@gotcos/glasses-server 6.27.9 → 6.27.11

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 ## Unreleased
 
+## 6.27.11
+- **SAFETY REVERT: the 6.27.10 relabel enrolment is disabled.** It joined two
+  different index spaces. `plan.value.changed` are positions in the COMPACTED sidecar
+  array (`meeting-relabel.ts:119`, over rows already filtered to those carrying text)
+  while the chunk-embedding store is keyed on the RAW capture index
+  (`transcribe-stream.ts:1868`). They diverge at the first text-less chunk.
+- Measured on a live session: naming ONE voice enrolled **73 of 103 rows belonging to
+  other people**, including **22 chunks of the owner**, plus five colleagues. It
+  reported success because rows do come back — the wrong ones. 73 of 74 live sessions
+  with embeddings have gaps, so this was the normal case, not an edge case.
+- `attachRawChunkIndices` is the conversion for exactly this. It was already imported
+  in the file, used correctly by the review path, and carries a comment three hundred
+  lines above the change reading "`chunks` is NOT the WAV number".
+- **Anyone on 6.27.10 should update.** Naming a voice in the review panel could write
+  other people — including the owner — into that person's profile, permanently and
+  across every future meeting. The relabel itself was always correct; only the
+  enrolment side effect was wrong.
+
+  Re-enabling requires all of: the `attachRawChunkIndices` mapping with a refusal when
+  it is unavailable; a coherence gate (an `Ext` bucket is many voices — 98% of its
+  pairwise cosines fall below the identifier's own 0.55 accept threshold); a
+  `correction:<sessionId>` source tag so samples are human-tier, quota-protected and
+  retractable by the existing de-attribute path (a bare `meeting-relabel` tag matches
+  none of the three prefixes `isSampleFromSession` accepts, so "Not in this meeting"
+  silently retracts nothing); `greedyDiversitySelect` to bound the loop (~41ms per
+  cycle against a 7.9 MB store x 109 chunks blocks the event loop past the helper's
+  30s timeout); and honest reporting so a zero enrolment is distinguishable from
+  success. The COS Control scope-picker copy also still reads "Corrects this meeting
+  only. Other meetings are left alone."
+
+## 6.27.10
+- **Naming an unidentified voice now creates a real profile.** `POST /api/meeting/:id/relabel`
+  was TEXT ONLY: it rewrote `speaker` strings in the sidecar and never touched the
+  voice store. Saving "Kirstyn Blum" over 109 segments labelled that one meeting and
+  taught the system nothing — she never appeared in `/api/voice/profiles`, the review
+  panel still offered her as `new name` inside the SAME meeting, no later meeting
+  could match her, and there was no profile to add further chunks against.
+  Verified on the live store: 77 profiles, no Kirstyn Blum, while both sidecars
+  carried her name.
+- The server already had `/api/voice/enroll-ext` for exactly this and the naming flow
+  never called it. Relabel now enrols the embeddings of the chunks it actually
+  changed, tagged `source: meeting-relabel` so a bad batch can be retracted wholesale.
+- **Scoped deliberately.** Enrolment runs ONLY when a placeholder (`Ext`,
+  `Unidentified N`, `Speaker N`, `Unknown`) becomes a real name. Correcting one real
+  name to another is left alone: moving a voice between existing people is
+  `merge-profiles`, which is explicit and confirmation-gated. A cross-roster sweep of
+  this store put two DISTINCT people at 0.85 similarity, so implicit re-pointing would
+  poison profiles.
+- Enrolment happens after the sidecar and ledger are durable, and a throwing voice
+  store cannot undo the rename the user asked for. `enrolledEmbeddings` is returned so
+  the panel can confirm a profile was created.
+- Four tests, both directions mutation-checked: reverting to text-only fails the
+  enrolment test; dropping the placeholder guard fails both safety tests.
+
 ## 6.27.9
 - **Large sessions open instead of 413ing.** `GET /api/agent-sessions/:provider/:id`
   answered `413 Session too large to open` for any transcript over 32 MiB, so the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.27.9",
+  "version": "6.27.11",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/routes/meeting.ts

@@ -23,7 +23,8 @@ import {
   meetingAudioChunkPath,
   meetingAudioRetentionDays,
 } from '../lib/meeting-audio-archive.js'
-import { readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
+import { enrollEmbedding, readVoiceProfiles, retractEmbeddingsBySource } from '../lib/speaker-embeddings.js'
+import { chunkEmbeddingsForIndices } from '../lib/chunk-embedding-store.js'
 
