feat: in-house IC-native personhood verification (#9072)

[julianjelfs]

Revives unique personhood verification (#9072) as an in-house, on-chain, SNS-controlled system, replacing the sunsetted third-party DecideAI/AWS integration.

What this is (and isn't)

A new personhood_verifier canister runs the whole face-uniqueness pipeline on-chain under DAO governance. It is a probabilistic sybil-resistance layer at parity with what DecideAI provided — the same face-embedding primitive — but fully on the IC and SNS-controlled, with no third-party dependency and no biometric data leaving the chain.

It is not a cryptographic 1:N uniqueness guarantee at million scale. Face embeddings carry ~40–60 bits of effective separating entropy, so P(collision) = 1-(1-FMR)^N compounds — no single threshold is both strongly sybil-resistant and low-false-reject past low tens of thousands of users. This is an information-theoretic ceiling, not an implementation gap, and it applies equally to the DecideAI system this replaces. Positioned and tuned accordingly.

How it works

• JPEG decode → UltraFace RFB-320 detection → insightface 2d106det landmarks → 5-point ArcFace alignment → w600k r50 ArcFace embedding → i8-quantized cosine uniqueness scan.
• Liveness: canister-issued random head-pose challenge (Center/Left/Right/Up/Down), verified on-chain from uploaded frames.
• Privacy: raw frames are heap-only and never persisted (structurally excluded from upgrade serialization); only the i8-quantized embedding is stored, and it is deleted on account deletion — or at any time via the profile's "Remove verification" button (remove_unique_person_proof), which revokes the proof and erases the embedding; the user can re-verify whenever they like.
• One heavy inference per timer execution to stay inside deterministic time slicing.

On-chain feasibility (measured)

tract-onnx on wasm32 with SIMD. r50 embed = 24.76B instructions; the full Center-frame step (decode + detect + landmarks + embed) = 27.19B, under the 40B DTS per-message ceiling (~32% headroom). Deterministic across runs. Confirmed end-to-end on a local deployment.

Thresholds

r50-calibrated on LFW and SNS-governable at runtime (set_uniqueness_thresholds, governance-guarded, invariant clear ≤ retry ≤ duplicate, surfaced in /metrics) — the right value tracks the enrolled population, which grows. Launch defaults lean to low false-reject: T_dup 0.55 / clear 0.45 / retry 0.50 (~1% innocent rejection at ~100k enrolled). Raise by proposal as N grows.

Governance / lifecycle

• Models are chunk-uploaded (inert) and activated only by a hash-pinned commit_model SNS proposal.
• Legacy DecideAI proofs are wiped; a re-verification window + removal fan-out (LUI → user) handle the transition.
• UniquePerson group/community gates are enforced against the new proofs.

Scope

Phases 0–3 (feasibility gate, backend skeleton, real on-chain pipeline, DecideAI cutover + UI) are complete. Phase 4 (production rollout) is the ordered SNS-proposal sequence, now fully documented in PRODUCTION_ROLLOUT.md (supersedes the earlier rollout comment on #9072). This PR also carries everything the rollout needs:

• upload_model_chunks_whitelist init arg — dev principals upload (inert) model chunks in production, mirroring openchat_installer's wasm-chunk whitelist; activation stays proposal-only via the hash-pinned commit_model (~180×1MB chunk calls for the r50 model made proposal-per-chunk a non-starter).
• commit_model, set_uniqueness_thresholds, set_personhood_verifier_canister_id and wipe_legacy_unique_person_proofs are now #[proposal] endpoints, exposing the _validate queries SNS generic-function registration requires.
• Proposal scripts under scripts/proposals/: one-shot registration of the SNS functions (commit_model 11000, set_uniqueness_thresholds 11001 — verified unused against the live registry) plus an execution script per function. Per review, the verifier canister id is hardcoded (wji62-oiaaa-aaaaf-bsc7a-cai, created ahead of time) and the DecideAI wipe rides a designated upgrade's post_upgrade, so no wiring/wipe functions are needed.
• verification_model_uploader --skip-commit — the production upload mode; prints the exact hash-pinned commit commands for the proposals.
• Two-phase UI rollout via a build-time flag (OC_UNIQUE_PERSON_REQUIREMENTS_ENABLED): phase A ships the ability to verify (flow, badges, gate evaluator) while creating unique-person gates and prize restrictions stays unavailable; phase B — once real-world verification data looks healthy — is a website rebuild with the flag set, no code change. Verification strings are translated into all 14 locales.

