studio-engine 0.119.1 → 0.120.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 327664450f0c0b1de0a01b75231b2f2fa470ab66d865f3b585eb55281e3318d3
-  data.tar.gz: 0634a4d5e519e0a808558cd3341d192ab7c0162373ad46d376e6cd6753a1f432
+  metadata.gz: 602092c1d8ddd3ce61cb6f192162ea1cae13af1313769742fa88d5f954327232
+  data.tar.gz: 6a2ca70d13097ebfe23e52c7b14d551b430f92ef07da51bed9c1b80f1baa522c
 SHA512:
-  metadata.gz: 75317c813644a660eb548ddd2ee7727371b7df3520867ef0037449a7d68bb57a72c5e0c87eb767b56426459f627809f17dd2dacd8d56baf9ffd41226337c7368
-  data.tar.gz: ba9ee2c20c1edf6659186b89a30a44a80c5cc3e4c4afd3b44910bdc934922c82d0250995996746b8ecc12976690d6ca5f8880dcae6f1caab7a149471a8808307
+  metadata.gz: 5e8a55b6e21888c67df80712062478ae4b635a4a95d2e062771ab00570f5cd9ba417601e05ab39f14791be16619c3780799d965d2c02491952386001dd6b6f18
+  data.tar.gz: 7abef1323bfc65d590af8c5cef094d7136471e6f0356703b6a1fd73c1bb3137d76b70051b500f6ddab24c4d092d3812f3ae82e766123dbf728c15b28dbd410a4

data/CHANGELOG.md

@@ -4,6 +4,26 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.120.0 — 2026-10-30
+
+### Added
+
+- **Voice profile on `/profile`, opt-in.** `config.voice_profile = true` adds a
+  "Your voice" row: the signed-in user reads three phrases while a live level
+  meter shows the microphone being heard, silent takes are refused, and each
+  take becomes a speaker embedding on the device (WeSpeaker ResNet34 int8 from
+  Hugging Face at a pinned revision, through transformers.js 3.7.6 from
+  jsDelivr). Save posts only the three vectors (`POST /profile/voice`); the
+  server averages them onto the user's own record. Re-record and Delete
+  (`DELETE /profile/voice`) are on the row, with a consent line saying what is
+  stored. A new host-table migration, `add_voice_profile_to_users`, adds
+  `voice_embedding`, `voice_embedding_model` and `voice_embedding_updated_at`.
+  `Studio::VoiceMatch.identify(embedding, among:, model:)` returns the closest
+  user at or above 0.6 cosine, else nil, comparing only voices from the same
+  model. `config.voice_embedder = "fake"` is the test embedder
+  (`window.studioFakeVoice`). docs/VOICE_PROFILE.md lists the CSP and privacy
+  changes a host makes first.
+
 ## 0.119.1 — 2026-10-29
 
 ### Fixed

data/README.md

@@ -45,6 +45,7 @@ resolved.
 - **Transactional emails**: `Studio::EmailCatalog` — every email an app sends, its type, a live preview, and its banner — plus the shared `/admin/emails` page. Every app inherits the standard emails and their artwork on day one, and can register its own workflows and upload its own banners. See [Transactional emails](#transactional-emails).
 - **Site footer**: `<%= studio_site_footer %>` in the layout renders the public site's footer. It is on by default: with nothing configured it prints the app's name, logo and the legal links the app has routes for, and no address. `config.site_footer` declares the app's own facts (brand, social profiles, link columns, an address with a live map, legal links), every part optional; `config.site_footer_address` adds a location in one setting; `config.site_footer = false` turns the footer off. Leaflet is vendored and served by the engine. See [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md).
 - **Booking**: a simple scheduler on Google Calendar appointment schedules, with or without the footer. With `config.booking_url`, `studio_booking_frame` embeds Google's booking page, `studio_booking_link` opens it in a popup, and `config.draw_booking_routes = true` draws `/schedule` (or name the app's own page with `config.booking_path`). `config.booking_crop` crops the frame to the slot picker at rest, from numbers `bin/booking-crop-measure` reads off the app's own schedule. See [`docs/BOOKING.md`](docs/BOOKING.md).
+- **Voice profile**: an opt-in row on `/profile` ("Set up your voice"): the person reads three phrases with a live level meter, their device turns each take into a speaker embedding (WeSpeaker via transformers.js), and only the averaged vector is saved on their user, never audio. `Studio::VoiceMatch.identify(embedding, among: User.all, model:)` answers who is speaking. Turn it on with `config.voice_profile = true` after installing the migration. See [`docs/VOICE_PROFILE.md`](docs/VOICE_PROFILE.md).
 - **Surveys**: define a survey in app code (`config/surveys/*.rb`, `Studio.define_survey`) with six question types — emoji scale, 1–5 rating, single and multiple choice, short and long text — and the engine serves it at `/surveys/:slug`: one question per screen, autosave, resume, keyboard shortcuts, and a no-JavaScript fallback. `config.on_survey_completed` and `config.survey_ref_resolver` let the app fire its own goals and attribute email arrivals. An admin panel at `/admin/surveys` breaks results down per question and exports CSV. Opt in with `config.draw_survey_routes = true` and `config.draw_admin_survey_routes = true`. See [`docs/SURVEYS.md`](docs/SURVEYS.md).
 
 ## Tailwind

data/app/controllers/studio/profiles_controller.rb

@@ -202,8 +202,64 @@ module Studio
       end
     end
 
+    # POST /profile/voice — save (or replace) the signed-in user's voice.
+    #
+    # THE BODY IS VECTORS, NEVER AUDIO. The page records three phrases, turns
+    # each into a speaker embedding on the device (studio/voice_profile) and
+    # drops the takes; this receives `voice[model]` and `voice[embeddings]` (a
+    # JSON array of Studio::VoiceMatch::TAKES vectors) and averages them here.
+    #
+    # The model must be the one this app runs (Studio.voice_embedder), so a page
+    # cannot save vectors from an embedder the matcher would never compare, and
+    # the test embedder can never be saved where the real one runs. A take that
+    # embedded to all zeros (silence the browser let through) is refused by
+    # VoiceMatch.enrol.
+    #
+    # Answers JSON for the page's fetch and redirects for anything else.
+    def save_voice
+      return voice_refused("This app has no voice profile to set up.", :not_found) unless row_rendered?(:voice)
+
+      embedder = Studio.voice_embedder.to_s
+      model = params.dig(:voice, :model).to_s
+      unless model == Studio::VoiceMatch.model_id(embedder)
+        return voice_refused("That voice came from a different model. Reload the page and record again.")
+      end
+
+      vector = Studio::VoiceMatch.enrol(params.dig(:voice, :embeddings), size: Studio::VoiceMatch.size(embedder))
+      if vector.nil?
+        return voice_refused("We couldn't use those recordings. Read all three phrases again.")
+      end
+
+      rescue_and_log(target: current_user) do
+        current_user.update!(voice_embedding: vector, voice_embedding_model: model,
+                             voice_embedding_updated_at: Time.current)
+        respond_to do |format|
+          format.json { render json: { url: profile_path }, status: :ok }
+          format.any  { redirect_to profile_path, notice: "Your voice is set up.", status: :see_other }
+        end
+      end
+    end
+
+    # DELETE /profile/voice — remove the stored voice entirely: the vector, its
+    # model and its date. Nothing of it is kept.
+    def delete_voice
+      return unsupported("voice profile") unless row_rendered?(:voice)
+
+      rescue_and_log(target: current_user) do
+        current_user.update!(voice_embedding: nil, voice_embedding_model: nil, voice_embedding_updated_at: nil)
+        redirect_to profile_path, notice: "Your voice was deleted.", status: :see_other
+      end
+    end
+
     private
 
