Files
vocero-client/docs/proposals/vocero-architecture.html
T

272 lines
112 KiB
HTML

<!DOCTYPE html><html lang="en"><head>
<meta charset="utf-8">
<meta content="width=device-width, initial-scale=1" name="viewport">
<title>Vocero S2S — Target technical architecture and implementation plan</title>
<style>
@page { size: A4; margin: 17mm 16mm 18mm; }
:root { --ink:#18232f; --muted:#52606d; --accent:#0c5f76; --line:#cbd5dc; --pale:#f5f8f9; }
* { box-sizing:border-box; }
html { background:#ffffff; }
body { margin:0; color:var(--ink); background:#ffffff; font-family:Arial, Helvetica, sans-serif; font-size:10.5pt; line-height:1.66; }
article { max-width:180mm; margin:0 auto; padding:0; }
.cover { min-height:245mm; display:flex; flex-direction:column; justify-content:center; border-top:8px solid var(--accent); padding:22mm 8mm 18mm; background:#fff; }
.cover .eyebrow { margin:0 0 14mm; color:var(--accent); letter-spacing:.11em; font-size:9pt; font-weight:700; text-transform:uppercase; }
.cover h1 { max-width:130mm; margin:0; color:#12212a; font-size:31pt; line-height:1.12; letter-spacing:-.025em; }
.cover .subtitle { max-width:135mm; margin:7mm 0 18mm; font-size:16pt; line-height:1.35; color:#344a57; }
.cover .meta { border-top:1px solid var(--line); padding-top:6mm; color:var(--muted); font-size:10pt; }
.toc { padding:10mm 0 9mm; border-bottom:1px solid var(--line); }
.toc h2 { margin-top:0; border:0; padding:0; break-before:auto; page-break-before:auto; }
.toc ol { columns:2; column-gap:13mm; margin:4mm 0 0; padding:0; list-style:none; }
.toc li { break-inside:avoid; margin:0 0 1.5mm; color:#31434d; font-size:9pt; }
.toc .toc-level-3 { margin-left:6mm; color:var(--muted); font-size:8.6pt; }
h1,h2,h3,h4 { color:#163948; line-height:1.24; }
article > h1 { margin:12mm 0 4mm; font-size:25pt; }
h2 { margin:13mm 0 5mm; padding-top:2mm; border-top:2px solid var(--accent); font-size:18pt; }
h2.chapter { break-before:page; page-break-before:always; }
h3 { margin:8mm 0 3mm; font-size:13pt; }
h4 { margin:6mm 0 2mm; font-size:11pt; }
p { margin:0 0 4mm; }
ul,ol { margin:2mm 0 5mm; padding-left:7mm; }
li { margin:1.4mm 0; }
blockquote { margin:5mm 0; padding:4mm 6mm; border-left:3px solid var(--accent); background:var(--pale); color:#2f4652; }
strong { font-weight:700; }
code { font-family:"SFMono-Regular",Consolas,"Liberation Mono",monospace; font-size:.88em; color:#153f50; }
pre.code-block { margin:5mm 0; padding:4.2mm; background:#f4f6f7; border:1px solid var(--line); white-space:pre-wrap; overflow-wrap:anywhere; line-height:1.45; }
pre.code-block code { color:#1c2932; font-size:8.5pt; }
.diagram { margin:6mm 0; padding:5mm; border:1px solid var(--line); background:#fff; }
.diagram .mermaid { margin:0; text-align:center; white-space:pre-wrap; font-family:Arial, Helvetica, sans-serif; }
table { width:100%; margin:5mm 0 6mm; border-collapse:collapse; font-size:8.6pt; line-height:1.38; table-layout:fixed; }
th,td { border:1px solid var(--line); padding:2.2mm 2.4mm; vertical-align:top; overflow-wrap:anywhere; }
th { background:#edf3f5; color:#163948; font-weight:700; text-align:left; }
tr { break-inside:avoid; page-break-inside:avoid; }
a { color:#075c77; text-decoration:underline; text-underline-offset:2px; }
a.inline_marker { display:inline; margin-left:1px; color:#075c77; font-size:.9em; font-weight:700; text-decoration:none; }
.references { padding-left:7mm; }
.references li { margin:0 0 3mm; overflow-wrap:anywhere; }
.keep-together { break-inside:avoid; page-break-inside:avoid; }
@media print { body { font-size:10pt; } .cover { min-height:245mm; } a { color:#075c77; } }
.static-diagram { margin:6mm 0; padding:4mm; border:1px solid var(--line); background:#fff; break-inside:avoid; page-break-inside:avoid; }
.static-diagram svg { display:block; width:100%; height:auto; }
.static-diagram .title { fill:#163948; font:700 25px Arial, Helvetica, sans-serif; }
.static-diagram .zone { fill:#f7fafb; stroke:#7d9aa6; stroke-width:1.5; }
.static-diagram .zone-label { fill:#0c5f76; font:700 17px Arial, Helvetica, sans-serif; letter-spacing:.06em; }
.static-diagram .node { fill:#ffffff; stroke:#0c5f76; stroke-width:1.8; }
.static-diagram .external { fill:#f4f6f7; stroke:#52606d; stroke-width:1.5; }
.static-diagram .store { fill:#eef5f7; stroke:#0c5f76; stroke-width:1.8; }
.static-diagram .gpu { fill:#f6f3ea; stroke:#806b2b; stroke-width:1.8; }
.static-diagram .state { fill:#ffffff; stroke:#0c5f76; stroke-width:1.8; }
.static-diagram .terminal { fill:#edf3f5; stroke:#52606d; stroke-width:1.5; }
.static-diagram .node-title { fill:#163948; font:700 15px Arial, Helvetica, sans-serif; text-anchor:middle; }
.static-diagram .node-sub { fill:#52606d; font:12px Arial, Helvetica, sans-serif; text-anchor:middle; }
.static-diagram .edge { fill:none; stroke:#52606d; stroke-width:1.5; marker-end:url(#arrow); }
.static-diagram .edge-dash { fill:none; stroke:#52606d; stroke-width:1.5; stroke-dasharray:5 4; marker-end:url(#arrow); }
.static-diagram .edge-label { fill:#405561; font:11px Arial, Helvetica, sans-serif; text-anchor:middle; }
.static-diagram .caption { margin:2mm 0 0; color:var(--muted); font-size:8.5pt; }
</style>
</head><body>
<article data-cid="4epIWe">
<header class="cover" data-cid="fCmHc7">
<p class="eyebrow" data-cid="6GVbUm">Technical architecture document</p>
<h1 data-cid="h4gP5z">Vocero S2S</h1>
<p class="subtitle" data-cid="MoJwfx">Target technical architecture and implementation plan</p>
<p class="meta" data-cid="S4IaaD"><strong data-cid="sw-7bp">Status:</strong> proposal for technical review<br data-cid="Dwe3P8"><strong data-cid="TfylEo">Source cutoff date:</strong> July 20, 2026<br data-cid="7ql9f_"><strong data-cid="t2Ytff">Scope:</strong> a decoupled, local Speech-to-Speech conversational platform extensible through MCP<br data-cid="v5QE9k"><strong data-cid="Yf-vsB">Audience:</strong> architecture, platform, security, MLOps, development, QA and operations</p>
</header>
<div style="break-before: page" class="editor-empty-block" data-cid="ik4QDj"></div>
<nav aria-label="Table of contents" class="toc" data-cid="um3tcL"><h2 data-cid="Y6_ljg">Table of contents</h2><ol data-cid="VKDgaM"><li class="toc-level-2" data-cid="cU0TcH">1. Executive summary</li><li class="toc-level-2" data-cid="hdjqdb">2. Scope</li><li class="toc-level-3" data-cid="52yIAH">2.1 Objectives</li><li class="toc-level-3" data-cid="0ipum3">2.2 Non-goals</li><li class="toc-level-2" data-cid="7KTF6G">3. Architecture principles</li><li class="toc-level-2" data-cid="8POJYH">4. Context and container view</li><li class="toc-level-3" data-cid="J9VVak">4.1 Logical view by plane</li><li class="toc-level-2" data-cid="OgeweQ">5. Component responsibilities</li><li class="toc-level-2" data-cid="7PDF1o">6. Deployment view</li><li class="toc-level-2" data-cid="YWPrbJ">7. State machine and session management</li><li class="toc-level-3" data-cid="ZPjGAg">7.1 Proposed states</li><li class="toc-level-3" data-cid="P0hnY3">7.2 Identifiers</li><li class="toc-level-3" data-cid="cBzJc9">7.3 Effective session state</li><li class="toc-level-2" data-cid="yiCagJ">8. Execution flows</li><li class="toc-level-3" data-cid="BJst5H">8.1 Normal conversational and MCP flow</li><li class="toc-level-3" data-cid="ZuSMBu">8.2 Tool call with confirmation</li><li class="toc-level-3" data-cid="_0rg9D">8.3 Barge-in</li><li class="toc-level-3" data-cid="QQ11AG">8.4 Errors and degradation</li><li class="toc-level-2" data-cid="XzOI_D">9. Illustrative contracts and events</li><li class="toc-level-3" data-cid="8RJA0R">9.1 Common envelope</li><li class="toc-level-3" data-cid="29CYzV">9.2 Minimum event catalog</li><li class="toc-level-3" data-cid="7UtGH4">9.3 Example of session.update_requested</li><li class="toc-level-3" data-cid="1GAQAj">9.4 Example of internal tool intent</li><li class="toc-level-3" data-cid="d-Vvxh">9.5 Errors</li><li class="toc-level-3" data-cid="9P6yC3">9.6 MCP compatibility</li><li class="toc-level-2" data-cid="2-VSIl">10. Voice cloning and governance</li><li class="toc-level-3" data-cid="O_rvLt">10.1 Operating model</li><li class="toc-level-3" data-cid="U0GChX">10.2 Lifecycle</li><li class="toc-level-3" data-cid="55E3GA">10.3 Controls</li><li class="toc-level-2" data-cid="0Q0oJ9">11. Security</li><li class="toc-level-3" data-cid="F1m7SS">11.1 Zones and trust view</li><li class="toc-level-3" data-cid="MgjLQi">11.2 Main threats and mitigations</li><li class="toc-level-3" data-cid="7yfzD3">11.3 Tool authorization</li><li class="toc-level-3" data-cid="vuXPa-">11.4 Data and retention</li><li class="toc-level-2" data-cid="h-RZHa">12. Observability and initial SLOs</li><li class="toc-level-3" data-cid="4Cdu1t">12.1 Telemetry model</li><li class="toc-level-3" data-cid="pwbk7K">12.2 Initial targets — not observed performance</li><li class="toc-level-3" data-cid="yQDBc_">12.3 Initial alerts</li><li class="toc-level-2" data-cid="SVS1lo">13. Scalability, backpressure and resilience</li><li class="toc-level-3" data-cid="6cVI8v">13.1 Scaling</li><li class="toc-level-3" data-cid="EUrlwS">13.2 Backpressure</li><li class="toc-level-3" data-cid="LUezOd">13.3 Resilience</li><li class="toc-level-2" data-cid="2i_y3_">14. Phased implementation plan</li><li class="toc-level-2" data-cid="4KSFWj">15. Testing strategy</li><li class="toc-level-3" data-cid="VZ6aeA">15.1 Pyramid</li><li class="toc-level-3" data-cid="n10oUv">15.2 Minimum scenario matrix</li><li class="toc-level-3" data-cid="reqR5_">15.3 Test oracles and reproducibility</li><li class="toc-level-2" data-cid="t2Glb-">16. Decision matrix and ADRs</li><li class="toc-level-2" data-cid="39KXUJ">17. Outstanding items and open questions</li><li class="toc-level-3" data-cid="wjt9JY">Product and experience</li><li class="toc-level-3" data-cid="RBE8Ss">Identity and authorization</li><li class="toc-level-3" data-cid="5WyxzW">MCP</li><li class="toc-level-3" data-cid="lXlN8W">Inference and capacity</li><li class="toc-level-3" data-cid="LV4sC2">Voice and legal considerations</li><li class="toc-level-3" data-cid="xcofmG">Operations</li><li class="toc-level-2" data-cid="VuOfs2">18. Consolidated risks</li><li class="toc-level-2" data-cid="WXcSS6">19. Pilot readiness criteria</li><li class="toc-level-2" data-cid="2M14FR">20. Sources</li><li class="toc-level-2" data-cid="zGXG-p">Appendix A — Implementation checklist</li></ol></nav>
<h1 id="vocero-s2s" data-cid="4Rht77">Vocero S2S</h1>
<h2 class="chapter" id="target-technical-architecture-and-implementation-plan" data-cid="mIMZwY">Target technical architecture and implementation plan</h2>
<p data-cid="Ve88hK"><strong data-cid="eKufR0">Document status:</strong> proposal for technical review<br data-cid="hDRyC_">
