@gotcos/glasses-server 6.73.0 → 6.73.3

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 6.73.3 — Speaker identity policy and exact Codex child sessions
+
+- Preserve the original child Codex session when reading completed job details. Control can open the actual result without substituting the parent conversation or starting another model turn.
+- Support Standard, High-confidence only and Anonymous / video identity policies per recording. Capture the policy before asynchronous audio processing and retain it through live chunks, stream decoding and finalization. Anonymous audio remains transcribed without naming or training known voices; strict policies cannot inherit weaker cached identity results.
+- Add authenticated, revision-guarded policy reads and updates for the matched Control 0.5.290 (343). Existing clients keep the standard policy; existing named segments require explicit correction. Global voice profiles remain intact.
+- Fix release metadata after the installed private 6.73.2 candidate failed its changelog/version gate. Preserve that installed artifact; this corrected package uses a new version.
+- No transcription model selections, second-opinion/resolver experiments or cue flags are enabled by this update. Companion 640 remains compatible; physical Control/phone/G2 acceptance remains separate from automated server gates.
+
+## 6.73.1 — GPT tier selection correction
+
+- Resolve GPT Max/Frontier to the newest provider-described frontier model and GPT Balanced to the newest workhorse/balanced model. A newer workhorse version no longer displaces a frontier model: GPT-6-Astra serves Max, GPT-6.1-Sol serves Balanced in the current catalog.
+- Keep version-based selection when the provider does not describe both tiers; preserve saved tier preferences, explicit model overrides, discovery refresh, and last-known-good fallback.
+- Server catalog and execution share the corrected selection. Existing companion builds can receive the correction without an EHPK update. No transcription settings or experimental flags change.
+
 ## [6.73.0] - 2026-10-13 - Prompts and dictation follow the speech-to-text settings
 
 Paired clients: none required. Every phone, including the public 618, already accepts the new dictation text (it never checks a model on dictation). COS Control and the phone can read the new `dictation` block in `GET /api/stt-settings` to replace "Dictation is unchanged" in their copy.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.73.0",
+  "version": "6.73.3",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -45,6 +45,7 @@
     "!server/scripts/hq-contention-canary.ts",
     "!server/scripts/live-cos-ask-canary.ts",
     "!server/scripts/work-review-candidate.ts",
+    "!server/scripts/work-session-identity-canary.ts",
     "!server/scripts/work-hardening-fixture.ts",
     "!server/scripts/work-review-mutation-gate.mjs",
     "!server/scripts/work-intake-mutation-gate.mjs",

package/server/lib/agent-session-store.ts

@@ -1671,7 +1671,12 @@ export async function parseAgentSession(
   let title = provider === 'codex' ? (opts.codexThreadName ?? '').trim() : ''
   let project = ''
   let gitBranch = ''
-  let sessionId = path.split('/').pop()?.replace(/\.jsonl$/, '') || ''
+  const filename = path.split('/').pop() || ''
+  // A forked Codex rollout can retain its parent's session_meta. Use the same
+  // filename identity as the list so details, signals and associations target
+  // the child we actually opened. Legacy filenames still use metadata below.
+  const codexFileId = provider === 'codex' ? idFromCodexFilename(filename) : null
+  let sessionId = codexFileId ?? filename.replace(/\.jsonl$/, '')
   let firstPrompt = ''
   let latestAssistant = ''
   let latestReply = ''
@@ -1797,7 +1802,7 @@ export async function parseAgentSession(
       if (obj.type === 'session_meta' && obj.payload && typeof obj.payload === 'object') {
         const payload = obj.payload as Record<string, unknown>
         if (typeof payload.cwd === 'string') project = workspaceLabel(payload.cwd)
-        if (typeof payload.id === 'string' && payload.id) sessionId = payload.id
+        if (!codexFileId && typeof payload.id === 'string' && payload.id) sessionId = payload.id
         const git = payload.git && typeof payload.git === 'object' ? payload.git as Record<string, unknown> : null
         if (git && typeof git.branch === 'string') gitBranch = git.branch
         continue

package/server/lib/batch-transcript-quality.ts

@@ -1,3 +1,4 @@
+import type { SpeakerMode } from './meeting-speaker-policy.js'
 import type { WhisperWord } from './whisper-local.js'
 import type { Disagreement } from './stt-resolver.js'
 