+    def voice_refused(message, status = :unprocessable_entity)
+      respond_to do |format|
+        format.json { render json: { error: message }, status: status }
+        format.any  { redirect_to profile_path, alert: message, status: :see_other }
+      end
+    end
+
     # Tell the host, and NEVER let it break the subscription.
     #
     # The subscription is the durable fact; the reaction is not. turf-monster's

data/app/javascript/studio/controllers/voice_profile_controller.js

@@ -0,0 +1,20 @@
+// voice-profile: the voice row on /profile (studio/profiles/_voice_section), on
+// the engine's Stimulus application (studio/stimulus registers it lazily, the
+// first time a page renders the row). It sits on the row's wrapper:
+//
+//   <div data-studio-controller="voice-profile" data-voice-save-url="/profile/voice" ...>
+//
+// The recording, the meter, the embedding and the save are studio/voice_profile.
+import { Controller } from "@hotwired/stimulus"
+import { mountVoiceProfile } from "studio/voice_profile"
+
+export default class extends Controller {
+  connect() {
+    this.voice = mountVoiceProfile(this.element)
+  }
+
+  disconnect() {
+    if (this.voice) this.voice.destroy()
+    this.voice = null
+  }
+}

data/app/javascript/studio/stimulus.js

@@ -57,7 +57,9 @@ export const schema = {
 // knowledge transcript: a recording whose controller failed still plays from
 // its own controls, and its page says that click-to-play did not load. So is the
 // agent chat: a chat whose controller failed still renders, and its section
-// carries data-studio-controller-failed="agent-chat".
+// carries data-studio-controller-failed="agent-chat". So is the voice row: a
+// row whose controller failed keeps its saved state and its Delete, and says
+// that recording did not load (data-studio-controller-failed="voice-profile").
 export const LAZY = {
   "board": () => import("studio/controllers/board_controller"),
   "geo-settings": () => import("studio/controllers/geo_settings_controller"),
@@ -67,7 +69,8 @@ export const LAZY = {
   "footer-map": () => import("studio/controllers/footer_map_controller"),
   "survey": () => import("studio/controllers/survey_controller"),
   "knowledge-transcript": () => import("studio/controllers/knowledge_transcript_controller"),
-  "agent-chat": () => import("studio/controllers/agent_chat_controller")
+  "agent-chat": () => import("studio/controllers/agent_chat_controller"),
+  "voice-profile": () => import("studio/controllers/voice_profile_controller")
 }
 
 export const application = Application.start(document.documentElement, schema)

