VFTE features
Voice identity and the consent layer — enroll, identify, deletion proof.
VFTE (a.k.a. FPM) is the voice-identity + consent layer. It turns audio into voiceprints, recognizes speakers scoped and consented, and owns the consent plane. It holds voiceprints and consent edges — never audio or transcript content. Everything here is built and merged.
VFTE no longer diarizes — the old
/v1/diarizewas stripped; diarization lives entirely in Capture.
Enrollment & identification
- Enroll (
POST /v1/enroll) — labeled audio + email + workspace → CAM++ 512-d embedding → create-or-strengthen a voiceprint (deterministic id, ≤ 20 exemplars with eviction, k-means sub-centroids, quality gate,enroll_allowedgate). - Identify —
POST /v1/identify(single clip) and the flagshipPOST /v1/identify-spans(pre-diarized spans, vote-locked, retro-relabel, mint-anonymous). Tiers MATCH / AMBIGUOUS / LOW / UNKNOWN with calibrated confidence;live(read-only) vsoffline(write).
See Voiceprints for the mechanics.
Consent plane
The full grammar — subject_consent {allow, anonymous, denied}, id_visibility, enroll_allowed,
propose/confirm/deny, forget/erasure, and recognition transparency (#3c) — is documented at
The consent plane. Permission scoping (#2, merged)
replaced flat scoping with scopes + membership edges.
Ownership & cryptography
| Feature | What it does | Status |
|---|---|---|
Deletion proof (#1) | Ed25519-signed, offline-verifiable deletion receipts; pubkey at GET /v1/deletion-receipt-key, attestation-bound | merged |
Export / import (#4) | Signed voiceprint export + re-import (create-or-merge); cross-model blocked | merged |
Hear-clip capability (#3) | Short-lived Ed25519-signed capability lets a subject play the clip that named them; VFTE never streams bytes | merged |
| At-rest crypto | AES-256-CBC + HMAC-SHA256; master key TEE-sealed → env → dev keyfile | merged |
| Auth / tokens | Scoped, fail-closed M2M tokens + session auth (OAuth / dev-login); per-token rate limits | merged |
Dashboard & product-agnostic design
A Next.js consent dashboard (voiceprint cards: stay-anonymous / pause-enroll / forget + usage
ledger; pending inbox with clip player; recognitions inbox; export/import bar). VFTE stays
product-agnostic by design: an opaque workspace_id, a pluggable consumer string, generic M2M
scopes, and neutral branding — so any app hooks in by passing its own scope + host + token. This
is the basis for VFTE as a service.
Source: FEATURE-SPEC.md §4, FPM/README.md.