@@ -7,6 +8,7 @@ export interface BatchSegment {
   startElapsed: number
   endElapsed: number
   speakers: string[]
+  speakerPolicy?: SpeakerMode
 }
 
 /** One hypothesis as an engine heard it, before any resolution (6.72.0). */

package/server/lib/codex-model-catalog.ts

@@ -50,7 +50,7 @@ export interface CodexModelCatalog {
   source: CodexCatalogSource
   refreshedAt: string
   autoUpdates: true
-  selectionPolicy: 'newest-generation-top-two'
+  selectionPolicy: 'capability-tiers-then-newest-generation'
   options: CodexModelOption[]
   refreshError?: string
 }
@@ -93,13 +93,24 @@ function isCapabilityCandidate(model: CodexCatalogModel): boolean {
   return !/(?:fast and affordable|cost-efficient|small,? fast|ultra-fast)/i.test(model.description)
 }
 
-/** Select two full-size models from the newest visible GPT generation. */
+/** Prefer the provider's frontier/workhorse tiers; use generation order when
+ * the catalog does not describe both tiers. A newer workhorse (6.1 Sol) must
+ * not replace the frontier (6 Astra) merely because its version is higher.
+ */
 export function selectTopCodexModels(models: CodexCatalogModel[]): CodexCatalogModel[] {
   const visible = models.filter(model => !model.hidden && versionParts(model.id))
   if (visible.length === 0) return []
 
   const capable = visible.filter(isCapabilityCandidate)
   const pool = capable.length > 0 ? capable : visible
+  const byNewest = (candidates: CodexCatalogModel[]): CodexCatalogModel | undefined =>
+    candidates.slice().sort((a, b) => compareVersionsDesc(versionParts(a.id) ?? [], versionParts(b.id) ?? []))[0]
+  const frontier = byNewest(pool.filter(model => /\bfrontier\b/i.test(model.description)))
+  const balanced = byNewest(pool.filter(model =>
+    !/\bfrontier\b/i.test(model.description) && /\b(workhorse|balanced)\b/i.test(model.description),
+  ))
+  if (frontier && balanced) return [frontier, balanced]
+
   const versions = pool
     .map(model => versionParts(model.id))
     .filter((parts): parts is number[] => !!parts)
@@ -144,7 +155,7 @@ export function buildCodexModelCatalog(
     source,
     refreshedAt,
     autoUpdates: true,
-    selectionPolicy: 'newest-generation-top-two',
+    selectionPolicy: 'capability-tiers-then-newest-generation',
     options,
   }
 }
@@ -163,7 +174,7 @@ function cliDefaultCatalog(refreshError?: string): CodexModelCatalog {
     source: 'cli-default',
     refreshedAt: new Date().toISOString(),
     autoUpdates: true,
-    selectionPolicy: 'newest-generation-top-two',
+    selectionPolicy: 'capability-tiers-then-newest-generation',
     options: [
       { ...common, preference: CODEX_FRONTIER_MODEL, displayName: 'GPT Frontier (auto)' },
       { ...common, preference: CODEX_BALANCED_MODEL, displayName: 'GPT Balanced (auto)', isDefault: false },

