fix(amispoof): incident-aware threat type + COOP/COEP multi-threading + drop dead launcher.js#90
Merged
Conversation
…ncher.js
THREAT TYPE (user-reported 2026-06-01): a low-light phone replay was
verdicted SPOOF correctly but labelled 'static_image' — wrong, since it
visibly moves (12 blinks) and fired 30 video_replay incidents. Root cause:
dominant_threat was taken purely from the fooled fusion category_scores
(static_image 0.08 > video_replay 0.06), ignoring the incidents that
actually flipped the verdict. SessionEngine.getVerdict() now:
1. lets the most-frequent incident category name the threat, and
2. re-labels static_image to the strongest dynamic category when >=1 blink
was observed (a frozen photo cannot blink).
Label-only change; the live/spoof decision is untouched. +2 locking tests
(254 -> 256 green), typecheck clean.
COOP/COEP: add Cross-Origin-Opener-Policy + Cross-Origin-Embedder-Policy to
the amispoof .htaccess so the live domain gets SharedArrayBuffer ->
multi-threaded ORT WASM (was single-threaded; local server.mjs already had
these, which is why local fps was higher). Verified safe: every cross-origin
subresource is jsdelivr, which sends ACAO:* + CORP:cross-origin. Rollback =
delete the two header lines.
LAUNCHER: remove the dead https://app.fivucsas.com/launcher.js script — it is
unused on amispoof (no FivucsasAuth/login references), was throwing a CORS
error in console, and was the only COEP-non-compliant resource on the page.
tooling: notebooks/yolo_bench.py (CVZone YOLOv8 fake/real benchmark, +--imgsz)
and notebooks/v3_check.py (per-session V3 separability summary).
Cache-bust -> 2026-06-01-threat-coop (HTML + app.js + lib import).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ahmetabdullahgultekin
added a commit
that referenced
this pull request
Jun 1, 2026
…in mic (#91) Re-applied on top of #90 (the prior #89 conflicted). Source-verified counts: 23 analyzers (20 active by default; hand + voice/audio opt-in), 18 liveness-proof axes, 3 gates. Fixed across index.html meta/OG/Twitter/JSON-LD + README/ROADMAP/web README. Also microphone=() -> microphone=(self) so the opt-in voice/audio analyzers can actually request mic permission in prod. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three changes, all surfaced by live low-light testing on 2026-06-01.
1. Threat-type attribution (user-reported bug)
A low-light phone replay was correctly verdicted SPOOF but mislabelled
static_image— even though it visibly moves (12 blinks) and fired 30video_replayincidents. Cause:dominant_threatcame purely from the fooled fusioncategory_scores(static_image 0.08 > video_replay 0.06), ignoring the incidents that flipped the verdict.SessionEngine.getVerdict()now:static_image→ strongest dynamic category when ≥1 blink was observed (a frozen photo cannot blink).Label-only — the live/spoof decision is unchanged. +2 locking tests (256 green), typecheck clean.
2. COOP/COEP → multi-threaded WASM on the domain
The live site ran single-threaded ORT (
numThreads … crossOriginIsolatedwarning) because Hostinger sent no COOP/COEP (the localserver.mjsalready does — hence higher local fps). Added both headers to.htaccess. Verified safe: every cross-origin subresource is jsdelivr, which repliesaccess-control-allow-origin: *+cross-origin-resource-policy: cross-origin. Rollback = delete the two lines (Hostinger picks it up instantly).3. Remove dead
launcher.jshttps://app.fivucsas.com/launcher.jsis unused on amispoof (noFivucsasAuth/login refs), threw a CORS error in console every load, and was the only COEP-non-compliant resource — so removing it unblocks #2.Plus tooling:
notebooks/yolo_bench.py(CVZone YOLOv8 fake/real benchmark) +notebooks/v3_check.py(V3 separability summary). Cache-bust →2026-06-01-threat-coop.🤖 Generated with Claude Code