<strong data-cid="_z_4my">Source cutoff date:</strong> July 20, 2026<br data-cid="c9VqXb">
<strong data-cid="WY-A3a">Scope:</strong> a decoupled, local Speech-to-Speech conversational platform extensible through MCP<br data-cid="I2MPq1">
<strong data-cid="oIiGmq">Audience:</strong> architecture, platform, security, MLOps, development, QA and operations</p>
<blockquote data-cid="vY1mwR">
<p data-cid="mDuEqp"><strong data-cid="pj0twH">Traceability convention</strong></p>
<ul data-cid="Uthxte">
<li data-cid="ISqg59"><strong data-cid="4a1odW">[REQ] Supplied requirement:</strong> comes directly from the Vocero S2S description provided by the requester.</li>
<li data-cid="mZARVJ"><strong data-cid="WVcJIS">[REC] Recommended decision:</strong> a design proposal that must be approved through an ADR.</li>
<li data-cid="oNbETv"><strong data-cid="2U5t60">[BENCH] Pending assumption:</strong> a hypothesis requiring measurement, load testing, legal assessment or validation in the target environment.</li>
</ul>
</blockquote>
<h2 class="chapter" id="1-executive-summary" data-cid="VOhVct">1. Executive summary</h2>
<p data-cid="fKCTzj">Vocero S2S is proposed as a real-time conversational platform separating four responsibilities: web experience, session control, speech and language inference, and enterprise integration through Model Context Protocol (MCP). <strong data-cid="BcetOV">[REQ]</strong> The initial implementation must use Parakeet TDT 0.6B for STT/VAD, LLaMA 3.1 8B Instruct for reasoning and tool calls, Qwen3-TTS 12Hz 1.7B Base in FP16 for synthesis and zero-shot cloning, and an NVIDIA GB10 node initially accessible through port <code data-cid="Ivz75n">12345</code>.</p>
<p data-cid="3b9XVE">The target architecture retains this decoupled pipeline while avoiding placing all logic in the WebSocket connection. <strong data-cid="TAacjB">[REC]</strong> The proposal includes a <strong data-cid="Zthalv">Control Plane</strong> on the UI &amp; Relay server for authentication, authorization, agent profiles, voice policy, MCP orchestration and auditing; a <strong data-cid="VobP8v">Realtime Data Plane</strong> for audio and events with ephemeral session state and priority cancellation; and a local <strong data-cid="-pgcFe">Inference Plane</strong> that exposes versioned adapters for STT, LLM and TTS. This separation allows models, transport or infrastructure to be replaced without changing business contracts.</p>
<p data-cid="n_qKBQ">For web clients, WebRTC offers operational advantages for media on variable networks, while WebSocket remains appropriate for server-to-server links and the proposed first version. Realtime platform documentation recommends WebRTC for browser/media and WebSocket for server pipelines <a class="inline_marker" href="#ref1" data-cid="31iu96">1</a>. <strong data-cid="-kNj2P">[REC]</strong> The plan therefore adopts WebSocket as the initial compatible transport and defines WebRTC as a controlled evolution rather than an MVP prerequisite.</p>
<p data-cid="Ml51Ql">Interruption management is a first-class capability: when user speech is detected during a response, the system must cancel still-reversible generation, stop audio, flush unplayed buffers and truncate history to what was actually heard. Realtime systems document this pattern through cancellation and truncation of conversation items <a class="inline_marker" href="#ref2" data-cid="Qnf1_Y">2</a>, as do agent frameworks that adjust history to the audio actually played <a class="inline_marker" href="#ref3" data-cid="ChS9bn">3</a>.</p>
<p data-cid="wGP5Cv">MCP is integrated through an enterprise gateway with policy, schema validation, delegated identity, limits, auditing and version adapters. <strong data-cid="FwSFpI">Critical timing decision:</strong> as of July 20, 2026, the announcement for <code data-cid="Lbt2Jo">2026-07-28</code> explicitly describes a <strong data-cid="GrxmVR">Release Candidate</strong> whose final standard is expected on July 28, 2026 and includes breaking changes <a class="inline_marker" href="#ref4" data-cid="pbYf-Q">4</a>. Therefore:</p>
<ol data-cid="p9nVOY">
<li data-cid="3T2A8U"><strong data-cid="ano7RF">[REC]</strong> the initial stable compatibility version will be <code data-cid="moxL7t">2025-11-25</code>, verified in the official transport documentation <a class="inline_marker" href="#ref5" data-cid="IJJ3i8">5</a>; this decision follows the requested source cutoff and does not contradict the stateless technical direction proposed by the RC;</li>
<li data-cid="l9zTAu"><strong data-cid="LeHSA5">[REC]</strong> <code data-cid="BbPNed">2026-07-28</code> will be implemented only behind an experimental adapter and feature flag;</li>
<li data-cid="l1bxtp"><strong data-cid="Js5NXi">[REC]</strong> the domain design will remain ready for the RC's stateless model: self-contained requests, application state through explicit handles, and routing independent of affinity;</li>
<li data-cid="0-r7RQ"><strong data-cid="jIa34f">[REC]</strong> promotion will require official ratification, conformance tests and an approved migration;</li>
<li data-cid="qgFQCC">this document will not assume it is a final standard.</li>
</ol>
<p data-cid="PNN7vI">Finally, running STT, LLM and TTS concurrently on a single GB10 has not been demonstrated through a benchmark of the complete pipeline. <strong data-cid="iQ81eX">[BENCH]</strong> The first engineering deliverable must be a reproducible harness measuring end-to-end latency, memory, bandwidth, degradation under concurrency, interruption accuracy and cloning quality before committing to capacity or a contractual SLO.</p>
<h2 class="chapter" id="2-scope" data-cid="dUQi3s">2. Scope</h2>
<h3 id="2-1-objectives" data-cid="fSPqkg">2.1 Objectives</h3>
<ul data-cid="5uScCQ">
<li data-cid="BZzyBW"><strong data-cid="Auo5LW">[REQ]</strong> Deliver bidirectional, low-latency voice conversation from a browser.</li><li data-cid="f1-FNq"><strong data-cid="6DQkO6">[REQ]</strong> Identify users through the customer API and personalize sessions by identity or role.</li><li data-cid="jmrXyK"><strong data-cid="1mUIIz">[REQ]</strong> Dynamically load the agent profile, instructions, rules and tools.</li><li data-cid="hbNyBh"><strong data-cid="pd6yrb">[REQ]</strong> Preserve a corporate cloned voice against defaults sent by the client.</li><li data-cid="109qZh"><strong data-cid="hNUJjH">[REQ]</strong> Run STT, reasoning, tool calls and TTS in a decoupled pipeline.</li><li data-cid="HUYdKW"><strong data-cid="Wj5og8">[REQ]</strong> Integrate enterprise systems through an MCP gateway without changing the core.</li><li data-cid="2iztAL"><strong data-cid="gkCvFk">[REC]</strong> Include barge-in, cancellation, backpressure, timeouts, isolation, traceability and failure recovery as core capabilities.</li><li data-cid="a32o56"><strong data-cid="jt7y9s">[REC]</strong> Maintain versioned contracts that allow transports, models, runtimes and MCP servers to be replaced.</li><li data-cid="_JBWjn"><strong data-cid="-svA8j">[REC]</strong> Provide operational evidence for sizing, SLOs and auditing.</li>
</ul>
<h3 id="2-2-non-goals" data-cid="dqRHZ8">2.2 Non-goals</h3>
<ul data-cid="J6VGF4"><li data-cid="-wK4u-">Train STT, LLM or TTS models from scratch.</li><li data-cid="oD-sS4">Replace ERP, CRM, catalogs or other systems of record.</li><li data-cid="kWwP9h">Allow the LLM to execute directly against databases or APIs without a gateway and policy.</li><li data-cid="b5CmF9">Make the browser a repository for enterprise credentials or master voice material.</li><li data-cid="l9vXzf">Guarantee capacity, latency or concurrency before benchmarking on GB10.</li><li data-cid="5xgX-z">Declare MCP version <code data-cid="P09U1Z">2026-07-28</code> a final standard before ratification.</li><li data-cid="c0E4Kt">Design a complete contact center, universal regulatory recording or SIP telephony at this stage; these may be added as later domains.</li></ul>
<h2 class="chapter" id="3-architecture-principles" data-cid="YPGBAM">3. Architecture principles</h2>
<ol data-cid="2BIgdu"><li data-cid="kFb5yH"><strong data-cid="Jh7ZWr">Separate control and media.</strong> Audio has real-time requirements; identity, policy and auditing require consistency and traceability.</li><li data-cid="vqrmCW"><strong data-cid="sXkbum">Contracts before implementations.</strong> Each boundary publishes versioned events and schemas; models remain behind adapters.</li><li data-cid="pubtHD"><strong data-cid="VP4USS">Priority interruption.</strong> Cancellation and audio stopping take precedence over generating more content.</li><li data-cid="eU_ZND"><strong data-cid="tyhKGx">Explicit state with ownership.</strong> Vocero owns conversational sessions; the protocol adapter or explicit handles own MCP state.</li><li data-cid="5ExqGq"><strong data-cid="ubVqUf">Zero trust between planes.</strong> Each hop authenticates the service, authorizes the action, limits scope and propagates audited identity.</li><li data-cid="qx13Y8"><strong data-cid="1pd_8o">Least privilege for tools.</strong> A tool receives only the strictly necessary arguments, identity and scopes.</li><li data-cid="PzhfDg"><strong data-cid="-ryTLr">Privacy by default.</strong> Audio, transcripts, prompts, responses and voices are sensitive data; retention is explicit and minimized.</li><li data-cid="Ip6B7I"><strong data-cid="6aHB7j">Conversational failure handling.</strong> Technical failures become deterministic events and safe responses without leaking internal details.</li><li data-cid="mz1Tek"><strong data-cid="iIGMLI">Measure before promising.</strong> Stage latency and percentiles govern the experience, rather than isolated averages.</li><li data-cid="_nXzu9"><strong data-cid="rMB76U">Versioned MCP compatibility.</strong> The gateway negotiates a stable version and encapsulates future candidates.</li></ol>
<h2 class="chapter" id="4-context-and-container-view" data-cid="acfezF">4. Context and container view</h2>
<figure aria-label="C4 container view" class="static-diagram" data-cid="7N-DCC"><svg role="img" viewBox="0 0 1400 1230" xmlns="http://www.w3.org/2000/svg" data-cid="bMoGPc"><defs data-cid="1UBflj"><marker id="arrow" markerHeight="9" markerWidth="9" orient="auto" refX="7" refY="4.5" data-cid="9236lq"><path d="M0,0 L9,4.5 L0,9 z" fill="#52606d" data-cid="bSVw1a"></path></marker></defs>
<text class="title" text-anchor="middle" x="700" y="32" data-cid="CEDbB1">Vocero S2S — C4 container view</text>
<rect class="zone" height="1020" rx="12" width="880" x="260" y="85" data-cid="ORv8ev"></rect><text class="zone-label" x="285" y="115" data-cid="KsS6KP">VOCERO S2S</text>