package/server/lib/meeting-batch-transcribe.ts

@@ -23,6 +23,7 @@ import { currentEffectiveStt } from './stt-runtime.js'
 import { transcribeParakeet, type ParakeetResult, type ParakeetRunOptions } from './parakeet.js'
 import { isDeletionProneEngine, resolveHypotheses, RESOLVER_VERSION, type Hypothesis } from './stt-resolver.js'
 import { getVocabulary } from './profile.js'
+import { captureSpeakerMode, policyLabel } from './meeting-speaker-policy.js'
 import { durableAtomicWriteFileSync } from './atomic-fs.js'
 import { isMetalBatchPreempted } from './whisper-metal-gate.js'
 import {
@@ -116,6 +117,20 @@ export function segmentTranscriptChunks(
       segmentStartPosition = position
       continue
     }
+    // Close before the first chunk captured under a different identity policy.
+    // A named Standard chunk must never lend its name to anonymous audio.
+    if (position > segmentStartPosition && captureSpeakerMode(chunk.speakerPolicy) !== captureSpeakerMode(first.chunk.speakerPolicy)) {
+      const window = entries.slice(segmentStartPosition, position)
+      const last = window.at(-1)!
+      segments.push({
+        startChunkIdx: first.chunkIndex, endChunkIdx: last.chunkIndex,
+        startElapsed: first.chunk.elapsed, endElapsed: last.chunk.elapsed,
+        speakers: [...new Set(window.map(item => policyLabel(item.chunk, captureSpeakerMode(item.chunk.speakerPolicy)).speaker).filter(speaker => speaker && speaker !== 'Ext'))],
+        speakerPolicy: captureSpeakerMode(first.chunk.speakerPolicy),
+      })
+      segmentStartPosition = position
+      continue
+    }
     if (chunk.elapsed - first.chunk.elapsed >= targetMs && position > segmentStartPosition) {
       const window = entries.slice(segmentStartPosition, position + 1)
       segments.push({
@@ -123,7 +138,8 @@ export function segmentTranscriptChunks(
         endChunkIdx: entry.chunkIndex,
         startElapsed: first.chunk.elapsed,
         endElapsed: chunk.elapsed,
-        speakers: [...new Set(window.map(item => item.chunk.speaker).filter(speaker => speaker && speaker !== 'Ext'))],
+        speakers: [...new Set(window.map(item => policyLabel(item.chunk, captureSpeakerMode(item.chunk.speakerPolicy)).speaker).filter(speaker => speaker && speaker !== 'Ext'))],
+        speakerPolicy: captureSpeakerMode(first.chunk.speakerPolicy),
       })
       segmentStartPosition = position + 1
     }
@@ -139,7 +155,8 @@ export function segmentTranscriptChunks(
         endChunkIdx: last.chunkIndex,
         startElapsed: first.chunk.elapsed,
         endElapsed: last.chunk.elapsed,
-        speakers: [...new Set(window.map(item => item.chunk.speaker).filter(speaker => speaker && speaker !== 'Ext'))],
+        speakers: [...new Set(window.map(item => policyLabel(item.chunk, captureSpeakerMode(item.chunk.speakerPolicy)).speaker).filter(speaker => speaker && speaker !== 'Ext'))],
+        speakerPolicy: captureSpeakerMode(first.chunk.speakerPolicy),
       })
     }
   }
@@ -173,6 +190,12 @@ export function mapWordsToSpeakers(
   segment: BatchSegment,
   entries: IndexedTranscriptChunk[],
 ): Array<{ word: string; start: number; end: number; speaker: string; similarity: number }> {
+  const window = entries.filter(entry => entry.chunkIndex >= segment.startChunkIdx && entry.chunkIndex <= segment.endChunkIdx)
+  const policies = new Set(window.map(entry => captureSpeakerMode(entry.chunk.speakerPolicy)))
+  const strict = captureSpeakerMode(segment.speakerPolicy) !== 'standard' || [...policies].some(mode => mode !== 'standard')
+  // Defensive gate for caller-provided/cached mixed windows, even though the
+  // segmenter now splits them. Without precise spans, retain words anonymously.
+  const mixedStrict = strict && policies.size > 1
   return words.map(word => {
     const absoluteElapsed = segment.startElapsed + word.start * 1000
     let speaker = segment.speakers[0] || 'Unknown'
@@ -184,14 +207,16 @@ export function mapWordsToSpeakers(
       const distance = Math.abs(chunk.elapsed - absoluteElapsed)
       if (distance < bestDistance) {
         bestDistance = distance
-        speaker = chunk.speaker
-        similarity = Number.isFinite(chunk.similarity) ? chunk.similarity : 0
+        const label = policyLabel(chunk, captureSpeakerMode(chunk.speakerPolicy))
+        speaker = label.speaker
+        similarity = Number.isFinite(label.similarity) ? label.similarity : 0
       }
     }
     if (bestDistance > 3_500) {
-      speaker = segment.speakers[0] || 'Unknown'
+      speaker = strict ? 'Ext' : segment.speakers[0] || 'Unknown'
       similarity = 0
     }
+    if (mixedStrict || captureSpeakerMode(segment.speakerPolicy) === 'anonymous') { speaker = 'Ext'; similarity = 0 }
     return { word: word.word, start: word.start, end: word.end, speaker, similarity }
   })
 }
@@ -322,6 +347,7 @@ function readProgressiveCheckpointMetadata(
     || cached.segment.endChunkIdx !== segment.endChunkIdx
     || cached.segment.startElapsed !== segment.startElapsed
     || cached.segment.endElapsed !== segment.endElapsed
+    || captureSpeakerMode(cached.segment.speakerPolicy) !== captureSpeakerMode(segment.speakerPolicy)
     || !Array.isArray(cached.segment.speakers)
     || cached.segment.speakers.some(speaker => typeof speaker !== 'string')
     || typeof cached.text !== 'string'