Tests

personhood_verification 7/7 green. gated_group and delete_user suites cover gate enforcement and embedding deletion.

Notes for reviewers

• New runtime dependency: @mediapipe/tasks-vision — client-side face tracking for the capture UX only (self-hosted assets, degraded manual-capture fallback if it fails to load). Not in the trust path; the canister re-derives everything on-chain.
• CSP widened: script-src now includes 'wasm-unsafe-eval' so the MediaPipe wasm can instantiate. This is a deliberately widened surface — flagged here explicitly.
• Per-stage instruction_counter logging in process_verifications is test_mode-gated (inert in production) — kept as a measurement aid for the r50 cost work; say if you'd prefer it stripped.
• backend/personhood_bench/models/test_face.jpg is a committed determinism fixture (a public-figure portrait); model weights and wasms are gitignored.

Review response (addressed in follow-up commits)

• Critical — stub-in-prod: start_verification returns NotReady and process_one_step parks rather than ever running the stub outside test_mode.
• Critical — oversized-frame DoS: decode capped at 2048px (zune bails at the SOF header) + upload_frame rejects oversized dims via a new SOF parser before they enter the queue.
• Risks: commit_model builds engines before the version-bump/notify and rolls back on failure; durable retry for unacknowledged proof notifications (persisted, retried by prune_sessions); cosine_similarity asserts equal length; MockVerifierClient throws on a prod misconfiguration; debug overlay gated on import.meta.env.DEV; saturating_sub on byte accounting.
• Deferred (tracked): per-canister test_mode in the integration harness → prod-mode/oversized-frame tests; the remaining behavioural frontend items (getUserMedia timeout, poll clock, NotReady UX); session-cap split; i18n nits.

Refs #9072

[github-actions]

canbench 🏋 (dir: .)

./canbench_results.yml is up to date ✅

---------------------------------------------------

Benchmark: add_reactions
  total:
    instructions: 1.36 B (0.07%) (change within noise threshold)
    heap_increase: 5 pages (no change)
    stable_memory_increase: 0 pages (no change)

---------------------------------------------------

Benchmark: push_simple_text_messages
  total:
    instructions: 209.85 M (0.93%) (change within noise threshold)
    heap_increase: 12 pages (no change)
    stable_memory_increase: 0 pages (no change)

---------------------------------------------------

[Copilot]

Pull request overview

This PR revives “unique personhood verification” as an in-house, on-chain (SNS-governed) system by introducing a new personhood_verifier canister, wiring its proof lifecycle into user_index/user propagation, and re-enabling unique-person UX (verification flow, badge, and gates) with a two-phase rollout flag.

Changes:

• Add the personhood_verifier canister (model chunk upload + hash-pinned commits, on-chain verification sessions, uniqueness scan, proof notifications, and embedding erasure paths).
• Re-enable unique-person UI/gating and add a new human verification flow (web + mobile), guarded for “requirements” via OC_UNIQUE_PERSON_REQUIREMENTS_ENABLED.
• Remove legacy DecideAI proof submission plumbing and add governance proposal scripts for cutover/operations.

