Rollingcat-Software · ahmetabdullahgultekin · Jun 1, 2026
diff --git a/README.md b/README.md
@@ -237,7 +237,7 @@ Browser TypeScript port (`web/`, published as `@rollingcat/spoof-detector`):
 - [ ] amispoof.com domain (currently `/amispoof/` slug on fivucsas.com).
 - [ ] iBeta PAD-Level-1 browser-bundle submission package.
 
-Live tester: https://amispoof.fivucsas.com/ (the old https://fivucsas.com/amispoof/ now 301s) — **19 analyzers + 3 gates + 15-axis passive liveness-proof scorer** running entirely client-side. Default-on: 17 analyzers covering the original ten plus the seven blendshape/3D-pose unlocks (eyebrow motion, blink symmetry, gaze, expression dynamics, 3D pose consistency, behavioural pattern, plus temporal + background grid brought across from `src/`). Opt-in extras: background motion (MediaPipe SelfieSegmenter), hand tracking (HandLandmarker), voice-activity + audio-mouth-sync (Web Audio API). Session recording + JSON replay shipped 2026-05-17. See `web/amispoof/README.md` for the deployment runbook and `ROADMAP.md` "Browser Port v0.1.0" for the full module inventory.
+Live tester: https://amispoof.fivucsas.com/ (the old https://fivucsas.com/amispoof/ now 301s) — **23 analyzers + 3 gates + 18-axis passive liveness-proof scorer** running entirely client-side. Default-on: 20 analyzers covering the original ten plus the seven blendshape/3D-pose unlocks (eyebrow motion, blink symmetry, gaze, expression dynamics, 3D pose consistency, behavioural pattern, plus temporal + background grid brought across from `src/`, plus background motion via MediaPipe SelfieSegmenter). Opt-in extras (3): hand tracking (HandLandmarker, `?hand=1`), voice-activity + audio-mouth-sync (Web Audio API, `?audio=1` or the 🎤 button). Session recording + JSON replay shipped 2026-05-17. See `web/amispoof/README.md` for the deployment runbook and `ROADMAP.md` "Browser Port v0.1.0" for the full module inventory.
 
 ## Academic paper
 

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -61,7 +61,7 @@ quality gate, not LIVE/SPOOF); doc + paper audit; PR + production deploy
 
 | Surface | State |
 |---|---|
-| **Browser bundle** (`@rollingcat/spoof-detector` on npm, live at amispoof.fivucsas.com) | **Production** — 19 analyzers, 15-axis proof scorer, 185-pt ceiling; 6.7–9.5 fps Pixel-class Android, 25–30 fps desktop Chrome WebGPU; 217 vitest green |
+| **Browser bundle** (`@rollingcat/spoof-detector` on npm, live at amispoof.fivucsas.com) | **Production** — 23 analyzers (20 active by default; hand & voice/audio opt-in), 3 gates, 18-axis proof scorer, 185-pt ceiling; 6.7–9.5 fps Pixel-class Android, 25–30 fps desktop Chrome WebGPU; 217 vitest green |
 | **Python reference** (`src/`) | **Production** — calibration source-of-truth + ISO/IEC 30107-3 benchmark harness for §6–§8 of the paper; 138 pytest green |
 | **Paper** (`paper/sections/`) | **Browser-first reframe** complete (PR #45); §0/§1/§10 lead with the client-side bundle, Python framed as starting-point + evaluation reference; §7.6 updated with measured browser-port perf numbers |
 | **iBeta PAD-Level-1 submission package** | Scoped to the Python pipeline; re-scope to the browser bundle is a planned next iteration |

diff --git a/web/amispoof/.htaccess b/web/amispoof/.htaccess
@@ -11,7 +11,11 @@
   # X-Robots-Tag intentionally NOT set — /amispoof/ is now publicly
   # indexable per the SEO update (2026-05-16). The page-level meta robots
   # + JSON-LD SoftwareApplication + Open Graph tags are in index.html.
-  Header always set Permissions-Policy 'camera=(self), microphone=()'
+  # microphone=(self) so the opt-in voice / audio-mouth-sync analyzers
+  # (🎤 button / ?audio=1) can request mic permission. Was microphone=()
+  # which hard-disabled the mic at the HTTP layer and silently killed the
+  # opt-in audio feature in prod.
+  Header always set Permissions-Policy 'camera=(self), microphone=(self)'
 </IfModule>
 
 <IfModule mod_mime.c>

diff --git a/web/amispoof/README.md b/web/amispoof/README.md
@@ -74,13 +74,20 @@ Both are aggressively cacheable via jsdelivr's `Cache-Control: public, max-age=3
 
 - **Verdict** (LIVE / SPOOF) with confidence percentage and peak-sensitive
   session memory — one sustained spoof burst flips and keeps the verdict.
-- **Twelve analyzers** with live score 0–100, grouped image-track vs
-  video-track per the paper's hybrid architecture:
-  - **Image** — MiniFASNet (w 5.0), Device boundary (0.5),
-    Background grid (1.5), Texture (0.0 by default), Moire (0.0), Screen
-    replay (0.5).
-  - **Video** — Screen flicker (3.0), Micro-tremor (0.5), Landmark
-    variance (2.0), rPPG pulse (0.5), Blink/EAR (0.5), Temporal motion (0.3).
+- **23 analyzers** with live score 0–100 (20 active by default; hand
+  tracking + voice-activity + audio-mouth-sync are opt-in), grouped
+  image-track (5) vs video-track (18) per the paper's hybrid architecture.
+  The canonical list with per-analyzer weights and descriptions is
+  `ANALYZER_ORDER` in `app.js`; the badge weights are overwritten at load
+  time from the lib's exported `DEFAULT_ANALYZER_WEIGHTS` so the UI always
+  reflects the weights the running fuser actually uses. Key signals:
+  - **Image** — MiniFASNet (w 5.0), Device boundary, Background grid,
+    Texture, Moire, Screen replay.
+  - **Video** — Screen flicker (3.0), Micro-tremor, Landmark variance,
+    rPPG pulse, Blink/EAR, Temporal motion, plus the Phase A blendshape /
+    3D-pose unlocks (eyebrow motion, blink symmetry, gaze, expression
+    dynamics, 3D pose consistency, planarity, behavioural pattern) and the
+    Phase D background-motion / hand-tracking / voice analyzers.
   Texture + moire default to weight 0.0 per the paper's §5.3
   anti-correlation finding; consumers can re-enable via constructor
   `analyzerWeights` override.