data/app/javascript/studio/voice_profile.js

@@ -0,0 +1,529 @@
+// studio/voice_profile: the voice row on /profile (studio/profiles/_voice_section).
+// The signed-in person reads three short phrases; each take is recorded, turned
+// into a speaker embedding ON THIS DEVICE, and thrown away. Save posts only the
+// vectors; the server averages them into one voice on the person's own record
+// (Studio::VoiceMatch). No audio leaves the device for this.
+//
+//   <section data-studio-controller="voice-profile" data-voice-state="idle"
+//            data-voice-save-url="/profile/voice" data-voice-embedder='{"name":"wespeaker",...}'>
+//
+// The controller (studio/controllers/voice_profile_controller) calls
+// mountVoiceProfile(element) and destroys it on disconnect. Ported from
+// Voicebox's voice setup (McRitchie-Studio/voicebox#10), where the embedder, the
+// level meter and the silence threshold were measured.
+//
+// STATES, on data-voice-state: idle (the summary) -> ready (setup open, phrase
+// n waiting) -> recording -> thinking -> ready ... -> complete -> saving. Each
+// phrase carries data-phrase-state: waiting, current or done. A take the meter
+// heard nothing in is refused (data-voice-last-take="silent") and the phrase
+// stays current. While recording, --studio-voice-level (0..1) on the root drives
+// the ring around the record button.
+//
+// EMBEDDERS, named by the page (Studio::VoiceMatch.browser_config):
+//   wespeaker  WeSpeaker ResNet34 (VoxCeleb), int8, through transformers.js on
+//              onnxruntime-web, from jsDelivr and Hugging Face at a pinned
+//              revision. Loaded when the setup opens; the browser caches it.
+//   fake       Tests only: a fixed vector per voice name (window.studioFakeVoice),
+//              because Chrome's fake microphone cannot play chosen audio.
+//
+// It imports nothing statically; the model runtime is a dynamic import of the
+// transformers.js URL the page names (Studio::VoiceMatch::TRANSFORMERS_URL), made
+// only once someone opens the setup. test/javascript/voice_profile.test.mjs
+// loads it as a data: module.
+
+// The model hears 16 kHz mono; a take is cut to its first MAX_SECONDS.
+export const SAMPLE_RATE = 16000
+export const MAX_SECONDS = 10
+
+// The loudest frame (RMS, 0..1) a take must reach to count as heard: 0.01 is
+// -40 dBFS. A muted microphone sits at 0, a quiet room near 0.002-0.006, and
+// speech at arm's length peaks well above 0.05.
+export const SILENCE_RMS = 0.01
+
+// A phrase is about four seconds; the take stops itself after TAKE_MS.
+export const TAKE_MS = 6000
+
+const MIME_CANDIDATES = [
+  "audio/webm;codecs=opus",
+  "audio/webm",
+  "audio/mp4;codecs=mp4a.40.2",
+  "audio/mp4",
+  "audio/ogg;codecs=opus"
+]
+
+export const COPY = {
+  idle: ["", ""],
+  ready: ["Record phrase {n}", "Tap Record, then read phrase {n} out loud."],
+  recording: ["Stop", "Listening... read phrase {n}, then tap Stop."],
+  thinking: ["One moment...", "Learning your voice..."],
+  complete: ["All three done", "All three done. Tap Save."],
+  saving: ["Saving...", "Saving..."]
+}
+
+export const MESSAGES = {
+  silent: "I couldn't hear that one. Check your microphone and read it again.",
+  failed: "That one didn't work. Tap Record and read it again.",
+  denied: "Allow the microphone to set up your voice.",
+  unsupported: "This browser can't record here. Try Safari or Chrome.",
+  network: "We couldn't reach the server. Tap Save again.",
+  notSaved: "That didn't save. Tap Save again."
+}
+
+export class SilentTakeError extends Error {}
+
+export function rootMeanSquare(samples) {
+  if (!samples || samples.length === 0) return 0
+  let sum = 0
+  for (let i = 0; i < samples.length; i++) sum += samples[i] * samples[i]
+  return Math.sqrt(sum / samples.length)
+}
+
+// The loudest 50 ms window's RMS, 0..1, at 16 kHz.
+export function peakWindowRms(samples, windowSize = 800) {
+  let peak = 0
+  if (!samples) return peak
+  for (let start = 0; start < samples.length; start += windowSize) {
+    const end = Math.min(samples.length, start + windowSize)
+    let sum = 0
+    for (let i = start; i < end; i++) sum += samples[i] * samples[i]
+    const rms = Math.sqrt(sum / Math.max(1, end - start))
+    if (rms > peak) peak = rms
+  }
+  return peak
+}
+
+// The meter's reading, 0..1: logarithmic from -40 dBFS to -10 dBFS, where
+// speech lives.
+export function meterLevel(rms) {
+  if (!(rms > 0)) return 0
+  const db = 20 * Math.log10(rms)
+  return Math.min(1, Math.max(0, (db + 40) / 30))
+}
+
+// Heard, unless the meter measured the take and it stayed under SILENCE_RMS. A
+// take the meter never measured (no Web Audio, a context that never ran) is
+// let through, and the embedder's own check on the decoded samples decides.
+export function takeWasHeard(peakRms, framesMeasured) {
+  if (!framesMeasured) return true
+  return peakRms >= SILENCE_RMS
+}
+
+export function pickMimeType(isTypeSupported) {
+  if (typeof isTypeSupported !== "function") return ""
+  return MIME_CANDIDATES.find((type) => {
+    try { return isTypeSupported(type) } catch (_) { return false }
+  }) || ""
+}
+
+// The words for a state, with {n} the phrase being read (1-based).
+export function copyFor(state, step) {
+  const [button, status] = COPY[state] || ["Try again", ""]
+  const n = String(step + 1)
+  return { button: button.replace("{n}", n), status: status.replace("{n}", n) }
+}
+
+// Each phrase's state for a step (how many takes are kept).
+export function phraseStates(total, step) {
+  return Array.from({ length: total }, (_, i) => (i < step ? "done" : (i === step ? "current" : "waiting")))
+}
+
+// mulberry32: a small seeded generator, so the fake's vectors are the same in
+// every run and every browser.
+function seededRandom(seed) {
+  let a = seed >>> 0
+  return () => {
+    a = (a + 0x6D2B79F5) >>> 0
+    let t = a
+    t = Math.imul(t ^ (t >>> 15), t | 1)
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61)
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296
+  }
+}
+
+function hashString(text) {
+  let h = 2166136261
+  for (let i = 0; i < text.length; i++) {
+    h ^= text.charCodeAt(i)
+    h = Math.imul(h, 16777619)
+  }
+  return h >>> 0
+}
+
+// The fake embedder's vector for a voice name: the same name always gives the
+// same vector, and two names give nearly unrelated ones (cosine near 0).
+export function fakeVector(voice, size = 256) {
+  const random = seededRandom(hashString(String(voice)))
+  return Array.from({ length: size }, () => random() * 2 - 1)
+}
+
+// A recorded Blob as 16 kHz mono floats: the browser decodes the container
+// (webm/opus or mp4/aac) and resamples it while rendering offline.
+export async function decodeToMono16k(blob, win = globalThis) {
+  const bytes = await blob.arrayBuffer()
+  const Offline = win.OfflineAudioContext || win.webkitOfflineAudioContext
+  const probe = new Offline(1, 1, SAMPLE_RATE)
+  const decoded = await probe.decodeAudioData(bytes)
+  const seconds = Math.min(decoded.duration, MAX_SECONDS)
+  const length = Math.max(1, Math.ceil(seconds * SAMPLE_RATE))
+  const offline = new Offline(1, length, SAMPLE_RATE)
+  const source = offline.createBufferSource()
+  source.buffer = decoded
+  source.connect(offline.destination) // a mono destination downmixes
+  source.start()
+  const rendered = await offline.startRendering()
+  return rendered.getChannelData(0)
+}
+
+class WespeakerEmbedder {
+  constructor(config) { this.config = config }
+
+  get name() { return this.config.name }
+  get id() { return this.config.id }
+
+  // Starts the download (runtime ~4.3 MB, model ~6.7 MB, cached after the first
+  // time) without waiting for it. Safe to call more than once; a failed load
+  // can be retried.
+  warm() {
+    if (!this.loading) {
+      this.loading = (async () => {
+        // By full URL (the page's config.runtime), never an importmap pin.
+        const transformers = await import(this.config.runtime)
+        // The model comes from the Hugging Face hub at a pinned revision, never
+        // from this app's own /models path.
+        transformers.env.allowLocalModels = false
+        const options = { revision: this.config.revision }
+        const [processor, model] = await Promise.all([
+          transformers.AutoProcessor.from_pretrained(this.config.model, options),
+          transformers.AutoModel.from_pretrained(this.config.model, { ...options, dtype: this.config.dtype })
+        ])
+        return { processor, model }
+      })()
+      this.loading.catch(() => { this.loading = null })
+    }
+    return this.loading
+  }
+
+  async embed(blob) {
+    const samples = await decodeToMono16k(blob)
+    if (peakWindowRms(samples) < SILENCE_RMS) throw new SilentTakeError("silent take")
+    const { processor, model } = await this.warm()
+    const inputs = await processor(samples)
+    const output = await model(inputs)
+    const tensor = output.embeddings || output.last_hidden_state || Object.values(output)[0]
+    return Array.from(tensor.data)
+  }
+}
+
+class FakeEmbedder {
+  constructor(config, win) {
+    this.config = config
+    this.win = win
+  }
+
+  get name() { return this.config.name }
+  get id() { return this.config.id }
+
+  warm() { return Promise.resolve() }
+
+  async embed(blob) {
+    if (!blob || blob.size === 0) throw new SilentTakeError("empty take")
+    return fakeVector((this.win && this.win.studioFakeVoice) || "default", this.config.size)
+  }
+}
+