Reviewed changes

Copilot reviewed 243 out of 248 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/upload-verification-models.sh	Local helper to download and upload/commit verifier models.
scripts/upgrade-canister.sh	Wires personhood_verifier canister id into upgrade tooling.
scripts/proposals/wipe_legacy_unique_person_proofs.sh	Proposal script to wipe DecideAI proofs during cutover.
scripts/proposals/set_uniqueness_thresholds.sh	Proposal script to tune on-chain uniqueness thresholds.
scripts/proposals/set_personhood_verifier_canister_id.sh	Proposal script to set verifier id on user_index.
scripts/proposals/register_personhood_verifier_functions.sh	Registers required SNS generic functions for governance.
scripts/proposals/commit_personhood_model.sh	Proposal script to commit hash-pinned model uploads.
scripts/generate-wasm.sh	Enables SIMD for personhood_verifier builds.
scripts/generate-typebox-types.sh	Includes personhood_verifier in type generation.
scripts/generate-all-canister-wasms.sh	Includes personhood_verifier in wasm build-all script.
scripts/download-personhood-spike-models.sh	Downloads feasibility-spike ONNX models (hash checked).
scripts/deploy.sh	Threads personhood_verifier into deploy tooling.
scripts/deploy-local.sh	Adds personhood_verifier to local deployment set.
scripts/copy-verification-assets.sh	Copies self-hosted MediaPipe assets for verification UX.
frontend/vite-env.d.ts	Adds env typing for rollout flag (and should type verifier canister env).
frontend/package.json	Adds MediaPipe tasks-vision dependency for capture UX.
frontend/package-lock.json	Locks MediaPipe dependency.
frontend/openchat-worker/src/worker.ts	Adds worker actions for start/upload/submit/status + removal/caching.
frontend/openchat-shared/src/domain/worker.ts	Adds worker request/response types for verification flow.
frontend/openchat-shared/src/domain/verification.ts	Adds shared domain types mirroring verifier canister API.
frontend/openchat-shared/src/domain/user/user.ts	Removes DecideAI proof submission response type.
frontend/openchat-shared/src/domain/index.ts	Re-exports verification domain types.
frontend/openchat-shared/src/domain/config.ts	Adds optional verifier canister config to agent config.
frontend/openchat-shared/src/domain/access.ts	Re-enables unique_person gate preprocessing; removes “suspended gate” stripping.
frontend/openchat-client/src/workerAgent.ts	Passes verifierCanister into agent config.
frontend/openchat-client/src/config.ts	Adds optional verifierCanister to client config.
frontend/openchat-agent/src/utils/userCache.ts	Adds cache update for isUniquePerson.
frontend/openchat-agent/src/utils/chatsDb.ts	Adds cached current-user unique-person flag update.
frontend/openchat-agent/src/services/verifier/verifier.client.ts	Adds canister client for personhood_verifier API.
frontend/openchat-agent/src/services/userIndex/userIndex.client.ts	Adds removeUniquePersonProof + durable cache sync helper; removes DecideAI submit call.
frontend/openchat-agent/src/services/userIndex/mappers.ts	Removes DecideAI proof mapper; trims unused imports.
frontend/openchat-agent/src/services/openchatAgent.ts	Routes verification calls to verifier client; removes DecideAI submission; enforces prod config.
frontend/openchat-agent/src/config.ts	Adds optional verifierCanister to agent config.
frontend/app/vite.config.ts	Runs verification asset copy script at build start.
frontend/app/src/utils/preview.svelte.ts	Removes unique-person “suspended gate” stripping in previews.
frontend/app/src/utils/humanVerification/sound.ts	Adds synthesized capture tone helper.
frontend/app/src/utils/humanVerification/poseDetector.ts	Adds MediaPipe-based pose estimation (UX only, with fallback).
frontend/app/src/utils/humanVerification/capture.ts	Adds JPEG capture/size ladder to meet canister budgets.
frontend/app/src/utils/featureFlags.ts	Adds build-time flag for phase-B “requirements enabled”.
frontend/app/src/utils/access.ts	Re-enables unique-person gate binding under feature flag; restores flattening semantics.
frontend/app/src/components/icons/Verified.svelte	Restores rendering of verified badge controlled by prop.
frontend/app/src/components/home/VisibilityControl.svelte	Removes suspended-gate stripping logic.
frontend/app/src/components/home/verification/VerificationModal.svelte	Adds verification modal wrapper (web).
