246 things OpenBark does for your clinic.

The round button is 64px (72px on touch screens) and shows a breathing ring, a 48-bar rolling waveform and the elapsed time while recording. The breathing ring is the only animation in the app that never stops.

packages/ui/src/RecordButton.tsx; packages/ui/src/Waveform.tsx; packages/ui/src/RecordButton.test.tsx; docs/design/DESIGN.md section 5

When the Recorder has focus, Space toggles recording. The button can't be pressed while recording is starting or stopping, so a double press can't happen.

apps/desktop/src/screens/Recorder.tsx onKeyDown; packages/ui/src/RecordButton.test.tsx 'can't be pressed while starting or stopping'

Voice detection, speech recognition and speaker labelling run while you talk. On a 9.6-minute test consult played in real time, the transcript was complete 0.0 s after stop.

engine/os-engine/src/live.rs; apps/desktop/src/components/TranscriptList.tsx; docs/perf/M0.md 'Live recording'

Each utterance's voice fingerprint (WeSpeaker ResNet34) is matched to the speakers heard so far, and utterances under 1 s never start a new speaker. Across four test consults, 98 to 100% of speech went to the right speaker.

engine/os-engine/src/live.rs DEFAULT_SPEAKER_THRESHOLD (0.65); engine/os-diar/src/lib.rs MIN_EMBED_SECS; docs/perf/M0.md 'Live recording' table ('purity 98-100% across all four fixtures')

The browser sends 16 kHz mono audio to the local engine as you speak, with live speaker labels. If microphone permission was denied, a message explains how to allow it again.

engine/os-server/src/lib.rs (/api/live); apps/desktop/src/engine.ts startBrowserRecording; docs/guide/recording.md; docs/guide/troubleshooting.md

Settings lists every input device with a System default option. Capture uses each system's own audio layer: WASAPI on Windows, CoreAudio on macOS, ALSA or PulseAudio on Linux.

engine/os-asr/src/capture.rs; engine/os-cli/src/record.rs (openbark devices); apps/desktop/src/screens/Settings.tsx Recording group

Audio is written to disk as it is recorded, already encrypted, and a cut-off recording is repaired so all of it can still be read. The status line tells you the audio is saved as you go.

engine/os-asr/src/wav.rs; engine/os-engine/src/vault.rs test a_recording_cut_off_mid_way_keeps_what_was_written; apps/desktop/src/screens/Recorder.tsx

Recording keeps the display on as well as keeping the computer awake. Transcribing and drafting only stop the computer sleeping, so the screen may turn off.

engine/os-engine/src/awake.rs (AwakeReason::Recording, display hold); engine/os-engine/src/live.rs

Recording, transcribing, drafting and downloading hold a keep-awake lock on Windows, macOS and Linux. If the lock can't be taken, this is logged and the job carries on.

engine/os-engine/src/awake.rs; engine/os-app/src/lib.rs (AwakeGuard::acquire); docs/plans/M0.md decision 7

An option, on by default, in the Recorder side panel and in Settings. Stopping opens Review and starts the draft straight away.

apps/desktop/src/screens/Recorder.tsx; apps/desktop/src/context.ts DEFAULTS.draftOnStop; docs/guide/recording.md

Icon tiles for six common visit types (New consult, Recheck, Annual exam, Phone call, Results, Clinician rounds) come first, then the team's own templates. Every other record template is under More types.

apps/desktop/src/components/VisitTypePicker.tsx; apps/desktop/src/templateIcons.tsx COMMON_TYPES; docs/templates.md 'Built-in templates'

Every field is optional. Details are saved with the visit and time-stamped.

apps/desktop/src/components/PatientFields.tsx; apps/desktop/src/screens/Recorder.tsx

WAV (including dictaphone ADPCM), AIFF, MP3, MP2, M4A, MP4, MOV, CAF, FLAC, Ogg, Opus, WebM and MKV are read, using the audio track of a video, and go through the same steps as a live recording. An AAC .m4a encoded from a test consult gave the same transcript as the WAV, and 11 generated formats were transcribed to check them.

engine/os-asr/src/audio.rs (Audio::load); apps/desktop/src/engine.ts AUDIO_EXTENSIONS; docs/guide/recording.md; commits 86d8e1b (m4a from the Windows Media Foundation encoder), 75dc765

Decoding uses symphonia 0.6.1 and opus-decoder 0.1.1, both written in Rust, chosen over native libopus to keep one native build. It was checked on browser WebM, Ogg Opus, .opus files and WebM video.

docs/versions.md (symphonia and opus-decoder rows); engine/os-asr/Cargo.toml

In the browser version, a file the engine can't read (such as HE-AAC) is converted by the browser first. WMA, AMR and Olympus or Philips DSS and DS2 files are refused with a message suggesting the recorder's own converter.

apps/desktop/src/engine.ts decodeInBrowser; docs/guide/recording.md

If an import fails, its half-made visit folder is deleted. You get a plain message listing the formats that work.

engine/os-app/src/lib.rs import_source ('An import that couldn't be read leaves no empty visit behind'); commit 75dc765

Record the call with the phone's own call recorder, export the file, import it and draft it with the Phone call template.

docs/adr/0007-phone-calls.md Phase 1; docs/guide/recording.md; docs/templates.md

The design makes OpenBark an extension on the clinic's own phone system, recording each side on its own channel so speaker labels are exact, with a recorded consent announcement. It stays off until configured.

docs/adr/0007-phone-calls.md Phase 2; docs/network.md 'Planned'

Dictation and a hybrid mode are in the product brief. 'Dictate correction' in the note editor is listed as not built yet.

the product brief section 2.2; docs/design/STATUS.md 'Not yet'

The brief asks for pause and resume and 'mark moment' bookmarks. The Recorder design puts bookmarks in the side panel.

the product brief section 5; docs/design/DESIGN.md section 6 Recorder

A test is designed for iPhone and Android background recording: it must lose no more than 0.5% of audio over a 15-minute locked-screen run, with the transcript written on the phone as it records. It hasn't been run yet.

docs/spikes/S1-mobile-audio-and-inference.md; engine/os-engine/src/awake.rs

Parakeet TDT 0.6B v3 runs through sherpa-onnx 1.13.8 and recognises English and 24 other European languages with no setting to change. The standard build is 0.67 GB, and a full-precision build (2.55 GB) is used when the optional NVIDIA speech pack is installed.

docs/adr/0001-inference-libraries.md; engine/os-asr/src/lib.rs; engine/os-models/catalog.json; docs/languages.md

Silero VAD v6.2.3 finds the speech, and passages longer than 20 s are split. During live recording each utterance is handed on as soon as the pause after it is heard.

engine/os-asr/src/vad.rs; docs/versions.md Models table

Imports run through the live pipeline at full speed with the same speaker tracker. That tracker was more accurate than whole-recording separation on short clips during tuning.

engine/os-app/src/lib.rs import_file (doc comment); docs/plans/M1.md

Words are compared with the vocabulary by spelling and by sound, with a stricter match for short condition names than for drugs, and hinted words get a dotted underline showing what was heard and the likely term. All 8 hints on the M1 test consults were correct; hints were chosen because biasing the recogniser toward listed terms made Parakeet worse in a test.

engine/os-engine/src/vocab.rs (THRESHOLD_DRUG 0.87, THRESHOLD_OTHER 0.95; test suggests_misheard_drug_names); apps/desktop/src/components/TranscriptList.test.tsx; docs/eval/M1.md finding 3; engine/os-asr/examples/hotwords.rs

168 drugs, 81 conditions, 31 procedures, 8 vaccines, 5 products and 3 routes, including 63 farm, equine, exotics, anaesthesia and suture terms added after ceftiofur came out as 'Seftiapha'. Everyday clinical words such as milligram or vomiting are never hinted.

packages/vocab/veterinary.tsv (296 rows, counted by kind); engine/os-engine/src/vocab.rs COMMON; docs/eval/M2.md 'What the specialty consults found' item 4

Terms listed in vocab.tsv in OpenBark's data folder (term, a tab, then the kind) are added to the built-in list. OPENBARK_VOCAB can point to another file.

engine/os-engine/src/vocab.rs (default_with_user; test user_terms_are_added)

'Roman 4' gets a hint of likely IV after it happened in three test consults, and a dose stuck to a drug name ('sepromazine.02') is split so both get hints. A first syllable heard as 'a' is rejoined ('a sepromazine' to acepromazine), after a test draft turned acepromazine into xylazine.

engine/os-engine/src/vocab.rs (spoken_form_hints, split_glued_decimals; test iv_heard_as_roman_four_is_hinted); docs/eval/M2.md items 2 and 3

Capitalised words that sound like one of the visit's animals (similarity 0.80 or more) get a name hint that only the note model sees. Ordinary words such as 'alive' are left alone.

engine/os-engine/src/vocab.rs (name_hints, NAME_THRESHOLD; test misheard_pet_names_are_hinted)

Speaker labels sit in the margin and timestamps on the right, and clicking a line plays the recording from there. Lines the second recogniser heard differently show 'Second listen heard: ...'.