+const EMBEDDERS = { wespeaker: WespeakerEmbedder, fake: FakeEmbedder }
+
+// The embedder the page names, or null when it names none this script knows.
+export function embedderFor(config, win = globalThis) {
+  if (!config || !config.name) return null
+  const Embedder = EMBEDDERS[config.name]
+  return Embedder ? new Embedder(config, win) : null
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text || "null") } catch (_) { return null }
+}
+
+// Binds the voice row. Returns { destroy }.
+export function mountVoiceProfile(root, win = window) {
+  const doc = root.ownerDocument
+  const phrases = () => Array.from(root.querySelectorAll("[data-voice-phrase]"))
+  const one = (selector) => root.querySelector(selector)
+  const embedder = embedderFor(parseJson(root.getAttribute("data-voice-embedder")), win)
+  const saveUrl = root.getAttribute("data-voice-save-url")
+
+  let vectors = []
+  let state = "idle"
+  let stream = null
+  let recorder = null
+  let chunks = []
+  let timer = null
+  let audioContext = null
+  let analyser = null
+  let levelBuffer = null
+  let meterFrame = null
+  let meterTimer = null
+  let peakRms = 0
+  let frames = 0
+  let starting = false
+  let destroyed = false
+
+  function setState(next, message = null) {
+    state = next
+    root.dataset.voiceState = next
+    const states = phraseStates(phrases().length, vectors.length)
+    phrases().forEach((phrase, i) => { phrase.dataset.phraseState = states[i] })
+    const words = copyFor(next, vectors.length)
+    const label = one("[data-voice-record-label]")
+    if (label && words.button) label.textContent = words.button
+    const status = one("[data-voice-status]")
+    if (status) status.textContent = message || words.status
+    const button = one("[data-voice-record]")
+    if (button) {
+      button.disabled = !["ready", "recording"].includes(next)
+      button.setAttribute("aria-pressed", next === "recording" ? "true" : "false")
+    }
+    const save = one("[data-voice-save]")
+    if (save) save.disabled = next !== "complete"
+  }
+
+  function settle(message = null) {
+    setState(vectors.length >= phrases().length ? "complete" : "ready", message)
+  }
+
+  function supported() {
+    return !!(win.MediaRecorder && win.navigator && win.navigator.mediaDevices && win.navigator.mediaDevices.getUserMedia)
+  }
+
+  function open() {
+    if (state !== "idle") return
+    vectors = []
+    const setup = one("[data-voice-setup]")
+    if (setup) setup.hidden = false
+    const summary = one("[data-voice-summary]")
+    if (summary) summary.hidden = true
+    if (!embedder || !supported()) {
+      setState("ready", MESSAGES.unsupported)
+      const button = one("[data-voice-record]")
+      if (button) button.disabled = true
+      return
+    }
+    embedder.warm().catch(() => {})
+    setState("ready")
+  }
+
+  function cancel() {
+    stopTake(false)
+    vectors = []
+    const setup = one("[data-voice-setup]")
+    if (setup) setup.hidden = true
+    const summary = one("[data-voice-summary]")
+    if (summary) summary.hidden = false
+    setState("idle")
+  }
+
+  function paintLevel(level) {
+    root.style.setProperty("--studio-voice-level", level.toFixed(3))
+    root.dataset.voiceLevel = level.toFixed(2)
+  }
+
+  function sampleLevel() {
+    if (!analyser || !audioContext || audioContext.state !== "running") return
+    analyser.getFloatTimeDomainData(levelBuffer)
+    const rms = rootMeanSquare(levelBuffer)
+    frames += 1
+    if (rms > peakRms) {
+      peakRms = rms
+      root.dataset.voicePeak = rms.toFixed(4)
+    }
+    if (rms >= SILENCE_RMS) root.dataset.voiceHeard = "true"
+    paintLevel(meterLevel(rms))
+  }
+
+  function startMeter(source) {
+    peakRms = 0
+    frames = 0
+    root.dataset.voiceHeard = "false"
+    root.dataset.voicePeak = "0"
+    paintLevel(0)
+    const AudioContextClass = win.AudioContext || win.webkitAudioContext
+    if (!AudioContextClass) return
+    try {
+      audioContext = new AudioContextClass()
+      const input = audioContext.createMediaStreamSource(source)
+      analyser = audioContext.createAnalyser()
+      analyser.fftSize = 1024
+      levelBuffer = new Float32Array(analyser.fftSize)
+      input.connect(analyser)
+      if (audioContext.state === "suspended" && audioContext.resume) audioContext.resume().catch(() => {})
+    } catch (_) {
+      closeMeter()
+      return
+    }
+    const frame = () => {
+      sampleLevel()
+      meterFrame = win.requestAnimationFrame(frame)
+    }
+    meterFrame = win.requestAnimationFrame(frame)
+    // A background tab stops animation frames; the timer keeps measuring.
+    meterTimer = win.setInterval(sampleLevel, 100)
+  }
+
+  function closeMeter() {
+    if (meterFrame) win.cancelAnimationFrame(meterFrame)
+    if (meterTimer) win.clearInterval(meterTimer)
+    meterFrame = null
+    meterTimer = null
+    analyser = null
+    if (audioContext && audioContext.state !== "closed") audioContext.close().catch(() => {})
+    audioContext = null
+    paintLevel(0)
+  }
+
+  function release() {
+    if (stream) stream.getTracks().forEach((track) => track.stop())
+    stream = null
+  }
+
+  async function startTake() {
+    try {
+      stream = await win.navigator.mediaDevices.getUserMedia({ audio: true })
+    } catch (error) {
+      setState("ready", error && error.name === "NotAllowedError" ? MESSAGES.denied : MESSAGES.failed)
+      return
+    }
+    if (destroyed || state !== "ready") { release(); return }
+    chunks = []
+    try {
+      startMeter(stream)
+      const MediaRecorderClass = win.MediaRecorder
+      const mimeType = pickMimeType(MediaRecorderClass.isTypeSupported && MediaRecorderClass.isTypeSupported.bind(MediaRecorderClass))
+      try {
+        recorder = mimeType ? new MediaRecorderClass(stream, { mimeType }) : new MediaRecorderClass(stream)
+      } catch (_) {
+        recorder = new MediaRecorderClass(stream)
+      }
+      recorder.addEventListener("dataavailable", (event) => {
+        if (event.data && event.data.size > 0) chunks.push(event.data)
+      })
+      recorder.addEventListener("stop", () => finishTake())
+      recorder.start(250)
+    } catch (_) {
+      closeMeter()
+      release()
+      setState("ready", MESSAGES.failed)
+      return
+    }
+    setState("recording")
+    timer = win.setTimeout(() => stopTake(true), TAKE_MS)
+  }
+
+  function stopTake(keep = true) {
+    if (timer) win.clearTimeout(timer)
+    timer = null
+    if (!recorder || recorder.state === "inactive") return
+    if (!keep) recorder.discard = true
+    recorder.stop()
+  }
+
+  async function finishTake() {
+    const discarded = recorder && recorder.discard
+    sampleLevel()
+    const heard = takeWasHeard(peakRms, frames)
+    closeMeter()
+    release()
+    const type = (recorder && recorder.mimeType) || "audio/webm"
+    const blob = new Blob(chunks, { type })
+    chunks = []
+    recorder = null
+    if (discarded || destroyed) return
+    if (!heard || blob.size === 0) {
+      root.dataset.voiceLastTake = "silent"
+      settle(MESSAGES.silent)
+      return
+    }
+    setState("thinking")
+    try {
+      const vector = await embedder.embed(blob)
+      if (destroyed || state !== "thinking") return
+      vectors.push(vector)
+      root.dataset.voiceLastTake = "kept"
+      settle()
+    } catch (error) {
+      if (destroyed || state !== "thinking") return
+      const silent = error instanceof SilentTakeError
+      root.dataset.voiceLastTake = silent ? "silent" : "failed"
+      settle(silent ? MESSAGES.silent : MESSAGES.failed)
+    }
+  }
+
+  function toggle() {
+    if (state === "recording") stopTake(true)
+    else if (state === "ready" && !starting) {
+      starting = true
+      startTake().finally(() => { starting = false })
+    }
+  }
+
+  function csrfToken() {
+    const meta = doc.querySelector("meta[name='csrf-token']")
+    return meta ? meta.content : ""
+  }
+
+  async function save() {
+    if (state !== "complete") return
+    setState("saving")
+    let response
+    let body
+    try {
+      response = await win.fetch(saveUrl, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Accept": "application/json", "Content-Type": "application/json", "X-CSRF-Token": csrfToken() },
+        body: JSON.stringify({ voice: { model: embedder.id, embeddings: vectors } })
+      })
+      body = await response.json().catch(() => null)
+    } catch (_) {
+      setState("complete", MESSAGES.network)
+      return
+    }
+    // fetch resolves on a 4xx or 5xx: only an ok answer with a url is saved.
+    if (!response.ok || !body || !body.url) {
+      setState("complete", (body && body.error) || MESSAGES.notSaved)
+      return
+    }
+    vectors = []
+    root.dataset.voiceSaved = "true"
+    win.location.assign(body.url)
+  }
+
+  const handlers = {
+    open: () => open(),
+    cancel: () => cancel(),
+    record: () => toggle(),
+    save: () => save()
+  }
+
+  function onClick(event) {
+    const target = event.target.closest && event.target.closest("[data-voice-action]")
+    if (!target || !root.contains(target)) return
+    const handler = handlers[target.getAttribute("data-voice-action")]
+    if (!handler) return
+    event.preventDefault()
+    handler()
+  }
+
+  root.addEventListener("click", onClick)
+  root.dataset.voiceReady = "true"
+  setState("idle")
+
+  return {
+    destroy() {
+      destroyed = true
+      root.removeEventListener("click", onClick)
+      stopTake(false)
+      closeMeter()
+      release()
+    }
+  }
+}