package/server/lib/meeting-speaker-policy.ts

@@ -0,0 +1,45 @@
+// Per-capture identity matching. Transcription continues when names are withheld.
+import { readFileSync, mkdirSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { join } from 'node:path'
+import { dataPath } from './data-dir.js'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { AUTO_ENROLL_THRESHOLD } from './voiceprint-floor.js'
+
+export const SPEAKER_MODES = ['standard', 'high-confidence', 'anonymous'] as const
+export type SpeakerMode = typeof SPEAKER_MODES[number]
+export function isSpeakerMode(value: unknown): value is SpeakerMode {
+  return typeof value === 'string' && SPEAKER_MODES.includes(value as SpeakerMode)
+}
+function path(sessionId: string): string {
+  if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) throw new Error('Invalid session ID')
+  return join(dataPath('speaker-policy'), createHash('sha256').update(sessionId).digest('hex') + '.json')
+}
+export function readSpeakerPolicy(sessionId: string): { mode: SpeakerMode; revision: string; error?: string } {
+  try {
+    const raw = readFileSync(path(sessionId), 'utf8')
+    const value = JSON.parse(raw)
+    if (value.sessionId !== sessionId || !isSpeakerMode(value.mode)) throw new Error('Invalid speaker policy')
+    return { mode: value.mode, revision: createHash('sha256').update(raw).digest('hex') }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { mode: 'standard', revision: 'unset' }
+    // Corrupt policy must never silently restore identity matching.
+    return { mode: 'anonymous', revision: 'unreadable', error: String(error) }
+  }
+}
+export function writeSpeakerPolicy(sessionId: string, mode: SpeakerMode, expectedRevision: string): void {
+  if (!isSpeakerMode(mode)) throw new Error('Invalid speaker mode')
+  if (readSpeakerPolicy(sessionId).revision !== expectedRevision) throw new Error('Speaker policy changed; refresh first')
+  mkdirSync(dataPath('speaker-policy'), { recursive: true, mode: 0o700 })
+  durableAtomicWriteFileSync(path(sessionId), JSON.stringify({ sessionId, mode }), { mode: 0o600 })
+}
+export function policyLabel<T extends { speaker: string; similarity?: number | null }>(value: T, mode: SpeakerMode): T {
+  if (mode === 'standard') return value
+  if (mode === 'high-confidence' && typeof value.similarity === 'number' && Number.isFinite(value.similarity) && value.similarity >= AUTO_ENROLL_THRESHOLD && value.similarity <= 1) return value
+  return { ...value, speaker: 'Ext', similarity: 0 }
+}
+
+/** Missing markers are legacy Standard. Malformed markers fail closed. */
+export function captureSpeakerMode(value: unknown): SpeakerMode {
+  return value === undefined ? 'standard' : isSpeakerMode(value) ? value : 'anonymous'
+}

package/server/lib/nemotron-final.ts

@@ -67,6 +67,7 @@ import {
   type TokenTime,
   wavHeader,
 } from './nemotron-segments.js'
+import { captureSpeakerMode, type SpeakerMode } from './meeting-speaker-policy.js'
 import { NEMOTRON_CHANNELS } from './nemotron-cli.js'
 import type { WhisperWord } from './whisper-local.js'
 