apps/desktop/src/components/TranscriptList.tsx; docs/design/STATUS.md 'Done' section 5 Transcript

The list follows new lines until you scroll up, then offers Jump to live. Scrolling stays inside the list, so the page and its controls don't move.

apps/desktop/src/components/TranscriptList.tsx; commit 4dd018e ('The transcript follows new lines without scrolling the page')

Both are in the design and listed under 'Not yet' in the design status.

docs/design/STATUS.md 'Not yet'; docs/design/DESIGN.md section 5 Transcript pane

Gemma 4 E2B (3.35 GB), E4B (5.15 GB, the default) and 12B (6.98 GB), all Apache-2.0, run through llama.cpp on the graphics chip where there is one, or on the processor. The context grows with each request up to 32,768 tokens.

engine/os-llm/src/llama.rs; engine/os-models/catalog.json; docs/adr/0001-inference-libraries.md

The note is generated against a structure built from the template, which llama.cpp enforces as the model writes. Every item must cite the transcript lines it came from.

docs/spikes/S2-native-linking.md step 4; docs/adr/0006-templates-from-headings.md Decision 2; engine/os-engine/src/template.rs generate_schema

Before, the model wrote headings alphabetically, so it reached the assessment before the history and exam. Measured on 13 test consults: recall about level (141/155 against 143/155), unsupported wording halved (45 to 23) and wrong citations down from 12 to 3.

docs/eval/heading-order.md; engine/os-engine/src/template.rs test schema_keeps_the_templates_heading_order

Measurements are written as a value, a unit and the line they came from. Since this change, every numeric vital in the evaluation has come out right with its unit.

docs/eval/M1.md finding 2; docs/adr/0006-templates-from-headings.md Context

The model first labels which animal each transcript line is about, then drafts each note only from that animal's lines and the shared ones. On a 7-minute test visit with two cats, facts found went from 17/23 with 6 values in the wrong cat's note to 21/23 with none, at about 6 s more per animal.

engine/os-engine/src/note.rs (attribute_lines, lines_for_pet; test each_animal_drafts_from_its_own_and_shared_lines); docs/eval/M2.md item 2; docs/plans/M2.md item 2

Add another animal before recording to make a multi-pet visit. If labelling the lines fails, each note is drafted from the whole visit with an instruction to write only about that animal.

apps/desktop/src/screens/Review.tsx pet-tabs; engine/os-engine/src/note.rs; docs/plans/M2.md item 2

On wide screens the transcript, audio player and note sit side by side, and smaller screens switch to Transcript and Note tabs. The line being played is highlighted.

apps/desktop/src/screens/Review.tsx; apps/desktop/src/app.css (.review-split, max-width 1023px); docs/design/STATUS.md 'Done' sections 4 and 5

Ask on any heading opens a panel with suggestions for that heading, and only that heading is redrafted from the transcript. The whole note is then checked again and saved as a new numbered draft with the request recorded.

engine/os-engine/src/note.rs (refine_note; test refine_prompt_covers_only_the_heading); apps/desktop/src/components/RefinePanel.tsx; RefinePanel.test.tsx; docs/adr/0006-templates-from-headings.md Decision 6

Editors cover bullet lines, medications (drug, dose, route, frequency, duration) and measurements with units, and each save makes a new draft. Changed lines are marked 'Edited by' with your name, and lines from the recording keep their evidence links.

engine/os-engine/src/edit.rs (tests edited_items_are_the_vets_and_unchanged_items_keep_their_checks, edits_must_fit_the_heading); apps/desktop/src/components/HeadingEditor.tsx; HeadingEditor.test.tsx

Ask, hand edits, reprocessing and drafting again each save a new numbered draft. The earlier drafts stay on disk.

engine/os-engine/src/session.rs (save_run); docs/guide/review.md; docs/templates.md

A template picker in the Review bar offers Draft again and Draft as another template. The model used is shown beside the draft.

apps/desktop/src/screens/Review.tsx (template-pick, output-row); docs/guide/review.md

Sign note records who signed and when. Signed notes refuse edits, Ask and redrafts with 'Add an addendum instead.', and signing twice is refused.

engine/os-engine/src/session.rs (sign_latest_by); engine/os-app/src/lib.rs (generate_note); apps/desktop/src/screens/Review.tsx sign(); docs/plans/M1.md item 6

Add addendum appends a dated addition signed with your name, and your role when a team is set up. Addenda appear under the note, in copies and in PDFs.

engine/os-engine/src/session.rs (add_addendum_by, Addendum); apps/desktop/src/screens/Review.tsx signAddendum; docs/templates.md

It reads '{n} statements, {n} numbers checked against the transcript', with the number of lines the vet entered and 'Drafted in x s'. A notice counts any flagged items.

apps/desktop/src/screens/Review.tsx (output-meta, note-summary)

A visit details panel with Edit details sits above the note. Consent reads, for example, 'Client agreed out loud; confirmed by Dr Patel, 2026-10-17 20:07'.

apps/desktop/src/screens/Review.tsx visit-facts; apps/desktop/src/engine.ts consentText

A draggable split remembered on each device, and keys to move between flagged sentences, are listed as not built yet.

docs/design/STATUS.md 'Not yet'; docs/design/DESIGN.md section 9

Core rules come ahead of every template's own: use only what was said, never write 'normal' unless it was said, copy numbers exactly with units, cite the line each fact came from, and one clinical fact per statement. Teams can add rules and can't remove these.

engine/os-engine/src/template.rs CORE_RULES; docs/adr/0006-templates-from-headings.md Decision 3; apps/desktop/src/screens/Templates.tsx

Resting on or focusing a statement lights up its transcript lines. Clicking it, or pressing Enter, plays that moment of the recording.

apps/desktop/src/components/NoteView.tsx; NoteView.test.tsx 'lights the cited transcript lines on hover and plays them on click'; docs/design/DESIGN.md section 1

Every number in the note must appear in the transcript; one that doesn't gets a red callout ('isn't anywhere in the transcript') and Sign note is disabled. It also fails the evaluation and the offline test that runs on every change.

engine/os-engine/src/faithfulness.rs (tests supported_numbers_pass, invented_vital_is_flagged); NoteView.test.tsx 'wraps a number absent from the transcript in a hard-fail callout'; scripts/ci/e2e-offline.sh

A draft passes only with no unsupported numbers and no invalid evidence links, and the engine refuses to sign any draft that hasn't passed. On screen an invalid link is a softer flag, so the engine is the stricter of the two.

engine/os-engine/src/faithfulness.rs (passed = invalid_evidence.is_empty() && unsupported_numbers.is_empty()); engine/os-engine/src/session.rs sign_latest_by; apps/desktop/src/screens/Review.tsx

M1 reported 0 at every prompt revision across 4 consults, and M2 reported 0 across 9 specialty consults, 3 GP templates and 3 client documents. M0 reported 0 for both E4B and 12B.

docs/eval/M1.md; docs/eval/M2.md; docs/perf/M0.md faithfulness row

A number that is in the transcript but not in the lines a statement cites gets an amber dotted underline and a tooltip. M0 measured 5 per note on the paced test consult, which is why it has its own flag.

engine/os-engine/src/faithfulness.rs test number_from_wrong_segment_is_a_citation_mismatch; NoteView.test.tsx 'underlines a value cited to the wrong line'; docs/perf/M0.md safety finding 3

Every cited line must exist in the transcript. Missing or unknown references are reported as invalid evidence.

engine/os-engine/src/faithfulness.rs test missing_or_unknown_evidence_is_flagged

The important words of each statement must appear in the lines it cites, with negations counted and 152 abbreviation and spoken-form pairs treated as the same (SC and under the skin, PO and by mouth, BID and twice). On the M1 consults it raised 22 flags (13 wrong-line citations, 5 real embellishments and 4 false flags since fixed), and flags ask for a check without blocking signing.

engine/os-engine/src/align.rs (FOLD table, 152 pairs; NEGATIONS; tests invented_claims_are_flagged, supported_and_paraphrased_statements_pass); docs/eval/M2.md item 1; docs/plans/M2.md item 1

When a flagged statement's words are found elsewhere, up to three lines that together hold at least 75% of them are suggested. The note reads 'It may come from line n'.

engine/os-engine/src/align.rs test wrong_citations_get_a_suggestion; NoteView.test.tsx 'flags a line whose words aren't in its cited line, with the likely line'

Species, breed, sex, age and name are checked against their cited line, with synonyms such as dog, canine and puppy understood. This was added after a draft wrote 'Species: dog' for an animal never described.

engine/os-engine/src/faithfulness.rs (SPECIES; test guessed_species_is_unverified); docs/eval/M1.md 'Patient details'

Lines with numbers, hints or one of 31 drug- and condition-like endings (-itis, -osis, -mycin, -pril and 27 more) are recognised again by Whisper large-v3-turbo, and a number that differs is shown as 'The second recogniser heard X instead of Y'. It isn't in the first-run download, so add it from the Models screen; on a 9.6-minute test consult it checked 19 of 57 segments and caught both recognition errors ('10 mL' for 100, '$120' for $320).