frontend/app/src/components/home/verification/VerificationDebugOverlay.svelte	Adds optional debug overlay (web).
frontend/app/src/components/home/profile/UserProfileCard.svelte	Minor import/style adjustments.
frontend/app/src/components/home/profile/UserProfile.svelte	Adds verification section + “remove verification” flow.
frontend/app/src/components/home/profile/LearnToEarn.svelte	Re-adds proved_unique_personhood achievement display.
frontend/app/src/components/home/profile/Badges.svelte	Displays verified badge when uniquePerson is true.
frontend/app/src/components/home/PrizeContentBuilder.svelte	Adds unique-person-only restriction UI under phase-B flag.
frontend/app/src/components/home/PrizeContent.svelte	Enforces unique-person eligibility and shows restriction badge/CTA.
frontend/app/src/components/home/HumanityConfirmation.svelte	Removes old DecideAI confirmation component.
frontend/app/src/components/home/Home.svelte	Switches “verify humanity” modal to new verification modal.
frontend/app/src/components/home/CurrentChatMessages.svelte	Removes suspended-gate stripping from preview gating logic.
frontend/app/src/components/home/communities/PreviewWrapper.svelte	Removes suspended-gate stripping from join preview logic.
frontend/app/src/components/home/access/LeafGateBuilder.svelte	Adds info text for unique-person gate.
frontend/app/src/components/home/access/AccessGateSummary.svelte	Stops stripping unique-person gates in summary/edit flow.
frontend/app/src/components/home/access/AccessGateIconsForChat.svelte	Updates merged gate icon rendering logic.
frontend/app/src/components/home/access/AccessGateEvaluator.svelte	Re-enables unique-person gate evaluation with verification flow.
frontend/app/src/components/home/access/AccessGateControl.svelte	Removes stripping in “bypass warning” logic.
frontend/app/src/components/home/access/AccessGateBuilder.svelte	Re-enables unique-person gate editing/validation paths.
frontend/app/src/components/App.svelte	Injects verifier canister env var into config.
frontend/app/src/components_mobile/icons/Verified.svelte	Restores verified badge (mobile).
frontend/app/src/components_mobile/home/verification/VerificationModal.svelte	Adds verification modal wrapper (mobile).
frontend/app/src/components_mobile/home/verification/VerificationDebugOverlay.svelte	Adds optional debug overlay (mobile).
frontend/app/src/components_mobile/home/user_profile/Verify.svelte	Removes DecideAI confirmation gating and updates consent text.
frontend/app/src/components_mobile/home/user_profile/UserProfileSummaryCard.svelte	Shows verified account pill when unique-person verified.
frontend/app/src/components_mobile/home/user_profile/UserProfileSummary.svelte	Adds verify CTA when user is not verified.
frontend/app/src/components_mobile/home/profile/LearnToEarn.svelte	Re-adds proved_unique_personhood achievement display (mobile).
frontend/app/src/components_mobile/home/profile/Badges.svelte	Displays verified badge when uniquePerson is true (mobile).
frontend/app/src/components_mobile/home/PrizeContentBuilder.svelte	Adds unique-person restriction chip under phase-B flag (mobile).
frontend/app/src/components_mobile/home/PrizeContent.svelte	Enforces unique-person eligibility and displays restriction (mobile).
frontend/app/src/components_mobile/home/PreviewFooter.svelte	Re-enables unique-person gates in flattened join flow gates.
frontend/app/src/components_mobile/home/HumanityConfirmation.svelte	Removes old DecideAI confirmation component (mobile).
frontend/app/src/components_mobile/home/Home.svelte	Switches “verify humanity” modal to new verification modal (mobile).
frontend/app/src/components_mobile/home/CurrentChatMessages.svelte	Removes suspended-gate stripping from preview gating (mobile).
frontend/app/src/components_mobile/home/communities/explore/Explore.svelte	Refactors selected community card binding (mobile).
frontend/app/src/components_mobile/home/access/AccessGateEvaluator.svelte	Re-enables unique-person gate evaluation via verification flow (mobile).
frontend/app/src/components_mobile/home/access_gates/AccessGates.svelte	Removes suspended-gate stripping from gate presence logic (mobile).
frontend/app/src/components_mobile/App.svelte	Injects verifier canister env var into config (mobile).
frontend/app/rollup.extras.mjs	Sets OC_VERIFIER_CANISTER env (optional) and logs it.