<rect class="external" height="78" rx="7" width="190" x="25" y="190" data-cid="xc6mrg"></rect><text class="node-title" x="120.0" y="214" data-cid="pAurew">User</text><text class="node-sub" x="120.0" y="235" data-cid="c1b0zR">Speaks from a browser</text><rect class="external" height="78" rx="7" width="190" x="25" y="375" data-cid="tUySm7"></rect><text class="node-title" x="120.0" y="399" data-cid="qP3RGI">Identity / customer API</text><text class="node-sub" x="120.0" y="420" data-cid="BJ9avw">User, roles and attributes</text><rect class="external" height="86" rx="7" width="190" x="25" y="555" data-cid="7t9OP9"></rect><text class="node-title" x="120.0" y="579" data-cid="dDAfPD">Profile service</text><text class="node-sub" x="120.0" y="600" data-cid="-IMNzi">Instructions, rules, tools</text><text class="node-sub" x="120.0" y="615" data-cid="iO4QoW">and voice policy</text><rect class="external" height="86" rx="7" width="190" x="1185" y="365" data-cid="6WbV3j"></rect><text class="node-title" x="1280.0" y="389" data-cid="Wl4Blu">Enterprise systems</text><text class="node-sub" x="1280.0" y="410" data-cid="eLGclC">ERP, CRM, catalogs,</text><text class="node-sub" x="1280.0" y="425" data-cid="YJjizj">reports and workflows</text><rect class="external" height="86" rx="7" width="190" x="1185" y="845" data-cid="bxX-Wt"></rect><text class="node-title" x="1280.0" y="869" data-cid="XnXQmL">Observability</text><text class="node-sub" x="1280.0" y="890" data-cid="w4Lobk">Metrics, logs, traces</text><text class="node-sub" x="1280.0" y="905" data-cid="_PYNdM">and alerts</text><rect class="node" height="78" rx="7" width="200" x="295" y="170" data-cid="ckifr4"></rect><text class="node-title" x="395.0" y="194" data-cid="GZEs_d">Web client</text><text class="node-sub" x="395.0" y="215" data-cid="N9sLs3">Web Audio + WS/WebRTC</text><rect class="node" height="78" rx="7" width="200" x="530" y="170" data-cid="GA7C6G"></rect><text class="node-title" x="630.0" y="194" data-cid="JJuDtq">Edge / termination</text><text class="node-sub" x="630.0" y="215" data-cid="0I06SZ">TLS, connection, rate limit</text><rect class="node" height="78" rx="7" width="200" x="765" y="170" data-cid="dLABce"></rect><text class="node-title" x="865.0" y="194" data-cid="XEeZM6">Realtime Relay</text><text class="node-sub" x="865.0" y="215" data-cid="lPUh8a">Audio/events, sanitization</text><rect class="node" height="88" rx="7" width="200" x="530" y="345" data-cid="1vF9w6"></rect><text class="node-title" x="630.0" y="369" data-cid="veMb6d">Session Orchestrator</text><text class="node-sub" x="630.0" y="390" data-cid="yNMhqR">States, turns, profile</text><text class="node-sub" x="630.0" y="405" data-cid="365lG3">and policy</text><rect class="node" height="88" rx="7" width="200" x="765" y="345" data-cid="PZRGQk"></rect><text class="node-title" x="865.0" y="369" data-cid="SHkkB-">MCP Gateway</text><text class="node-sub" x="865.0" y="390" data-cid="3GCGHh">MCP client + policy</text><text class="node-sub" x="865.0" y="405" data-cid="qznGmy">enforcement</text><rect class="store" height="78" rx="7" width="200" x="530" y="525" data-cid="ghjHsd"></rect><text class="node-title" x="630.0" y="549" data-cid="lLCUA9">Session Store</text><text class="node-sub" x="630.0" y="570" data-cid="CjxJy0">KV with TTL</text><rect class="store" height="78" rx="7" width="200" x="765" y="525" data-cid="yvfvsh"></rect><text class="node-title" x="865.0" y="549" data-cid="xABU8g">Audit Store</text><text class="node-sub" x="865.0" y="570" data-cid="-CswDJ">Immutable store</text><rect class="node" height="88" rx="7" width="200" x="530" y="705" data-cid="rw0JkO"></rect><text class="node-title" x="630.0" y="729" data-cid="Y-V_xg">Inference Gateway</text><text class="node-sub" x="630.0" y="750" data-cid="OYoy4_">Internal realtime API</text><text class="node-sub" x="630.0" y="765" data-cid="3tqLmI">STT, LLM and TTS</text><rect class="gpu" height="75" rx="7" width="190" x="295" y="875" data-cid="2HqcBT"></rect><text class="node-title" x="390.0" y="899" data-cid="NIMM0q">Parakeet TDT 0.6B</text><text class="node-sub" x="390.0" y="920" data-cid="MOp10j">NeMo / GPU</text><rect class="gpu" height="75" rx="7" width="190" x="515" y="875" data-cid="aZJeex"></rect><text class="node-title" x="610.0" y="899" data-cid="SnOkQ3">LLaMA 3.1 8B</text><text class="node-sub" x="610.0" y="920" data-cid="TF7rXP">Local runtime</text><rect class="gpu" height="75" rx="7" width="190" x="735" y="875" data-cid="mUA5fg"></rect><text class="node-title" x="830.0" y="899" data-cid="w4fan3">Qwen3-TTS 1.7B</text><text class="node-sub" x="830.0" y="920" data-cid="zn2AVm">FP16 / GPU</text><rect class="store" height="75" rx="7" width="165" x="955" y="875" data-cid="ywXT7R"></rect><text class="node-title" x="1037.5" y="899" data-cid="z6Gilb">Voice Vault</text><text class="node-sub" x="1037.5" y="920" data-cid="pqPci4">Authorized references</text><path class="edge" d="M215 229 H295" data-cid="0mcWH8"></path><text class="edge-label" x="255" y="214" data-cid="xr7Fzd">Audio, controls and confirmations</text><path class="edge" d="M495 209 H530" data-cid="v0Vkwf"></path><text class="edge-label" x="512" y="194" data-cid="eNp6bY">Media and events · TLS</text><path class="edge" d="M730 209 H765" data-cid="Zc-oPK"></path><text class="edge-label" x="747" y="194" data-cid="7WvqpA">Authenticated stream</text><path class="edge" d="M865 248 V345" data-cid="td_hjy"></path><text class="edge-label" x="895" y="305" data-cid="U8e_Qw">Session events</text><path class="edge" d="M530 389 H215 V414" data-cid="VHLxeJ"></path><text class="edge-label" x="370" y="370" data-cid="RNHCux">Resolve identity · HTTPS</text><path class="edge" d="M530 405 H215 V598" data-cid="5oDKsX"></path><text class="edge-label" x="370" y="578" data-cid="Yi1hrb">Load profiles and policies · HTTPS</text><path class="edge" d="M630 433 V525" data-cid="wd0AJG"></path><text class="edge-label" x="675" y="490" data-cid="DGjbI_">Read/write ephemeral state</text><path class="edge" d="M730 389 H765" data-cid="0FoTUs"></path><text class="edge-label" x="748" y="373" data-cid="Gd0hTb">Tool intent + delegated context · mTLS</text><path class="edge" d="M630 433 V705" data-cid="07flbE"></path><text class="edge-label" x="690" y="645" data-cid="TVERQA">Inference commands and events · mTLS</text><path class="edge" d="M630 793 V875" data-cid="UhDHYl"></path><text class="edge-label" x="665" y="845" data-cid="rCqP4q">Audio chunks</text><path class="edge" d="M730 749 V875" data-cid="DZWXMs"></path><text class="edge-label" x="762" y="825" data-cid="gW2-uq">Context and tokens</text><path class="edge" d="M730 770 H830 V875" data-cid="FKk8xX"></path><text class="edge-label" x="855" y="845" data-cid="bm8X2b">Text and voice_profile_ref</text><path class="edge" d="M925 912 H955" data-cid="OV8rqa"></path><text class="edge-label" x="940" y="897" data-cid="WC1kTL">Read authorized reference</text><path class="edge" d="M965 389 H1185" data-cid="t2A68c"></path><text class="edge-label" x="1075" y="373" data-cid="mLGlrt">Versioned MCP/HTTPS</text><path class="edge" d="M765 433 V525" data-cid="H55xYI"></path><text class="edge-label" x="845" y="490" data-cid="L5nJ7C">Executions and decisions</text><path class="edge" d="M730 389 H765 V525" data-cid="ubLurZ"></path><text class="edge-label" x="782" y="475" data-cid="XsKDuu">Audit events</text><path class="edge" d="M730 205 H1185 V880" data-cid="FA5pOH"></path><text class="edge-label" x="1040" y="190" data-cid="UvAbQi">Telemetry</text><path class="edge" d="M630 433 H1185 V880" data-cid="-Zqtqa"></path><text class="edge-label" x="1010" y="420" data-cid="sYYFxG">Telemetry</text><path class="edge" d="M630 705 H1185 V890" data-cid="HeuwHi"></path><text class="edge-label" x="1005" y="690" data-cid="zfpjeR">GPU/model telemetry</text></svg><figcaption class="caption" data-cid="9IoG_x">Static vector representation of the C4 view included in version v2.</figcaption></figure>
<h3 id="4-1-logical-view-by-plane" data-cid="bjFTuU">4.1 Logical view by plane</h3>
<p data-cid="ivNYuo"><strong data-cid="9OdTp6">Experience Plane</strong></p><ul data-cid="0-evtJ"><li data-cid="oDcahu">Web client, microphone capture, echo cancellation, playback and consent controls.</li><li data-cid="00IJ-r">Retains only required visual state and cursors; does not retain secrets or master voice material.</li></ul>
<p data-cid="j0Ehlp"><strong data-cid="8DOBp_">Realtime Data Plane</strong></p><ul data-cid="wG8UM-"><li data-cid="fG9jxC">WebSocket or WebRTC termination, media relay and event multiplexing.</li><li data-cid="7kcGkL">Enforces buffer, sequence and size limits; discards stale data when generation changes.</li><li data-cid="f1J7ei">Separates a high-priority control queue —<code data-cid="eDAJxE">cancel</code>, <code data-cid="1U6ptc">barge_in</code>, <code data-cid="mniP-2">close</code>— from the audio/data queue.</li></ul>
<p data-cid="dZJP89"><strong data-cid="Og5vUw">Conversation Control Plane</strong></p><ul data-cid="fMvhjd"><li data-cid="r9jLKt">Resolves identity, profile, permissions and effective configuration.</li><li data-cid="xc389G">Maintains the session and turn state machine.</li><li data-cid="A1vmR9">Builds context, coordinates inference and decides whether a tool can be executed, confirmed or rejected.</li></ul>
<p data-cid="j-Jyy3"><strong data-cid="57Pcle">Inference Plane</strong></p><ul data-cid="8w2Qjp"><li data-cid="B-9WGa">Hides runtime details and exposes uniform capabilities: <code data-cid="NdfAlc">transcribe</code>, <code data-cid="lmR8Yo">generate</code>, <code data-cid="i7DbdW">synthesize</code>, <code data-cid="IB4h_z">cancel</code>, <code data-cid="T7fbBs">health</code>, <code data-cid="0j_ZSY">capacity</code>.</li><li data-cid="gMQUQw">Correlates each output with <code data-cid="qKSIqy">session_id</code>, <code data-cid="2up0Ge">turn_id</code> and <code data-cid="MRDvHy">generation_id</code> to discard late responses.</li></ul>
<p data-cid="7AM-7u"><strong data-cid="m6sQ2s">Enterprise Integration Plane</strong></p><ul data-cid="8UN2Bn"><li data-cid="Q2XSaj">MCP gateway with version adapters, allowlists, validation, authorization, service secrets, idempotency and auditing.</li><li data-cid="TTghSa">No tool response enters the context without size, classification and sanitization checks.</li></ul>
<h2 class="chapter" id="5-component-responsibilities" data-cid="2_zamP">5. Component responsibilities</h2>