engine/os-engine/src/crosscheck.rs (CLINICAL_ENDINGS, 31 entries; tests dropped_magnitude_is_a_disagreement, chooses_segments_that_matter); engine/os-engine/src/models.rs required_status (Whisper turbo not included); engine/os-engine/src/live.rs; docs/eval/M1.md 'Second-opinion recognition'

Both readings are kept side by side and the vet decides. During a live recording the second listen runs in the background.

engine/os-engine/src/faithfulness.rs DisputedNumber; engine/os-engine/src/live.rs; docs/plans/M1.md item 4

When the second recogniser is installed, known veterinary terms that only its reading contains are attached as hints labelled 'second recogniser'. In M1, adding it together with new rules for medications and declined tests raised facts found from 36/44 to 39/44, with 0 invented numbers.

engine/os-engine/src/crosscheck.rs test second_reading_suggests_the_term_it_heard; docs/eval/M1.md table

'One hundred and twenty' becomes 120, 'four and a half weeks' 4.5 and 'point seven' 0.7. Both sides are put in one standard form before comparing.

engine/os-engine/src/numbers.rs (tests normalises_spoken_numbers, canonicalises, spoken_then_extracted_matches_note); engine/os-engine/src/crosscheck.rs test spelled_and_written_numbers_agree

Digits said one by one ('four oh four') are joined into one number, while 'three forty' stays as two numbers. This was found during the specialty-template evaluation.

engine/os-engine/src/numbers.rs test normalises_spoken_numbers; docs/eval/M2.md

Recognition writes 'point one' as '.1', sometimes stuck to the drug ('hydromorphone.1'), and this is always read as 0.1 with a visible hint. Before the fix a test surgery note had 1 mg/kg and the check passed it; it now gives 0.1 mg/kg.

engine/os-engine/src/numbers.rs test a_decimal_without_its_leading_zero_is_still_a_decimal; engine/os-engine/src/vocab.rs test dose_written_without_a_leading_zero_is_hinted; docs/eval/M2.md finding 1

Condition names need a near-exact match: 'artitis' scores 0.948 against arthritis but was really otitis, so no hint is given. The rule is that a missing hint beats a misleading one.

engine/os-engine/src/vocab.rs test crowded_condition_names_get_no_misleading_hint; docs/eval/M1.md finding 4

Empty headings show 'Not discussed' in the app, in copies and in PDFs, and a medication without details reads 'dose, route and frequency not stated'. Every draft is labelled 'Draft: not reviewed or signed by a veterinarian.'

engine/os-engine/src/render.rs (NOT_DISCUSSED; test empty_note_says_not_discussed_everywhere); NoteView.test.tsx; apps/desktop/src/copyFormats.test.ts

The copied draft says how many items couldn't be matched. Each one is marked '[check against recording]'.

engine/os-engine/src/render.rs (FLAG; test renders_statements_fields_medications_and_flags); docs/plans/M1.md item 12

An Ask request guides the model without counting as evidence, and numbers are checked again afterwards. Every supported fact is kept unless the vet asked to remove it.

docs/adr/0006-templates-from-headings.md Decision 6 and Consequences; docs/templates.md

Hand-edited items are marked as entered by the vet and listed for review. Unchanged items keep their checks against the recording.

engine/os-engine/src/faithfulness.rs test vet_entered_items_are_listed_not_failed; engine/os-engine/src/edit.rs

Oncology never calculates a dose or body surface area, production animal leaves withdrawal times empty unless said, and dental keeps Triadan numbers as said. Estimate explanation copies prices exactly and never adds them up.

docs/templates.md 'Built-in templates'; packages/templates/*/template.yaml

SOAP facts found went 33/44 (75%), 37, 28, 36, 39 and 40/44 (91%) across a baseline and five measured changes, with 0 invented numbers each time; the drop to 28 came when vocabulary hints were first added and was fixed by writing measurements with separate units. After M2 the SOAP template still scores canine 9/10, feline 17/19 and smoke 5/5.

docs/eval/M1.md table (six rows); docs/eval/M2.md ('canine 9/10, feline 17/19, smoke 5/5'); commits 591ad1b, 837f400, f7fbc20

Published findings include 'hundred' dropped in slow speech (now caught by the second listen), misheard drug names (hinted) and wrong citations (flagged). Still-open cases, such as 'ASA one' heard as 'A sat one', are listed too.

docs/perf/M0.md 'Safety findings'; docs/eval/M2.md 'Still open'

OpenBark is in beta today. Every figure on this page comes from scripted test consults voiced on a computer, or from developer machines.

README.md ('Status: beta ... hasn't been validated for clinical use yet'); packages/eval/fixtures/

Transcription, drafting and checking run with the network unplugged once the models are downloaded. The sidebar shows 'This device' or 'Web, this computer only'.

docs/network.md; docs/guide/README.md; apps/desktop/src/App.tsx sidebar-foot

There is no analytics, crash reporting, update check, licence server or fallback to a cloud model.

docs/network.md 'Nothing else at run time'; the product brief section 3

There are five, all started by the user: two kinds of model download, the browser version listening on this computer only, Hugging Face search and the optional NVIDIA speech pack. Any other connection is treated as a bug.

docs/network.md (R1 to R5, plus build-time hosts B1 to B6)

A CI script walks the dependency tree for web-client libraries (reqwest, ureq, isahc, attohttpc, surf). Only the model downloader may use one.

scripts/ci/check-network.sh; .github/workflows/ci.yml; docs/plans/M0.md M0-6

openbark serve listens only on 127.0.0.1, port 4317 by default. It won't listen on the clinic network until the Clinic Hub adds sign-in and encrypted connections.

docs/network.md R3; install/README.md; engine/os-server/src/lib.rs (Ipv4Addr::LOCALHOST)

The server answers only requests addressed to itself (which blocks DNS rebinding) and coming from its own pages, and every change must carry an X-OpenBark header that another site can't add. Network and device paths are refused however they are spelled, and the folder browser needs the same header.

engine/os-server/src/lib.rs (Host, Origin and X-OpenBark middleware with tests); commit 3888f20 'Web mode'

Licence acceptance and one download at a time are enforced by the server, as well as on screen. A restart is refused while work is running.

commit 3888f20 ('licence acceptance and a single download enforced by the server, restart refused while busy'); engine/os-server/src/lib.rs

A token goes only to huggingface.co, and only for a gated model the user chose. Search sends only the search words or the model's name.

docs/network.md R1 and R4

NVIDIA's CUDA runtime, cuBLAS and cuDNN are fetched from NVIDIA's own packages after the clinic ticks acceptance, and are never shipped with the app. Every file is pinned by address, size and SHA-256.

docs/adr/0014-gpu-speech-recognition.md Decision 2; docs/network.md R5; engine/os-models/src/gpu_pack.rs

Each file is encrypted with XChaCha20-Poly1305 under a random 256-bit key, with its file name bound in so files can't be swapped. It was checked on 6 older visits migrated and a new import, with no patient names left on disk.

engine/os-engine/src/vault.rs; docs/adr/0008-encryption-at-rest.md; docs/plans/M1.md item 10; docs/versions.md chacha20poly1305 row

Audio streams into encrypted 64 KiB chunks of about 2 s each, each bound to its position so chunks can't be reordered. Fixed-size chunks let playback jump to any point.

engine/os-engine/src/vault.rs (AUDIO_MAGIC, CHUNK); docs/adr/0008-encryption-at-rest.md Decision 1

Uploaded audio is decoded from memory. It goes into the encrypted visit folder as it is processed.

engine/os-app/src/lib.rs import_bytes ('Decoded from memory: the upload never touches the disk unencrypted'); docs/plans/M1.md item 10

The team and patient files are read and written only through the encryption module. They use the same data key as the visits.

engine/os-engine/src/users.rs (crate::vault); engine/os-engine/src/patients.rs; docs/plans/M1.md item 11

The key lives in Windows Credential Manager, macOS Keychain or Linux Secret Service. Where no keychain is available, such as over a remote connection, a key file readable only by the user account is used, and Settings says which is in use.

engine/os-engine/src/vault.rs (KeySource, FILE_WARNING); docs/adr/0008-encryption-at-rest.md Decision 2; apps/desktop/src/screens/Settings.tsx Encryption

Settings shows the recovery key on request, to print or keep in a password manager, and it can be imported on another computer. Import refuses to replace a different key unless asked, and uninstallers warn to save it before deleting data.

engine/os-engine/src/vault.rs (recovery_key, import_key); engine/os-cli/src/main.rs KeyCommand; docs/adr/0008-encryption-at-rest.md Decision 3; install/README.md

Settings lists visits saved before encryption with Encrypt them now, which rewrites every file in place. Old plain files stay readable until then.

engine/os-engine/src/vault.rs (encrypt_folder; test folders_encrypt_in_place); engine/os-cli/src/sessions.rs; engine/os-server/src/lib.rs /api/encryption/encrypt-existing; docs/adr/0008 Decision 4

