@gotcos/glasses-server 6.21.24 → 6.21.26

package/CHANGELOG.md

@@ -1,3 +1,48 @@
+## 6.21.26
+
+- `assertedSegments` added to the speaker review: how many segments belong to
+  voices the panel actually shows WITH A NAME. `attributed` is a boolean that
+  only goes false at 100% unidentified, so a meeting where 295 of 299 chunks
+  matched nobody reported `true` and rendered as though normally attributed.
+  Measured unidentified share across 14 retained sessions ran 24% to 100%, all
+  of it collapsing onto that one boolean.
+
+  It counts asserted voices (`nameAsserted`), NOT chunks carrying a
+  person-shaped label. Those diverge sharply: on session 0i1xv3 the label-based
+  count is 287 of 379 segments while only 177 are displayed as names, so a
+  header built on labels would claim three quarters of the meeting identified
+  above a list of rows reading "Unidentified voice".
+
+  Purely additive — the route already spreads the review object and no client
+  decodes this payload strictly. COS Control 0.5.5+ renders it, and omits the
+  line against an older server rather than showing a zero.
+
+## 6.21.25
+
+- `POST /meeting/:sessionId/confirm` — record that a human vouched for a label
+  the display floor demoted. The floor exists so the identifier cannot assert a
+  name it did not earn, but a person who was in the room is better evidence
+  than a cosine score, and there was no way to say so. A rename could not
+  express it: `relabelSidecarJson` rejects `from === to`. So the panel demoted
+  the row, instructed the reviewer to name it, and offered a candidate list
+  that excluded the very name they wanted.
+
+  A confirmation rewrites nothing — the sidecar already carries the label. It
+  records the vouch, and `reviewMeetingSpeakers` then reports the row as
+  asserted. Meeting-scoped like every other correction: vouching for a voice in
+  one room says nothing about a different room. Refuses with 409 if no chunk in
+  the meeting actually carries that label, so a typo cannot become a permanent
+  confirmation in an append-only ledger.
+
+  A confirmed row still shows its thrash caveat. The name is asserted; the
+  evidence that it swaps with someone else is not hidden.
+
+- Fixed a latent trap found while building it: `readCorrections` validated
+  `phase` against a hardcoded list, so adding a phase to the TYPE made every
+  such row unusable at read time — the write succeeded, the read silently
+  dropped it, and no error surfaced anywhere. Phase validation now derives from
+  a single list with a narrowing guard.
+
 ## 6.21.24
 
 - A leaked recording session can no longer block every restart. The maintenance

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.24",
+  "version": "6.21.26",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/meeting-corrections.ts

@@ -35,7 +35,31 @@ export const CORRECTIONS_DIR = 'meeting-corrections'
  * `intent` goes down before any file is touched; `applied` or `failed` closes it.
  * An unclosed intent is an incomplete correction, not a successful one.
  */
-export type CorrectionPhase = 'intent' | 'applied' | 'failed'
+export type CorrectionPhase = 'intent' | 'applied' | 'failed' | 'confirmed'
+/**
+ * A human confirming the identifier was RIGHT about a label the display floor
+ * demoted.
+ *
+ * Distinct from a rename, and it has to be: `relabelSidecarJson` rejects
+ * `from === to`, so "yes, this really is Queen Ukaoma" cannot be expressed as a
+ * correction at all. The floor exists because a 0.56 match is not evidence — but
+ * a person who was in the room IS evidence, and there was no way to record it.
+ * The panel demoted the row, told the reviewer to name it, and then offered a
+ * list that deliberately excluded the one name they wanted.
+ *
+ * A confirmation rewrites NOTHING. The sidecar already carries the label; this
+ * only records that a human vouched for it, so the review stops presenting it
+ * as unearned. Scoped to one meeting like every other correction.
+ */
+export const CONFIRMATION_PHASE = 'confirmed' as const
+
+/** Runtime counterpart of CorrectionPhase. Must stay in step with it. */
+const VALID_PHASES = new Set<string>(['intent', 'applied', 'failed', 'confirmed'])
+
+/** Narrowing guard, so the reader keeps its type safety with one phase list. */
+function isCorrectionPhase(value: unknown): value is CorrectionPhase {
+  return typeof value === 'string' && VALID_PHASES.has(value)
+}
 