frontend/app/rollup.config.mjs	Defines import.meta.env.OC_VERIFIER_CANISTER at build time.
frontend/app/public/assets/verification/.gitignore	Ignores copied/downloaded verification assets in repo.
dfx.json	Adds personhood_verifier canister entry.
Cargo.toml	Adds new canister crates, tools, spike crate, and face_pipeline lib; adjusts release opts for tract/zune.
backend/tools/verification_model_uploader/Cargo.toml	Adds model uploader tool crate.
backend/tools/threshold_calibration/README.md	Documents offline calibration tool and semantics.
backend/tools/threshold_calibration/Cargo.toml	Adds calibration tool crate.
backend/tools/canister_upgrader/src/main.rs	Adds CLI flag and routing for upgrading personhood_verifier.
backend/tools/canister_upgrader/src/lib.rs	Adds upgrade function for personhood_verifier.
backend/tools/canister_upgrader/Cargo.toml	Adds personhood_verifier api dependency.
backend/tools/canister_installer/src/main.rs	Adds installer CLI flag for personhood_verifier.
backend/tools/canister_installer/src/lib.rs	Installs personhood_verifier with init args; threads canister id.
backend/tools/canister_installer/Cargo.toml	Adds personhood_verifier api dependency.
backend/personhood_spike/src/scan.rs	Adds benchmark for i8 uniqueness scan cost.
backend/personhood_spike/src/main.rs	Adds feasibility spike harness and deterministic wasm rand.
backend/personhood_spike/src/jpeg.rs	Adds JPEG decode benchmark.
backend/personhood_spike/README.md	Documents feasibility results and instruction counts.
backend/personhood_spike/models/.gitignore	Ignores downloaded ONNX models.
backend/personhood_spike/Cargo.toml	Adds spike crate dependencies and pinned tract version.
backend/personhood_spike/canbench.yml	Adds canbench build/run config for spike.
backend/personhood_spike/canbench_results.yml	Stores measured bench results.
backend/libraries/types/src/proof_of_uniqueness.rs	Adds OpenChat provider + model_version field to unique person proofs.
backend/libraries/proof_of_unique_personhood/src/lib.rs	Removes DecideAI credential verification library.
backend/libraries/proof_of_unique_personhood/Cargo.toml	Removes DecideAI credential verification crate manifest.
backend/libraries/gated_groups/src/lib.rs	Re-enables unique-person gate enforcement (no longer always pass/filter).
backend/libraries/face_pipeline/Cargo.toml	Adds shared inference pipeline crate manifest.
backend/libraries/canister_agent_utils/src/lib.rs	Adds personhood_verifier to canister id plumbing.
backend/integration_tests/src/wasms.rs	Adds personhood_verifier wasm to test harness.
backend/integration_tests/src/setup.rs	Installs personhood_verifier canister in PocketIC setup.
backend/integration_tests/src/lib.rs	Adds personhood verification test module and canister ids field.
backend/integration_tests/src/client/user_index.rs	Adds client call for remove_unique_person_proof.
backend/integration_tests/src/client/personhood_verifier.rs	Adds verifier client calls and happy-path helpers.
backend/integration_tests/src/client/mod.rs	Exposes verifier client module.
backend/integration_tests/Cargo.toml	Adds personhood_verifier deps and serde_bytes.
backend/canisters/user/impl/src/updates/c2c_local_user_index.rs	Handles unique-person proof removal event locally.
backend/canisters/user/impl/src/queries/updates.rs	Ensures unique-person status updates propagate after removal.
backend/canisters/user/impl/src/lib.rs	Stores unique_person_proof_removed_at for update propagation.
backend/canisters/user/CHANGELOG.md	Notes unique person proof removal handling.
backend/canisters/user/api/src/lib.rs	Adds NotifyUniquePersonProofRemoved event variant.
backend/canisters/user_index/impl/src/updates/wipe_legacy_unique_person_proofs.rs	Adds governance proposal endpoint to trigger legacy wipe.
backend/canisters/user_index/impl/src/updates/submit_proof_of_unique_personhood.rs	Removes DecideAI proof submission endpoint implementation.
backend/canisters/user_index/impl/src/updates/set_personhood_verifier_canister_id.rs	Adds governance proposal endpoint to set verifier id.
backend/canisters/user_index/impl/src/updates/remove_unique_person_proof.rs	Adds user endpoint to revoke proof + delete embedding/attempt history.
backend/canisters/user_index/impl/src/updates/mod.rs	Wires new personhood update modules; removes DecideAI submission module.
backend/canisters/user_index/impl/src/updates/c2c_notify_personhood_verified.rs	Records OpenChat-provider unique person proofs from verifier canister.