data/app/views/studio/profiles/_voice_section.html.erb

@@ -0,0 +1,108 @@
+<%# The voice row: "Set up your voice". Rendered only when Studio.voice_profile
+    is on and the user has the voice columns (lib/studio/profile_sections.rb).
+
+    Locals: user (required); embedder (optional, defaults to
+    Studio.voice_embedder: the browser e2e lab passes "fake" rather than write
+    the process-wide setting).
+
+    THE DEVICE DOES THE LISTENING. Three phrases are recorded one at a time;
+    studio/voice_profile turns each take into a speaker embedding in the browser,
+    drops the audio, and Save posts only the vectors to /profile/voice, where
+    Studio::VoiceMatch averages them into one voice on this user. Nothing here
+    uploads a recording.
+
+    WITHOUT JAVASCRIPT the row still says whether a voice is saved and still
+    deletes it: the summary and the Delete form are plain HTML. Only recording
+    needs the controller (lazy, studio/stimulus). If it fails to load, the row
+    carries data-studio-controller-failed="voice-profile" and says so.
+
+    SCOPED CSS rather than utilities, as in _identity_styles: the meter ring and
+    the phrase marks must render in an app whose Tailwind build never saw this
+    file. The ring reads --studio-voice-level (0..1), which the module writes
+    while a take records. %>
+<% embedder = local_assigns.fetch(:embedder, Studio.voice_embedder).to_s %>
+<% config = Studio::VoiceMatch.browser_config(embedder) %>
+<% saved = user.voice_embedding.present? %>
+<% current = saved && user.voice_embedding_model.to_s == config["id"] %>
+
+<style>
+  .studio-voice-consent { font-size: .8125rem; color: var(--color-text-secondary, inherit); margin-bottom: 1rem; }
+  .studio-voice-lead { margin-bottom: .5rem; }
+  .studio-voice-row { display: flex; align-items: center; justify-content: space-between; gap: .75rem; flex-wrap: wrap; }
+  .studio-voice-actions { display: flex; align-items: center; gap: .5rem; flex-wrap: wrap; }
+  .studio-voice-phrases { list-style: none; padding: 0; margin: 0 0 1rem; display: grid; gap: .5rem; }
+  .studio-voice-phrase { display: flex; align-items: center; gap: .75rem; padding: .75rem; border-radius: .75rem;
+    border: 1px solid var(--color-border, rgb(127 127 127 / .25)); }
+  .studio-voice-phrase[data-phrase-state="current"] { outline: 2px solid rgb(var(--color-primary-500-rgb, 99 102 241)); outline-offset: 1px; }
+  .studio-voice-mark { flex-shrink: 0; width: 1.75rem; height: 1.75rem; border-radius: 9999px; display: flex;
+    align-items: center; justify-content: center; font-size: .8125rem; font-weight: 700;
+    border: 1px solid var(--color-border, rgb(127 127 127 / .25)); color: var(--color-text-secondary, inherit); }
+  .studio-voice-phrase[data-phrase-state="done"] .studio-voice-mark { background: #10b981; border-color: #10b981; color: #fff; }
+  .studio-voice-controls { display: flex; flex-direction: column; align-items: center; gap: .75rem; text-align: center; }
+  .studio-voice-record { min-width: 12rem; border-radius: 9999px; padding: .875rem 1.75rem; font-weight: 700;
+    color: #fff; background: rgb(var(--color-primary-500-rgb, 99 102 241));
+    box-shadow: 0 0 0 calc(var(--studio-voice-level, 0) * 14px) rgb(var(--color-primary-500-rgb, 99 102 241) / .3);
+    transition: box-shadow 80ms linear; }
+  .studio-voice-record:disabled { opacity: .5; cursor: not-allowed; }
+  [data-voice-state="recording"] .studio-voice-record { background: #dc2626; }
+  @media (prefers-reduced-motion: reduce) { .studio-voice-record { transition: none; } }
+  .studio-voice-status { min-height: 2.5rem; max-width: 24rem; color: var(--color-text-body, inherit); }
+  .studio-voice-failed { display: none; font-size: .8125rem; color: var(--color-text-secondary, inherit); }
+  [data-studio-controller-failed~="voice-profile"] .studio-voice-failed { display: block; }
+</style>
+
+<div data-studio-controller="voice-profile"
+     data-voice-state="idle"
+     data-voice-save-url="<%= profile_voice_path %>"
+     data-voice-embedder="<%= config.to_json %>">
+  <p class="studio-voice-consent" data-voice-consent>
+    This saves a voice pattern, not a recording. Your device listens to three short phrases and keeps
+    only numbers that describe how you sound, so your agent can tell it's you. Delete it any time.
+  </p>
+
+  <div class="studio-voice-row" data-voice-summary>
+    <p class="text-body min-w-0" data-voice-saved="<%= current ? "current" : (saved ? "stale" : "none") %>">
+      <% if current %>
+        Your voice is set up<% if user.voice_embedding_updated_at %> (<%= user.voice_embedding_updated_at.to_date.to_fs(:long) %>)<% end %>.
+      <% elsif saved %>
+        Your saved voice came from an older model. Record it again to keep using it.
+      <% else %>
+        Read three short phrases so your agent knows your voice.
+      <% end %>
+    </p>
+    <div class="studio-voice-actions">
+      <button type="button" class="btn btn-primary btn-sm" data-voice-action="open">
+        <%= saved ? "Re-record" : "Set up your voice" %>
+      </button>
+      <% if saved %>
+        <%= button_to "Delete", profile_voice_path, method: :delete,
+                      class: "btn btn-sm", form: { class: "inline", data: { voice_delete: true } } %>
+      <% end %>
+    </div>
+  </div>
+  <p class="studio-voice-failed">Recording didn't load on this page. Reload to try again.</p>
+
+  <div data-voice-setup hidden>
+    <p class="studio-voice-lead text-sm font-semibold text-heading">Read each one out loud</p>
+    <ol class="studio-voice-phrases">
+      <% Studio::VoiceMatch::PHRASES.each_with_index do |phrase, i| %>
+        <li class="studio-voice-phrase" data-voice-phrase data-phrase-state="waiting">
+          <span class="studio-voice-mark" aria-hidden="true"><%= i + 1 %></span>
+          <span class="text-body">&ldquo;<%= phrase %>&rdquo;</span>
+        </li>
+      <% end %>
+    </ol>
+
+    <div class="studio-voice-controls">
+      <button type="button" class="studio-voice-record" data-voice-action="record" data-voice-record
+              aria-pressed="false" disabled>
+        <span data-voice-record-label>Record phrase 1</span>
+      </button>
+      <p class="studio-voice-status" data-voice-status role="status" aria-live="polite"></p>
+      <div class="studio-voice-actions">
+        <button type="button" class="btn btn-primary btn-sm" data-voice-action="save" data-voice-save disabled>Save</button>
+        <button type="button" class="btn btn-sm" data-voice-action="cancel">Cancel</button>
+      </div>
+    </div>
+  </div>
+</div>