 export interface CorrectionSurfaces {
   /** Chunks whose `speaker` changed in the sidecar. */
@@ -123,7 +147,11 @@ export function readCorrections(sessionId: string): CorrectionReadResult {
     try {
       const o = JSON.parse(line) as Record<string, unknown>
       if (typeof o.id !== 'string' || typeof o.from !== 'string' || typeof o.to !== 'string') { unusable++; continue }
-      if (o.phase !== 'intent' && o.phase !== 'applied' && o.phase !== 'failed') { unusable++; continue }
+      // Kept as one list so adding a phase to the TYPE cannot silently make
+      // every such row unusable at read time — which is exactly what happened
+      // when 'confirmed' was added: appendCorrection wrote it, this dropped it,
+      // and the confirmation vanished with no error anywhere.
+      if (!isCorrectionPhase(o.phase)) { unusable++; continue }
       rows.push({
         id: o.id,
         phase: o.phase,
@@ -156,6 +184,22 @@ function isSurfaces(v: unknown): v is CorrectionSurfaces {
  * and a meeting with a pending correction should be treated as possibly
  * half-written rather than clean.
  */
+/**
+ * Labels a human has confirmed for this meeting.
+ *
+ * Read by the speaker review to clear the display floor for exactly those
+ * labels. A confirmation is per-meeting and never global: vouching for a voice
+ * in one room says nothing about a different room, which is the same reasoning
+ * that makes every correction here meeting-scoped.
+ */
+export function confirmedLabels(sessionId: string): Set<string> {
+  const confirmed = new Set<string>()
+  for (const row of readCorrections(sessionId).rows) {
+    if (row.phase === 'confirmed') confirmed.add(row.to)
+  }
+  return confirmed
+}
+
 export function pendingCorrections(sessionId: string): CorrectionRow[] {
   const { rows } = readCorrections(sessionId)
   const closed = new Set(rows.filter(r => r.phase !== 'intent').map(r => r.id))

package/server/lib/meeting-speaker-review.ts

@@ -130,6 +130,8 @@ export interface VoiceReview {
   meanRun: number
   longestRun: number
   isOwner: boolean
+  /** A human confirmed this label for this meeting; the floor is waived. */
+  confirmedByHuman: boolean
   reliability: Reliability
   /**
    * Whether `label` may be shown to a human AS A NAME.
@@ -225,6 +227,23 @@ export interface MeetingSpeakerReview {
   segments: number
   /** False when no chunk carries a real speaker — a recovered capture. */
   attributed: boolean
+  /**
+   * Segments belonging to voices this review asserts a NAME for.
+   *
+   * `attributed` is a boolean that only goes false at 100% unidentified, so a
+   * meeting where 295 of 299 chunks matched nobody still reports `true` and
+   * renders as though it were normally attributed. This is the graded version:
+   * measured Ext share across 14 retained sessions ran from 24% to 100%.
+   *
+   * Counts SEGMENTS OF ASSERTED VOICES, not chunks carrying a person-shaped
+   * label — see the derivation for why those differ. Denominator is `segments`
+   * (every chunk, including unlabelled ones), so `assertedSegments / segments`
+   * is the ratio every client should compute.
+   *
+   * Not named "coverage": `coverageRatio` in batch-transcript-quality.ts is an
+   * unrelated word-overlap measure and the two must not read as siblings.
+   */
+  assertedSegments: number
   durationMs: number
   voices: VoiceReview[]
   /** Chronological spans, so a ribbon can be a timeline instead of a share bar. */
@@ -385,9 +404,21 @@ export function selectPhrases(
 /** Build the whole review for one meeting's chunks. */
 export function reviewMeetingSpeakers(
   chunks: ReviewChunk[],
-  options: { owner?: string; phrasesPerVoice?: number; durationMs?: number } = {},
+  options: {
+    owner?: string
+    phrasesPerVoice?: number
+    durationMs?: number
+    /**
+     * Labels a human vouched for in THIS meeting. The floor is a guard against
+     * the identifier over-claiming; it was never meant to overrule a person who
+     * was in the room. A confirmed label asserts its name with no rewrite —
+     * the sidecar already carries it.
+     */
+    confirmed?: Set<string>
+  } = {},
 ): MeetingSpeakerReview {
   const owner = options.owner ?? 'Me'
+  const confirmed = options.confirmed ?? new Set<string>()
   const limit = options.phrasesPerVoice ?? 3
   const sequence = chunks.map(c => c.speaker ?? '')
   // The caller's durationMs (the sidecar's own) is the meeting's true end.
@@ -439,6 +470,12 @@ export function reviewMeetingSpeakers(
     const assertionBlockers: string[] = []
     if (unattributed) {
       assertionBlockers.push('no name was ever assigned to this voice')
+    } else if (confirmed.has(label)) {
+      // A human said this is them. Blockers stay OFF the list rather than being
+      // listed-then-overridden, because a reviewer reading "similarity 0.56
+      // below 0.65" under a name they personally confirmed would reasonably
+      // conclude the confirmation had not taken. `thrashesWith` still renders,
+      // so a genuinely mixed row is still visibly mixed.
     } else if (label === owner) {
       // The wearer is exempt. Their identity is established by wearing the
       // device, not by cosine — and the owner is verified at exactly this floor
@@ -466,6 +503,8 @@ export function reviewMeetingSpeakers(
       meanRun: Math.round(mean(runs) * 100) / 100,
       longestRun: runs.length ? Math.max(...runs) : 0,
       isOwner: label === owner,
+      /** True when a human vouched for this label in this meeting. */
+      confirmedByHuman: confirmed.has(label),
       reliability,
       nameAsserted: assertionBlockers.length === 0,
       assertionBlockers,
@@ -478,6 +517,14 @@ export function reviewMeetingSpeakers(
   return {
     segments: chunks.length,
     attributed: named.length > 0,
+    // Derived from `nameAsserted`, NOT from `isUnattributed`. Those two answer
+    // different questions and diverge badly: measured on session 0i1xv3, the
+    // label-based count is 287 of 379 segments while only 177 belong to voices
+    // the panel actually shows with a name — a 29-point gap. A header built on
+    // labels would claim three quarters of the meeting was identified above a
+    // list of rows reading "Unidentified voice", which is the confusion this
+    // number exists to remove.
+    assertedSegments: voices.reduce((n, v) => (v.nameAsserted ? n + v.segments : n), 0),
     durationMs,
     voices,
     timeline: speakerTimeline(chunks, durationMs),