backend/canisters/user_index/impl/src/updates/c2c_notify_model_upgraded.rs	Records model upgrade + lapse deadline and restarts lapse job.
backend/canisters/user_index/impl/src/model/user_map.rs	Adds method to remove unique person proof from user map.
backend/canisters/user_index/impl/src/lifecycle/inspect_message.rs	Allows new endpoints in inspect_message (user/governance guarded).
backend/canisters/user_index/impl/src/lifecycle/init.rs	Threads personhood_verifier_canister_id into init.
backend/canisters/user_index/impl/src/jobs/mod.rs	Starts lapse-removal job.
backend/canisters/user_index/impl/src/guards.rs	Adds guard for personhood_verifier caller.
backend/canisters/user_index/impl/Cargo.toml	Adds personhood_verifier dep; removes DecideAI proof dep.
backend/canisters/user_index/CHANGELOG.md	Documents new governance endpoints + DecideAI removal.
backend/canisters/user_index/c2c_client/src/lib.rs	Adds c2c calls for model upgrade + verification notify.
backend/canisters/user_index/api/src/updates/wipe_legacy_unique_person_proofs.rs	Adds candid/TS types for wipe proposal endpoint.
backend/canisters/user_index/api/src/updates/submit_proof_of_unique_personhood.rs	Removes DecideAI submission API.
backend/canisters/user_index/api/src/updates/set_personhood_verifier_canister_id.rs	Adds API types for setting verifier id (proposal).
backend/canisters/user_index/api/src/updates/remove_unique_person_proof.rs	Adds API types for user-initiated proof removal.
backend/canisters/user_index/api/src/updates/mod.rs	Wires new update APIs; removes DecideAI submission API.
backend/canisters/user_index/api/src/updates/c2c_notify_personhood_verified.rs	Adds API types for verifier→user_index proof notification.
backend/canisters/user_index/api/src/updates/c2c_notify_model_upgraded.rs	Adds API types for verifier→user_index model upgrade notify.
backend/canisters/user_index/api/src/main.rs	Generates TS methods for new endpoints; removes DecideAI endpoint.
backend/canisters/user_index/api/src/lifecycle/init.rs	Adds init arg for personhood_verifier_canister_id.
backend/canisters/personhood_verifier/impl/src/updates/upload_model_chunk.rs	Adds chunk upload endpoint guarded by whitelist.
backend/canisters/personhood_verifier/impl/src/updates/upload_frame.rs	Adds frame upload endpoint with byte + dimension checks.
backend/canisters/personhood_verifier/impl/src/updates/submit_verification.rs	Adds submission endpoint that queues session.
backend/canisters/personhood_verifier/impl/src/updates/set_uniqueness_thresholds.rs	Adds governance endpoint to tune live thresholds.
backend/canisters/personhood_verifier/impl/src/updates/mod.rs	Wires verifier canister updates.
backend/canisters/personhood_verifier/impl/src/updates/c2c_delete_user_embedding.rs	Adds user_index→verifier embedding deletion endpoint.
backend/canisters/personhood_verifier/impl/src/queries/verification_status.rs	Adds status query with queued position.
backend/canisters/personhood_verifier/impl/src/queries/model_info.rs	Adds query for model version + enrollment count.
backend/canisters/personhood_verifier/impl/src/queries/mod.rs	Wires verifier queries.
backend/canisters/personhood_verifier/impl/src/queries/http_request.rs	Adds http_request for logs/metrics endpoints.
backend/canisters/personhood_verifier/impl/src/model/sessions.rs	Adds heap-only session model with raw-frame exclusion.
backend/canisters/personhood_verifier/impl/src/model/mod.rs	Wires model submodules.
backend/canisters/personhood_verifier/impl/src/model/embeddings.rs	Adds embedding store + scan logic and cosine helper.
backend/canisters/personhood_verifier/impl/src/model/attempts.rs	Adds attempt history windowing + retry allowance.
backend/canisters/personhood_verifier/impl/src/memory.rs	Adds stable memory manager for upgrades/model chunks.
backend/canisters/personhood_verifier/impl/src/lifecycle/pre_upgrade.rs	Serializes stable state excluding raw frames.
backend/canisters/personhood_verifier/impl/src/lifecycle/post_upgrade.rs	Restores state/logs and re-inits env/cycles client.
backend/canisters/personhood_verifier/impl/src/lifecycle/mod.rs	Wires init/upgrade lifecycle and RNG reseed.
backend/canisters/personhood_verifier/impl/src/lifecycle/init.rs	Initializes verifier canister state and cycles client.
