deploy: wire voice in the container — bind + real onnxruntime 1.26

"voice unavailable" in the web UI: mavweb dials mavend:9100, but the container
mavend.json had no voice block, so mavend never bound 9100 (worked pre-docker
because the host's ~/.config/maven/mavend.json had one). Ported that block:
enabled, bind 0.0.0.0:9100 (not 127.0.0.1 — mavweb is a separate container),
lang ru, stt/tts worker sockets, onnx embedder.

Enabling the embedder surfaced a second bug: the router needs onnxruntime 1.26,
but deps/lib only carries dangling symlinks to it (absolute host paths, not in
the image), so the only libonnxruntime present was piper's 1.14 (copied in) →
"ORT API base: 2", crash loop. Fixed the Dockerfile to ship the real 1.26 .so
and stop copying piper's .so into the shared lib dir (piper finds its own 1.14
via $ORIGIN + exact soname, so TTS is unaffected).

Verified: mavend "onnx embedder loaded (384 dim)", "voice listening on :9100",
stack stable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.dockerignore

@@ -17,7 +17,12 @@ certs
 # heavy deps we don't need in context. We keep only the prebuilt runtime libs
 # (deps/lib, deps/piper) and the headers the CGO build needs.
 deps/go
+# keep the onnxruntime 1.26 runtime lib (the router embedder loads it); the
+# deps/lib symlinks point here. Other onnxruntime dirs (headers etc.) excluded.
 deps/onnxruntime-linux-x64-*
+!deps/onnxruntime-linux-x64-1.26.0
+deps/onnxruntime-linux-x64-1.26.0/*
+!deps/onnxruntime-linux-x64-1.26.0/lib
 deps/whisper.cpp/**
 !deps/whisper.cpp
 !deps/whisper.cpp/ggml

Dockerfile

@@ -51,11 +51,19 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 && \
     rm -rf /var/lib/apt/lists/*
 
-# runtime native libs: whisper/ggml (incl. vulkan), onnxruntime, piper/espeak.
+# runtime native libs: whisper/ggml (incl. vulkan) are real files in deps/lib.
 COPY deps/lib/   /opt/maven/lib/
 COPY deps/piper/ /opt/maven/piper/
-# piper ships its own .so (onnxruntime, espeak, phonemize) — put them on the path too.
-RUN cp -a /opt/maven/piper/*.so* /opt/maven/lib/ 2>/dev/null || true
+# The router embedder needs onnxruntime 1.26, but deps/lib only carries dangling
+# symlinks to it (they point at an absolute HOST path that isn't in the image).
+# Ship the real 1.26 lib and repoint the symlinks. Piper keeps its OWN
+# onnxruntime 1.14 under /opt/maven/piper (found via piper's $ORIGIN runpath +
+# its exact soname libonnxruntime.so.1.14.1) — do NOT copy piper's .so into
+# /opt/maven/lib, that clobbers 1.26 and mavend dies with "ORT API base: 2".
+COPY deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0 /opt/maven/lib/
+RUN cd /opt/maven/lib \
+    && ln -sf libonnxruntime.so.1.26.0 libonnxruntime.so \
+    && ln -sf libonnxruntime.so.1.26.0 libonnxruntime.so.1
 COPY --from=build /out/ /opt/maven/bin/
 
 ENV LD_LIBRARY_PATH=/opt/maven/lib PATH=/opt/maven/bin:$PATH

deploy/mavend.json

@@ -3,5 +3,18 @@
   "db_tmpfs": "/dev/shm/maven-plain.db",
   "db_key_env": "MAVEN_DB_KEY",
   "socket_path": "/run/maven/mavend.sock",
-  "state_dir": "/var/lib/maven"
+  "state_dir": "/var/lib/maven",
+
+  "voice": {
+    "enabled": true,
+    "bind": "0.0.0.0:9100",
+    "lang": "ru",
+    "stt": { "socket": "/run/maven/stt.sock", "lang": "ru" },
+    "tts": { "socket": "/run/maven/tts.sock", "lang": "ru" },
+    "embedder": {
+      "model_path": "/opt/maven/models/embedder/model.onnx",
+      "tokenizer_path": "/opt/maven/models/embedder/tokenizer.json",
+      "lib_path": "/opt/maven/lib/libonnxruntime.so"
+    }
+  }
 }