<div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="k8XI__"><table data-cid="0GBXr5"><thead data-cid="5-Da7k"><tr data-cid="N1f_QZ"><th data-cid="gyW-Lh">Component</th><th data-cid="464jl1">Responsibilities</th><th data-cid="QaF30B">Must not</th></tr></thead><tbody data-cid="9ZXSi0"><tr data-cid="xImSvz"><td data-cid="8GBoDc">Web client</td><td data-cid="dnegF1">Capture/play audio; AEC/NS/AGC where appropriate; show state; send confirmations; report playout progress</td><td data-cid="u1lGHx">Authorize tools; store secrets; decide the effective voice</td></tr><tr data-cid="1zKfjx"><td data-cid="6JB5f1">Realtime edge</td><td data-cid="vwnT5W">TLS; connection authentication; limits; routing; DoS protection; WS upgrade or WebRTC termination</td><td data-cid="SwhTVa">Interpret prompts or MCP arguments</td></tr><tr data-cid="ebGI1E"><td data-cid="HlirZd">Realtime Relay</td><td data-cid="kowfv0">Multiplex audio/events; order sequences; backpressure; sanitize <code data-cid="qOWuAr">session.update</code>; prioritize interruptions</td><td data-cid="2WzrJu">Retain business logic or downstream credentials</td></tr><tr data-cid="9wk5vQ"><td data-cid="-d5eI7">Session Orchestrator</td><td data-cid="e4ds7L">State machine; identity; profile; context; turns; cancellation; degradation; correlation</td><td data-cid="upUcbU">Execute SQL, ERP or APIs directly</td></tr><tr data-cid="nOBvkX"><td data-cid="hxsKKO">Policy Engine</td><td data-cid="QE9EVf">Evaluate identity, role, tool, risk, scope, consent and data policy</td><td data-cid="XpW_FE">Silently rewrite business arguments without a record</td></tr><tr data-cid="52sq8a"><td data-cid="ybXSZ3">MCP Gateway</td><td data-cid="RWV44P">Negotiate versions; discover tools; validate JSON Schema; delegate identity; apply timeouts/retries; audit</td><td data-cid="zwzQW8">Expose credentials to the LLM or browser</td></tr><tr data-cid="RLBYC3"><td data-cid="x2dWUN">Inference Gateway</td><td data-cid="Bm3t21">Admit/cancel jobs; adapt protocols; measure stages; health/capacity</td><td data-cid="kA5DJf">Decide enterprise permissions</td></tr><tr data-cid="qb8eMV"><td data-cid="KJflBq">STT/VAD</td><td data-cid="rmA4EP">Emit partial/final transcripts and speech signals with timestamps</td><td data-cid="XKUo_s">Persist audio indefinitely</td></tr><tr data-cid="LBAiLI"><td data-cid="5DSCRP">LLM</td><td data-cid="X6boPR">Generate structured text or tool intent within allowed schemas</td><td data-cid="AoU4Tj">Treat itself as the authority to execute actions</td></tr><tr data-cid="cfTjSv"><td data-cid="NUuL2w">TTS</td><td data-cid="97B11p">Synthesize a stream tied to a generation and authorized voice profile</td><td data-cid="W98g4z">Accept arbitrary <code data-cid="IcHjbe">ref_audio</code> from the client</td></tr><tr data-cid="76Ow5j"><td data-cid="hPezZP">Voice Vault</td><td data-cid="F0mG-Q">Version, encrypt and govern voice references and consent</td><td data-cid="Gs2jrA">Serve files without service and tenant authorization</td></tr><tr data-cid="VhXdi0"><td data-cid="kwkb1_">Stores</td><td data-cid="qER4h_">Ephemeral state with TTL, immutable auditing and versioned configuration</td><td data-cid="RcOUtN">Mix operational PII with unrestricted telemetry</td></tr><tr data-cid="TDbZt_"><td data-cid="BDx_63">Observability</td><td data-cid="gJT3XQ">Metrics, structured logs, traces, alerts and dashboards</td><td data-cid="FGqBYh">Log audio, tokens or sensitive arguments by default</td></tr></tbody></table></div>
<h2 class="chapter" id="6-deployment-view" data-cid="UGMd_n">6. Deployment view</h2>
<figure aria-label="Deployment view" class="static-diagram" data-cid="E-FkWs"><svg role="img" viewBox="0 0 1400 1190" xmlns="http://www.w3.org/2000/svg" data-cid="nXQ8FN"><defs data-cid="INZgwt"><marker id="arrow" markerHeight="9" markerWidth="9" orient="auto" refX="7" refY="4.5" data-cid="QMYDXj"><path d="M0,0 L9,4.5 L0,9 z" fill="#52606d" data-cid="J4vcpb"></path></marker></defs><text class="title" text-anchor="middle" x="700" y="32" data-cid="D3RGEZ">Vocero S2S — Deployment view</text>
<rect class="zone" height="122" rx="10" width="1320" x="40" y="70" data-cid="4Zibkm"></rect><text class="zone-label" x="60" y="98" data-cid="8OZWFv">PUBLIC ZONE</text>
<rect class="zone" height="138" rx="10" width="1320" x="40" y="220" data-cid="32L8rc"></rect><text class="zone-label" x="60" y="248" data-cid="6DdXis">DMZ / EDGE</text>
<rect class="zone" height="395" rx="10" width="820" x="40" y="388" data-cid="yLXjyd"></rect><text class="zone-label" x="60" y="416" data-cid="VqXWhE">APPLICATION NETWORK</text>
<rect class="zone" height="395" rx="10" width="470" x="890" y="388" data-cid="Dqv6qO"></rect><text class="zone-label" x="910" y="416" data-cid="icLA0n">RESTRICTED INFERENCE SEGMENT</text>
<rect class="zone" height="180" rx="10" width="820" x="40" y="814" data-cid="VOfnxV"></rect><text class="zone-label" x="60" y="842" data-cid="FoQAj_">ENTERPRISE NETWORK</text>
<rect class="zone" height="180" rx="10" width="470" x="890" y="814" data-cid="iPTIT5"></rect><text class="zone-label" x="910" y="842" data-cid="btB4Xl">OPERATIONS</text><rect class="node" height="55" rx="7" width="200" x="600" y="105" data-cid="GIqIww"></rect><text class="node-title" x="700.0" y="129" data-cid="ZtnWqF">Browser</text><rect class="node" height="58" rx="7" width="210" x="300" y="268" data-cid="GghPGo"></rect><text class="node-title" x="405.0" y="292" data-cid="Ydg66Y">WAF + Reverse Proxy</text><rect class="external" height="58" rx="7" width="210" x="820" y="268" data-cid="9EItKx"></rect><text class="node-title" x="925.0" y="292" data-cid="yJHi6m">Optional TURN/SFU</text><text class="node-sub" x="925.0" y="313" data-cid="Thnm2B">WebRTC evolution</text><rect class="node" height="60" rx="7" width="160" x="85" y="455" data-cid="TJqZc3"></rect><text class="node-title" x="165.0" y="479" data-cid="uJ_I6G">Realtime Relay A</text><rect class="node" height="60" rx="7" width="160" x="85" y="550" data-cid="wpy0-c"></rect><text class="node-title" x="165.0" y="574" data-cid="9GlTWK">Realtime Relay B</text><rect class="node" height="60" rx="7" width="170" x="290" y="455" data-cid="KFa3BR"></rect><text class="node-title" x="375.0" y="479" data-cid="JS6Uhk">Session Orchestrator A</text><rect class="node" height="60" rx="7" width="170" x="290" y="550" data-cid="mrMdj8"></rect><text class="node-title" x="375.0" y="574" data-cid="CYPBvF">Session Orchestrator B</text><rect class="node" height="60" rx="7" width="150" x="510" y="455" data-cid="2nHYwS"></rect><text class="node-title" x="585.0" y="479" data-cid="Jj1djF">Policy Engine</text><rect class="node" height="60" rx="7" width="150" x="510" y="550" data-cid="ALAgel"></rect><text class="node-title" x="585.0" y="574" data-cid="SPd46n">MCP Gateway</text><rect class="store" height="60" rx="7" width="120" x="705" y="455" data-cid="j2TZ6i"></rect><text class="node-title" x="765.0" y="479" data-cid="zfODRV">Session Store</text><text class="node-sub" x="765.0" y="500" data-cid="ej8ehj">TTL</text><rect class="store" height="60" rx="7" width="120" x="705" y="550" data-cid="deU58h"></rect><text class="node-title" x="765.0" y="574" data-cid="h2xw6Q">Audit Store</text><rect class="node" height="65" rx="7" width="190" x="960" y="455" data-cid="GD2WvR"></rect><text class="node-title" x="1055.0" y="479" data-cid="1ab6fs">Inference Gateway</text><text class="node-sub" x="1055.0" y="500" data-cid="51kE3a">Internal port 12345</text><rect class="gpu" height="58" rx="7" width="120" x="930" y="580" data-cid="xhyRyb"></rect><text class="node-title" x="990.0" y="604" data-cid="_vC7wc">Parakeet STT/VAD</text><rect class="gpu" height="58" rx="7" width="120" x="1060" y="580" data-cid="1Qw6ag"></rect><text class="node-title" x="1120.0" y="604" data-cid="hGQ1vN">LLaMA 3.1 8B</text><rect class="gpu" height="58" rx="7" width="125" x="1190" y="580" data-cid="6HZ-LQ"></rect><text class="node-title" x="1252.5" y="604" data-cid="d2LOt-">Qwen3-TTS 1.7B</text><text class="node-sub" x="1252.5" y="625" data-cid="zJ28mf">FP16</text><rect class="store" height="55" rx="7" width="125" x="1190" y="675" data-cid="b3ykH_"></rect><text class="node-title" x="1252.5" y="699" data-cid="tM9UQR">Voice Vault</text><text class="node-sub" x="1252.5" y="720" data-cid="JorC6v">encrypted cache</text><rect class="gpu" height="55" rx="7" width="205" x="940" y="675" data-cid="EhoPN8"></rect><text class="node-title" x="1042.5" y="699" data-cid="xEMJpP">NVIDIA GB10</text><rect class="external" height="60" rx="7" width="190" x="105" y="875" data-cid="s4Ftcy"></rect><text class="node-title" x="200.0" y="899" data-cid="b3V-fg">Auth + Agent Profile APIs</text><rect class="external" height="60" rx="7" width="190" x="355" y="875" data-cid="FFyrSW"></rect><text class="node-title" x="450.0" y="899" data-cid="VxqvQ_">MCP Servers / Adapters</text><rect class="external" height="60" rx="7" width="190" x="605" y="875" data-cid="Fi1Dpx"></rect><text class="node-title" x="700.0" y="899" data-cid="37cq99">ERP / CRM / Data / Workflows</text><rect class="node" height="60" rx="7" width="130" x="920" y="875" data-cid="KgmwqW"></rect><text class="node-title" x="985.0" y="899" data-cid="tUVyye">OTel Collector</text><rect class="external" height="60" rx="7" width="150" x="1080" y="875" data-cid="oDwR37"></rect><text class="node-title" x="1155.0" y="899" data-cid="G590hO">Metrics / Logs / Traces / Alerts</text><rect class="store" height="60" rx="7" width="100" x="1240" y="875" data-cid="ZtB_rO"></rect><text class="node-title" x="1290.0" y="899" data-cid="JY3CFt">Secrets + KMS</text><path class="edge" d="M700 160 V268 H510" data-cid="Invvcy"></path><text class="edge-label" x="590" y="210" data-cid="lR-j_J">Initial TLS WS</text><path class="edge-dash" d="M700 160 V268 H820" data-cid="jGhPA-"></path><text class="edge-label" x="770" y="210" data-cid="zmQTZv">Future WebRTC</text><path class="edge" d="M405 326 V455 H245" data-cid="EOQc5j"></path><path class="edge" d="M405 326 V550 H245" data-cid="-rhtVI"></path><path class="edge-dash" d="M925 326 V455 H245" data-cid="GzOfhn"></path><text class="edge-label" x="720" y="342" data-cid="f_PgDz">Future WebRTC</text><path class="edge" d="M245 485 H290" data-cid="zGM6c2"></path><path class="edge" d="M245 580 H290" data-cid="1_BTEt"></path><path class="edge" d="M460 485 H510" data-cid="C3o0Yo"></path><path class="edge" d="M460 580 H510" data-cid="ybGQxf"></path><path class="edge" d="M460 485 H705" data-cid="tTFjpm"></path><path class="edge" d="M460 580 H705" data-cid="OI-FtL"></path><path class="edge" d="M460 485 H960" data-cid="Xp0ULD"></path><text class="edge-label" x="700" y="470" data-cid="a3B7Be">mTLS realtime</text><path class="edge" d="M460 580 H960" data-cid="C0iAj-"></path><text class="edge-label" x="700" y="600" data-cid="6wcx9_">mTLS realtime</text><path class="edge" d="M1055 520 V580 H990" data-cid="DHJeJL"></path><path class="edge" d="M1055 520 V580 H1120" data-cid="osBGlQ"></path><path class="edge" d="M1055 520 V580 H1250" data-cid="Wzk8bo"></path><path class="edge" d="M1250 638 V675" data-cid="n0KL9V"></path><path class="edge" d="M460 485 V875 H295" data-cid="bSAKZy"></path><path class="edge" d="M460 580 V875 H295" data-cid="zrO_Zh"></path><path class="edge" d="M660 580 V875" data-cid="Je7Jc4"></path><path class="edge" d="M545 905 H605" data-cid="XHvzWp"></path><path class="edge" d="M660 485 H705 V580" data-cid="IiAD2a"></path><path class="edge" d="M660 580 H705" data-cid="thsFcE"></path><path class="edge" d="M245 485 V875 H920" data-cid="B87Z-f"></path><path class="edge" d="M460 485 V875 H920" data-cid="vPptbj"></path><path class="edge" d="M660 580 V875 H920" data-cid="Lzp7Vx"></path><path class="edge" d="M1050 905 H1080" data-cid="o-UJ4L"></path><path class="edge" d="M1290 875 V610 H1250" data-cid="LRBA69"></path><path class="edge" d="M1290 875 V520 H1150" data-cid="gBa_PX"></path></svg><figcaption class="caption" data-cid="1Ylq9s">Static vector representation of the deployment view included in version v2.</figcaption></figure>
