Security + correctness hardening (brain code review)

- SECURITY: torch.load(weights_only=True) for adapter speaker_embedding.pt and
saved voices — never pickle-execute arbitrary user-supplied HF payloads.
- CJK long-form: sentence splitter now \s* (was \s+, never split 。！？).
- Click-free long-form joins: short edge fades on each chunk before the gap.
- sdpa everywhere; dropped flash-attn auto-select (wrong sm_120 kernels risk).
- LoRA double-apply guard (no nested PeftModel wrappers).
- Voice library under data/ (gitignored; clone prompts are biometric-adjacent).

qvs/audio.py

@@ -36,8 +36,22 @@ def ref_from_gradio(audio) -> Optional[tuple[np.ndarray, int]]:
     return None
 
 
-def concat(wavs: list[np.ndarray], sr: int, gap_s: float = 0.15) -> np.ndarray:
-    """Join chunk waveforms with a short silence between them (long-form)."""
+def _edge_fade(w: np.ndarray, sr: int, ms: float = 8.0) -> np.ndarray:
+    """Linear fade-in/out on the chunk edges so joins into the silence gap don't
+    click (a hard cut from a non-zero sample is a step discontinuity)."""
+    n = min(int(sr * ms / 1000.0), len(w) // 2)
+    if n <= 0:
+        return w
+    w = w.astype(np.float32, copy=True)
+    ramp = np.linspace(0.0, 1.0, n, dtype=np.float32)
+    w[:n] *= ramp
+    w[-n:] *= ramp[::-1]
+    return w
+
+
+def concat(wavs: list[np.ndarray], sr: int, gap_s: float = 0.12, fade_ms: float = 8.0) -> np.ndarray:
+    """Join chunk waveforms with a short silence between them (long-form),
+    edge-fading each chunk so the joins are click-free."""
     if not wavs:
         return np.zeros(0, dtype=np.float32)
     if len(wavs) == 1:
@@ -45,7 +59,7 @@ def concat(wavs: list[np.ndarray], sr: int, gap_s: float = 0.15) -> np.ndarray:
     gap = np.zeros(int(sr * gap_s), dtype=np.float32)
     out: list[np.ndarray] = []
     for i, w in enumerate(wavs):
-        out.append(np.asarray(w, dtype=np.float32))
+        out.append(_edge_fade(np.asarray(w, dtype=np.float32), sr, fade_ms))
         if i != len(wavs) - 1:
             out.append(gap)
     return np.concatenate(out)

qvs/device.py

@@ -9,7 +9,6 @@ path used for reference audio.
 """
 from __future__ import annotations
 
-import functools
 import os
 
 
@@ -52,26 +51,13 @@ def get_dtype():
     return torch.bfloat16
 
 
-@functools.lru_cache(maxsize=1)
-def _flash_attn_available() -> bool:
-    try:
-        import flash_attn  # noqa: F401
-
-        return True
-    except Exception:
-        return False
-
-
 def get_attn_impl(device: str | None = None) -> str:
-    """flash_attention_2 on CUDA when the wheel is present, else sdpa.
-
-    flash-attn is CUDA-only, so MPS always uses sdpa. sdpa is a safe default on
-    CUDA too (just a little slower than flash-attn).
+    """sdpa everywhere (DESIGN D7). flash-attn is deliberately NOT auto-selected:
+    its import can succeed pre-fork on CUDA while the sm_120 (Blackwell) kernels
+    are wrong/untested — a silent-corruption risk for zero fidelity gain. Override
+    only via the explicit QVS_ATTN env for future experiments.
     """
-    dev = device or target_device()
-    if dev == "cuda" and _flash_attn_available():
-        return "flash_attention_2"
-    return "sdpa"
+    return os.environ.get("QVS_ATTN", "sdpa")
 
 
 # ---- optional ZeroGPU decorator ----------------------------------------------

qvs/engine.py

@@ -93,7 +93,9 @@ def free_cache() -> None:
 
 
 # ---- long-form chunking -------------------------------------------------------
-_SENT_SPLIT = re.compile(r"(?<=[.!?。！？…])\s+")
+# \s* (not \s+): CJK sentences have no whitespace after 。！？, so \s+ would never
+# split them and long-form would collapse to one chunk.
+_SENT_SPLIT = re.compile(r"(?<=[.!?。！？…])\s*")
 
 
 def split_sentences(text: str) -> list[str]:

qvs/lora.py

@@ -63,12 +63,16 @@ def load_speaker_embedding(source: str) -> Optional[np.ndarray]:
     path = os.path.join(base, "speaker_embedding.pt")
     if not os.path.exists(path):
         return None
-    obj = torch.load(path, map_location="cpu", weights_only=False)
+    try:
+        # weights_only=True: never pickle-execute an arbitrary user-supplied repo.
+        obj = torch.load(path, map_location="cpu", weights_only=True)
+    except Exception:
+        return None  # refuse rather than fall back to unsafe loading
     if isinstance(obj, dict):
+        if torch.is_tensor(obj.get("embedding")):
+            return obj["embedding"].reshape(-1).float().cpu().numpy()
         for v in obj.values():
-            import torch as _t
-
-            if _t.is_tensor(v):
+            if torch.is_tensor(v):
                 return v.reshape(-1).float().cpu().numpy()
         return None
     if torch.is_tensor(obj):
@@ -104,6 +108,8 @@ class AdapterManager:
     def apply(self, base_model, source: str) -> LoraInfo:
         from peft import PeftModel
 
+        if self._peft is not None:  # never nest PeftModel wrappers — clear any prior adapter first
+            self.unload(base_model)
         adapter_dir = resolve_adapter(source)
         cfg = read_adapter_config(adapter_dir)
         declared = cfg.get("base_model_name_or_path") or ""

qvs/voices.py

@@ -13,7 +13,9 @@ from typing import Optional
 
 import numpy as np
 
-VOICE_DIR = os.environ.get("QVS_VOICE_DIR", "voice_library")
+# Under data/ (gitignored): saved clone prompts are biometric-adjacent and must
+# never be committed to the public repo.
+VOICE_DIR = os.environ.get("QVS_VOICE_DIR", "data/voices")
 
 
 def _ensure_dir() -> str:
@@ -80,7 +82,7 @@ def load_voice(name: str):
     import torch
     from qwen_tts import VoiceClonePromptItem
 
-    payload = torch.load(_path(name), map_location="cpu", weights_only=False)
+    payload = torch.load(_path(name), map_location="cpu", weights_only=True)
     items = []
     for d in payload["items"]:
         ref_code = d.get("ref_code")