@@ -92,6 +93,7 @@ export interface SidecarChunk {
   speaker: string
   elapsed: number
   similarity: number
+  speakerPolicy?: SpeakerMode
   words?: WhisperWord[]
   segments?: ChunkSpeakerSegment[]
   evenHubSpeakerRole?: EvenRole
@@ -631,7 +633,7 @@ export const FINAL_REASON_CODES = [
   'no_transcript', 'already_applied', 'no_chunks', 'nemotron_timeout', 'nemotron_cli_failed',
   'nemotron_bad_output', 'nemotron_spawn_failed', 'nemotron_error', 'no_speaker_words', 'chunk_map_ambiguous',
   'word_mismatch', 'no_change', 'changed_during_pass', 'markdown_write', 'sidecar_restore_failed', 'too_long',
-  'metadata_not_persisted', 'error',
+  'metadata_not_persisted', 'speaker_policy', 'error',
 ] as const
 export type FinalReasonCode = typeof FINAL_REASON_CODES[number]
 const REASON_SET: ReadonlySet<string> = new Set(FINAL_REASON_CODES)
@@ -793,6 +795,13 @@ async function finalPassNow(options: FinalPassOptions): Promise<FinalPassOutcome
   }
   const entries = (Array.isArray(sidecar.chunkEntries) ? sidecar.chunkEntries : []) as SidecarEntry[]
   if (!entries.length) return { status: 'skipped', reason: 'no_chunks' }
+  // Final diarization builds meeting-wide channel/name maps. Earlier Standard
+  // identities cannot safely authorize names for later strict-policy audio.
+  // Preserve the canonical transcript (including earlier names) byte-for-byte.
+  if (entries.some(entry => captureSpeakerMode(entry.chunk.speakerPolicy) !== 'standard')
+    || (Array.isArray(sidecar.chunks) && sidecar.chunks.some((chunk: SidecarChunk) => captureSpeakerMode(chunk.speakerPolicy) !== 'standard'))) {
+    return { status: 'skipped', reason: 'speaker_policy' }
+  }
 
   const timeline = await buildMeetingTimeline(entries, options.audioDir)
   const excluded = timeline.excluded

package/server/lib/speaker-embeddings.ts

@@ -42,7 +42,7 @@ const require = createRequire(import.meta.url)
 const __dirname = fileURLToPath(new URL('.', import.meta.url))
 
 import { DATA_DIR } from './data-dir.js'
-import { OWNER_VERIFY_SIMILARITY } from './voiceprint-floor.js'
+import { AUTO_ENROLL_THRESHOLD, OWNER_VERIFY_SIMILARITY } from './voiceprint-floor.js'
 
 export const SPEAKER_MODEL_FILENAME = '3dspeaker_speech_eres2net_sv_en_voxceleb_16k.onnx'
 
@@ -92,7 +92,8 @@ const SEARCH_THRESHOLD = 0.55
 /** The bar `autoEnroll` enrols at. From 6.45.4 also the bar at which a held
  *  group is offered as a person with one click ("high"): the identifier would
  *  have written that sample itself. */
-export const AUTO_ENROLL_THRESHOLD = 0.88    // High bar — must be very confident before auto-enrolling
+export { AUTO_ENROLL_THRESHOLD } from './voiceprint-floor.js'
+
 /** The live path only ASKS autoEnroll about a chunk above this; autoEnroll
  *  then applies AUTO_ENROLL_THRESHOLD. Named so transcribe-stream and the
  *  held-voice panel read the same number (6.45.4). */
@@ -375,9 +376,10 @@ export function identifySpeaker(
   expectedSpeakers?: string[],
   /** 6.61.0: `event` tags the calibration rows, e.g. 'nemotron-track' for one
    *  Nemotron track's audio, so they are never read as whole-chunk checks. */
-  options: { event?: string } = {},
+  options: { event?: string; minSimilarity?: number } = {},
 ): { speaker: string; similarity: number; embedding?: Float32Array } | null {
   if (!extractor || !manager) return null
+  const minimum = Number.isFinite(options.minSimilarity) ? Math.max(0, Math.min(1, options.minSimilarity!)) : 0
 