data/db/migrate/20261029120000_add_voice_profile_to_users.rb

@@ -0,0 +1,44 @@
+# The voice row on /profile (Studio.voice_profile): one speaker embedding on the
+# user's own record, the model it came from, and when it was saved.
+#
+# A HOST-TABLE MIGRATION, the engine's second after
+# add_standard_user_profile_columns, and built the same way for the same reason:
+# one definition the apps install (`bin/rails studio_engine:install:migrations`)
+# instead of a hand-written copy per app.
+#
+#   voice_embedding            jsonb  the averaged unit vector (256 floats for
+#                                     the wespeaker embedder). A pattern of the
+#                                     voice, never audio: the takes stay on the
+#                                     device.
+#   voice_embedding_model      string which embedder and revision made it
+#                                     (Studio::VoiceMatch::EMBEDDERS ids). Vectors
+#                                     from different models are not comparable,
+#                                     so the matcher filters on this.
+#   voice_embedding_updated_at datetime
+#
+# Every add is `if_not_exists`, and an app with no users table is skipped, as in
+# the standard-columns migration.
+#
+# THE DOWN DROPS THEM, unlike the standard-columns migration, which refuses. That
+# one could not tell its columns from columns the host already owned
+# (first_name, birth_year). These three names are the engine's own coinage, and
+# no consumer had any of them when this shipped (mcritchie-studio,
+# turf-monster, mcritchie-industries, cyvasse and moms-app checked 2026-10-29),
+# so a drop removes only what this migration added.
+class AddVoiceProfileToUsers < ActiveRecord::Migration[7.2]
+  def up
+    return unless table_exists?(:users)
+
+    add_column :users, :voice_embedding, :jsonb, if_not_exists: true
+    add_column :users, :voice_embedding_model, :string, if_not_exists: true
+    add_column :users, :voice_embedding_updated_at, :datetime, if_not_exists: true
+  end
+
+  def down
+    return unless table_exists?(:users)
+
+    remove_column :users, :voice_embedding_updated_at, if_exists: true
+    remove_column :users, :voice_embedding_model, if_exists: true
+    remove_column :users, :voice_embedding, if_exists: true
+  end
+end

data/lib/studio/engine.rb

@@ -299,6 +299,14 @@ module Studio
       app.config.middleware.use Studio::GoogleSignIn::Middleware
     end
 
+    # The voice row's vectors stay out of every consumer's request log and
+    # User#inspect: POST /profile/voice carries voice[embeddings], and the user
+    # holds voice_embedding (Voicebox logged vectors until it filtered them).
+    # `(\A|\.)` also masks the JSON param wrapper's copy (profile.voice.embeddings).
+    initializer "studio.voice_profile.filter_parameters" do |app|
+      app.config.filter_parameters += [/(\A|\.)voice\.embeddings\z/, /\Avoice_embedding\z/]
+    end
+
     initializer "studio.footer_only_eager_load" do
       next if Studio.active_record?
 

data/lib/studio/profile_sections.rb

@@ -6,6 +6,7 @@
 # and the engine fails to boot. Declaring the dependency where it is used makes
 # the pair immune to a future reorder of that require list.
 require_relative "newsletter"
+require_relative "voice_match"
 
 # Resolves Studio.profile_sections — the rows that make up the shared /profile
 # page — for a given view context. Pure Ruby (no Rails dependency) so the unit
@@ -100,6 +101,16 @@ module Studio
         requires: Studio::Newsletter::COLUMNS,
         modals: "studio/profiles/newsletter_modals" },
 
+      # The voice: three phrases read once, so an agent can tell who is
+      # talking. OPT-IN (Studio.voice_profile), because it fetches a speaker
+      # model from Hugging Face and stores a voice pattern, and a host's CSP and
+      # privacy page must say so first. Gated on the columns too: the engine
+      # migration add_voice_profile_to_users installs them.
+      { key: :voice, title: "Your voice", page: :show,
+        partial: "studio/profiles/voice_section",
+        requires: Studio::VoiceMatch::USER_COLUMNS,
+        if: -> { Studio.voice_profile } },
+
       # --- the edit page ------------------------------------------------------
       # These are FIELDS in one form with one Save, so they carry no buttons of
       # their own. Email included: it needed a separate action only while it was