<p data-cid="U3zlDT"><strong data-cid="-TsXp1">[REC]</strong> Port <code data-cid="8Hy65b">12345</code> must be internal, protected by a firewall, mTLS and service authentication; it must not be exposed directly to the Internet. <strong data-cid="OktuX7">[REC]</strong> Relay and Orchestrator are deployed with at least two logical instances in production. This does not require physical high availability from the first day of the MVP, but contracts must not depend exclusively on local memory.</p>
<p data-cid="ksD7-H"><strong data-cid="ZZ1REl">[BENCH]</strong> The GB10 is initially a single failure and capacity domain. Before production, define the spare-node strategy, admission queue, session limit, shedding policy and model recovery procedure.</p>
<h2 class="chapter" id="7-state-machine-and-session-management" data-cid="o5wBzh">7. State machine and session management</h2>
<h3 id="7-1-proposed-states" data-cid="aM8CvA">7.1 Proposed states</h3>
<figure aria-label="Session state machine" class="static-diagram" data-cid="-aZcy_"><svg role="img" viewBox="0 0 1400 1010" xmlns="http://www.w3.org/2000/svg" data-cid="KJjFlV"><defs data-cid="N-k4fy"><marker id="arrow" markerHeight="9" markerWidth="9" orient="auto" refX="7" refY="4.5" data-cid="5D0jsA"><path d="M0,0 L9,4.5 L0,9 z" fill="#52606d" data-cid="wLEwCt"></path></marker></defs><text class="title" text-anchor="middle" x="700" y="32" data-cid="3LoC3v">Vocero S2S — Session state machine</text><rect class="terminal" height="52" rx="7" width="125" x="50" y="100" data-cid="r0W_xa"></rect><text class="node-title" x="112.5" y="124" data-cid="nXbces">Start</text><rect class="state" height="58" rx="7" width="165" x="220" y="100" data-cid="OvS-07"></rect><text class="node-title" x="302.5" y="124" data-cid="Gg-gC6">CONNECTING</text><rect class="state" height="58" rx="7" width="190" x="440" y="100" data-cid="x4CIAu"></rect><text class="node-title" x="535.0" y="124" data-cid="d6tR7-">AUTHENTICATING</text><rect class="state" height="58" rx="7" width="180" x="690" y="100" data-cid="07bOo-"></rect><text class="node-title" x="780.0" y="124" data-cid="_Gu2Vu">CONFIGURING</text><rect class="state" height="58" rx="7" width="150" x="940" y="100" data-cid="UoXp-O"></rect><text class="node-title" x="1015.0" y="124" data-cid="4qopLW">LISTENING</text><rect class="state" height="58" rx="7" width="175" x="940" y="235" data-cid="o40tDe"></rect><text class="node-title" x="1027.5" y="259" data-cid="tMy4G3">TRANSCRIBING</text><rect class="state" height="58" rx="7" width="150" x="940" y="370" data-cid="GiSy0a"></rect><text class="node-title" x="1015.0" y="394" data-cid="3Xop-U">THINKING</text><rect class="state" height="58" rx="7" width="180" x="940" y="505" data-cid="cPpzNy"></rect><text class="node-title" x="1030.0" y="529" data-cid="vnKLqx">TOOL_PENDING</text><rect class="state" height="58" rx="7" width="185" x="1180" y="505" data-cid="YW5GTS"></rect><text class="node-title" x="1272.5" y="529" data-cid="Voz9_U">AWAITING_CONFIRMATION</text><rect class="state" height="58" rx="7" width="170" x="1115" y="640" data-cid="mVym6L"></rect><text class="node-title" x="1200.0" y="664" data-cid="cM5PgC">TOOL_RUNNING</text><rect class="state" height="58" rx="7" width="155" x="720" y="370" data-cid="EO3ODx"></rect><text class="node-title" x="797.5" y="394" data-cid="OMsRGh">SPEAKING</text><rect class="state" height="58" rx="7" width="155" x="520" y="370" data-cid="hTjp0W"></rect><text class="node-title" x="597.5" y="394" data-cid="kwwOCy">INTERRUPTING</text><rect class="state" height="58" rx="7" width="175" x="690" y="235" data-cid="b7K9W9"></rect><text class="node-title" x="777.5" y="259" data-cid="mSgUnP">DEGRADED</text><rect class="terminal" height="58" rx="7" width="150" x="420" y="745" data-cid="O8tx2o"></rect><text class="node-title" x="495.0" y="769" data-cid="I_szIs">CLOSING</text><rect class="terminal" height="58" rx="7" width="145" x="220" y="235" data-cid="gF0Cjv"></rect><text class="node-title" x="292.5" y="259" data-cid="GCjlCh">FAILED</text><path class="edge" d="M175 126 H220" data-cid="gdpxH-"></path><path class="edge" d="M385 129 H440" data-cid="a9Wm70"></path><text class="edge-label" x="412" y="115" data-cid="PkNczn">transport ready</text><path class="edge" d="M630 129 H690" data-cid="5pObZN"></path><text class="edge-label" x="660" y="115" data-cid="uYmOPB">valid identity</text><path class="edge" d="M630 146 V264 H365" data-cid="QZB5Aj"></path><text class="edge-label" x="495" y="215" data-cid="xaTqvb">rejection or timeout</text><path class="edge" d="M870 129 H940" data-cid="5SZtjx"></path><text class="edge-label" x="905" y="115" data-cid="O4gG2-">profile + voice + tools loaded</text><path class="edge" d="M780 158 V235 H865" data-cid="ya8vgh"></path><text class="edge-label" x="820" y="212" data-cid="hOg67i">noncritical dependency fails</text><path class="edge" d="M1015 158 V235" data-cid="VRM4M-"></path><text class="edge-label" x="1075" y="210" data-cid="7HhBee">speech_started</text><path class="edge" d="M1027 293 V370" data-cid="2cOmAf"></path><text class="edge-label" x="1095" y="345" data-cid="EYkztJ">turn_committed</text><path class="edge" d="M1015 428 V505" data-cid="feyTFY"></path><text class="edge-label" x="1085" y="480" data-cid="Alnx2J">tool_intent</text><path class="edge" d="M1120 534 H1180" data-cid="rbmQsx"></path><text class="edge-label" x="1150" y="520" data-cid="sT8ZdV">sensitive action</text><path class="edge" d="M1272 563 V640" data-cid="YJDa2f"></path><text class="edge-label" x="1312" y="610" data-cid="kJjvN5">confirmed</text><path class="edge" d="M1120 563 V640" data-cid="K-dNwd"></path><text class="edge-label" x="1165" y="610" data-cid="VR942t">allowed</text><path class="edge" d="M1115 669 H1090 V428" data-cid="HSlV-9"></path><text class="edge-label" x="1100" y="490" data-cid="FT2r2T">tool_result</text><path class="edge" d="M940 399 H875" data-cid="UP4HJT"></path><text class="edge-label" x="905" y="385" data-cid="y23W_p">audio_first_chunk</text><path class="edge" d="M720 399 H675" data-cid="E5ih2x"></path><text class="edge-label" x="700" y="385" data-cid="MHtcp9">barge_in</text><path class="edge" d="M520 399 V129 H940" data-cid="T2QWyH"></path><text class="edge-label" x="695" y="210" data-cid="lRcVc5">output stopped</text><path class="edge" d="M875 399 H940 V158" data-cid="eEQgjp"></path><text class="edge-label" x="902" y="260" data-cid="vkyqS6">response_completed</text><path class="edge" d="M690 264 H865" data-cid="4fYFwM"></path><text class="edge-label" x="778" y="250" data-cid="zuAdYo">alternative available</text><path class="edge" d="M940 158 V774 H570" data-cid="udBrpL"></path><text class="edge-label" x="790" y="730" data-cid="QnWVsD">close</text><path class="edge" d="M1027 293 V774 H570" data-cid="FKvly5"></path><text class="edge-label" x="850" y="750" data-cid="9MVXPi">close</text><path class="edge" d="M1015 428 V774 H570" data-cid="EsAMnP"></path><text class="edge-label" x="760" y="790" data-cid="J9XpCQ">close</text><path class="edge" d="M720 428 V774 H570" data-cid="tfSA-A"></path><text class="edge-label" x="650" y="650" data-cid="clry5a">close</text><path class="edge" d="M420 774 H250 V293" data-cid="vc1LTp"></path><path class="edge" d="M220 264 H175" data-cid="UKserc"></path></svg><figcaption class="caption" data-cid="hEgNfa">Static vector representation of the state machine included in version v2.</figcaption></figure>
<h3 id="7-2-identifiers" data-cid="VLmGLo">7.2 Identifiers</h3>
<ul data-cid="Z7cVDM"><li data-cid="Moh_5Z"><code data-cid="5WW_7v">connection_id</code>: transport connection; may change on reconnection.</li><li data-cid="X6YUTg"><code data-cid="jac5_8">session_id</code>: stable, opaque conversational session.</li><li data-cid="Plcjwz"><code data-cid="UP6Cun">turn_id</code>: committed user input.</li><li data-cid="13YypE"><code data-cid="nyPXM-">generation_id</code>: agent response; changes after cancellation or regeneration.</li><li data-cid="ksba69"><code data-cid="3zQ3jn">tool_call_id</code>: unique invocation; must be idempotent when supported by the tool.</li><li data-cid="p9pmTY"><code data-cid="uC5Gvg">voice_profile_id</code> + <code data-cid="pi7g6k">voice_version</code>: immutable reference to the authorized voice.</li><li data-cid="2l2Qw4"><code data-cid="wCGoHg">trace_id</code>: distributed correlation; does not replace functional identifiers.</li></ul>
<h3 id="7-3-effective-session-state" data-cid="nUCjdj">7.3 Effective session state</h3>
<p data-cid="P2qE-n"><strong data-cid="F-YVQY">[REC]</strong> Calculated in this order, without allowing the client to escalate privileges:</p><ol data-cid="Q8M2NG"><li data-cid="yMeYvk">secure platform defaults;</li><li data-cid="C1qBxn">tenant policy;</li><li data-cid="kTrt17">versioned agent profile;</li><li data-cid="5LnFS3">authorized user attributes;</li><li data-cid="-a4VWj">allowed session preferences;</li><li data-cid="-DM92l">explicitly allowlisted per-response overrides.</li></ol>
<p data-cid="0JDSIe">The sanitizer for <code data-cid="NcSKQE">session.update</code> removes or rejects fields that could replace <code data-cid="nAFCJ9">voice_profile_id</code>, tools, system instructions, limits or scopes. Any difference between requested and effective configuration is recorded in a <code data-cid="R4duqa">session.configuration_applied</code> event with coded reasons.</p><p data-cid="CWdXy3"><strong data-cid="TxsuBf">[REC]</strong> Ephemeral state is stored with TTL and optimistic version control. Resumption requires a short-lived opaque token, the same identity and a profile-version check. Uncommitted audio and generation jobs are not resumed: they are canceled and the client returns to <code data-cid="v2yjLk">LISTENING</code>.</p>