   try {
     const embedding = extractEmbeddingFromWav(wavBuffer)
@@ -386,7 +388,7 @@ export function identifySpeaker(
     // If the wearer is enrolled, verify against them first (they're wearing the glasses)
     const owner = getOwnerSpeakerLabel()
     if (manager.contains(owner)) {
-      const isOwner = manager.verify({ name: owner, v: embedding, threshold: VERIFY_THRESHOLD })
+      const isOwner = manager.verify({ name: owner, v: embedding, threshold: Math.max(VERIFY_THRESHOLD, minimum) })
       if (isOwner) {
         const similarity = computeCosineSimilarity(embedding, owner)
         logCalibration(owner, similarity, true, options.event)
@@ -399,7 +401,7 @@ export function identifySpeaker(
       for (const name of expectedSpeakers) {
         if (name === owner) continue // wearer already checked
         if (!manager.contains(name)) continue
-        const matches = manager.verify({ name, v: embedding, threshold: SEARCH_THRESHOLD })
+        const matches = manager.verify({ name, v: embedding, threshold: Math.max(SEARCH_THRESHOLD, minimum) })
         if (matches) {
           const similarity = computeCosineSimilarity(embedding, name)
           logCalibration(name, similarity, true, options.event)
@@ -409,7 +411,7 @@ export function identifySpeaker(
     }
 
     // Full search across all speakers (fallback or no expected speakers)
-    const found = manager.search({ v: embedding, threshold: SEARCH_THRESHOLD })
+    const found = manager.search({ v: embedding, threshold: Math.max(SEARCH_THRESHOLD, minimum) })
     if (found && found.length > 0) {
       const similarity = computeCosineSimilarity(embedding, found)
       logCalibration(found, similarity, true, options.event)

package/server/lib/voiceprint-floor.ts

@@ -10,3 +10,6 @@ export const VOICEPRINT_MIN_AUDIO_SEC = 2.0
  *  back as the wearer between 0.55 and 0.65 without ever passing owner verify;
  *  6.61.1 refuses that for a split track (it named other people as the wearer). */
 export const OWNER_VERIFY_SIMILARITY = 0.65
+
+/** Existing auto-enrollment floor; strict meeting recognition uses the same bar. */
+export const AUTO_ENROLL_THRESHOLD = 0.88

package/server/routes/meeting.ts

@@ -1,3 +1,4 @@
+import { readSpeakerPolicy, writeSpeakerPolicy, isSpeakerMode } from '../lib/meeting-speaker-policy.js'
 // POST /api/meeting/save — finalize an existing transcribe-stream session into
 // the standalone public meeting store. The live transcript and chunk metadata
 // are durable before the session is closed; batch improvement runs afterward.
@@ -952,6 +953,36 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
 
   // (safeDirectoryRealpath / safeReadFile) instead of reassembling a path from
   // client-supplied domain and filename components.
+  router.get('/meeting/:sessionId/speaker-policy', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) { res.status(400).json({ error: 'Invalid session ID' }); return }
+    if (sessions.getStartTime(sessionId) === null && !findCosOperationsMeetingBySessionId(sessionId) && !store.findBySessionId(sessionId)) {
+      res.status(404).json({ error: 'Meeting not found' }); return
+    }
+    res.set('Cache-Control', 'private, no-store').json(readSpeakerPolicy(sessionId))
+  })
+  router.post('/meeting/:sessionId/speaker-policy', (req, res) => {
+    const sessionId = String(req.params.sessionId ?? '')
+    const refusal = assertVoiceEvidenceSource([sessionId]) ?? refuseDerivedMutation(req.body?.recordId)
+    if (refusal) { res.status(refusal.status).json(refusal.body); return }
+    if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId) || !isSpeakerMode(req.body?.mode) || typeof req.body?.expectedPolicyRevision !== 'string') {
+      res.status(400).json({ error: 'A valid session, mode and policy revision are required' }); return
+    }
+    const operations = findCosOperationsMeetingBySessionId(sessionId)
+    const saved = operations ? null : store.findBySessionId(sessionId)
+    if (!operations && !saved && sessions.getStartTime(sessionId) === null) { res.status(404).json({ error: 'Meeting not found' }); return }
+    if (operations || saved) {
+      const selected = operations ? `ops:${operations.domain}:${operations.month}:${operations.filename}` : `standalone:${sessionId}`
+      if (req.body?.recordId !== selected) { res.status(409).json({ error: 'Reopen the selected meeting' }); return }
+      const sourceRefusal = sourceRevisionRefusal(sessionId, req.body) ?? finalizingRefusal(sessionId)
+      if (sourceRefusal) { res.status(sourceRefusal.status).json(sourceRefusal.body); return }
+    }
+    try {
+      writeSpeakerPolicy(sessionId, req.body.mode, req.body.expectedPolicyRevision)
+      res.json({ ...readSpeakerPolicy(sessionId), message: 'Matching changed for new audio. Existing names are unchanged.' })
+    } catch (error) { res.status(409).json({ error: String(error) }); }
+  })
+
   router.get('/meeting/:sessionId/speakers', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
     if (!/^[A-Za-z0-9:_-]{3,96}$/.test(sessionId)) {
@@ -1041,6 +1072,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       domain,
       filename,
       ...identity,
+      speakerPolicy: readSpeakerPolicy(sessionId),
       reviewIdentityVersion: 1,
       sourceRevision: reviewRevision(operations?.meetingPath ?? direct?.meetingPath ?? saved!.filepath, sidecarPath),
       ...(operations?.mergedScribeConflict?.length ? { mutable: false, identityConflict: operations.mergedScribeConflict } : {}),

