feat(dictate): support configurable ASR backends

services/dictate/tests/test_systemd_units.py

@@ -1,12 +1,21 @@
+import hashlib
 from pathlib import Path
 import unittest
 
+from pi_dictate_service.startup import EXPECTED_BASE_UNIT_SHA256
+
 
 REPOSITORY_ROOT = Path(__file__).resolve().parents[3]
 UNIT_DIR = REPOSITORY_ROOT / "systemd/user"
 
 
 class SystemdUnitTests(unittest.TestCase):
+    def test_startup_hash_matches_the_checked_in_service_unit(self) -> None:
+        self.assertEqual(
+            hashlib.sha256((UNIT_DIR / "pi-dictate.service").read_bytes()).hexdigest(),
+            EXPECTED_BASE_UNIT_SHA256,
+        )
+
     def test_socket_unit_owns_the_exact_private_runtime_path(self) -> None:
         socket_unit = (UNIT_DIR / "pi-dictate.socket").read_text(encoding="utf-8")
         self.assertIn("ListenStream=%t/pi-dictate.sock", socket_unit)
@@ -24,11 +33,20 @@ class SystemdUnitTests(unittest.TestCase):
             "TRANSFORMERS_OFFLINE=1",
             "TRITON_CACHE_DIR=/tmp/pi-dictate-triton",
             "NUMBA_CACHE_DIR=/tmp/pi-dictate-numba",
+            "TimeoutStopSec=5s",
             "LimitCORE=0",
             "MemorySwapMax=0",
             "ProtectSystem=strict",
-            "ProtectHome=read-only",
+            "ProtectHome=tmpfs",
+            "BindReadOnlyPaths=%h/.local/share/pi-dictate",
+            "BindReadOnlyPaths=%h/.local/share/uv/python",
+            "BindReadOnlyPaths=%h/.config/pi-dictate/config.json",
+            "BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service",
+            "BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service.d",
+            "BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.socket",
+            "BindReadOnlyPaths=%t/pipewire-0",
             "RestrictAddressFamilies=AF_UNIX",
+            "SystemCallFilter=~bind listen",
             "IPAddressDeny=any",
         ):
             self.assertIn(expected, service_unit)