VFTEE features
Voice identity and the consent layer — enroll, identify, deletion proof.
VFTEE (a.k.a. FPM) is the voice-identity + consent layer. It turns audio into voiceprints, recognizes speakers scoped and consented, and owns the consent plane. It holds voiceprints and consent edges, never audio or transcript content.
VFTEE no longer diarizes — the old
/v1/diarizewas stripped; diarization lives entirely in Capture.
Enrollment & identification
- Enroll (
POST /v1/enroll) — labeled audio + email + workspace → CAM++ 512-d embedding → create-or-strengthen a voiceprint (deterministic id, ≤ 20 exemplars with eviction, k-means sub-centroids, quality gate,enroll_allowedgate). - Identify —
POST /v1/identify(single clip) and the flagshipPOST /v1/identify-spans(pre-diarized spans, vote-locked, retro-relabel, mint-anonymous). Tiers MATCH / AMBIGUOUS / LOW / UNKNOWN with calibrated confidence;live(read-only) vsoffline(write).
See Voiceprints for the mechanics.
Consent plane
The full grammar — subject_consent {allow, anonymous, denied}, id_visibility, enroll_allowed,
propose/confirm/deny, forget/erasure, and recognition transparency (#3c) — is documented at
The consent plane. Permission scoping (#2, merged)
replaced flat scoping with scopes + membership edges.
Ownership & cryptography
| Feature | What it does | Status |
|---|---|---|
Deletion proof (#1) | Ed25519-signed, offline-verifiable deletion receipts; pubkey at GET /v1/deletion-receipt-key, attestation-bound | merged |
Export / import (#4) | Signed voiceprint export + re-import (create-or-merge); cross-model blocked | merged |
Hear-clip capability (#3) | Short-lived Ed25519-signed capability lets a subject play the clip that named them; VFTEE never streams bytes | merged |
| At-rest crypto | AES-256-CBC + HMAC-SHA256; master key TEE-sealed → env → dev keyfile | merged |
| Auth / tokens | Scoped, fail-closed M2M tokens + session auth (OAuth / dev-login); per-token rate limits | merged |
Dashboard & product-agnostic design
A Next.js consent dashboard (voiceprint cards: stay-anonymous / pause-enroll / forget + usage
ledger; pending inbox with clip player; recognitions inbox; export/import bar). VFTEE stays
product-agnostic by design: an opaque workspace_id, a pluggable consumer string, generic M2M
scopes, and neutral branding — so any app hooks in by passing its own scope + host + token. This
is the basis for VFTEE as a service.