Audio is decrypted into memory for playback, and all clinical reads and writes go through one encryption module. A test guards that no visit file goes around it.

docs/adr/0008-encryption-at-rest.md Decision 5 and Consequences; apps/desktop/src/engine.ts audioUrl

The command openbark key forget deletes the key from the keychain and the key file, after a confirmation flag. The visits can then be opened only with the recovery key.

engine/os-engine/src/vault.rs (forget; test forgetting_removes_the_key_file); engine/os-cli/src/main.rs KeyCommand::Forget

Tests cover round trips, a wrong key failing, files bound to their names and audio encrypted as it streams. A saved visit is checked to leave nothing readable on disk.

engine/os-engine/src/vault.rs tests (small_files_round_trip_and_are_bound_to_their_name, another_key_cannot_read); engine/os-engine/src/session.rs test encrypted_sessions_round_trip_with_nothing_plain_on_disk

Patient records hold only the animal's name, family name, species and timestamps. There is no medical history or client contact information.

docs/adr/0011-patients-and-visits.md Context and Decision 1; engine/os-engine/src/patients.rs

A dialog stays until 'I understand, and I'll get consent from clients before recording' is ticked. It can be shown again from Settings.

apps/desktop/src/components/ConsentNotice.tsx; packages/ui/src/Sheet.test.tsx 'a notice that needs an answer ignores Escape until answered'; docs/guide/getting-started.md

When switched on, the clinic sets its rule (all parties or one party), a script to read and the method, and each consent is saved with who confirmed it and when. Consent is taken before recording or importing starts, clinician-only consent is refused under an all-parties rule, and 'Client declined' means recording never begins.

engine/os-engine/src/session.rs (ConsentRule, ConsentMethod, Consent::check); apps/desktop/src/components/ConsentStep.tsx; ConsentStep.test.tsx; apps/desktop/src/screens/Recorder.tsx declineConsent; docs/plans/M1.md item 7

Import opens the same consent panel before the file is read. The consent is checked against the clinic's rule and saved with the visit.

apps/desktop/src/screens/Recorder.tsx (consentFor 'import'); engine/os-app/src/lib.rs import_source; docs/design/STATUS.md

The guide says PDFs and copied text are the only way clinical text leaves OpenBark unencrypted. They should be kept as carefully as any record.

docs/guide/documents.md (last paragraph)

The accepted design is opt-in and off by default, encrypted on the device with keys the server never holds, and carries transcripts and notes only: recordings never leave the device that recorded them. It could be self-hosted. It hasn't been built yet.

docs/adr/0017-accounts-and-encrypted-sync.md; docs/adr/0005-optional-cloud-sync.md; docs/network.md 'Planned'

A passphrase protecting the data key can be added as an option. Per-user keys come with Clinic Hub sign-in.

docs/adr/0008-encryption-at-rest.md Alternatives and Consequences

One row per animal shows a species icon, visit count, last visit type and date. The list filters by animal or family name.

apps/desktop/src/screens/Patients.tsx; docs/adr/0011-patients-and-visits.md; apps/desktop/e2e/patients.mjs

Each visit shows its type icon, reason, date, length and a status written in words (Transcribed, Draft, Signed). New visit opens the Recorder with the patient filled in.

apps/desktop/src/screens/PatientDetail.tsx; docs/adr/0011-patients-and-visits.md

Visits link by animal and family name, ignoring case, spacing and accents, and older visits link themselves the first time patients are listed. A multi-pet visit appears under every animal in it.

engine/os-engine/src/patients.rs (match_key, find_or_create; test records_are_found_by_name_and_family_whatever_the_spelling); docs/adr/0011 Decisions 2 and 3

A search box suggests up to 6 matching patients with species and visit count, and choosing one fills the name, family name and species. Typing a new name makes a new patient.

apps/desktop/src/components/PatientPicker.tsx; docs/adr/0011-patients-and-visits.md Decision 5

Patient name, family name and reason for visit are time-stamped when entered and when changed. Editing a patient doesn't alter past visits.

apps/desktop/src/screens/PatientDetail.tsx save(); engine/os-engine/src/session.rs (PatientInfo, set_patient); docs/adr/0011 Decision 4

They reach the model marked as entered by the clinic and not evidence. Species decides which species-only headings appear and is never taken from the recording.

engine/os-engine/src/session.rs prompt_context; engine/os-engine/src/note.rs user_message

Time, patient, reason, template, length, drafts and status. It works by keyboard, and Enter opens a visit.

apps/desktop/src/screens/Encounters.tsx; apps/desktop/src/screens/Patients.tsx

A button beside each visit on the patient page drafts it again from the same recording, as the same type when a draft went wrong or as another type. Earlier drafts are kept, and signed notes stay final with addenda for anything new.

apps/desktop/src/components/ReprocessSheet.tsx; apps/desktop/src/screens/PatientDetail.tsx; docs/guide/recording.md 'Drafting a visit again'; apps/desktop/e2e/patients.mjs; commit 3888f20

Dog, Cat, Horse, Cattle, Sheep or goat, Pig, Bird, Reptile, Rabbit, Small rodent and Ferret. Six have their own icon (dog, cat, horse, cow, bird, rabbit), and pigs, reptiles, ferrets and unknown species show a paw.

apps/desktop/src/species.ts; apps/desktop/src/templateIcons.tsx SPECIES_ICONS; apps/desktop/src/species.test.ts

This is named as a later change if same-name merging becomes a problem. Deleting patients needs its own careful flow.

docs/adr/0011-patients-and-visits.md Consequences

16 record templates, from SOAP, New consult and Recheck to Dental, Surgery and anaesthesia, Oncology, Exotics, Equine, Production animal and Euthanasia and quality of life, plus 4 client documents. Tests check that each one loads, validates and prints to PDF with all its headings.

packages/templates/*/template.yaml (20 folders); engine/os-engine/src/template.rs test every_builtin_loads_and_its_empty_note_validates; engine/os-engine/src/pdf.rs test every_builtin_template_renders_a_pdf_with_its_headings

9 scripted specialty consults found 91 of 98 facts (93%) with 0 invented numbers. Dental 10/10, spay 14/16, hit by car 13/13, equine lameness 11/11, mastitis 9/11, bearded dragon 10/10, atopic dog 8/9, lymphoma 10/11 and quality of life 6/7.

docs/eval/M2.md item 3; docs/plans/M2.md item 3; packages/eval/fixtures/scripts/*.yaml

A template is headings and subheadings holding bullet points, a text box, measurements with units or medications, with optional plain instructions. The structure the model fills is generated from them, so every team template gets the same evidence links, 'Not discussed' handling and checks.

engine/os-engine/src/template.rs (generate_schema, PartKind; test team_template_from_headings_only); docs/adr/0006-templates-from-headings.md Decisions 1 and 2; docs/templates.md

The text box writes connected sentences shown as a paragraph. Each sentence still cites its own transcript lines, so the evidence link works inside it.

engine/os-engine/src/template.rs PartKind::Text; commit 6408787

A structure list with drag handles and Move up and Move down buttons sits beside instructions per heading, icon, level of detail and audience. Delete asks for confirmation, and unsaved changes prompt before leaving.

apps/desktop/src/screens/Templates.tsx Builder; docs/design/STATUS.md 'Done' section 5 Template builder

The preview updates 300 ms after typing stops and checks the template. A second tab shows the exact instructions the model will receive.

apps/desktop/src/screens/Templates.tsx preview tabs; docs/templates.md

The model lists the example's headings in the clinic's own words and picks a content kind and instruction for each, and the example (up to 20,000 characters) is never saved. On three test notes it found 4/4, 9/9 and 8/8 headings, copied nothing about the patient and recognised a discharge letter as a client document.

engine/os-engine/src/from_example.rs (MAX_EXAMPLE; tests a_draft_becomes_a_valid_template_and_mends_gaps, a_client_draft_is_a_client_document); apps/desktop/src/components/ExampleSheet.tsx; docs/eval/M2.md item 5

Team headings get one of 17 example sets matched on the title (dental, lameness, anaesthesia, vaccines, withdrawal times and more), and 8 whole-note examples cover practice types from small-animal GP to shelter and referral. Examples reach the model only when the vet uses one.

apps/desktop/src/promptExamples.ts (BY_TITLE, NOTE_EXAMPLES); apps/desktop/src/promptExamples.test.ts; engine/os-engine/src/template.rs test heading_examples_load_but_stay_out_of_the_prompt

Any heading can be limited to one of 11 species groups, to dogs and cats, to farm animals or to exotics, and other species' headings are removed before drafting. The same consult entered as a cat and as a dog gave only the right headings.

engine/os-engine/src/template.rs (SPECIES, for_species; test headings_for_other_species_are_left_out_of_prompt_and_schema); apps/desktop/src/species.ts SHOW_FOR; docs/eval/M2.md item 4

Concise asks for the fewest words that keep every fact, and thorough includes every relevant detail said and nothing unsaid. Record templates are signed by a veterinarian, and client templates follow the signed note and are never signed.

