feat(nh3-svos): SVOS voice (app-voice) live — /voice route before Basic auth (lease bearer), unit + quiesce hook; app credentials vaulted

configs/qemu-ga/svos/50-svos

@@ -12,7 +12,7 @@ import tempfile
 import time
 
 SERVICES = ('svos-kernel.service', 'svos-interface.service', 'svos-terminal.service',
-            'svos-knowledge.service', 'svos-postoffice.service')
+            'svos-knowledge.service', 'svos-postoffice.service', 'svos-voice.service')
 
 class Quiesce:
     def __init__(self, directory, *, run=None):

configs/qemu-ga/svos/README.md

@@ -13,3 +13,4 @@
 - 2026-10-07 (a737a06 refresh): `SERVICES` gained `svos-terminal`, `svos-knowledge` and `svos-postoffice` before
   they were started. The hook restores only the units that were active at freeze, so a declared-but-stopped app
   (postoffice until its bridge handle exists) is recorded as inactive and left stopped.
+- 2026-10-08: `svos-voice` added (Prime: voice on), before it started.

configs/qemu-ga/svos/test_quiesce.py

@@ -10,7 +10,8 @@ class QuiesceTests(unittest.TestCase):
   spec=importlib.util.spec_from_loader('svos_quiesce',loader)
   self.module=importlib.util.module_from_spec(spec);spec.loader.exec_module(self.module)
   self.states={'svos-kernel.service':('active','success'),'svos-interface.service':('inactive','success'),
-   'svos-terminal.service':('inactive','success'),'svos-knowledge.service':('inactive','success'),'svos-postoffice.service':('inactive','success')}
+   'svos-terminal.service':('inactive','success'),'svos-knowledge.service':('inactive','success'),'svos-postoffice.service':('inactive','success'),
+   'svos-voice.service':('inactive','success')}
   self.calls=[];self.stop_fail=False;self.start_fail=False;self.dirty_stop=False
   def run(args,**kwargs):
    self.calls.append(args)

configs/svos-apps/svos-voice.service

@@ -0,0 +1,30 @@
+# eshpfi configs/svos-apps/ (infra-ops, 2026-10-07, a737a06 refresh), modelled on svoperatingsystem
+# deployment/nh3-svos/svos-interface.service. The credential is /etc/svos/voice.env (root 0600, SVOS_APP_CREDENTIAL),
+# minted by enrollment on the private kernel listener. Listed in the qemu-ga quiesce hook (configs/qemu-ga/svos/50-svos).
+[Unit]
+Description=SVOS Voice app (app-voice, U12)
+After=svos-kernel.service
+Requires=svos-kernel.service
+ConditionPathExists=/etc/svos/voice.env
+[Service]
+Type=simple
+User=svc-svos
+Group=svc-svos
+UMask=0077
+WorkingDirectory=/var/lib/svos
+EnvironmentFile=/etc/svos/voice.env
+Environment=SVOS_KERNEL_URL=http://127.0.0.1:8400
+Environment=SVOS_DATA_ROOT=/var/lib/svos
+Environment=SVOS_APP_LISTEN=127.0.0.1:8402
+ExecStart=/opt/svos/current/apps-env/bin/svos-voice
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+KillMode=control-group
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ReadWritePaths=/var/lib/svos
+[Install]
+WantedBy=multi-user.target

configs/svos-front/Caddyfile

@@ -65,6 +65,19 @@ https://svos.phasefinal.com:443 {
 			root * /opt/svos/current/static
 			file_server
 		}
+		# Voice (U12, app-voice on 127.0.0.1:8402; Prime 2026-10-08 "voice on"). BEFORE basic_auth on purpose: the browser
+		# calls /voice/* with `Authorization: Bearer <lease secret>` (web/src/lib/voice.ts), minted by a signed kernel open
+		# that itself goes through /api behind Basic auth. Basic auth here would reject the bearer, and the kernel's
+		# Authorization strip below would drop it. The lease IS the auth; the app refuses /voice without it. The /voice
+		# prefix is preserved upstream, Authorization passes untouched, no buffering (streamed audio), cancellation
+		# reaches the listener (client disconnect closes the upstream). Engines stay private (fv-ml1 :8300, irv-ml1 :8198).
+		@voice path /voice /voice/*
+		handle @voice {
+			reverse_proxy 127.0.0.1:8402 {
+				flush_interval -1
+			}
+		}
+
 		# Previous release's hashed assets across a rollout (svos-dev 2026-10-05): open workers restore evicted inventory
 		# credential-free. Generated by the same tool: a matcher + handle rooted in THAT release's static dir, or
 		# comments only when there is no previous release.