<h2 class="chapter" id="8-execution-flows" data-cid="mstQ8o">8. Execution flows</h2><h3 id="8-1-normal-conversational-and-mcp-flow" data-cid="zlRuBZ">8.1 Normal conversational and MCP flow</h3><h3 id="8-2-tool-call-with-confirmation" data-cid="73RNpN">8.2 Tool call with confirmation</h3>
<ol data-cid="U1BW72"><li data-cid="hgnnoF">The LLM emits intent, never direct execution.</li><li data-cid="MKI5o-">Orchestrator validates the name against the allowlist and current schema.</li><li data-cid="qL4HSS">Policy Engine classifies the action: read, reversible write, irreversible action or prohibited.</li><li data-cid="fHZSew">If consent is required, emit <code data-cid="Qr_XXd">tool.confirmation_required</code> with a readable summary and nonsensitive fields.</li><li data-cid="gw_Ard">The user confirms; create a <code data-cid="LdF2Uk">confirmation_id</code> bound to a hash of tool + arguments + identity + expiration.</li><li data-cid="PiYUID">MCP Gateway executes with a delegated token of minimum scope.</li><li data-cid="81K04T">Validate, limit and classify the result before returning it to the LLM.</li><li data-cid="oW81jh">Record the decision, not secrets or complete sensitive payloads.</li></ol>
<p data-cid="HEXwLG">For stable compatibility <code data-cid="WUBD9I">2025-11-25</code>, the adapter maintains the protocol lifecycle and session according to the official transport <a class="inline_marker" href="#ref5" data-cid="b7Ls-s">5</a>. RC <code data-cid="KK-JcO">2026-07-28</code> proposes eliminating the handshake and protocol session, using self-contained requests, routing headers and <code data-cid="ibgleD">InputRequiredResult</code>; these capabilities remain only in the experimental adapter until ratification <a class="inline_marker" href="#ref4" data-cid="LbJd8T">4</a>.</p>
<h3 id="8-3-barge-in" data-cid="bR0grF">8.3 Barge-in</h3><p data-cid="rO5-oR">Rules:</p><ul data-cid="ScqSS-"><li data-cid="zdwvtO">An interruption event bypasses token and audio queues.</li><li data-cid="gKA6-N">Each subsequent chunk from <code data-cid="iMW70R">G1</code> is discarded because of a stale <code data-cid="SLhMXc">generation_id</code> .</li><li data-cid="bw_0Ey">The client cursor is the source of truth for played audio; when missing, use the last conservative ACK.</li><li data-cid="u-xUGj">A read-only tool can be canceled; an already confirmed, irreversible action is not undone by barge-in. Report its status and avoid repeating it.</li><li data-cid="weowuc">Apply AEC and adaptive thresholds to reduce self-interruptions; test brief interjections as a specific case.</li></ul>
<h3 id="8-4-errors-and-degradation" data-cid="rUtrUg">8.4 Errors and degradation</h3>
<div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="LRxZVv"><table data-cid="o8KeF8"><thead data-cid="BG4m5F"><tr data-cid="dScA7n"><th data-cid="artf8w">Condition</th><th data-cid="AueFD4">Automatic action</th><th data-cid="UKxiT8">User experience</th><th data-cid="9JAkFB">Auditing/operations</th></tr></thead><tbody data-cid="Ij9615"><tr data-cid="GXRdlH"><td data-cid="Yzzu5x">Authentication denied</td><td data-cid="b8xxLe">Close with a stable code</td><td data-cid="Qsfye-">Unauthorized access message</td><td data-cid="5FEOmI">Reason, tenant, subject hash</td></tr><tr data-cid="GLZJBJ"><td data-cid="MFDaqg">Profile unavailable</td><td data-cid="q6yEkj">Bounded retry; fallback only if approved</td><td data-cid="12zVmK">“I cannot start the assistant right now”</td><td data-cid="LZcdB3">Dependency alert</td></tr><tr data-cid="3mcU7Z"><td data-cid="CcHFZG">Unhealthy STT</td><td data-cid="cXwsjT">Pause admission or enable text mode if available</td><td data-cid="0bSDyd">Report degradation</td><td data-cid="7UGQJH">Metric and circuit breaker</td></tr><tr data-cid="EBXWtN"><td data-cid="LS-Sse">LLM timeout</td><td data-cid="Tcn1oZ">Cancel generation; retry once only if no tool side effect occurred</td><td data-cid="t1Bv0Y">Brief, safe response</td><td data-cid="q4uINc">Span with timeout</td></tr><tr data-cid="06tgpE"><td data-cid="1QjUXx">TTS fails</td><td data-cid="JRNrGu">Keep text; do not replace the voice without a policy</td><td data-cid="lhTPJZ">Show text or request a retry</td><td data-cid="u5gtba">Voice/model status</td></tr><tr data-cid="dwskbI"><td data-cid="bKc-XH">MCP timeout</td><td data-cid="NtL70f">Cancel or mark status unknown</td><td data-cid="yztM1F">“I could not confirm the operation”</td><td data-cid="PtuHpX">Do not retry writes without idempotency</td></tr><tr data-cid="i_4rT0"><td data-cid="7QY3da">Invalid MCP response</td><td data-cid="LUFLSu">Reject the payload; do not send it to the LLM</td><td data-cid="xqT6n5">Controlled error</td><td data-cid="pDxmQl">Schema violation</td></tr><tr data-cid="S1e_85"><td data-cid="Uc6dFc">Saturated buffer</td><td data-cid="Zgagm3">Slow the producer; discard stale partials; never lose cancellation</td><td data-cid="iZlz9B">Possible network indicator</td><td data-cid="5O9Pd9">Drop/backpressure counters</td></tr><tr data-cid="nvluxo"><td data-cid="1clBpQ">Client disconnected</td><td data-cid="dwJno0">Short lease; cancel media; retain minimal resumable state</td><td data-cid="azIBJ1">Controlled retry</td><td data-cid="3ypTAl">Close reason</td></tr><tr data-cid="QKs3qo"><td data-cid="Vic-Ju">GPU at capacity</td><td data-cid="WDcm8Z">Early rejection or bounded queue</td><td data-cid="KTBeo-">“Service busy, please try again”</td><td data-cid="_RQzRT">Saturation, queue and shedding</td></tr></tbody></table></div>
<h2 class="chapter" id="9-illustrative-contracts-and-events" data-cid="iERdV1">9. Illustrative contracts and events</h2><blockquote data-cid="KYLg9g"><p data-cid="kbGqhZ"><strong data-cid="I2Vd0T">[REC]</strong> The following schemas are illustrative. They must become versioned JSON Schema with compatibility tests and size limits. They do not represent a final contract.</p></blockquote><h3 id="9-1-common-envelope" data-cid="f-pdWv">9.1 Common envelope</h3><pre class="code-block keep-together" data-cid="c-4f6e"><code class="code language-json" data-cid="XifFyT">{
"specversion": "1.0",
"type": "vocero.audio.input.delta.v1",
"source": "web-client",
"id": "evt_opaque",
"time": "RFC3339 timestamp",
"subject": "session/{session_id}",
"traceparent": "00-...",
"data": {
"session_id": "ses_opaque",
"turn_id": "turn_opaque",
"sequence": 42,
"payload": {}
}
}</code></pre>
<h3 id="9-2-minimum-event-catalog" data-cid="Hn2Zyc">9.2 Minimum event catalog</h3><p data-cid="EOAnH5"><strong data-cid="ITfq97">Client → platform</strong></p><ul data-cid="CFwrr7"><li data-cid="OYTKWv"><code data-cid="Tvgz7n">session.connect.v1</code></li><li data-cid="xzqyi0"><code data-cid="GiN_-x">session.update_requested.v1</code></li><li data-cid="mu-5Tp"><code data-cid="6_qEnC">audio.input.delta.v1</code></li><li data-cid="iTHUq9"><code data-cid="52FFSQ">audio.input.commit.v1</code></li><li data-cid="oOb4r7"><code data-cid="E59Wm6">input.speech_started.v1</code></li><li data-cid="8O-7Ad"><code data-cid="P0M0fs">output.playout_progress.v1</code></li><li data-cid="r-cb_0"><code data-cid="JMlGSP">generation.cancel_requested.v1</code></li><li data-cid="DK5oVB"><code data-cid="NoUUUV">tool.confirmation_submitted.v1</code></li><li data-cid="9MzUMJ"><code data-cid="B_1Hao">session.close.v1</code></li></ul><p data-cid="OfziNN"><strong data-cid="6UQGI8">Platform → client</strong></p><ul data-cid="TuYUdU"><li data-cid="Z2UhsQ"><code data-cid="QcNNnS">session.configuration_applied.v1</code></li><li data-cid="s7azNc"><code data-cid="mFy49P">transcript.partial.v1</code></li><li data-cid="_LoG6b"><code data-cid="LHWtmi">transcript.final.v1</code></li><li data-cid="Za8oGy"><code data-cid="yE80oP">response.text_delta.v1</code></li><li data-cid="TXOXzf"><code data-cid="VkjUP1">response.audio_delta.v1</code></li><li data-cid="NncMSh"><code data-cid="ElfKjI">response.completed.v1</code></li><li data-cid="sT6gwp"><code data-cid="Ij4dNT">output.stop_and_flush.v1</code></li><li data-cid="7YnthF"><code data-cid="ccBC4g">tool.confirmation_required.v1</code></li><li data-cid="C2ciMy"><code data-cid="kb5lxd">tool.status.v1</code></li><li data-cid="9xFTxP"><code data-cid="dXQJo5">error.v1</code></li></ul>
<h3 id="9-3-example-of-session-update-requested" data-cid="GCNEO6">9.3 Example of <code data-cid="ZzoYTn">session.update_requested</code></h3><pre class="code-block keep-together" data-cid="aH__nN"><code class="code language-json" data-cid="8GryQ5">{
"type": "vocero.session.update_requested.v1",
"data": {
"session_id": "ses_opaque",
"client_capabilities": {
"audio_codecs": ["opus", "pcm16"],
"supports_playout_ack": true
},
"preferences": {
"locale": "es-CL",
"turn_mode": "server_vad"
}
}
}</code></pre><p data-cid="eDVSqN">Fields such as <code data-cid="zxSVKR">system_prompt</code>, <code data-cid="0cvzDk">tools</code>, <code data-cid="D56K4k">mcp_credentials</code>, <code data-cid="SjCRyy">ref_audio</code>, <code data-cid="an4t0Z">ref_text</code> or <code data-cid="NI2juK">voice_profile_id</code> are not accepted through this public contract. If received, the relay rejects or removes them according to policy and records the reason.</p>
<h3 id="9-4-example-of-internal-tool-intent" data-cid="w27nw0">9.4 Example of internal tool intent</h3><pre class="code-block keep-together" data-cid="e22mUg"><code class="code language-json" data-cid="VY_iIi">{
"tool_call_id": "tc_opaque",
"session_id": "ses_opaque",
"turn_id": "turn_opaque",
"tool": {
"name": "production.report.get",
"schema_version": "1.2.0"
},
"arguments": {
"site_id": "site_authorized",
"period": "value_from_user_or_context"
},
"execution": {
"mode": "read",
"idempotency_key": "idem_opaque",
"deadline_ms": "configured_value"
},
"principal": {
"subject_ref": "opaque_subject",
"tenant_id": "tenant_opaque",
"scopes": ["report:read"]
}
}</code></pre>
<h3 id="9-5-errors" data-cid="y_zff-">9.5 Errors</h3><pre class="code-block keep-together" data-cid="PRWcdF"><code class="code language-json" data-cid="8SUbZy">{
"type": "vocero.error.v1",
"data": {
"code": "MCP_TOOL_TIMEOUT",
"category": "dependency",
"retryable": false,
"user_message_key": "tool.temporarily_unavailable",
"correlation_id": "corr_opaque",
"details_ref": "internal_log_reference"
}
}</code></pre><p data-cid="pqZoSF">Public messages do not contain stack traces, internal endpoints, prompts, tokens, sensitive arguments or secret names.</p>
<h3 id="9-6-mcp-compatibility" data-cid="llOSm0">9.6 MCP compatibility</h3><pre class="code-block keep-together" data-cid="P5kRRv"><code class="code language-text" data-cid="NXOHsF">McpAdapter
├── StableAdapter_2025_11_25 # default
├── CandidateAdapter_2026_07_28 # feature flag, not enabled in production by default
└── ConformanceHarness
├── discovery
├── tools/list
