Admin Cockpit · Journey

Journey: Trust & safety voice-abuse monitoring

A source-reconciled journey record for Admin Cockpit — shipped behavior, state boundaries, failure modes, and the automation evidence available today.

automated · 1 spec
9sections6 minread1table
Markdown source
On this page
Journey at a glance
ActorsTrust & safety readerCloned-voice reviewerRights operatorIncident operator
Systems exercisedincidents.mdrights.mdtrust-safety-voice-abuse.mdtrust-safety.md
Automation1 E2E spec(s)

Journey flow#

Generated from the authored steps below — click a node to jump to that section.

flowchart TD s1["1. Inspect cloned-voice cases in the parent w…"] s2["2. Enter the dedicated voice-abuse route"] s3["3. Read and sort alerts"] s4["4. Read revocation-cascade progress"] s5["5. Keep the domain store separate"] s6["6. Keep evaluation evidence separate"] s7["7. Escalate through separate workspaces only"] s1 --> s2 --> s3 --> s4 --> s5 --> s6 --> s7 click s1 href "#1-inspect-cloned-voice-cases-in-the-parent-workspace" click s2 href "#2-enter-the-dedicated-voice-abuse-route" click s3 href "#3-read-and-sort-alerts" click s4 href "#4-read-revocation-cascade-progress" click s5 href "#5-keep-the-domain-store-separate" click s6 href "#6-keep-evaluation-evidence-separate" click s7 href "#7-escalate-through-separate-workspaces-only"

The current Admin implementation monitors voice-abuse evidence; it does not execute a response cascade. The parent /trust-safety workspace renders a seeded cloned-voice review queue. The dedicated /trust-safety/voice-abuse route renders read-only @iris/voice alerts and revocation-cascade progress, but its loader defaults to empty unless another module binds it. No button triages an alert, revokes consent, flags an artifact, notifies a rights holder, or opens an incident.

Surface Data shown Mutation available
Parent trust-safety workspace Cloned-voice cases, target, consent status, match score, detector, assignee None in ClonedVoiceReviewList
Dedicated voice-abuse route Alert id/kind/profile/severity/status/evidence/time Tab switch only
Revocation-cascade tab Profile, reason, initiation, SLA, total/flagged/breached/latency None
@iris/voice domain store Open, triage, resolve, flag-artifact functions Library API, not wired to Admin route

Personas#

  • Trust & safety reader — has the trust-safety workspace scope and inspects the monitoring tables.
  • Cloned-voice reviewer — uses the parent workspace's richer seeded case facts for manual triage context.
  • Rights operator — an adjacent role who would own consent action, but has no handoff control in this panel.
  • Incident operator — may independently open the incident cockpit; no voice-alert escalation is wired here.

Pre-conditions#

  • An admin session exists and has access to trust-safety.
  • The parent workspace detail snapshot contains any cloned-voice review rows to display.
  • The dedicated route receives an AbuseContext from bindVoiceAbuseLoader; without a binding it intentionally renders empty arrays and the current Unix time.
  • AbuseAlert.severity is a numeric value from 0 to 1, not an S1/S2 taxonomy.

Steps#

flowchart LR A[Bound AbuseContext] --> B[Voice-abuse page] B --> C[Alerts table] B --> D[Cascade progress] E[AbuseDetectionStore] -. not wired .-> B F[Consent ledger] -. no route call .-> D G[Incident cockpit] -. no automatic link .-> B

1. Inspect cloned-voice cases in the parent workspace#

  • /trust-safety loads the moderation snapshot and composes ClonedVoiceReviewList among the other safety queues.
  • Rows show case status, priority, abuse category, consent status, voice-match score, suspected target, content/source references, detector model/version, assignee, region, and timestamps.
  • Cases sort by status, then priority, then voice-match score.
  • The list has no row action, detail link, audio player, acknowledge, assignment, or resolution control.
  • Parent offender history is another list in the same snapshot; no case-to-history join is rendered by the cloned-voice component.

2. Enter the dedicated voice-abuse route#

  • A missing session redirects to unauthorized with the dedicated return path.
  • A session lacking the trust-safety workspace scope redirects with forbidden-workspace.
  • An allowed session loads operator view and the bound context in parallel, then renders VoiceAbusePanel inside AdminShell.
  • No production registration path for bindVoiceAbuseLoader is identified by this source audit.

