feat(llm): speech-to-text for patient voice input via OpenRouter (+ offline mock)

POST /api/v1/me/{token}/stt takes a 16 kHz mono WAV and only transcribes: the patient checks the text and sends it as an ordinary message, so safety, scrub() and the LLM gateway still apply. Audio is neither stored nor logged. OpenRouter STT is synthetic-data only (ADR-014); SaluteSpeech for the pilot is #121. Refs #116 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-31 11:19:55 +03:00
parent 4b166cf488
commit 7443b61974
9 changed files with 430 additions and 4 deletions
@@ -17,17 +17,19 @@ issued by the server instead of handing out the pseudonymous token itself.

 import logging
 import secrets
+import time as monotonic_time
 from collections import defaultdict
 from datetime import date, datetime, time, timedelta
 from typing import Any, Literal
 from zoneinfo import ZoneInfo

-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, ConfigDict, Field
 from sqlalchemy import select

 from app.api import fixtures
 from app.api.schemas import DemoPersona
+from app.config import get_settings
 from app.core import clock
 from app.core.instrument_catalog import Catalog, catalog
 from app.core.intake_questions import DIARY_KINDS
@@ -42,6 +44,7 @@ from app.db.identity import TOKEN_LEN
 from app.db.intake import QuestionnaireRecord
 from app.db.session import get_clinical_session, get_identity_session
 from app.integrations.emias_mock import CODE_MAX_LEN, EmiasMock
+from app.llm.stt import InvalidAudio, SttError, SttNoSpeech, get_stt, wav_seconds
 from app.services import anonymous_care

 log = logging.getLogger(__name__)
@@ -219,7 +222,56 @@ async def auth_anonymous(body: AnonymousIn | None = None) -> AuthOut:
@router.get("/patient/capabilities")
 async def patient_capabilities() -> dict[str, bool]:
    """Expose availability without leaking clinical policy or server configuration."""
-    return {"primary_screening": intake_enabled()}
+    return {"primary_screening": intake_enabled(), "voice_input": get_stt(get_settings()) is not None}
+
+
+class SttOut(BaseModel):
+    text: str
+    provider: str
+
+
+# 16 kHz mono 16-bit PCM = 32 000 bytes/s, + header slack.
+_WAV_BYTES_PER_SECOND = 32_000
+
+
+@router.post("/me/{token}/stt", response_model=SttOut)
+async def transcribe_voice(token: str, request: Request) -> SttOut:
+    """Voice → text for the patient to check and edit (#116). Body: raw `audio/wav`, 16 kHz mono.
+
+    Only transcribes: nothing is written to the dialog and the agent is not called — the patient sends the
+    checked text as an ordinary message, where safety and `scrub()` apply. The audio is neither stored nor logged.
+    """
+    settings = get_settings()
+    stt = get_stt(settings)
+    if stt is None:
+        raise HTTPException(404, "voice input is off")
+    async with get_clinical_session() as s:
+        if await repo.get_profile(s, token) is None:
+            raise HTTPException(404, "patient not found")
+    max_bytes = (settings.stt_max_seconds + 2) * _WAV_BYTES_PER_SECOND + 4096
+    declared = request.headers.get("content-length")
+    if declared and declared.isdigit() and int(declared) > max_bytes:
+        raise HTTPException(413, "recording too long")
+    audio = await request.body()
+    if len(audio) > max_bytes:
+        raise HTTPException(413, "recording too long")
+    try:
+        seconds = wav_seconds(audio)
+    except InvalidAudio as exc:
+        raise HTTPException(415, "expected audio/wav") from exc
+    if seconds > settings.stt_max_seconds + 1:
+        raise HTTPException(413, "recording too long")
+    started = monotonic_time.monotonic()  # latency only, not domain time (that is app.core.clock)
+    try:
+        text = await stt.transcribe(audio, "wav")
+    except SttNoSpeech as exc:
+        raise HTTPException(422, "no speech recognised") from exc
+    except SttError as exc:
+        log.warning("stt failed tok=%s provider=%s: %s", token[:6], stt.name, exc)
+        raise HTTPException(503, "speech recognition unavailable") from exc
+    ms = int((monotonic_time.monotonic() - started) * 1000)
+    log.info("stt tok=%s provider=%s secs=%.1f ms=%d chars=%d", token[:6], stt.name, seconds, ms, len(text))
+    return SttOut(text=text, provider=stt.name)