engine/os-engine/src/template.rs Detail; engine/os-engine/src/note.rs rules; apps/desktop/src/screens/Templates.tsx builder-meta

Save as a standard stores an Ask request against a heading or the whole note, and later drafts follow it as a team standard. Each standard shows who added it and when, and can be removed.

engine/os-engine/src/template_store.rs (add_standard; test standards_for_builtin_and_team_templates); engine/os-engine/src/note.rs test standards_reach_the_prompt; apps/desktop/src/components/RefinePanel.tsx; docs/adr/0006 Decision 7

Try on a visit lists the last 20 visits. It drafts the chosen one with the template.

apps/desktop/src/screens/Templates.tsx tryTemplate; docs/templates.md

Each template is a template.yaml file in its own folder, and each saved change raises its version. Built-ins are read-only (Duplicate to change them), and a new template never takes over an existing one.

engine/os-engine/src/template_store.rs (tests builtins_are_read_only, save_list_version_and_delete); docs/adr/0006 Decision 4; docs/templates.md 'Files'

Each draft saves the template it was written with, standards included. Changing the template later doesn't touch it.

engine/os-engine/src/session.rs run_template; docs/adr/0006-templates-from-headings.md Decision 5

Templates can hold up to 30 sections, 20 subheadings, 30 fields, 80 headings in all and 1,500 characters of text. A hand-written structure that doesn't match the headings is refused.

engine/os-engine/src/template.rs (MAX_SECTIONS to MAX_TEXT; tests helpful_errors_for_unfinished_templates, mismatched_handwritten_schema_is_rejected)

A picker offers 39 icons, such as a stethoscope, tooth, horse and syringe. Record notes default to a clipboard and client documents to a speech bubble.

apps/desktop/src/templateIcons.tsx TEMPLATE_ICONS; apps/desktop/src/screens/Templates.tsx IconPicker

The plan is a chart with canine and feline Triadan numbering for missing, fractured and mobile teeth, periodontal stage, extraction and resorption. Each finding would link to its transcript line and appear in the note and PDF.

docs/plans/M2.md item 7 ('Not started'); docs/design/DESIGN.md section 5 Dental chart

The plan reads scanned pages on the computer and links every summary item to its source page. History would count as context and never as evidence.

docs/plans/M2.md item 8 and 'Decisions for the product owner'

An audio-capable model would run as an experiment. It stays only if it comes within 10% of Parakeet's word error rate.

docs/spikes/S2-native-linking.md configuration C; the product brief section 4.4

Optional structured data alongside the written note is one of the product brief's goals.

the product brief section 2.3 item 8

Discharge instructions, client summary, estimate explanation and euthanasia aftercare open from buttons under the note, with the evidence link, Copy, Save PDF and Draft again. They are never signed and are labelled 'Draft for the client: check it before handing it over.'

engine/os-engine/src/note.rs (Reference, reference_message); apps/desktop/src/components/DocumentSheet.tsx; docs/plans/M1.md item 9; docs/guide/documents.md

Estimate explanation copies prices exactly and never adds them up. Euthanasia aftercare covers arrangements and support in gentle words.

packages/templates/estimate-explanation/template.yaml; packages/templates/euthanasia-aftercare/template.yaml; docs/guide/documents.md

Client documents give medications exactly as in the note and write doses in digits, after a test discharge listed 'Marapitin' and doses in words. They go through the same invented-number check, with numbers the vet entered counting as supported.

engine/os-engine/src/faithfulness.rs test numbers_the_vet_entered_are_supported_in_client_documents; docs/eval/M2.md 'Client documents'

Each document's language, any of the 7 note languages, is chosen in its panel. A French discharge from an English consult kept the medication and every number unchanged.

apps/desktop/src/components/DocumentSheet.tsx doc-language; docs/plans/M2.md item 6; docs/eval/M2.md 'Client documents'

PDFs carry the clinic's letterhead, visit details, the signature or a clear draft line, every heading, addenda and page numbers, on Letter or A4. The same output comes out on every platform, and citations are left out so it reads cleanly.

engine/os-engine/src/pdf.rs (note_pdf, PageSize; tests every_builtin_template_renders_a_pdf_with_its_headings, long_notes_flow_onto_more_pages); docs/plans/M1.md item 12

Copy as plain text (most practice systems), formatted text or Markdown, with an optional header, addenda and transcript line numbers. Each section has its own Copy button.

apps/desktop/src/copyFormats.ts; apps/desktop/src/copyFormats.test.ts; docs/guide/documents.md; docs/plans/M1.md item 12

Planned: a browser extension for web-based practice systems, an ezyVet connector, clipboard presets for desktop systems, and HL7v2 and FHIR R4 exports.

the product brief sections 4.6 and 6 (M3)

Veterinarians can do everything, technicians record, draft and edit, and reception records and enters patient details; the engine enforces these roles. PINs of 4 to 8 digits are stored as salted hashes with 100,000 rounds, and the first member must be a veterinarian.

engine/os-engine/src/users.rs (Role, ROUNDS; test team_members_roles_and_pins); apps/desktop/src/components/TeamSettings.tsx; docs/plans/M1.md item 11

A 'Who's using OpenBark?' picker with Switch sits at the bottom of the sidebar. The last veterinarian can't be removed while others remain.

apps/desktop/src/components/UserPicker.tsx; engine/os-engine/src/users.rs

Settings has 'Change my PIN'. A veterinarian resets someone else's PIN by removing and re-adding them.

apps/desktop/src/components/TeamSettings.tsx ('Change my PIN'); engine/os-app/src/lib.rs set_user_pin; docs/guide/team-and-security.md

Each visit stores who recorded it, and each draft who drafted, edited or asked for it. Each signature and addendum records who made it, with their role.

docs/plans/M1.md item 11; apps/desktop/src/engine.ts setActor; docs/guide/team-and-security.md

The user guide says roles keep an honest record on a shared computer and aren't a security boundary against someone with access to the computer's account. Clinic-wide accounts and audit come with the Clinic Hub.

docs/guide/team-and-security.md; docs/plans/M1.md item 11

With no team set up, the app runs for one person. Your name in Settings is saved with each note you sign.

docs/guide/team-and-security.md; docs/guide/getting-started.md

Planned: discovery on the clinic network, pairing by QR code, encrypted connections, a shared clinic store, an audit log and an admin dashboard. It would stay off unless Hub mode is switched on.

the product brief sections 4.7 and 6 (M4); docs/network.md 'Planned' M4

Parakeet TDT v3 recognises the language automatically. Nothing needs to be chosen before recording.

docs/languages.md; docs/plans/M1.md 'Extra'

Notes can be written in English, French, Spanish, German, Portuguese, Italian or Dutch, with drug names, doses, units and numbers kept exactly as said. When the note's language differs from the consult's, the word-level check is switched off and the number check still runs.

engine/os-engine/src/note.rs (NOTE_LANGUAGES; test note_language_is_asked_for_except_english); engine/os-engine/src/faithfulness.rs check_opts; docs/languages.md

Each of the four translations holds 745 strings, and the app starts in the browser's language when available, falling back to English. The translations were machine-generated and are waiting for review by native-speaking veterinary staff.

packages/i18n/i18n-{de,es,fr,pt}.json (745 keys each); apps/desktop/src/i18n.ts UI_LANGUAGES; scripts/i18n-keys.py; docs/languages.md

Labels come in English, French, Spanish, German and Portuguese. Anything missing falls back to English.

engine/os-engine/src/pdf.rs (LABELS; test labels_follow_the_language)

Tests check that every translation keeps the English placeholders and that English fallback works. The build scripts check placeholders too.

apps/desktop/src/i18n.test.ts; scripts/i18n-keys.py

Headings come from the template, so built-in headings stay in English whatever the note language. A French clinic can duplicate a template and rename its headings.

docs/languages.md 'Note language'; docs/eval/M2.md 'Client documents'; docs/plans/M2.md item 6

Spoken-number reading and vocabulary hints work in English only. Numbers said in words in other languages may be flagged even when right.

docs/languages.md

About 6 GB (voice detection, Parakeet, the speaker models and Gemma 4 E4B) downloads smallest first, with one progress bar, the computer kept awake and a resumable Try again. The second recogniser for number checks is a separate download on the Models screen.

apps/desktop/src/components/SetupPanel.tsx; SetupPanel.test.tsx 'downloads every missing model, smallest first, then reports ready'; engine/os-engine/src/models.rs required_status; docs/plans/M1.md item 8

Each model shows its use, size, licence and Fits, Tight or Won't fit, estimating its size plus about 25% against 90% of graphics memory, or against 70% of (RAM minus 4 GB) without a graphics card. Fits means at most 80% of that budget and Tight at most 105%, and models that won't fit can't be downloaded.

engine/os-models/src/hub.rs fit (test fit_uses_gpu_memory_first); apps/desktop/src/screens/Models.tsx; docs/guide/getting-started.md

Names become chips (12B, E4B, it, QAT, Q4_K_M, GGUF, MLX and others) with one-line meanings, a 9-term legend and a recommended size for this computer's memory. As a rule of thumb, E2B suits older laptops, E4B most computers and 12B cards with 10 GB or more, or Macs with 24 GB or more.