diff --git a/web/amispoof/index.html b/web/amispoof/index.html
@@ -8,7 +8,7 @@
     <!-- Primary SEO -->
     <meta
       name="description"
-      content="Am I spoof? amispoof answers the question in the browser. Open face anti-spoof + liveness tester — 19 analyzers (MiniFASNet, blink, rPPG, gaze, blendshapes, 3D pose, audio-mouth sync, ...) + 15-axis passive liveness-proof scorer running entirely client-side. No server, no upload. Point your camera at a printed photo or another screen and watch the LIVE / SPOOF verdict flip in seconds."
+      content="Am I spoof? amispoof answers the question in the browser. Open face anti-spoof + liveness tester — 23 analyzers (20 active by default; hand & voice/audio are opt-in) like MiniFASNet, blink, rPPG, gaze, blendshapes, 3D pose, audio-mouth sync, plus an 18-axis passive liveness-proof scorer and 3 gates running entirely client-side. No server, no upload. Point your camera at a printed photo or another screen and watch the LIVE / SPOOF verdict flip in seconds."
     />
     <meta
       name="keywords"
@@ -27,21 +27,21 @@
     <meta property="og:title" content="Am I Spoof? — Live browser face anti-spoof + liveness tester" />
     <meta
       property="og:description"
-      content="Am I spoof? amispoof answers it in the browser. 19 analyzers, 3 gates, and a 15-axis passive liveness-proof scorer via onnxruntime-web + MediaPipe. Test printed-photo, phone-screen replay, deepfake, occlusion and dark-room attacks against a live LIVE/SPOOF verdict in seconds. No server, no upload."
+      content="Am I spoof? amispoof answers it in the browser. 23 analyzers (20 active by default; hand & voice/audio are opt-in), 3 gates, and an 18-axis passive liveness-proof scorer via onnxruntime-web + MediaPipe. Test printed-photo, phone-screen replay, deepfake, occlusion and dark-room attacks against a live LIVE/SPOOF verdict in seconds. No server, no upload."
     />
     <meta property="og:locale" content="en_US" />
     <meta property="og:image" content="https://amispoof.fivucsas.com/og-image.png" />
     <meta property="og:image:width" content="1200" />
     <meta property="og:image:height" content="630" />
     <meta property="og:image:type" content="image/png" />
-    <meta property="og:image:alt" content="amispoof — browser face anti-spoof + liveness proof. LIVE verdict at 97% confidence with per-analyzer scores and a 15-axis passive liveness-proof scorer." />
+    <meta property="og:image:alt" content="amispoof — browser face anti-spoof + liveness proof. LIVE verdict at 97% confidence with per-analyzer scores and an 18-axis passive liveness-proof scorer." />
 
     <!-- Twitter / X card -->
     <meta name="twitter:card" content="summary_large_image" />
     <meta name="twitter:title" content="Am I Spoof? — Browser face anti-spoof + liveness tester" />
     <meta
       name="twitter:description"
-      content="19-analyzer face anti-spoof + 15-axis liveness-proof pipeline running entirely in the browser. No server, no GPU, no upload. Open the page, point your camera at a photo, watch the verdict flip."
+      content="23-analyzer (20 active by default; hand & voice/audio opt-in) face anti-spoof + 18-axis liveness-proof pipeline with 3 gates running entirely in the browser. No server, no GPU, no upload. Open the page, point your camera at a photo, watch the verdict flip."
     />
     <meta name="twitter:image" content="https://amispoof.fivucsas.com/og-image.png" />
     <meta name="twitter:image:alt" content="amispoof verdict panel showing LIVE at 97% confidence, with the per-analyzer scores for MiniFASNet, blink symmetry, gaze, eyebrow motion, 3D pose, and behavioural pattern." />
@@ -91,7 +91,7 @@
             "name": "Am I spoof?",
             "acceptedAnswer": {
               "@type": "Answer",
-              "text": "amispoof answers the question in your browser in a few seconds — open https://amispoof.fivucsas.com/, grant camera access, and the page runs 19 anti-spoof analyzers + a 15-axis passive liveness-proof scorer on your face. The verdict (LIVE or SPOOF) appears in real time with per-axis evidence. Nothing is uploaded — all inference happens client-side in WebAssembly."
+              "text": "amispoof answers the question in your browser in a few seconds — open https://amispoof.fivucsas.com/, grant camera access, and the page runs 23 anti-spoof analyzers (20 active by default; hand & voice/audio are opt-in) + an 18-axis passive liveness-proof scorer and 3 gates on your face. The verdict (LIVE or SPOOF) appears in real time with per-axis evidence. Nothing is uploaded — all inference happens client-side in WebAssembly."
             }
           },
           {