 /**
  * The label a de-attributed voice takes, numbered within its meeting.
@@ -974,6 +975,46 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     })
   })
 
+  /** Labels the diariser invents when it does not know who is speaking. Naming one
+   *  of these is a FIRST TRAINING RUN for a new person, not a correction. */
+  const PLACEHOLDER_LABEL = /^(ext|unknown|unidentified(\s+\d+)?|speaker\s*\d+)$/i
+  const isPlaceholderLabel = (label: string): boolean => PLACEHOLDER_LABEL.test(label.trim())
+
+  /**
+   * Turn a named placeholder into a real voice profile.
+   *
+   * WHY THIS EXISTS. Relabelling was TEXT ONLY: it rewrote `speaker` strings in the
+   * meeting sidecar and never touched the voice store. So naming an unidentified
+   * voice "Kirstyn Blum" labelled that one meeting and taught the system nothing —
+   * she never appeared in `/api/voice/profiles`, the review panel still offered her
+   * as `new name` inside the SAME meeting, no later meeting could match her, and
+   * there was no profile to accumulate further chunks against. The server already
+   * had `/api/voice/enroll-ext` for exactly this and the naming flow never called it.
+   *
+   * Enrolment is ADDITIVE and scoped: it runs only when a placeholder becomes a real
+   * name. Correcting one real name to another is left alone deliberately — moving a
+   * voice between existing people is `merge-profiles`, which is explicit and
+   * confirmation-gated, and doing it implicitly here would poison profiles.
+   *
+   * `enrollEmbedding` owns the diversity gate and the FIFO cap, so feeding it the
+   * relabelled chunks cannot bloat a profile.
+   */
+  const enrolNamedVoice = (sessionId: string, from: string, to: string, changed: number[]): number => {
+    if (!isPlaceholderLabel(from) || isPlaceholderLabel(to) || changed.length === 0) return 0
+    let enrolled = 0
+    try {
+      for (const row of chunkEmbeddingsForIndices(sessionId, changed)) {
+        if (!row.embedding) continue
+        if (enrollEmbedding(to, row.embedding, 'meeting-relabel').success) enrolled += 1
+      }
+    } catch {
+      // Enrolment is a bonus on top of the relabel. A voice store that refuses must
+      // not fail the rename the user actually asked for.
+      return enrolled
+    }
+    return enrolled
+  }
+
   router.post('/meeting/:sessionId/relabel', (req, res) => {
     res.set('Cache-Control', 'private, no-store')
     const sessionId = String(req.params.sessionId ?? '')
@@ -1150,7 +1191,29 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       proseStale: preview.proseStale,
     })
 
-    res.json({ ok: true, correctionId: id, ...preview })
+    // Enrol AFTER the sidecar and ledger are durable: the rename is the thing the
+    // user asked for, and a voice store that refuses must not undo it. Reported so
+    // the panel can say a profile was created rather than leaving the user to
+    // discover, in another meeting, that it was not.
+    // DISABLED in 6.27.11. 6.27.10 shipped this joining the WRONG INDEX SPACE:
+    // `plan.value.changed` are positions in the COMPACTED sidecar array
+    // (meeting-relabel.ts:119, over rows already filtered to those with text) while
+    // the embedding store is keyed on the RAW capture index
+    // (transcribe-stream.ts:1868). They diverge at the first text-less chunk.
+    //
+    // Measured on a live session: naming one voice enrolled 73 of 103 rows belonging
+    // to OTHER people, including 22 chunks of the owner. It reported success because
+    // rows do come back — just the wrong ones. 73 of 74 live sessions have gaps, so
+    // this was the normal case.
+    //
+    // `attachRawChunkIndices` is the conversion for this and is imported at line 126,
+    // used correctly by the review path at 755 and 856. Re-enable only WITH that
+    // mapping, a refusal when the mapping is unavailable, a coherence gate (an `Ext`
+    // bucket is many voices — 98% of its pairwise cosines fall below the identifier's
+    // own 0.55 accept threshold), and a `correction:<sessionId>` source tag so the
+    // samples are human-tier, quota-protected and retractable.
+    const enrolled = 0
+    res.json({ ok: true, correctionId: id, enrolledEmbeddings: enrolled, ...preview })
   })