apps/desktop/src/modelGuide.ts; apps/desktop/src/components/ModelGuide.tsx; apps/desktop/src/modelGuide.test.ts; docs/guide/getting-started.md

Search lists GGUF models, most downloaded first, pinned to their current version. Permissive licences such as Apache-2.0 or MIT download in one click, and restrictive or unstated ones must be accepted first.

engine/os-models/src/hub.rs (PERMISSIVE; tests restricted_licence_needs_acceptance, licences_are_classified); apps/desktop/src/screens/Models.tsx HubBrowser; docs/network.md R4

A model with a restrictive or unstated licence found in the Hugging Face browser, such as one under Google's HAI-DEF terms, must be accepted before download and is kept out of the built-in list. A test checks the built-in list has only redistributable licences, with attribution in the licence notice file.

engine/os-models/src/hub.rs test licences_are_classified; engine/os-models/src/catalog.rs (line 160 and test only_redistributable_licenses_in_builtin_catalog); NOTICE

10 built-in models are each pinned to a Hugging Face revision with licence and attribution, and OpenBark's own downloader resumes and checks size, SHA-256 and free disk space. It was written because hf-hub 1.0 dropped resumable downloads.

engine/os-models/catalog.json (10 models); engine/os-models/src/download.rs; engine/os-models/src/store.rs test sha256_of_known_content; docs/plans/M0.md change 4

An 'In use' panel picks the note model (Gemma 4 E4B by default) and shows the transcription and speaker models. Any .gguf model file can be used as well as the built-in ones.

apps/desktop/src/screens/Models.tsx; engine/os-engine/src/models.rs; engine/os-cli/src/main.rs --llm

On a Mac, the Hugging Face browser also lists MLX builds with a chip and a filter and points to the GGUF build that runs on the Mac's graphics chip today. Windows and Linux never list MLX builds.

docs/adr/0009-mlx-on-mac.md Decision 1; apps/desktop/src/screens/Models.tsx mlx-chip; docs/network.md R4

The installers draft with Metal on Apple silicon and Vulkan on Windows and Linux, including NVIDIA cards, and fall back to the processor. CUDA is used only when the browser version is built from source on a computer with NVIDIA's toolkit.

.github/workflows/release.yml (features: vulkan, metal); install/install.ps1 and install/install.sh (nvcc check); engine/os-llm/Cargo.toml

Measured on an RTX 4080, the whole 8.5-minute import took 152 s on the processor and 43 s with the pack, and the number check kept pace. The pack downloads about 1.9 GB of runtime and 5.7 GB of full-precision models, resumably and checked, and Remove takes it away again.

docs/adr/0014-gpu-speech-recognition.md (table and Consequences); engine/os-models/src/gpu_pack.rs; apps/desktop/src/components/GpuCard.tsx; commit 3888f20

After install and at each start, a separate process loads both models on the graphics card and transcribes a second of silence, and only a clean exit turns the card on. A failure shows Try again, and it was tested with every CUDA folder removed from the system path.

docs/adr/0014-gpu-speech-recognition.md Decision 4 and Consequences; engine/os-asr/src/lib.rs

Full precision is used only when CUDA really runs, an app update that changes the runtime is noticed, and download progress survives leaving the screen. A library of the same name that was there first is kept and put back.

commit 3888f20 ('GPU state'); engine/os-models/src/gpu_pack.rs; apps/desktop/src/components/GpuCard.tsx

The compact speech models stay on the processor (Parakeet took 43 s on the RTX 4080 against 28 s on 6 processor threads), and the full-precision builds use the graphics card. Whisper turbo at full precision took 166 s on the processor and 22 s on the card for 5.5 minutes of audio.

engine/os-asr/src/lib.rs provider selection; docs/adr/0014-gpu-speech-recognition.md table

OPENBARK_ASR_PROVIDER (cpu, cuda or coreml) overrides the automatic choice. Core ML is accepted but hasn't been measured.

engine/os-asr/src/lib.rs asr_provider; docs/adr/0014-gpu-speech-recognition.md Decisions 5 and 6

Exactly one copy of llama.cpp's engine and at most one ONNX Runtime go into each program, checked in CI on Linux and macOS. whisper-rs was ruled out after it corrupted memory with a second copy.

scripts/ci/check-symbols.sh; docs/adr/0001-inference-libraries.md; docs/spikes/S2-native-linking.md; docs/versions.md 'Deliberately excluded'

Each model's own chat template, stored in its file, is used to talk to it. There are no hard-coded turn markers.

engine/os-llm/src/chat_template.rs

openbark probe reports memory, graphics card and processor features, and openbark bench measures time to first word, words per second and peak memory for each step. scripts/bench.sh runs a warm-up first and saves the results per computer and date.

engine/os-cli/src/main.rs (Probe, Bench); engine/os-cli/src/probe.rs; scripts/bench.sh

Core ML on the Mac hasn't been measured, and Linux CUDA needs its own pins and a test machine.

docs/adr/0014-gpu-speech-recognition.md Decision 6

This comes only after measuring llama.cpp on Metal against MLX for Gemma 4 E4B and 12B on the test consults. Until then the app says MLX models need this engine.

docs/adr/0009-mlx-on-mac.md Decisions 2 and 3; apps/desktop/src/screens/Models.tsx

Planned: separate slots for transcription, notes, fast edits and speakers, profiles such as 'Laptop, balanced', and an optional OpenAI-compatible server. It would be off by default, clearly labelled and never a silent fallback.

the product brief section 4.3; docs/network.md 'Planned'

On a desktop with an RTX 4080 graphics card, a 9.6-minute test consult played in real time had its transcript complete 0.0 s after stop and its E4B note saved 13.1 s after stop, against a 30 s target. The same consult from a file took 76.8 s with E4B and 115.1 s with 12B on a shared graphics card.

docs/perf/M0.md 'Live recording' and stage tables; docs/perf/results/rtx4080-win11-20261017/

Reading the recording, Transcribing (minutes of audio done out of the total), Checking numbers with the second recogniser and Saving tick off under one bar that only moves forward, with an 'About n minutes left' estimate. The same board appears after you stop a live recording, and in the browser version uploading and in-browser conversion show as steps too.

apps/desktop/src/components/ProgressBoard.tsx; apps/desktop/src/components/ProcessingBar.tsx; engine/os-engine/src/live.rs Stage; apps/desktop/e2e/import-progress.mjs

When the second recogniser isn't installed, its step is marked skipped with 'Not installed: the Models screen can add it'. Skipped steps get their own icon, separate from finished ones.

apps/desktop/src/components/ProcessingBar.tsx (state 'skipped'); apps/desktop/src/components/ProgressBoard.tsx

The board shows Loading the note model (only for the first draft after opening OpenBark), Reading the transcript with its line count, Writing the note with each heading ticked in turn, and Checking every number against the transcript. It shows the time so far and how long the last draft of this visit took.

apps/desktop/src/components/DraftProgress.tsx (DraftBoard); engine/os-engine/src/live.rs Stage (LoadModel, ReadTranscript, Write, Verify); engine/os-app/src/lib.rs load_llm_with_progress; apps/desktop/e2e/draft-board.mjs

The board names the template being used and says the current draft stays until the new one is ready, with earlier drafts kept. For a multi-pet visit it names the animal being drafted, such as Animal 1 of 2.

apps/desktop/src/screens/Review.tsx (noteBoard, note-under-redraft, petRound)

A compact board sits inside the Ask panel while one heading is redrafted, and the client document panel shows a board with each heading of the handout. Step changes are announced to screen readers.

apps/desktop/src/components/RefinePanel.tsx (board); apps/desktop/src/components/DocumentSheet.tsx (board); apps/desktop/src/components/ProgressBoard.tsx

The note structure is checked one word at a time and fully only when a word breaks it, which took E4B from 20.7 to between 45 and 58 tokens a second. Full checking was about 6 times slower with no gain in quality.

engine/os-llm/src/llama.rs; docs/perf/M0.md fixes table; docs/eval/M1.md finding 1

On 8.5 minutes of audio, 2 threads took 56 s, 4 took 34 s, 6 took 28 s, 8 took 39 s and 16 took 92 s. The main recogniser now uses a third of the processor (2 to 6 threads) and the second up to 8.

engine/os-asr/src/lib.rs (asr_threads, second_threads); docs/adr/0014-gpu-speech-recognition.md Context and Decision 1

On an RTX 4080, E4B read a 2,590-token prompt in 0.64 s and wrote 58 tokens a second with 3.4 GB peak memory, and 12B wrote 22 tokens a second with 7.2 GB. The graphics card was shared with a game, so these are treated as upper bounds.

docs/perf/M0.md; docs/perf/results/rtx4080-win11-20261017/

The target is a 10-minute consult drafted in 60 s or less, benchmarked on E4B and 12B. The Apple silicon run is still to do.

docs/runbooks/macos.md step 3; docs/perf/M0.md 'Pending'