├── tools/call
├── cancellation
├── schema validation
├── auth propagation
└── error mapping</code></pre><p data-cid="55tnwO">The official MCP architecture separates a JSON-RPC data layer from a transport layer and includes lifecycle, primitives and notifications <a class="inline_marker" href="#ref6" data-cid="XkNET-">6</a>. <strong data-cid="H5GfHV">[REC]</strong> Vocero will preserve this separation inside the adapter so transport details do not contaminate conversational logic.</p><p data-cid="TQrDhy"><strong data-cid="s4Lhi9">Candidate capabilities being prepared but not activated as a final standard:</strong> the RC <code data-cid="XpmurZ">2026-07-28</code> introduces <code data-cid="QIm1Tv">server/discover</code>, metadata <code data-cid="TpzW7C">ttlMs</code> and <code data-cid="UZfwu0">cacheScope</code> in list/read results, and headers <code data-cid="29R__Z">Mcp-Method</code>/<code data-cid="SpvQbH">Mcp-Name</code> for routing <a class="inline_marker" href="#ref4" data-cid="ddc3Px">4</a>. <strong data-cid="jtdFFY">[REC]</strong> The gateway will model discovery and caching through neutral interfaces: the stable adapter will resolve its mechanism according to <code data-cid="FUHlYH">2025-11-25</code>, while the candidate adapter can map the new capabilities. The cache will never share results beyond the allowed identity/tenant scope and will always respect revocation and policy changes.</p>
<h2 class="chapter" id="10-voice-cloning-and-governance" data-cid="47G1Bc">10. Voice cloning and governance</h2><h3 id="10-1-operating-model" data-cid="1lqd3d">10.1 Operating model</h3><p data-cid="ECkyuf"><strong data-cid="S_R5l7">[REQ]</strong> Qwen3-TTS must use <code data-cid="0TITuZ">ref_audio</code> and <code data-cid="ANcn4L">ref_text</code> for zero-shot cloning and preserve a corporate voice. The Qwen3-TTS 1.7B Base model card confirms streaming, Spanish support and fast cloning from short audio <a class="inline_marker" href="#ref7" data-cid="gFZStI">7</a>. Repository documentation describes streaming generation and voice cloning <a class="inline_marker" href="#ref8" data-cid="wzNJlZ">8</a>.</p><p data-cid="sgjI53"><strong data-cid="2LICX0">Modes to evaluate:</strong></p><ul data-cid="TUlefZ"><li data-cid="78pYnA"><strong data-cid="c--wx4">Full ICL — recommended for maximum fidelity:</strong> uses <code data-cid="vKW1Ra">ref_audio</code> and an exact, aligned transcript <code data-cid="2Ry7hR">ref_text</code> . <strong data-cid="mt76oL">[REC]</strong> This will be the default candidate mode for approved corporate voices.</li><li data-cid="GuNjNr"><strong data-cid="inm0M0">x-vector (<code data-cid="WApmY_">x_vector_only_mode=True</code>):</strong> allows operation without <code data-cid="-0_jHo">ref_text</code>, but research reports lower timbre and prosody fidelity. <strong data-cid="L-s5OI">[BENCH]</strong> It can be promoted for a profile only after meeting the defined quality and risk thresholds.</li></ul><p data-cid="V1vWk3"><strong data-cid="TMNryc">[REC]</strong> The client never sends master references during a session. The agent profile contains only <code data-cid="5Z5YAk">voice_profile_id</code> and <code data-cid="lcl4W_">voice_version</code>; TTS resolves the reference from Voice Vault using service identity. The relay removes standard voices proposed by the client, and Orchestrator applies the authorized effective voice.</p>
<h3 id="10-2-lifecycle" data-cid="EdZ7e0">10.2 Lifecycle</h3><ol data-cid="ddpYwH"><li data-cid="R8oXfT"><strong data-cid="OpUkNk">Request:</strong> voice owner, purpose, tenant, languages and usage period.</li><li data-cid="wCv3eF"><strong data-cid="s3wt1Z">Verifiable consent:</strong> document or authorization evidence; legal review for the applicable jurisdiction.</li><li data-cid="AjbqxR"><strong data-cid="BmygyC">Controlled ingestion:</strong> antivirus, normalization, noise assessment and aligned transcription.</li><li data-cid="FOBZ9a"><strong data-cid="EYRk1i">Evaluation:</strong> fidelity, intelligibility, pronunciation, stability and impersonation risk.</li><li data-cid="pcEFLH"><strong data-cid="9YbZEh">Four-eyes approval:</strong> business owner plus security/legal or equivalent roles.</li><li data-cid="hYbHYo"><strong data-cid="EXtRLM">Versioning:</strong> hash of <code data-cid="Vo5mug">ref_audio</code>, hash of <code data-cid="2CKn0A">ref_text</code>, model, parameters and effective date.</li><li data-cid="Y9H1SB"><strong data-cid="4pe0cP">Publication:</strong> only approved profiles can be used in production.</li><li data-cid="jzals8"><strong data-cid="MXdF_W">Monitoring:</strong> usage by tenant/agent, anomalies and complaints.</li><li data-cid="RyNcGX"><strong data-cid="nPtgTR">Revocation:</strong> immediately block new sessions; rotate cache; provide deletion evidence.</li></ol>
<h3 id="10-3-controls" data-cid="2ZESdM">10.3 Controls</h3><ul data-cid="2ZHsrE"><li data-cid="Bxqqjl">Encryption in transit and at rest using managed keys.</li><li data-cid="0kRRky">Isolation by tenant and environment; do not copy real voices into development.</li><li data-cid="OZ2X6A">Short-lived signed URLs or direct reading through workload identity.</li><li data-cid="wWte8t">Access logging without including audio in logs.</li><li data-cid="G0L8YL">Provenance markers or disclosure when required by corporate policy or regulation.</li><li data-cid="0UUYGT">Abuse tests: offensive text, fraud, social engineering, reference extraction and cross-tenant use.</li><li data-cid="h6N5Qc"><strong data-cid="gGKkIg">[BENCH]</strong> Compare Full ICL with <code data-cid="H4_-fF">ref_audio</code> + <code data-cid="KJm94a">ref_text</code> against text-free mode; do not assume equivalent quality.</li><li data-cid="e3Kt64"><strong data-cid="3uDMQS">[BENCH]</strong> Legal review of code and weight licenses before commercial use; collected evidence must not replace legal advice.</li></ul>
<h2 class="chapter" id="11-security" data-cid="WW8JUD">11. Security</h2><h3 id="11-1-zones-and-trust-view" data-cid="s1jHzW">11.1 Zones and trust view</h3><h3 id="11-2-main-threats-and-mitigations" data-cid="f1wLYY">11.2 Main threats and mitigations</h3>
<div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="RbWd75"><table data-cid="vpaukF"><thead data-cid="E-Jb4b"><tr data-cid="4J8TDY"><th data-cid="b1ogWG">Threat</th><th data-cid="JQOEg4">Recommended mitigations</th></tr></thead><tbody data-cid="nR6iFn"><tr data-cid="DtIFVv"><td data-cid="SBalQp">User impersonation</td><td data-cid="TlcGVB">OIDC/OAuth, ephemeral tokens, issuer/audience validation, reauthentication for sensitive actions</td></tr><tr data-cid="tFsK8U"><td data-cid="prVghb">Prompt injection from users or tool results</td><td data-cid="LQ9Ufg">Instruction separation, tool allowlist, output validation, untrusted-content labeling, authorization outside the LLM</td></tr><tr data-cid="eGPUWp"><td data-cid="-ktlOG">Tool poisoning or malicious schema</td><td data-cid="9lKsDh">Approved-server registry, version/hash pinning, schema review, depth/size limits, cache with secure invalidation</td></tr><tr data-cid="EgxRJU"><td data-cid="c9aj4g">Confused deputy</td><td data-cid="qz7sDp">Propagate subject and tenant; token exchange; per-tool scopes; backend resource checks</td></tr><tr data-cid="VeEBBT"><td data-cid="C8Y-W2">Exfiltration through tools</td><td data-cid="q1PK2_">Egress allowlist, DLP/classification, response minimization, limits and redaction before context insertion</td></tr><tr data-cid="-pGfuf"><td data-cid="-eIh-_">Repeated writes</td><td data-cid="kbzksk">Idempotency key, hash-bound confirmation, execution ledger, no retries for unknown status</td></tr><tr data-cid="V6Gd39"><td data-cid="qwHiTb">Voice theft</td><td data-cid="jx7WZT">Vault, encryption, isolation, consent, revocation, no browser download</td></tr><tr data-cid="mR2FEN"><td data-cid="FJTCeR">Session hijacking/replay</td><td data-cid="a-NOny">Short-lived connection tokens, nonce, expiration, identity binding, reconnection limits</td></tr><tr data-cid="cZu2Mu"><td data-cid="9mMdXl">Audio/GPU DoS</td><td data-cid="uY7iMK">Quotas, bitrate/chunk limits, admission control, bounded queues, circuit breakers, shedding</td></tr><tr data-cid="XhzQRg"><td data-cid="pwzgap">Leaks through logs/traces</td><td data-cid="6E9Ar8">Redaction, attribute classification, sampling, limited retention, RBAC access</td></tr><tr data-cid="_skhA9"><td data-cid="Q_JOJF">Lateral movement</td><td data-cid="wy6w4X">Segmentation, mTLS, workload identities, deny-by-default and controlled egress</td></tr></tbody></table></div>
<h3 id="11-3-tool-authorization" data-cid="1CaKyf">11.3 Tool authorization</h3><p data-cid="X-LSpJ">The decision evaluates:</p><pre class="code-block keep-together" data-cid="gi_NMJ"><code class="code language-text" data-cid="leOPk_">permit = policy(
tenant,
principal,
agent_profile_version,
tool_name,
tool_schema_version,
action_class,
resource_scope,
argument_classification,
confirmation,
session_risk
)</code></pre><p data-cid="KhXLzJ">The LLM can propose <code data-cid="HTuVoW">tool_name</code> and <code data-cid="3C-5GN">arguments</code>, but not <code data-cid="FYBPfm">principal</code>, scopes, credentials, action classification or policy outcomes. <strong data-cid="x0wt_W">[REC]</strong> Irreversible actions require specific human confirmation or a documented corporate exception.</p>
<h3 id="11-4-data-and-retention" data-cid="kuKGIi">11.4 Data and retention</h3><p data-cid="k_4NLm">Define a matrix by data class:</p><ul data-cid="3v1WWF"><li data-cid="5rJmr1">raw audio;</li><li data-cid="VkSLyu">voice references;</li><li data-cid="8aOIsd">transcripts;</li><li data-cid="J7Y74H">prompt/context;</li><li data-cid="6CPODX">model responses;</li><li data-cid="2gYs6P">tool arguments and results;</li><li data-cid="phF27i">telemetry and auditing.</li></ul><p data-cid="aF8xcz">For each class, approve purpose, legal basis, location, encryption, retention, deletion, export, access, training use and redaction. <strong data-cid="5qKyXe">Pending:</strong> the requester did not supply corporate policies or jurisdictions; this document therefore sets no retention periods.</p>