@router.post("/me/{token}/doctor/connect")
@@ -42,6 +42,13 @@ class Settings(BaseSettings):
    chat_agent_timeout_s: float = 25.0
    chat_agent_max_steps: int = 5

+    # Voice input (#116): speech-to-text for the patient's messages. `auto` = OpenRouter if a key is set, else mock.
+    # OpenRouter STT is synthetic data only (ADR-014): the audio leaves the RF and cannot be scrubbed.
+    stt_provider: Literal["auto", "off", "mock", "openrouter"] = "auto"
+    stt_model: str = "google/gemini-2.5-flash"  # needs audio input
+    stt_timeout_s: float = 30.0
+    stt_max_seconds: int = Field(default=60, ge=5, le=300)
+
    # Telegram is used only for the prototype on synthetic data; prod channel is MAX / Gosuslugi.
    tg_bot_token: str = ""
    # The RF server reaches api.telegram.org over IPv6 only; docker has IPv4 only → go through a proxy (http/socks).
@@ -0,0 +1,160 @@
+"""Speech-to-text for the patient's voice input (#116, slide 11: record → check the text → send).
+
+The service only transcribes: the text goes back to the patient to check and edit, and reaches the dialog as an
+ordinary text message — safety, `scrub()` and the LLM gateway apply there. Audio is never stored or logged.
+
+* `OpenRouterSTT` — an audio-capable model via OpenRouter `/chat/completions` (`input_audio`). TEMPORARY, synthetic
+  data only (ADR-014): voice is personal data that `scrub()` cannot depersonalise, and OpenRouter is a foreign
+  service (152-FZ). Real patients need an RF provider (SaluteSpeech, #121) behind the same `SpeechToText` contract.
+* `MockSTT` — offline, returns a fixed synthetic phrase (ADR-004: the demo works without network).
+"""
+
+import asyncio
+import base64
+import logging
+import struct
+from functools import lru_cache
+from pathlib import Path
+from typing import Protocol
+
+import httpx
+import yaml
+from pydantic import BaseModel
+
+from app.config import Settings
+
+log = logging.getLogger(__name__)
+
+_RETRY_STATUSES = {429, 500, 502, 503, 504}
+_ATTEMPTS = 3
+
+
+class SttTexts(BaseModel):
+    system: str
+    user: str
+    silence_marker: str
+    mock_transcript: str
+
+
+@lru_cache
+def load_texts(path: Path | None = None) -> SttTexts:
+    from app.config import get_settings
+
+    path = path or get_settings().config_dir / "texts" / "stt.yaml"
+    return SttTexts.model_validate(yaml.safe_load(path.read_text(encoding="utf-8")))
+
+
+class SttError(RuntimeError):
+    """The provider failed (network, HTTP error, bad response)."""
+
+
+class SttNoSpeech(SttError):
+    """The recording holds no recognisable speech."""
+
+
+class InvalidAudio(ValueError):
+    pass
+
+
+def wav_seconds(audio: bytes) -> float:
+    """Duration of a PCM WAV file; raises `InvalidAudio` for anything else."""
+    if len(audio) < 44 or audio[:4] != b"RIFF" or audio[8:12] != b"WAVE":
+        raise InvalidAudio("not a WAV file")
+    pos, byte_rate = 12, 0
+    while pos + 8 <= len(audio):
+        chunk_id, size = audio[pos : pos + 4], struct.unpack_from("<I", audio, pos + 4)[0]
+        if chunk_id == b"fmt " and size >= 16:
+            byte_rate = struct.unpack_from("<I", audio, pos + 16)[0]
+        elif chunk_id == b"data":
+            if not byte_rate:
+                break
+            return min(size, len(audio) - pos - 8) / byte_rate
+        pos += 8 + size + (size & 1)
+    raise InvalidAudio("malformed WAV")
+
+
+class SpeechToText(Protocol):
+    name: str
+
+    async def transcribe(self, audio: bytes, fmt: str = "wav") -> str: ...
+
+
+class MockSTT:
+    name = "mock"
+