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.119.1"
+  VERSION = "0.120.0"
 end

data/lib/studio/voice_match.rb

@@ -0,0 +1,238 @@
+# frozen_string_literal: true
+
+require "json"
+
+# Who is speaking: compares one take's speaker embedding with the voice
+# embeddings saved on users' own records (the voice row on /profile, opt-in with
+# Studio.voice_profile). Pure arithmetic on arrays of floats, with no Rails
+# dependency, so the threshold logic is unit-tested without a browser, a model or
+# a database.
+#
+# THE EMBEDDINGS COME FROM THE BROWSER. The profile page records three short
+# phrases, turns each take into a vector on the person's own device
+# (app/javascript/studio/voice_profile.js), drops the audio, and posts only the
+# vectors. The server averages them here and stores one vector on the user. No
+# audio is ever uploaded for this.
+#
+# Ported from Voicebox's SpeakerMatch (McRitchie-Studio/voicebox#10), where the
+# embedder, the threshold and the averaging were measured.
+module Studio
+  module VoiceMatch
+    # The speaker embedders the browser may run, by name. `id` is what is stored
+    # on the user beside the vector (users.voice_embedding_model): vectors from
+    # two models, or from two revisions of one model, are not comparable, so the
+    # matcher only ever compares a take with users whose id is the same.
+    #
+    # "wespeaker" is WeSpeaker's ResNet34 speaker model (trained on VoxCeleb),
+    # int8-quantized, run by transformers.js on onnxruntime-web. The model is
+    # about 6.7 MB and the runtime about 4.3 MB; the browser caches both after the
+    # first load. Its revision is pinned so THRESHOLD always describes the vectors
+    # it was tuned on. Changing the revision is changing the id, and every saved
+    # voice stops matching until its owner re-records.
+    #
+    # "fake" is for tests only: a deterministic vector seeded by a voice name the
+    # test sets on the page (window.studioFakeVoice), because Chrome's fake
+    # microphone cannot play chosen audio.
+    TRANSFORMERS_VERSION = "3.7.6"
+
+    # Where the browser imports transformers.js from, by full URL. NOT an
+    # importmap pin: every pin a host draws must be a fingerprinted local asset
+    # (the hub's AssetUrlsTest), and a ~1 MB runtime that fetches its own
+    # onnxruntime WebAssembly from the same jsDelivr path anyway gains nothing
+    # from being vendored. A host's CSP names this package path.
+    TRANSFORMERS_URL =
+      "https://cdn.jsdelivr.net/npm/@huggingface/transformers@#{TRANSFORMERS_VERSION}/dist/transformers.min.js"
+
+    EMBEDDERS = {
+      "wespeaker" => {
+        "id" => "wespeaker-voxceleb-resnet34-LM@6a61a18",
+        "size" => 256,
+        "model" => "onnx-community/wespeaker-voxceleb-resnet34-LM",
+        "revision" => "6a61a1833ff2583aabeba044f5c8221f00b67ceb",
+        "dtype" => "q8",
+        "runtime" => TRANSFORMERS_URL
+      }.freeze,
+      "fake" => {
+        "id" => "fake-256",
+        "size" => 256
+      }.freeze
+    }.freeze
+
+    # The columns the voice lives in on the host's users table, installed by the
+    # engine migration add_voice_profile_to_users.
+    USER_COLUMNS = %i[voice_embedding voice_embedding_model voice_embedding_updated_at].freeze
+
+    # What the setup asks the person to read: three short, phonetically varied
+    # sentences of about four seconds each. TAKES is their count, and the server
+    # refuses a save with any other number of vectors.
+    PHRASES = [
+      "The quick brown fox jumps over the lazy dog.",
+      "I'd like a cup of coffee and a slice of toast, please.",
+      "My voice is my own, and today is a good day to talk."
+    ].freeze
+
+    TAKES = PHRASES.size
+
+    # The cosine similarity a take must reach to be named. Measured in Voicebox
+    # (2026-10-29) on the wespeaker embedder, enrolling five synthetic voices from
+    # three phrases each and probing with a fourth: same voice 0.85 - 0.91,
+    # different voice 0.04 - 0.53 (the closest pair two adult women). 0.6 sits
+    # above every different-voice score and well under every same-voice one.
+    THRESHOLD = 0.6
+
+    # user: the closest user at or above the threshold, else nil. score: that
+    # closest similarity, or nil when there was nothing to compare.
+    Result = Struct.new(:user, :score, keyword_init: true) do
+      def unknown? = user.nil?
+    end
+
+    NONE = Result.new(user: nil, score: nil).freeze
+
+    module_function
+
+    # The settings the page hands the browser for one embedder.
+    def browser_config(name)
+      config = EMBEDDERS.fetch(name.to_s)
+      { "name" => name.to_s }.merge(config)
+    end
+
+    def embedder!(name)
+      EMBEDDERS.fetch(name.to_s) do
+        raise ArgumentError, "Studio.voice_embedder must be one of #{EMBEDDERS.keys.join(', ')} (got #{name.inspect})"
+      end
+    end
+
+    def model_id(name) = embedder!(name).fetch("id")
+
+    def size(name) = embedder!(name).fetch("size")
+
+    # The closest user to `embedding` among `among`, or nil when nobody reaches
+    # the threshold. Only users whose saved vector came from `model` are
+    # compared. `among` is anything enumerable of users; an ActiveRecord scope is
+    # narrowed to that model in SQL first.
+    def identify(embedding, among:, model:, threshold: THRESHOLD)
+      match(embedding, among: among, model: model, threshold: threshold).user
+    end
+
+    # identify, with the score: a caller that wants to say "someone new" needs to
+    # tell "nobody close" (a score below the threshold) from "nothing to compare".
+    def match(embedding, among:, model:, threshold: THRESHOLD)
+      probe = vector(embedding)
+      return NONE if probe.nil? || model.to_s.empty?
+
+      best = nil
+      best_score = nil
+      candidates(among, model).each do |user|
+        next unless user.respond_to?(:voice_embedding_model) && user.voice_embedding_model.to_s == model.to_s
+
+        saved = vector(user.voice_embedding)
+        next if saved.nil? || saved.size != probe.size
+
+        score = cosine(probe, saved)
+        next if score.nil?
+
+        if best_score.nil? || score > best_score
+          best = user
+          best_score = score
+        end
+      end
+      return NONE if best_score.nil?
+
+      Result.new(user: best_score >= threshold ? best : nil, score: best_score.round(4))
+    end
+
+    # Cosine similarity, -1..1; nil when the sizes differ or either vector has
+    # no length.
+    def cosine(a, b)
+      return nil unless a.size == b.size
+
+      dot = 0.0
+      norm_a = 0.0
+      norm_b = 0.0
+      a.each_with_index do |x, i|
+        y = b[i]
+        dot += x * y
+        norm_a += x * x
+        norm_b += y * y
+      end
+      return nil if norm_a.zero? || norm_b.zero?
+
+      dot / Math.sqrt(norm_a * norm_b)
+    end
+
+    # One profile vector from the setup takes: each take scaled to unit length,
+    # so a loud phrase does not outweigh a quiet one, then averaged and scaled to
+    # unit length again. nil when no take has any length (silence embeds to
+    # zeros), or the takes disagree on size.
+    def average(vectors)
+      units = Array(vectors).map { |v| normalize(v) }.compact
+      return nil if units.empty?
+      return nil unless units.all? { |u| u.size == units.first.size }
+
+      sum = Array.new(units.first.size, 0.0)
+      units.each { |u| u.each_with_index { |x, i| sum[i] += x } }
+      normalize(sum)
+    end
+
+    def normalize(vector)
+      return nil if vector.nil? || vector.empty?
+
+      norm = Math.sqrt(vector.sum { |x| x * x })
+      return nil if norm.zero? || !norm.finite?
+
+      vector.map { |x| x / norm }
+    end
+
+    # A vector the browser sent, as floats, or nil when it is not `size` finite
+    # numbers. Accepts a JSON string or an already-parsed array.
+    def parse(raw, size:)
+      values = raw.is_a?(String) ? JSON.parse(raw) : raw
+      return nil unless values.is_a?(Array) && values.size == size
+      return nil unless values.all? { |x| x.is_a?(Numeric) && x.to_f.finite? }
+
+      values.map(&:to_f)
+    rescue JSON::ParserError
+      nil
+    end
+
+    # The setup's takes, validated: exactly TAKES vectors of `size` finite
+    # numbers, each with some length. Returns the averaged unit vector, or nil.
+    def enrol(raw_takes, size:)
+      takes = raw_takes.is_a?(String) ? JSON.parse(raw_takes) : raw_takes
+      return nil unless takes.is_a?(Array) && takes.size == TAKES
+
+      vectors = takes.map { |take| parse(take, size: size) }
+      return nil if vectors.any?(&:nil?)
+      return nil if vectors.any? { |v| normalize(v).nil? }
+
+      average(vectors)
+    rescue JSON::ParserError
+      nil
+    end
+
+    # A stored embedding (jsonb array, or a JSON string on an adapter without
+    # json columns) as floats, or nil.
+    def vector(raw)
+      values = raw.is_a?(String) ? JSON.parse(raw) : raw
+      return nil unless values.is_a?(Array) && !values.empty?
+      return nil unless values.all? { |x| x.is_a?(Numeric) && x.to_f.finite? }
+
+      values.map(&:to_f)
+    rescue JSON::ParserError
+      nil
+    end
+
+    def candidates(among, model)
+      return Array(among) unless among.respond_to?(:where)
+
+      # A scope or the model class itself. Narrowed in SQL only when the table
+      # has the column; the per-user check in #match holds either way.
+      klass = among.respond_to?(:klass) ? among.klass : among
+      if klass.respond_to?(:column_names) && klass.column_names.include?("voice_embedding_model")
+        among.where(voice_embedding_model: model.to_s)
+      else
+        among
+      end
+    end
+  end
+end