A rerun on an idle graphics card, the Apple silicon benchmark, and the macOS disk image and uninstaller check are listed as pending.

docs/perf/M0.md 'Pending'; docs/runbooks/macos.md steps 3 and 5

A desktop app built and tested on Windows, with macOS and Linux versions built but not yet tried on real machines. openbark serve runs the browser version locally with the same screens. After a folder change or speech pack install, the browser version offers Restart now and the desktop app restarts itself.

docs/adr/0004-monorepo-and-tooling.md; apps/desktop/src/engine.ts; docs/network.md R3; docs/adr/0013 Decision 7; docs/adr/0014 Decision 3

A per-user wizard in English, French, Spanish, German or Portuguese installs the program apart from the clinic's data. Uninstall is in the Start menu, and a newer setup updates in place.

docs/adr/0012-point-and-click-installers.md Decision 1; apps/desktop/src-tauri/windows/installer.nsi; install/README.md

A silent install, an update in place and a silent uninstall were run, and the 13.9 GB data folder was byte-for-byte unchanged afterwards. The delete-data path waits for a separate test machine, since the development PC holds real data.

docs/adr/0012-point-and-click-installers.md Consequences

The 'Delete the application data' box is unticked by default and needs a second Yes or No that defaults to No. Silent and update uninstalls never delete data, and the script uninstaller asks you to type a confirmation word first.

docs/adr/0012-point-and-click-installers.md Decision 2; install/README.md

After the app has closed, the Windows uninstaller deletes exactly the files listed in the pack's manifest. An update leaves them in place.

apps/desktop/src-tauri/windows/hooks.nsh; docs/adr/0014-gpu-speech-recognition.md Consequences; commit 3888f20

The image holds OpenBark, an Applications shortcut and an Uninstall OpenBark app that offers Keep my data (the default) or Delete my data with a second confirmation. The uninstaller's paths were tested with stand-in dialogs, and the real image is waiting for a test on a Mac.

scripts/macos-dmg.sh; install/macos/Uninstall OpenBark.app; docs/adr/0012 Decision 3; docs/runbooks/macos.md step 5

Packages appear in the app menu, and removing them keeps data in ~/.local/share/OpenBark. They are built by the release workflow and are waiting for a hands-on test.

docs/adr/0012-point-and-click-installers.md Decision 4 and Consequences; .github/workflows/release.yml; install/README.md

A version tag builds the Windows setup, the macOS disk image with its uninstaller, and the Linux .deb, .rpm and AppImage. The build fails if any installer is missing, and it can sign once certificates exist.

.github/workflows/release.yml; scripts/macos-dmg.sh

Double-click Install and Uninstall scripts build the browser version from source, choose the graphics option automatically and share the desktop app's data folder. CI checks that the .sh and .command scripts parse.

install/install.ps1; install/install.sh; install/README.md; .github/workflows/ci.yml 'Install scripts parse' (bash -n on install/*.sh and install/*.command)

Microsoft's WebView2 is downloaded only on a computer without it. The macOS image and Linux packages make no network calls.

docs/network.md; docs/adr/0012-point-and-click-installers.md Decision 1

Code signing and Apple notarisation wait on buying certificates. Until then the Mac app shows Open Anyway, and the release workflow can sign once certificates exist.

docs/adr/0012-point-and-click-installers.md Decisions 3 and 6

The iPhone app is designed: recording and transcription run on the phone, and drafting stays on computers. A test of background recording on the phone is designed with pass and fail criteria. No phone app has been built or tested yet.

docs/adr/0018-iphone-app.md; docs/plans/M3.md; docs/spikes/S1-mobile-audio-and-inference.md

A browser test and an installable web app are scheduled for a later milestone (M5).

docs/plans/M0.md item 6 (S3); the product brief section 6 (M5)

Settings shows each folder with its size and free space, and Change folder uses the system picker, or a small folder browser in the browser version. You can move what's there, use a folder as it is, or start empty.

apps/desktop/src/components/StorageSection.tsx; apps/desktop/src/components/ChangeFolderSheet.tsx; docs/adr/0013-choose-where-data-is-kept.md Decisions 1, 2 and 5

The check shows the exact folder and free space and warns about OneDrive, Dropbox, Google Drive or iCloud Drive folders and removable or network drives. It refuses the current folder, overlapping folders, folders inside the app's own data folder and folders OpenBark can't write to.

engine/os-models/src/locations.rs (synced_by); docs/adr/0013 Decision 3; commit 3888f20 ('Folders inside the app's data folder can't be chosen')

Visits stay encrypted wherever they are kept, and the key stays on the computer. The sync service keeps copies it can't open.

docs/adr/0013-choose-where-data-is-kept.md Decision 3 and Consequences; docs/adr/0008-encryption-at-rest.md

A chosen folder that already holds other things gets an 'OpenBark visits' or 'OpenBark models' folder inside it. A folder counts as OpenBark's only when everything in it is OpenBark's, so a move never sweeps up other files.

docs/adr/0013 Decision 4; commit 3888f20 ('A folder only counts as OpenBark's when everything in it is ours')

On the same drive files are renamed instantly; across drives each is copied, checked and only then removed, with a progress bar, and a clash stops the move before anything changes. A failed copy is undone, and moves are refused while recording.

engine/os-models/src/locations.rs (move_tree and tests); apps/desktop/e2e/storage.mjs; docs/adr/0013 Decision 5

Imports, drafts, signing, edits, patient changes, downloads and recordings each hold a ticket, and a folder change is refused while any of them is writing. Late requests can't write to the old folder, and a move is put back if the new choice can't be saved.

commit 3888f20 ('Data safety: a work gate'); engine/os-app/src/lib.rs

OPENBARK_MODELS_DIR, OPENBARK_SESSIONS_DIR and command-line options override the setting. Settings then shows 'Set by ...'.

docs/adr/0013-choose-where-data-is-kept.md Decision 6

Data lives in the system's own app-data folder, apart from the program. Uninstallers never delete folders the clinic chose elsewhere.

install/README.md 'Your data, and the recovery key'; docs/adr/0013 Consequences

Each visit folder holds the visit's details, the audio, the transcript and numbered drafts, each with its note and template. The models and settings used are recorded too.

engine/os-engine/src/session.rs (save_run; test session_round_trip_with_runs); docs/plans/M0.md decision 8

Every visit folder keeps the audio as an encrypted 16 kHz WAV, whatever format was imported.

commit 86d8e1b ('session folders always keep a 16 kHz WAV for playback'); engine/os-engine/src/vault.rs

The brief's default of deleting audio at signing was changed so recordings are kept with their visit. They are removed only when their folder is deleted by hand or the app is uninstalled with its data.

docs/plans/M0.md decision 8 ('Retention changes from the master prompt'); engine/os-app/src/lib.rs (no delete-visit function)

There is no delete button for a visit yet, in the app, the browser version or the command line. An optional auto-delete policy was planned in M0 and hasn't been built.

docs/plans/M0.md decision 8; engine/os-app/src/lib.rs; apps/desktop/src/engine.ts

Show files opens the visit folder in the system file manager. It is available in the desktop app.

apps/desktop/src/screens/Review.tsx; apps/desktop/src/engine.ts canReveal/reveal

The system's own font, gentle spring motion, translucent materials for floating controls only, and grouped panels with rounded corners. Buttons give a small press response.

docs/adr/0010-apple-style-refresh.md; packages/ui/src/spring.ts; packages/ui/src/tokens.css; docs/design/DESIGN.md

Reduced motion swaps springs for short fades and stops the breathing ring, and reduced transparency makes frosted surfaces solid. Increased contrast strengthens borders and text.

packages/ui/src/tokens.css (prefers-reduced-motion, prefers-reduced-transparency, prefers-contrast); packages/ui/src/record.css; docs/adr/0010-apple-style-refresh.md

WCAG 2.2 AA contrast, keyboard paths, visible focus rings, status shown as text as well as colour, and labelled icon buttons. Recording started, draft ready and note signed are announced aloud.

apps/desktop/src/App.tsx aria-live region; apps/desktop/src/components/NoteView.tsx; docs/design/STATUS.md 'Done' section 9

Each progress board names its bar and reads out the current step and its detail. Step changes are announced as they happen.

apps/desktop/src/components/ProgressBoard.tsx (aria-valuetext, announced step changes)

Buttons, inputs and icon buttons are 44px on touch screens, and the Record button grows to 72px. Heading tools are always visible on touch.

packages/ui/src/tokens.css; apps/desktop/src/app.css (pointer: coarse)

A System, Light or Dark switch in Settings follows the system by default. An explicit choice is remembered on the device.

packages/ui/src/ThemeToggle.tsx; packages/ui/src/theme.ts; packages/ui/src/ThemeToggle.test.tsx

The sidebar becomes an icon rail below 1200px and a bottom tab bar below 640px, ready for the phone apps to come. The browser version runs on the same computer only, so phones can't open it today.

apps/desktop/src/app.css media queries; docs/network.md R3; docs/design/STATUS.md 'Done' section 4

On desktop, panels float inset; in narrow windows they become bottom sheets with a grabber that follows the finger and closes on a downward flick. Dialogs scale and fade.

