anyscribe staleness audit

21 to 22 October 2026. Repo rishmadaan/anyscribe, starting point v0.16.5 (commit b3cddc1).

The answer: five pull requests were filed from a full audit, every one went through independent review (two reviewers per round, up to four rounds), and all five are merged on main with CI green on each final commit. Nothing reaches people who pip install anyscribe until a release is cut; that, and three dependency decisions, are the only things left for you.

The tile numbers are counts from the audit reports and the review log in this folder. "~120" is my tally of numbered reviewer findings across all rounds; it is an estimate, not a tracked figure.

What was out of date, in plain words

The code moved fast through versions 0.13 to 0.16 (the rename to anyscribe, local files, Groq, the new MCP SDK, the docs pipeline, the login toggle). The words did not keep up. The automatic checks only catch version numbers, unrendered HTML, a missing MCP tool name and a missing changelog heading. None of them checks whether a documented command, flag or JSON shape matches the code. So the drift was invisible until someone compared every sentence with the code. The things that would have hurt a user:

• Commands that fail as documented. anyscribe --clipboard is rejected (it needs transcribe in front). Deleting a transcript by relative path only works from inside the vault. config set workspace_path was shown without a value.
• Scripts that break. The documented --json output shape was flat; the real one is wrapped in success / data / error, so jq '.file' returned nothing.
• The Claude Code skill (the main way people drive anyscribe) told Claude the wrong commands and the wrong result shapes in 39 places, and never said that setting up local transcription does not switch the provider.
• Wrong promises. "Deepgram never chunks" (it splits anything over 25 MB or 30 minutes); "word-level timestamps" from ElevenLabs (anyscribe writes one timestamp per ~30 words); Sarvam returns an English translation, not the original language; --timeout in batch cancels nothing.
• Installers still called the tool scribe and hard-coded a Python 3.12 path.
• Packaging. A breaking release of the menu library (beaupy 4, 15 Oct) was being pulled into every fresh install; the publish workflow skipped checks that normal CI runs; the GitHub Actions in use run on a deprecated Node; the shipped web UI bundled a router version with an open-redirect advisory.
• Developer instructions (CLAUDE.md, AGENTS.md) sent future agents to places that do not exist (a URL regex in the registry, env vars in the wizard) and the file tree was missing 25 files.

The five pull requests

Merge order mattered: #16 before #19, because #19 documents the publish workflow that #16 introduced. That order was kept.

How the review worked, and what it caught

Each round, two fresh reviewers read the same brief and never saw each other's report: a correctness reviewer (OpenAI's gpt-6-astra, through the Codex command line, read-only sandbox, run from a folder outside the repo) and a fit reviewer (Claude Opus 5.5, as a read-only subagent; it runs with this session's instruction files loaded, so "independent" is weaker on that side). I verified every material finding against the code before anyone built on it, then the builder fixed, then a fresh pair re-checked. Round one found 2 to 21 defects per PR on top of the audit; later rounds found the fixes' own gaps (for example a recipe that still routed runs to Deepgram when a saved diarize: true was set). Rounds stopped when both reviewers said good to go, or at the cap of four.

The full record (every brief, every report, the review log with models and verdicts per round) is committed in docs/reviews/2026-10-21-staleness-audit/. On GitHub: docs/reviews/2026-10-21-staleness-audit. The audit's own story is in docs/building/journal/2026-10-21-staleness-audit.md.

What needs you

Each of these is a product or dependency decision. I did not build any of them.

1. Cut a release (recommend 0.16.6). None of this reaches pip install users, and the corrected skill does not refresh on anyone's machine, until a version bump. The CHANGELOG entry is written at release time by the repo's own rule; I can draft it. Cost: nothing new; the existing scripts/release.sh flow.
2. yt-dlp now wants a JavaScript runtime for full YouTube support. Verified on this Mac: with Deno hidden from PATH, yt-dlp still downloads but warns "No supported JavaScript runtime could be found... some formats may be missing." That is degraded, not broken. Options: (a) leave it and document it; (b) depend on yt-dlp[default] (adds a small pure-Python helper package, no runtime) and make anyscribe doctor warn when Deno is missing; (c) also add Deno as a required install. I recommend (b): no new runtime forced on users, and the warning is visible. It adds one Python dependency you can drop again.
3. Python 3.10 reached end of life this month. CI still tests it (3.10, 3.12, 3.14 now). Dropping it is a one-line change in two files and lets some dependencies move forward. I recommend dropping it at the next minor release, not in a patch.
4. A direct starlette>=1.3.1 floor. The web server's HTTP library has known advisories below 1.3.1, and raising the FastAPI floor does not fix that (the reviewer checked). Adding the floor is one line in pyproject.toml; fresh installs already get a new Starlette, so this only protects old environments. Recommend adding it.
5. Landing page prices. The Deepgram card says about $0.0043 per minute while the providers guide says about $0.30 per hour. Both predate this audit and I could not verify the real price from code. Someone should check the vendor's page before the next landing edit.

Not yours to act on: the follow-ups below are mine or any implementer's, and none blocks a release.

Follow-ups I recommend next (small code changes, not done here)

• Batch --timeout does not cancel. The docs now say so honestly; the real fix is to shut the worker pool down without waiting. Then the docs flip back.
• Groq has no language list in the web picker. Adding "groq": WHISPER_LANGUAGES is one line; it is recorded in BACKLOG.
• The web wizard's ElevenLabs card still says "99 languages, word-level timestamps" (React source, needs a rebuild). The server-side copies were fixed in #18.
• Groq with --diarize on a long file shows OpenAI's 25 MB error instead of Groq's own; reorder two checks.
• anyscribe install-skill on a fresh machine prints "already installed" because the startup hook installs first; confusing, cosmetic.
• The web "Test key" button only checks that a key was typed for Groq, Sarvam and OpenRouter (OpenRouter's models endpoint answers without a key). Real validation calls would make the button honest.
• Installer nits declined at review: apt update failure handling and the wording of one failure message.