data/lib/studio.rb

@@ -46,6 +46,7 @@ require "studio/loader"
 require "studio/auth_labels"
 require "studio/profile_sections"
 require "studio/profile_image"
+require "studio/voice_match"
 require "studio/oauth_identity"
 require "studio/google_sign_in"
 require "studio/newsletter"
@@ -556,6 +557,25 @@ module Studio
   # wants the page gone still sets this false.
   mattr_accessor :draw_profile_routes, default: true
 
+  # The voice row on /profile: "Set up your voice". The signed-in user reads
+  # three short phrases; each take becomes a speaker embedding ON THEIR DEVICE
+  # (studio/voice_profile, a WeSpeaker model run by transformers.js), the audio
+  # is dropped, and only the vectors are posted. The server averages them into
+  # one vector on the user's own record (users.voice_embedding, installed by the
+  # engine migration add_voice_profile_to_users). Studio::VoiceMatch.identify
+  # answers "who is speaking" from an embedding.
+  #
+  # OFF BY DEFAULT. Turning it on is a privacy decision (a voice pattern is
+  # biometric data in several jurisdictions) and it makes the page fetch a model
+  # from Hugging Face and its runtime from jsDelivr, which a host's CSP and
+  # privacy page must both name. docs/VOICE_PROFILE.md lists what to change.
+  mattr_accessor :voice_profile, default: false
+
+  # Which speaker embedder the browser runs: "wespeaker" (the real one) or
+  # "fake" (tests only; a fixed vector per window.studioFakeVoice). The server
+  # refuses a voice saved by any other embedder, so a page cannot pick its own.
+  mattr_accessor :voice_embedder, default: "wespeaker"
+
   # How long a freshly minted magic link stays live.
   mattr_accessor :magic_link_ttl, default: 15.minutes
 
@@ -1926,6 +1946,13 @@ module Studio
         post   "profile/newsletter", to: "studio/profiles#subscribe_newsletter",
                as: :profile_newsletter
         delete "profile/newsletter", to: "studio/profiles#unsubscribe_newsletter"
+
+        # The voice row. POST saves (or replaces) the voice from the setup's
+        # vectors; DELETE removes it. Drawn with the page, like the newsletter
+        # pair; the actions refuse unless the row renders (Studio.voice_profile
+        # on, and the user has the columns).
+        post   "profile/voice", to: "studio/profiles#save_voice", as: :profile_voice
+        delete "profile/voice", to: "studio/profiles#delete_voice"
       end
 
       resources :error_logs, only: [:index, :show]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.119.1
+  version: 0.120.0
 platform: ruby
 authors:
 - Alex McRitchie
@@ -512,6 +512,7 @@ files:
 - app/javascript/studio/controllers/style_modals_controller.js
 - app/javascript/studio/controllers/survey_controller.js
 - app/javascript/studio/controllers/toast_controller.js
+- app/javascript/studio/controllers/voice_profile_controller.js
 - app/javascript/studio/cropper.js
 - app/javascript/studio/email_banner.js
 - app/javascript/studio/email_banner_scale.js
@@ -545,6 +546,7 @@ files:
 - app/javascript/studio/theme_editor.js
 - app/javascript/studio/toast.js
 - app/javascript/studio/vendor/stimulus.js
+- app/javascript/studio/voice_profile.js
 - app/jobs/error_log_cleanup_job.rb
 - app/jobs/studio/email_delivery_job.rb
 - app/jobs/studio/health_report_job.rb
@@ -738,6 +740,7 @@ files:
 - app/views/studio/profiles/_pencil_icon.html.erb
 - app/views/studio/profiles/_plain_save.html.erb
 - app/views/studio/profiles/_save_controls.html.erb
+- app/views/studio/profiles/_voice_section.html.erb
 - app/views/studio/profiles/edit.html.erb
 - app/views/studio/profiles/show.html.erb
 - app/views/studio/public_users/not_found.html.erb
@@ -806,6 +809,7 @@ files:
 - db/migrate/20261006120003_ensure_image_caches_table.rb
 - db/migrate/20261008120000_add_recording_to_studio_knowledge_docs.rb
 - db/migrate/20261010120000_add_stored_in_to_image_caches.rb
+- db/migrate/20261029120000_add_voice_profile_to_users.rb
 - docs/BOOKING.md
 - docs/SITE_FOOTER.md
 - lib/active_storage/service/studio_trash_s3_service.rb
@@ -889,6 +893,7 @@ files:
 - lib/studio/ui_primitives.rb
 - lib/studio/username_generator.rb
 - lib/studio/version.rb
+- lib/studio/voice_match.rb
 - lib/tasks/studio_email.rake
 - lib/tasks/studio_knowledge.rake
 - lib/tasks/studio_node.rake