packages/ui/src/Sheet.tsx; packages/ui/src/Sheet.test.tsx; docs/adr/0010-apple-style-refresh.md Sheets row

Geist fonts are bundled under OFL-1.1 as the fallback font, and Phosphor icons are bundled too. There is no emoji anywhere in the interface.

packages/ui/src/tokens.css; packages/ui/src/fonts/OFL.txt; docs/design/STATUS.md 'Done'

Sentence case, buttons named for what they do, and specific error messages. 'Visit' replaced 'encounter' throughout the interface.

docs/design/STATUS.md 'Done' section 8; docs/adr/0011-patients-and-visits.md Decision 6

Tests cover the record button being disabled while starting or stopping and sheets that ignore Escape while work runs. They also check that the theme follows the system and remembers an explicit choice.

packages/ui/src/RecordButton.test.tsx; packages/ui/src/Sheet.test.tsx; packages/ui/src/ThemeToggle.test.tsx

Where to run, downloading models and recording consent. It is listed as not built yet.

docs/design/STATUS.md 'Not yet'; docs/design/DESIGN.md section 6 Onboarding

Getting started, Patients and visits, Recording a consult, Reviewing and signing, Templates, Client documents and PDFs, and Team and security, about 26 MB in all, each with written steps in the app's language. They were recorded on 2026-10-18 before Reprocess, the speech pack card and the progress boards were added, so those aren't shown yet.

apps/desktop/public/help/*.webm (7 files, 26,477,487 bytes); apps/desktop/src/screens/Help.tsx HELP_TOPICS; last changed in commit 4dd018e

A script drives the app against demo data with captions and a visible pointer, playing a test recording as the microphone. Another captures chosen frames to check the videos without a player.

apps/desktop/e2e/help-videos.mjs; apps/desktop/e2e/frames.mjs

Pages cover getting started, recording, review, documents, templates, and team and security. A troubleshooting table explains 12 common messages and what to do.

docs/guide/ (8 pages); docs/guide/troubleshooting.md (12 rows)

The Mac runbook covers setup, building, the 60 s benchmark, the desktop app and the disk image with its uninstaller. The Windows runbook covers the browser version and the desktop app.

docs/runbooks/macos.md; docs/runbooks/windows.md

The videos are recorded by a script, so they can be re-recorded on the current app.

apps/desktop/e2e/help-videos.mjs; commit history of apps/desktop/public/help

openbark eval drafts each synthetic consult and scores expected vitals, doses and phrases, invented numbers (a hard fail), citation errors and, in multi-pet visits, values in the wrong animal's note. Transcripts are cached, so a prompt change reruns only the note.

engine/os-cli/src/eval.rs (tests phrase_matching_is_forgiving_but_not_loose, numbers_are_extracted_plainly); docs/eval/M1.md; docs/eval/M2.md

14 recorded consults, 36 minutes in all, come from 13 scripts listing the expected facts, from canine wellness and feline vomiting to equine, exotics, oncology, production animal and surgery. Each has a reference file with speaker, text and timing.

packages/eval/fixtures/scripts/*.yaml (13); packages/eval/fixtures/audio/*.wav (14, 35.98 minutes) and *.ref.json

A tool renders a script to audio plus its reference using Kokoro-82M (Apache-2.0), with a different voice for each speaker.

tools/fixture-tts/src/main.rs

A SOAP note, feline dental charting by tooth and a cystotomy surgical report, each with its expected headings.

packages/eval/fixtures/example-notes/ (dental, soap, surgery); docs/eval/M2.md item 5

A script matches predicted segments to reference lines. It reports the speakers found and the share of speech given to the right speaker.

packages/eval/score_diarization.py

The command-line transcribe, run, rerun, bench and eval paths use pyannote segmentation 3.0 with WeSpeaker fingerprints, numbering speakers in the order they first speak. The app's own imports use the live speaker tracker instead.

engine/os-cli/src/main.rs; engine/os-cli/src/sessions.rs; engine/os-diar/src/lib.rs (tests); engine/os-engine/src/transcribe.rs test speakers_renumbered_by_first_appearance

Raising the clustering threshold from 0.5 to 0.7 took the speakers found from 6 to the true 2, with 99.7% purity on the feline consult and 99.6% on the three-speaker multi-pet one. A window step of 0.25 instead of 0.1 cut labelling from 37.5 s to 14.9 s with identical purity.

docs/perf/M0.md 'Fixes made during the spike'; packages/eval/score_diarization.py

The wait is the longer of the two, not their sum: about 45 s together instead of about 84 s. The app's imports take the live path and don't use this.

docs/perf/M0.md stage and fixes tables; engine/os-engine/src/transcribe.rs (used by os-cli only)

Linux CI runs transcription and drafting with networking disabled, first checking that huggingface.co can't be reached. It then requires a draft that passes the faithfulness check.

.github/workflows/ci.yml 'Offline end-to-end (M0-2, M0-4, M0-6)'; scripts/ci/e2e-offline.sh

Linux runs formatting, lint with warnings as errors, all tests, the symbol check and the offline test; Windows and macOS build and run the tests. A separate job typechecks and tests the interface.

.github/workflows/ci.yml

Tests cover number reading, word-level checks, the second listen, vocabulary, encryption, templates, PDFs, team, patients, storage moves, licences, the speech pack and the browser version's protections. A snapshot fails if the generated SOAP structure changes.

118 #[test] and 1 #[tokio::test] in engine/ and tools/ (grep -c, 2026-10-18); engine/os-engine/src/template.rs test generated_soap_schema_matches_snapshot

Vitest cases in 14 files cover the note view, sheets, copy formats, prompt examples, translations, species, the model guide, consent, the heading editor, the Ask panel, setup, the transcript, the record button and the theme switch.

apps/desktop/src/**/*.test.ts(x) and packages/ui/src/*.test.tsx (14 files, 43 it/test cases)

Eight Playwright scripts cover screenshots (failing on console errors or sideways scrolling), patients with Reprocess, storage, import progress, the drafting board, a feature showcase, help videos and frames. Each runs against a demo server with its own data.

apps/desktop/e2e/*.mjs (8 scripts)

14 commands: probe, models, transcribe, note, bench, run, rerun, sessions, eval, record, devices, key, templates and serve.

engine/os-cli/src/main.rs enum Command; engine/os-cli/src/{models,sessions,templates,record,probe}.rs

openbark sessions check prints every faithfulness flag on a visit's latest note, and rerun --retranscribe transcribes the saved audio again. record --file --realtime plays a recording through the live pipeline at microphone pace, which is how the 13.1 s figure was measured.

engine/os-cli/src/sessions.rs (SessionsCommand::Check, RerunArgs.retranscribe); engine/os-cli/src/record.rs (file, realtime); docs/perf/M0.md 'Live recording'

One layer holds everything the screens can ask for, and the 47 desktop commands and 43 browser routes are thin wrappers over it. Progress travels as events in both.

engine/os-app/src/lib.rs; apps/desktop/src-tauri/src/lib.rs (47 handlers in generate_handler!); engine/os-server/src/lib.rs (43 routes, excluding a test-only route)

Native and inference libraries and very new releases are pinned to exact versions, ordinary ones use ranges, and lock files fix every resolved version; models are pinned by commit. Packages must be at least 24 hours old and their build scripts are denied unless allowed.

docs/versions.md 'Pinning policy'; Cargo.toml; Cargo.lock (706 packages); pnpm-workspace.yaml (catalog, allowBuilds); docs/adr/0004-monorepo-and-tooling.md (pnpm 11 minimumReleaseAge)

The licence is shown in the Windows wizard, Parakeet's attribution is in the licence notice file, and GPL libraries such as PJSIP aren't bundled. NVIDIA's libraries are fetched with consent and never shipped.

LICENSE; NOTICE; README.md 'License'; docs/versions.md; docs/adr/0007-phone-calls.md; docs/adr/0014-gpu-speech-recognition.md

The source will be public on GitHub under the Apache-2.0 licence, so any clinic or developer can inspect it, build it and improve it.

LICENSE; website/README.md

12 architecture decision records cover inference libraries, tooling, sync, templates, phone calls, encryption, MLX, the design refresh, patients, installers, storage and graphics-card speech. Two test designs, milestone plans M0 to M2 and a list of deliberately excluded dependencies sit beside them.

docs/adr/ (0001 and 0004 to 0014; 0000 is the template); docs/spikes/; docs/plans/M0.md, M1.md, M2.md; docs/versions.md 'Deliberately excluded'

A review by 107 agents raised findings that were each checked by three sceptical agents, and the 30 confirmed by a majority were fixed and re-verified. The fixes cover folder moves, the browser version's protections, speech pack state and uninstall.

commit 3888f20 ('fixes from a 107-agent review'; '30 confirmed by majority of 3 skeptics, all re-verified')

The name lives in one constant plus the desktop app's product name. A formal trademark search is planned before public launch.

docs/adr/0004-monorepo-and-tooling.md; docs/plans/M0.md decision 1