+    async def transcribe(self, audio: bytes, fmt: str = "wav") -> str:
+        return load_texts().mock_transcript
+
+
+class OpenRouterSTT:
+    name = "openrouter"
+
+    def __init__(self, settings: Settings, client: httpx.AsyncClient | None = None) -> None:
+        self._key = settings.openrouter_api_key
+        self._model = settings.stt_model
+        self._url = settings.openrouter_base_url.rstrip("/") + "/chat/completions"
+        self._timeout = settings.stt_timeout_s
+        self._proxy = settings.openrouter_proxy_url or None
+        self._client = client
+
+    async def transcribe(self, audio: bytes, fmt: str = "wav") -> str:
+        texts = load_texts()
+        content = [
+            {"type": "text", "text": texts.user},
+            {"type": "input_audio", "input_audio": {"data": base64.b64encode(audio).decode(), "format": fmt}},
+        ]
+        body = {
+            "model": self._model,
+            "messages": [{"role": "system", "content": texts.system}, {"role": "user", "content": content}],
+            "temperature": 0,
+            "max_tokens": 800,
+        }
+        data = await self._post(body)
+        try:
+            text = (data["choices"][0]["message"]["content"] or "").strip()
+        except (KeyError, IndexError, TypeError) as exc:
+            raise SttError("bad response") from exc
+        text = text.strip("«»\"' \n")
+        if not text or text.lower() == texts.silence_marker.lower():
+            raise SttNoSpeech("no speech")
+        return text
+
+    async def _post(self, body: dict) -> dict:
+        headers = {"Authorization": f"Bearer {self._key}", "X-Title": "PTSRaiAgent prototype (synthetic data)"}
+        for attempt in range(_ATTEMPTS):
+            try:
+                if self._client is not None:
+                    resp = await self._client.post(self._url, json=body, headers=headers, timeout=self._timeout)
+                else:
+                    async with httpx.AsyncClient(timeout=self._timeout, proxy=self._proxy) as client:
+                        resp = await client.post(self._url, json=body, headers=headers)
+            except httpx.HTTPError as exc:
+                if attempt + 1 == _ATTEMPTS:
+                    raise SttError(type(exc).__name__) from exc
+                await asyncio.sleep(0.5 * 2**attempt)
+                continue
+            if resp.status_code in _RETRY_STATUSES and attempt + 1 < _ATTEMPTS:
+                log.warning("stt openrouter http %s, retry %d", resp.status_code, attempt + 1)
+                await asyncio.sleep(0.5 * 2**attempt)
+                continue
+            if resp.status_code != 200:
+                # Provider error bodies carry no patient data — log the message to make failures diagnosable.
+                log.error("stt openrouter http %s: %s", resp.status_code, resp.text[:200])
+                raise SttError(f"http {resp.status_code}")
+            try:
+                return resp.json()
+            except ValueError as exc:
+                raise SttError("bad json") from exc
+        raise SttError("retries exhausted")
+
+
+def get_stt(settings: Settings) -> SpeechToText | None:
+    """The configured provider; `None` = voice input is off. `auto` = OpenRouter if a key is set, else mock."""
+    mode = settings.stt_provider
+    if mode == "auto":
+        mode = "openrouter" if settings.openrouter_api_key else "mock"
+    if mode == "openrouter":
+        return OpenRouterSTT(settings) if settings.openrouter_api_key else None
+    if mode == "mock":
+        return MockSTT()
+    return None