backend/canisters/personhood_verifier/impl/src/jobs/purge_lapsed_embeddings.rs	Purges superseded-model embeddings after lapse window.
backend/canisters/personhood_verifier/impl/src/jobs/prune_sessions.rs	Prunes sessions and retries pending proof notifications.
backend/canisters/personhood_verifier/impl/src/jobs/mod.rs	Starts verifier jobs.
backend/canisters/personhood_verifier/impl/src/guards.rs	Adds guards for user_index/governance/whitelist callers.
backend/canisters/personhood_verifier/impl/src/engine/mod.rs	Defines thresholds and stub embedding generator entrypoint.
backend/canisters/personhood_verifier/impl/Cargo.toml	Adds verifier canister implementation crate dependencies.
backend/canisters/personhood_verifier/CHANGELOG.md	Documents verifier canister functionality and rollout.
backend/canisters/personhood_verifier/c2c_client/src/lib.rs	Adds generated c2c client for embedding deletion.
backend/canisters/personhood_verifier/c2c_client/Cargo.toml	Adds c2c client crate manifest.
backend/canisters/personhood_verifier/api/src/updates/upload_model_chunk.rs	Adds upload_model_chunk API types.
backend/canisters/personhood_verifier/api/src/updates/upload_frame.rs	Adds upload_frame API types.
backend/canisters/personhood_verifier/api/src/updates/submit_verification.rs	Adds submit_verification API types.
backend/canisters/personhood_verifier/api/src/updates/start_verification.rs	Adds start_verification API types and NotReady semantics.
backend/canisters/personhood_verifier/api/src/updates/set_uniqueness_thresholds.rs	Adds set_uniqueness_thresholds API types.
backend/canisters/personhood_verifier/api/src/updates/mod.rs	Wires verifier update APIs.
backend/canisters/personhood_verifier/api/src/updates/commit_model.rs	Adds commit_model API types (hash pinned).
backend/canisters/personhood_verifier/api/src/updates/c2c_delete_user_embedding.rs	Adds c2c_delete_user_embedding API types.
backend/canisters/personhood_verifier/api/src/queries/verification_status.rs	Adds verification_status API types.
backend/canisters/personhood_verifier/api/src/queries/model_info.rs	Adds model_info API types.
backend/canisters/personhood_verifier/api/src/queries/mod.rs	Wires verifier query APIs.
backend/canisters/personhood_verifier/api/src/main.rs	Generates TS bindings for verifier canister API.
backend/canisters/personhood_verifier/api/src/lifecycle/post_upgrade.rs	Adds post-upgrade args API types.
backend/canisters/personhood_verifier/api/src/lifecycle/mod.rs	Wires lifecycle API modules.
backend/canisters/personhood_verifier/api/src/lifecycle/init.rs	Adds init args API types (whitelist + governance).
backend/canisters/personhood_verifier/api/src/lib.rs	Defines public verifier API types and enums.
backend/canisters/personhood_verifier/api/Cargo.toml	Adds verifier canister API crate manifest.
backend/canisters/openchat_installer/impl/src/updates/install_canisters.rs	Threads verifier canister id into user_index init args.
backend/canisters/openchat_installer/impl/src/lifecycle/init.rs	Threads verifier canister id into installer init.
backend/canisters/openchat_installer/impl/src/lib.rs	Adds verifier canister id storage/defaulting and exposes it.
backend/canisters/openchat_installer/CHANGELOG.md	Notes installer threading of verifier canister id.
backend/canisters/openchat_installer/api/src/lifecycle/init.rs	Adds verifier canister id to installer init args API.
backend/canisters/local_user_index/impl/src/updates/c2c_notify_user_index_events.rs	Propagates proof removal event and updates global map.
backend/canisters/local_user_index/impl/src/model/global_user_map.rs	Adds unique-person proof removal from global map.
backend/canisters/local_user_index/impl/src/lib.rs	Stops accepting DecideAI unique-person JWTs.
backend/canisters/local_user_index/impl/Cargo.toml	Removes DecideAI proof lib dependency.
backend/canisters/local_user_index/CHANGELOG.md	Notes DecideAI JWT removal and proof removal handling.
backend/canisters/local_user_index/api/src/lib.rs	Adds user index event variant for proof removal.
backend/canisters/group/CHANGELOG.md	Notes unique-person gate enforcement restored.
backend/canisters/community/CHANGELOG.md	Notes unique-person gate enforcement restored.
.gitignore	Adds .calibration/ ignore for calibration artifacts.
.github/workflows/backend.yaml	Excludes personhood_spike from clippy/tests in CI.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[megrogan]