package/server/routes/transcribe-stream.ts

@@ -1,3 +1,5 @@
+import { AUTO_ENROLL_THRESHOLD } from '../lib/voiceprint-floor.js'
+import { readSpeakerPolicy, policyLabel, type SpeakerMode } from '../lib/meeting-speaker-policy.js'
 // POST /api/transcribe-stream — Streaming transcription for continuous meeting capture
 // Uses local Whisper. OpenAI API fallback is disabled by default and requires
 // both COS_OPENAI_WHISPER_FALLBACK=1 and a configured key.
@@ -272,6 +274,8 @@ export interface TranscriptChunk {
   speaker: string
   elapsed: number    // ms since session start
   similarity: number // speaker identification confidence (0-1)
+  /** Capture-time policy survives batch and final passes; absent means legacy Standard. */
+  speakerPolicy?: SpeakerMode
   words?: WhisperWord[] // word-level timestamps from DTW alignment
   asrProvider?: 'server-whisper' | 'iphone-whisperkit-beta'
   backend?: string
@@ -2061,15 +2065,16 @@ function ownerLabelOrNull(): string | null {
   try { return getOwnerSpeakerLabel() } catch { return null }
 }
 
-function identifyChunkSpeaker(audioBuffer: Buffer, sessionId: string, chunkIndex: number, clientSpeaker: string): { speaker: string; similarity: number } {
+function identifyChunkSpeaker(audioBuffer: Buffer, sessionId: string, chunkIndex: number, clientSpeaker: string, policy: SpeakerMode): { speaker: string; similarity: number } {
+  if (policy === 'anonymous') return { speaker: 'Ext', similarity: 0 }
   const expectedSpeakers = undefined
   const audioDurationSec = Math.max(0, (audioBuffer.length - 44)) / 32000
-  if (!isEmbeddingAvailable() || audioDurationSec < VOICEPRINT_MIN_AUDIO_SEC) return { speaker: clientSpeaker, similarity: 0 }
+  if (!isEmbeddingAvailable() || audioDurationSec < VOICEPRINT_MIN_AUDIO_SEC) return policyLabel({ speaker: clientSpeaker, similarity: 0 }, policy)
 
   const tEmb = performance.now()
-  const embeddingResult = identifySpeaker(audioBuffer, expectedSpeakers)
+  const embeddingResult = identifySpeaker(audioBuffer, expectedSpeakers, { minSimilarity: policy === 'high-confidence' ? AUTO_ENROLL_THRESHOLD : undefined })
   console.log(`[perf] identifySpeaker: ${(performance.now() - tEmb).toFixed(1)}ms`)
-  if (!embeddingResult) return { speaker: clientSpeaker, similarity: 0 }
+  if (!embeddingResult) return policyLabel({ speaker: clientSpeaker, similarity: 0 }, policy)
 
   // Bank the embedding before anything else can return. This is the only moment
   // it exists: identifySpeaker computes it per chunk and nothing else keeps it,
@@ -2079,25 +2084,25 @@ function identifyChunkSpeaker(audioBuffer: Buffer, sessionId: string, chunkIndex
   if (embeddingResult.embedding) {
     appendChunkEmbedding(sessionId, {
       i: chunkIndex,
-      speaker: embeddingResult.speaker,
+      speaker: policyLabel(embeddingResult, policy).speaker,
       similarity: embeddingResult.similarity,
       embedding: embeddingResult.embedding,
     })
   }
 