3. Read and sort alerts#

  • The Alerts tab reports open/triaging count and total count.
  • Rows sort by descending numeric severity.
  • Each row exposes alert id, evidence summary, alert kind, profile id, severity, status, and reported timestamp.
  • Severity at or above 0.8 and 0.5 receives progressively stronger row highlighting.
  • The AbuseAlert shape has no caller id, target identity, detector confidence, audio sample, consent-record id, or incident id.
  • There is no alert selection, triage, dismiss, resolve, or evidence-player control.

4. Read revocation-cascade progress#

  • The tab lists each profile id, revocation reason, initiation time, and SLA seconds.
  • reportCascadeProgress derives total artifacts, flagged count, mean flag latency, and overdue unflagged count.
  • Artifact kinds in this contract are voice-clip, transcript, and derivative-merge.
  • The component test proves an unflagged artifact becomes an SLA breach after the window.
  • The UI does not preview scope or call flagArtifactsForRevocation.
  • It does not write a consent ledger, remove media, re-render derivatives, or select take-down/disclosure treatment.

5. Keep the domain store separate#

  • AbuseDetectionStore can open, triage, and resolve alerts in memory and records a resolution decision.
  • Resolution actions include no-action, monitor, freeze-profile, revoke-profile, and cascade-takedown.
  • The Iris unit suite validates state transitions, duplicate/range errors, artifact flagging, latency, and SLA calculation.
  • No Admin route instantiates this store for the dedicated page, exposes its commands over HTTP, or persists its decisions.

6. Keep evaluation evidence separate#

  • The voice-abuse evaluation contract scores classifier predictions across attack type, subject type, consent status, safety category, and recommended action.
  • It has pass-blocking critical-miss counters for minors, non-consent attacks, commercial rights, and sexual-content consent.
  • That offline/release evaluation suite is not the live alert detector, queue loader, or operator response workflow.

7. Escalate through separate workspaces only#

  • The Admin app has independent rights, support, incidents, audit, and trust-safety surfaces.
  • This panel does not deep-link to those workspaces.
  • No automatic incident declaration, notification job, consent-owner lookup, support ticket, or cross-workspace audit correlation is proved.

Post-conditions#

  • The operator can inspect the cloned-voice queue and, when a loader is bound, the dedicated alert/cascade monitoring snapshot.
  • The displayed cascade metrics are derived read-only from the supplied RevocationCascade values.
  • No alert or consent state is changed by the dedicated page.
  • No claim is made that the source detector, Iris domain store, consent ledger, incident cockpit, notifications, or global audit trail are connected.

Failure modes#

  • Loader never bound — the dedicated page honestly renders zero alerts and cascades.
  • Missing trust-safety scope — access redirects before the monitoring panel renders.
  • Severity taxonomy mismatch — treating numeric severity as S1/S2 invents a contract.
  • Rich-case/detail conflation — parent cloned-voice rows and dedicated Iris alerts are different shapes without a proved identity join.
  • Read-only control mistaken for response — tab switches do not triage, resolve, or revoke.
  • Cascade metric mistaken for cascade command — SLA counts are computed from input; nothing is written.
  • In-memory domain store mistaken for production wiring — the tested class is not connected to the Admin loader.
  • Evaluation suite mistaken for live detector — golden-case evaluation does not ingest an operational alert.
  • Incident/notification inference — no automatic route or job is called.

E2E coverage#

Coverage is component/unit level for voice-abuse monitoring and absent for operator response. There is no dedicated Playwright journey and no tested alert → revocation → notification → incident chain.

Per-view files touched by this journey#

Cross-references#

  • incident-handling-admin.md — real incident controls, independent of this monitor.
  • persona-release-cycle.md — persona and voice release evidence boundaries.
  • apps/oshun/admin/src/app/trust-safety/page.tsx — parent composition.
  • apps/oshun/admin/src/app/trust-safety/voice-abuse/page.tsx — session, scope, and loader boundary.
  • apps/oshun/admin/src/app/trust-safety/voice-abuse/VoiceAbusePanel.tsx — read-only monitor.
  • libs/iris/voice/src/integrity/abuse-detection.ts — separate domain store and cascade math.

Open questions#

  • Which production module binds the dedicated voice-abuse loader?
  • Should parent cloned-voice case ids map to Iris alert ids and profile ids?
  • What durable service owns alert triage and resolution decisions?
  • Which endpoint previews and commits artifact revocation idempotently?
  • How are consent-ledger writes, artifact treatment, and rollback modeled?
  • Which workspace owns affected-party notification and delivery receipts?
  • What severity policy should create or link an incident?
  • Which audit correlation id joins alert, consent, artifact, notification, and incident evidence?
  • What Playwright fixture can exercise the dedicated route with realistic bound data and mutation controls once they exist?