 1800,
-        "fail_open": false,
-        "one_active_run": true
-      },
-      "enabled": false,
-      "tags": [
-        "desktop",
-        "e2b",
-        "co-review",
-        "browser",
-        "disabled-pending-e2b-key"
-      ]
+      "pinned": false,
+      "status": "planned"
     }
   ],
   "notebook": {
@@ -382,7 +188,7 @@
       "binding_id": "pub-gate-approve",
       "skill_id": "pmoves-publish-gate",
       "room_id": "darkxsides.room",
-      "display_name": "Publish Gate \u2014 Approve / Hold",
+      "display_name": "Publish Gate — Approve / Hold",
       "intent": [
         "publish",
         "approve",
@@ -698,7 +504,7 @@
           "no-literal-lan-or-tailscale-ips"
         ],
         "fail_closed": true,
-        "note": "Adults-only reflection space. The floor protects operator + collaborator PII and enforces operator final-say on egress \u2014 it is NOT a content-rating gate. Minor safety is handled by room separation (kids only ever in P7 Playground), not by scanning this room. Anything crossing to a PUBLIC surface passes this floor regardless of room rating; cannot be bypassed by opening the gate."
+        "note": "Adults-only reflection space. The floor protects operator + collaborator PII and enforces operator final-say on egress — it is NOT a content-rating gate. Minor safety is handled by room separation (kids only ever in P7 Playground), not by scanning this room. Anything crossing to a PUBLIC surface passes this floor regardless of room rating; cannot be bypassed by opening the gate."
       }
     },
     "memory": {
@@ -741,14 +547,5 @@
       "pmoves/docs/ROOM_MANIFEST_CONTRACT.md",
       "pmoves/docs/PMOVESCHIT/GEOMETRY_BUS_INTEGRATION.md"
     ]
-  },
-  "skills": [
-    "pinokio-bridge",
-    "flute-gateway",
-    "comfyui",
-    "e2b-mcp"
-  ],
-  "default_services": [
-    "up-comfyui"
-  ]
-}
+  }
+}

pmoves/docker-compose.media.yml

@@ -373,7 +373,7 @@ services:
     # Realtime duplex voice agent (/v1/voice/agent: mic→Whisper→LLM→VibeVoice).
     # Off by default — requires pipecat-ai installed + VibeVoice (7860) running.
     - PIPECAT_ENABLED=${PIPECAT_ENABLED:-false}
-    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}
+    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}  # NATIVE-first: engines run in the Pinokio-native UTS on host 7860 (feedback_tts_native_not_docker); the GHCR container is a UI/MCP shell WITHOUT engine packages — override to http://ultimate-tts-studio:7860 only if the image ever bakes engines
     - ULTIMATE_TTS_TIMEOUT_SEC=${ULTIMATE_TTS_TIMEOUT_SEC:-300}
     # Host-affinity routing (opt-in, #2305): with VOICE_HOST_AFFINITY=1 a cast
     # host-swaps the configured engine URL to the selected fleet node's Tailscale
@@ -433,7 +433,7 @@ services:
     environment:
     - PORT=8060
     - FLUTE_GATEWAY_URL=http://flute-gateway:8055
-    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}
+    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}  # NATIVE-first: engines run in the Pinokio-native UTS on host 7860 (feedback_tts_native_not_docker); the GHCR container is a UI/MCP shell WITHOUT engine packages — override to http://ultimate-tts-studio:7860 only if the image ever bakes engines
     - NATS_URL=${NATS_URL}
     - CHIT_REQUIRE_SIGNATURE=${CHIT_REQUIRE_SIGNATURE:-false}
     - CHIT_DECRYPT_ANCHORS=${CHIT_DECRYPT_ANCHORS:-false}

pmoves/docker-compose.ultimate-tts-studio.yml

@@ -8,6 +8,13 @@ services:
       - HF_HOME=/data/hf
       - HUGGINGFACE_HUB_CACHE=/data/hf
       - XDG_CACHE_HOME=/data/cache
+      # Empty SSL_CERT_FILE/_DIR means "trust nothing" to Python/OpenSSL and
+      # breaks HF weight downloads — re-point at the container CA store (same
+      # anti-host-leak intent as the env.shared blanks, working trust chain).
+      - SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+      - SSL_CERT_DIR=/etc/ssl/certs
+      - REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
+      - CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
     volumes:
       - ultimate-tts-data:/data
     ports:
@@ -20,7 +27,9 @@ services:
             - driver: nvidia
               capabilities: [compute,utility]
               count: ${GPU_COUNT:-all}
-    networks: [api_tier, data_tier]
+    # pmoves_external: engines lazy-download weights from HuggingFace on first
+    # load — without egress every handle_load_* returns "Failed to load".
+    networks: [api_tier, data_tier, pmoves_external]
 
 volumes:
   ultimate-tts-data: {}

pmoves/docker-compose.yml

@@ -4439,7 +4439,7 @@ services:
     # Realtime duplex voice agent (/v1/voice/agent: mic→Whisper→LLM→VibeVoice).
     # Off by default — requires pipecat-ai installed + VibeVoice (7860) running.
     - PIPECAT_ENABLED=${PIPECAT_ENABLED:-false}
-    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}
+    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}  # NATIVE-first: engines run in the Pinokio-native UTS on host 7860 (feedback_tts_native_not_docker); the GHCR container is a UI/MCP shell WITHOUT engine packages — override to http://ultimate-tts-studio:7860 only if the image ever bakes engines
     - ULTIMATE_TTS_TIMEOUT_SEC=${ULTIMATE_TTS_TIMEOUT_SEC:-300}
     # Host-affinity routing (opt-in, #2305): with VOICE_HOST_AFFINITY=1 a cast
     # host-swaps the configured engine URL to the selected fleet node's Tailscale
@@ -4610,7 +4610,7 @@ services:
     environment:
     - PORT=8060
     - FLUTE_GATEWAY_URL=http://flute-gateway:8055
-    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}
+    - ULTIMATE_TTS_URL=${ULTIMATE_TTS_URL:-http://host.docker.internal:7860}  # NATIVE-first: engines run in the Pinokio-native UTS on host 7860 (feedback_tts_native_not_docker); the GHCR container is a UI/MCP shell WITHOUT engine packages — override to http://ultimate-tts-studio:7860 only if the image ever bakes engines
     - NATS_URL=${NATS_URL}
     - CHIT_REQUIRE_SIGNATURE=${CHIT_REQUIRE_SIGNATURE:-false}
     - CHIT_DECRYPT_ANCHORS=${CHIT_DECRYPT_ANCHORS:-false}