-  let speaker = embeddingResult.speaker
+  let speaker = policyLabel(embeddingResult, policy).speaker
   if (speaker !== clientSpeaker) {
     console.log(`[speaker] Embedding: ${speaker} vs Amplitude: ${clientSpeaker} (sim: ${embeddingResult.similarity.toFixed(2)})`)
   }
 
-  if (embeddingResult.similarity >= AUTO_ENROLL_CANDIDATE_SIMILARITY && speaker !== 'Ext') {
+  if (policy === 'standard' && embeddingResult.similarity >= AUTO_ENROLL_CANDIDATE_SIMILARITY && speaker !== 'Ext') {
     const enrollResult = autoEnroll(speaker, audioBuffer, embeddingResult.similarity, sessionId)
     if (enrollResult.enrolled) {
       console.log(`[speaker] Auto-enrolled ${speaker} from G2 mic (sim: ${embeddingResult.similarity.toFixed(3)})`)
     }
   }
 
-  if (speaker !== 'Ext' && embeddingResult.similarity > 0.50) {
+  if (policy === 'standard' && speaker !== 'Ext' && embeddingResult.similarity > 0.50) {
     // Audio has its own count and TTL. A full profile still needs examples
     // from new meetings; deleting/expiring old audio immediately frees a slot.
     try {
@@ -2208,6 +2213,9 @@ async function processStreamChunk(opts: {
     return emptyChunkResponse(alreadyEmpty, sessionId, chunkIndex)
   }
 
+  // Pin identity policy at acceptance, before persistence, ASR or diarization
+  // yields. A later loosening applies to the next chunk, never this audio.
+  const capturePolicy = readSpeakerPolicy(sessionId).mode
   await persistRawSessionAudioChunk(sessionId, chunkIndex, audioBuffer)
   // Commit the received-index ledger only after the canonical raw WAV is
   // durable. A failure is typed non-2xx and a retry remains safe.
@@ -2237,7 +2245,7 @@ async function processStreamChunk(opts: {
   const whisperContext = recentWhisperContext(sessionId, session)
   console.log(`[perf] whisperContext: ${whisperContext.length}b | session.chunks: ${session.chunks.length}`)
 
-  const speakerPromise = Promise.resolve(identifyChunkSpeaker(audioBuffer, sessionId, chunkIndex, clientSpeaker))
+  const speakerPromise = Promise.resolve(identifyChunkSpeaker(audioBuffer, sessionId, chunkIndex, clientSpeaker, capturePolicy))
 
   let rawText = ''
   let words: WhisperWord[] | undefined
@@ -2312,13 +2320,16 @@ async function processStreamChunk(opts: {
         clientSpeaker,
         owner: ownerLabelOrNull(),
         identify: wav => {
-          const named = identifySpeaker(wav, undefined, { event: 'nemotron-track' })
-          return named ? { speaker: named.speaker, similarity: named.similarity } : null
+          const policy = capturePolicy
+          if (policy === 'anonymous') return { speaker: 'Ext', similarity: 0 }
+          const named = identifySpeaker(wav, undefined, { event: 'nemotron-track', minSimilarity: policy === 'high-confidence' ? AUTO_ENROLL_THRESHOLD : undefined })
+          return named ? policyLabel({ speaker: named.speaker, similarity: named.similarity }, policy) : null
         },
       })
     : { speaker: voiceprint.speaker, similarity: voiceprint.similarity }
   if (labels.record) nemotronLive.record({ sessionId, chunkIndex }, labels.record)
-  const { speaker, similarity } = labels
+  const { speaker, similarity } = policyLabel(labels, capturePolicy)
+  if (labels.segments) labels.segments = labels.segments.map(segment => policyLabel(segment, capturePolicy))
 
   if (!trimmedText) {
     console.log(`[hallucination] Filtered (${sanitized.fallbackReason || fallbackReason || 'empty'}): "${rawText.slice(0, 60)}"`)
@@ -2346,6 +2357,7 @@ async function processStreamChunk(opts: {
 
   const chunk: TranscriptChunk = {
     text: trimmedText,
+    speakerPolicy: capturePolicy,
     speaker,
     elapsed,
     similarity,