package/server/routes/meeting.ts

@@ -13,6 +13,7 @@ import { isSampleFromSession, untraceableSampleCount } from '../lib/training-aud
 import { sendAudioFile } from '../lib/send-audio.js'
 import { chunkDiagnostics } from '../lib/chunk-embedding-diagnostics.js'
 import { errMsg } from '../lib/utils.js'
+import { confirmedLabels } from '../lib/meeting-corrections.js'
 import {
   extAudioChunkPath,
   listExtAudioChunks,
@@ -724,6 +725,10 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const withIndices = attachRawChunkIndices(chunks as ReviewChunk[], sidecar.chunkEntries)
     const review = reviewMeetingSpeakers(withIndices, {
       owner: getOwnerSpeakerLabel(),
+      // Labels a human already vouched for in this meeting. Without this the
+      // floor re-demotes a confirmed name on every reload, and the reviewer
+      // confirms the same voice forever.
+      confirmed: confirmedLabels(sessionId),
       phrasesPerVoice: Math.max(1, Math.min(6, Number(req.query.phrases) || 3)),
       // The sidecar's own durationMs is the meeting's true end. Deriving it from
       // max(elapsed) uses the START of the last chunk, which made the final
@@ -929,6 +934,87 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   // like and will keep matching. Removing only the label fixes the transcript and
   // leaves the profile poisoned — the exact mechanism that grew the phantom
   // "Erick Hernandez" from 3 mislabelled seeds to 18 samples.
+  /**
+   * Confirm the identifier was RIGHT about a label the display floor demoted.
+   *
+   * Rewrites nothing. The sidecar already carries the label; this records that
+   * a human vouched for it so the review stops presenting it as unearned.
+   *
+   * This exists because "yes, that really is her" was inexpressible. A rename
+   * cannot say it — `relabelSidecarJson` rejects `from === to` — so the panel
+   * demoted the row, instructed the reviewer to name it, and then offered a
+   * candidate list that excluded the very name they wanted. The floor is a
+   * guard against the IDENTIFIER over-claiming; it was never meant to overrule
+   * a person who was in the room.
+   *
+   * Meeting-scoped, like every other correction: vouching for a voice in one
+   * room says nothing about a different room.
+   */
+  router.post('/meeting/:sessionId/confirm', (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
+      res.status(400).json({ error: 'Invalid sessionId', reason: 'invalid_session_id' })
+      return
+    }
+    const label = typeof req.body?.label === 'string' ? req.body.label : ''
+    const bad = invalidLabelReason(label)
+    if (bad) {
+      res.status(400).json({ error: `label: ${bad}`, reason: 'invalid_label' })
+      return
+    }
+
+    // Same resolution as GET /speakers and the relabel route, so the panel and
+    // the confirmation act on the same copy of the meeting.
+    const operations = cosOperationsMeetingsConfigured()
+      ? findCosOperationsMeetingBySessionId(sessionId)
+      : null
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved) {
+      res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
+      return
+    }
+    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
+
+    // Refuse to confirm a label the meeting does not actually carry. Otherwise
+    // a typo becomes a permanent confirmation for a speaker who was never here,
+    // and the ledger is append-only.
+    let carried = 0
+    try {
+      const doc = JSON.parse(readFileSync(sidecarPath, 'utf-8')) as Record<string, unknown>
+      const rows = Array.isArray(doc.chunks) ? doc.chunks : []
+      carried = rows.filter(r => r && typeof r === 'object'
+        && (r as Record<string, unknown>).speaker === label).length
+    } catch {
+      res.status(500).json({ error: 'Could not read the chunk sidecar', reason: 'sidecar_unreadable' })
+      return
+    }
+    if (carried === 0) {
+      res.status(409).json({
+        error: `No chunk in this meeting is labelled "${label}"`,
+        reason: 'label_not_present',
+      })
+      return
+    }
+
+    const ok = appendCorrection(sessionId, {
+      id: `confirm-${Date.now()}`,
+      phase: 'confirmed',
+      at: new Date().toISOString(),
+      // `from` and `to` are the same by definition — that is what makes this a
+      // confirmation rather than a rename, and why relabel could not express it.
+      from: label,
+      to: label,
+      chunks: [],
+      scope: 'meeting',
+    })
+    if (!ok) {
+      res.status(500).json({ error: 'Could not record the confirmation', reason: 'ledger_write_failed' })
+      return
+    }
+    res.json({ confirmed: true, label, segments: carried })
+  })
+
   router.post('/meeting/:sessionId/deattribute', (req, res) => {
     res.set('Cache-Control', 'private, no-store')
     const sessionId = String(req.params.sessionId ?? '')