We should create a new canister and then hardcode the canister id here

[julianjelfs]

Done — the canister now exists (wji62-oiaaa-aaaaf-bsc7a-cai) and is hardcoded as PERSONHOOD_VERIFIER_CANISTER_ID in the constants crate (baf77fe). The init-arg plumbing through the installer and user_index is gone; local deployments and the integration tests create the canister with that exact id (specified-id creation), so the same constant is correct in every environment.

[megrogan]

Don't give it a serde default - let's set the correct principals when we install

[julianjelfs]

Done — default removed in 09f5f35; installs must state the whitelist explicitly.

[megrogan]

Sems a bit OTT - I would have thought doing on user_index upgrade would be fine

[julianjelfs]

Agreed — endpoint removed in 09f5f35. The wipe is now a post_upgrade one-liner to ship in a designated user_index release once the verification UI has baked in production (it mustn't ride the first upgrade carrying this code, because users need a working way to re-verify before their badge disappears). The rollout runbook documents this, and voters see it in that release's changelog.

[megrogan]

As per a previous comment - let's create a canister ahead of time and hardcode the canister id here. And no need to have a new endpoint to set it.

[julianjelfs]

Done in baf77fe — the endpoint is removed along with its SNS function registration and script; the user_index authenticates the verifier against the hardcoded constant, so there is nothing to set.

[megrogan]

Should the personhood_spike be committed? Hasn't that done its job?

[julianjelfs]

Should the personhood_spike be committed? Hasn't that done its job?

I asked the same - apparently it's still doing a job, but I will ask it to rename to something less suspicious.

[megrogan]

Why not start with a StableBTreeMap?

[julianjelfs]

It now starts with one (09f5f35): a StableBTreeMap is the source of truth — nothing (de)serializes through upgrades however large the enrolled population gets — with a heap cache mirroring it for the scan path, rebuilt in post_upgrade. The cache exists because every verification brute-force scans all enrolled embeddings, and a contiguous heap scan benched ~247M instructions per 100k users (see personhood_bench), where deserializing every entry out of stable memory per probe would cost roughly an order of magnitude more.

[julianjelfs]

I think we will probably end up not doing this since it's a bit controversial and really cannot be made to work well enough to satisfy the stated requirement.