[sh1pt-actions-fleet]

Changes

• Default new and existing workers to the TTS and STT roles, installing Piper, Kokoro, and faster-whisper models on first start. Explicit --roles remains the way to choose a smaller role set.
• Skip already-installed speech assets on later starts.
• Limit ONNX and Whisper CPU threads to the worker quota, use faster Whisper decoding, and allow slow speech jobs up to 15 minutes to return.
• Include the existing 0.2.39 equal-price auction rotation so concurrent jobs spread across matching nodes.

Validation

• Workspace build and test suites passed; the core and CLI suites were rerun after the final changes.
• Protocol documentation check passed.
• Real Piper TTS (1.6s), Kokoro TTS (3.1s), and Whisper STT (3.5s) smoke runs passed inside the 2-CPU worker.

[github-actions]

ThreatCrush Security Scan

9 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	apps/web/public/sw.js:21
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:81
MEDIUM	sh-remote-script-execution	scripts/dev-setup.sh:25
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35
MEDIUM	sh-remote-script-execution	scripts/install.sh:162
MEDIUM	sh-remote-script-execution	scripts/install.sh:187
MEDIUM	sh-remote-script-execution	scripts/install.sh:305
MEDIUM	sh-remote-script-execution	scripts/install.sh:322

Snippets are redacted; ThreatCrush never prints matched credential material.