<h2 class="chapter" id="12-observability-and-initial-slos" data-cid="tCwZyI">12. Observability and initial SLOs</h2><h3 id="12-1-telemetry-model" data-cid="m3zjXZ">12.1 Telemetry model</h3><p data-cid="j-u4rg"><strong data-cid="1UhJRp">Traces:</strong> one trace per turn with spans for capture, relay, STT, endpointing, LLM, policy, MCP, TTS, network and playout. The future RC proposes standardized names for propagating W3C Trace Context in <code data-cid="9z3Qpe">_meta</code>, but this form remains a candidate until ratification <a class="inline_marker" href="#ref4" data-cid="wS4Po1">4</a>. In the stable adapter, Vocero will propagate <code data-cid="93rwTu">traceparent</code> through compatible internal metadata without requiring future domain changes.</p><p data-cid="J750jH"><strong data-cid="BBbmRc">Experience metrics</strong></p><ul data-cid="2Ey_Wc"><li data-cid="5o-A_q"><code data-cid="hwNkdv">turn_endpointing_ms</code>: acoustic endpoint to turn commit.</li><li data-cid="zAukNl"><code data-cid="6rWpQr">stt_partial_ms</code> and <code data-cid="ncoQUH">stt_final_ms</code>.</li><li data-cid="YaedG8"><code data-cid="WJGF8k">llm_ttft_ms</code>: commit to first token.</li><li data-cid="NcE_iK"><code data-cid="T1Lm8L">tts_ttfa_ms</code>: available text to first audio.</li><li data-cid="vmcq1R"><code data-cid="AdCatj">ttfs_ms</code>: end of speech to first playable sound.</li><li data-cid="2gr-6y"><code data-cid="tCPnFi">barge_in_stop_ms</code>: interruption detection to effective silence.</li><li data-cid="A3Y_lr"><code data-cid="5iwjTj">tool_latency_ms</code> by tool and outcome.</li><li data-cid="AAhZAj"><code data-cid="aETFuO">turn_e2e_ms</code> by direct or tool-assisted path.</li><li data-cid="7kZ6vC">reconnection, cancellation, false barge-in and abandonment rates.</li></ul><p data-cid="M1dVZO">TTFT and end-to-end latency are recognized as distinct, relevant dimensions for voice/realtime workloads <a class="inline_marker" href="#ref9" data-cid="XoMUg9">9</a>.</p><p data-cid="tFQY1A"><strong data-cid="nbmcXA">Quality metrics</strong></p><ul data-cid="G_hour"><li data-cid="Ns_Vtp">WER/CER by language, accent, noise and domain.</li><li data-cid="5krVT8">early/late endpointing rate.</li><li data-cid="QIKGrD">intelligibility and human assessment of naturalness.</li><li data-cid="VbZp2z">speaker similarity and voice stability.</li><li data-cid="erBq7M">accuracy of tool selection, arguments, policy and task completion.</li></ul><p data-cid="GBKg7X"><strong data-cid="nP3Trf">Resource metrics</strong></p><ul data-cid="Pp9yP4"><li data-cid="9QftJu">GPU utilization and memory; KV cache; per-model queues; tokens/s; audio seconds/s.</li><li data-cid="ydnFOY">buffer depth and age; drops; retransmissions; jitter; playout underruns.</li><li data-cid="xe-hyA">active connections, admitted/rejected sessions and dependency errors.</li></ul>
<h3 id="12-2-initial-targets-not-observed-performance" data-cid="o1IqPd">12.2 Initial targets — not observed performance</h3><blockquote data-cid="ewkw_Y"><p data-cid="MtiLnU"><strong data-cid="6q8cxx">[REC/BENCH]</strong> These values are <strong data-cid="Aa5TVw">provisional engineering targets</strong>, not measured figures, guarantees or a contractual SLO. They must be ratified after benchmarking with real audio, networks, tools and concurrency.</p></blockquote>
<div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="UewefS"><table data-cid="3Lkxis"><thead data-cid="SWgBg1"><tr data-cid="YX23Pt"><th data-cid="fLV9-Q">Indicator</th><th data-cid="PdPaBM">Proposed initial target</th><th data-cid="x-RkYj">Window/percentile</th><th data-cid="L7jYUr">Ratification condition</th></tr></thead><tbody data-cid="SGn-1f"><tr data-cid="ISg1qm"><td data-cid="FSnIs_">Conversational service availability</td><td data-cid="DXM-N-">≥ 99,5 %</td><td data-cid="mP0Cbp">Monthly</td><td data-cid="VXfMex">Exclude agreed windows and define the GPU dependency</td></tr><tr data-cid="QIW15t"><td data-cid="cSvYGf">Response audio start <code data-cid="OkiyqU">ttfs_ms</code></td><td data-cid="l71z6T">≤ 1,200 ms</td><td data-cid="YEYtBX">p95, direct turn</td><td data-cid="AfnwPM">Target corporate network and warm session</td></tr><tr data-cid="ASRmra"><td data-cid="Q56rj9">Barge-in stopping</td><td data-cid="cxb2To">≤ 300 ms</td><td data-cid="qldv4J">p95</td><td data-cid="SnU8xd">Measured through playout silence, not only ACK</td></tr><tr data-cid="xq02_4"><td data-cid="0I_Qns">Turns without platform errors</td><td data-cid="H_4-3I">≥ 99,0 %</td><td data-cid="sm91bg">Monthly</td><td data-cid="IkJZS1">Separate dependency errors from invalid input</td></tr><tr data-cid="ntZaDX"><td data-cid="an4iVp">MCP read executions accepted by the gateway</td><td data-cid="svmQf9">≥ 99,0 %</td><td data-cid="doBQAs">Monthly</td><td data-cid="nlo5iR">Exclude policy rejections and downstream timeouts</td></tr><tr data-cid="u02olk"><td data-cid="aQBhCN">Loss of accepted control events</td><td data-cid="CAW-uo">0</td><td data-cid="SE8KqI">Every window</td><td data-cid="fQ1UeX">Verified by sequence and ACK</td></tr><tr data-cid="13mkhq"><td data-cid="Ze0MIK">Unauthorized voice use</td><td data-cid="CiiGPZ">0</td><td data-cid="huwWIH">Every window</td><td data-cid="DcBt-f">Mandatory alert and audit</td></tr></tbody></table></div><p data-cid="RxZGbL">Provisional budget for <code data-cid="NISkWj">ttfs_ms</code> for analysis, not a commitment:</p><pre class="code-block keep-together" data-cid="LJ82ku"><code class="code language-text" data-cid="qKu-h-">endpointing + STT final + scheduling + LLM TTFT + TTS primer audio + transporte/playout</code></pre><p data-cid="gGyyys">No fixed milliseconds are allocated per stage before benchmarking; the dashboard must show contributions and percentiles separately.</p>
<h3 id="12-3-initial-alerts" data-cid="VSjV0I">12.3 Initial alerts</h3><ul data-cid="k6nCPX"><li data-cid="bR2-tx">Availability and successful-turn burn rates.</li><li data-cid="NRzADW">Sustained queue growth or buffer age.</li><li data-cid="UxO0GD">GPU OOM, model restart or degraded health.</li><li data-cid="3tEvV4">Divergence between <code data-cid="qazQ-Y">generation.cancel</code> and the last emitted chunk.</li><li data-cid="Qb28W0">MCP error/latency by tool, tenant and dependency.</li><li data-cid="NQMtl-">Denied access or voice anomalies.</li><li data-cid="lSA2BL">Missing traces or uncontrolled cardinality.</li></ul>
<h2 class="chapter" id="13-scalability-backpressure-and-resilience" data-cid="S-LogK">13. Scalability, backpressure and resilience</h2><h3 id="13-1-scaling" data-cid="Tx0fGk">13.1 Scaling</h3><ul data-cid="4QpQzq"><li data-cid="-_zxab"><strong data-cid="vM8-7h">Edge/Relay:</strong> horizontal scaling by connections; minimal state; drain before deployment.</li><li data-cid="10o9TO"><strong data-cid="qYAfma">Orchestrator:</strong> horizontal scaling by session with a store lease; optional affinity as an optimization rather than a correctness requirement.</li><li data-cid="gxrdWw"><strong data-cid="RXXb7w">MCP Gateway:</strong> horizontal scaling; per-downstream pools; per-tenant/tool bulkheads.</li><li data-cid="zHEk8m"><strong data-cid="OJwAHO">Inference:</strong> admission control based on actual capacity, not only CPU; separate STT, LLM and TTS queues; prioritize cancellation and active audio.</li><li data-cid="G5cthX"><strong data-cid="Ye4Twn">Voice cache:</strong> encrypted cache bounded by approved voices; invalidate on version changes/revocation.</li></ul>
<h3 id="13-2-backpressure" data-cid="0JvDeL">13.2 Backpressure</h3><p data-cid="utahvp"><strong data-cid="cHawg8">[REC]</strong> Each link publishes <code data-cid="N2slfm">high_watermark</code>, <code data-cid="ke9ISa">low_watermark</code> and an overflow policy. The LLM can produce text faster than TTS or the network can consume it; the system must throttle tokens, group pronounceable units and limit buffered audio. Realtime pipelines document the general problem of fast producers and slow consumers <a class="inline_marker" href="#ref10" data-cid="TffY26">10</a>.</p><p data-cid="PAiaHT">Policies:</p><ol data-cid="34cFBN"><li data-cid="BS0Gyn">Control events never share a blocking queue with audio.</li><li data-cid="9Hbjz9">Stale partial STT transcripts may be coalesced; final transcripts and commits may not.</li><li data-cid="U030et">Discard unsynthesized tokens from a canceled generation.</li><li data-cid="_oDMes">Discard generated but unplayed audio on interruption.</li><li data-cid="gOQW7L">A slow connection cannot consume unbounded memory.</li><li data-cid="zcEc1G">The client reports <code data-cid="upJNXd">buffered_ms</code> and playout; the server adjusts chunking or pauses.</li><li data-cid="D4VlSi">Queues have deadlines; expired work is not processed merely for completeness.</li></ol>
<h3 id="13-3-resilience" data-cid="2UuUOD">13.3 Resilience</h3><ul data-cid="sdmWGt"><li data-cid="OE41eC">Per-stage timeouts and a propagated total deadline.</li><li data-cid="4XVonQ">Circuit breakers by dependency and model.</li><li data-cid="jvca85">Retries with jitter only for idempotent operations.</li><li data-cid="PrBCc8">Bulkheads by tenant and tool to avoid cascading failures.</li><li data-cid="yViEwr">Separate process health, model readiness and capacity signals.</li><li data-cid="SxGk0J">Verified warmup before accepting sessions.</li><li data-cid="RmZtTC">Deploy with connection draining and safe cancellation.</li><li data-cid="PpOjlP">Configuration snapshots and profile/model rollback.</li><li data-cid="g1y4fv">Runbooks for GPU OOM, STT/TTS degradation, slow MCP, unavailable stores and voice compromise.</li></ul><p data-cid="zVGbdi"><strong data-cid="PPdteA">[BENCH]</strong> The ability to host the entire pipeline simultaneously on one GB10, and the number of sustainable sessions, must be measured. Parakeet TDT 0.6B v3 has documented streaming support and timestamps <a class="inline_marker" href="#ref11" data-cid="-T4vBK">11</a>; this validates functional capability rather than the complete system's concurrent capacity.</p>
<h2 class="chapter" id="14-phased-implementation-plan" data-cid="iMAclj">14. Phased implementation plan</h2><p data-cid="IlmPIw">Phases include no dates or durations because team availability, environments, procurement and change windows were not supplied. Each phase ends with an explicit decision to proceed, correct or stop.</p>
<h3 id="phase-0-discovery-contracts-and-risks" data-cid="3fA-uK">Phase 0 — Discovery, contracts and risks</h3><p data-cid="jXzI1d"><strong data-cid="vM7Ft0">Deliverables</strong></p><ul data-cid="hTTZeR"><li data-cid="wnKAq9">Inventory of functional requirements, data, tenants, roles, tools and sensitive actions.</li><li data-cid="5TJlv5">Initial ADRs and threat model.</li><li data-cid="BiY8Oa">Event catalog v1 and audio/control schemas.</li><li data-cid="ZeQTV7">License matrix and voice governance.</li><li data-cid="JDN63x">Benchmark corpus definition and measurement plan.</li></ul><p data-cid="JjC5vm"><strong data-cid="kKEUM5">Dependencies</strong></p><ul data-cid="1nFE2F"><li data-cid="gUOs7p">Access to auth/profile APIs and the customer's MCP definition.</li><li data-cid="YhYrpk">Security, legal, business and operations owners.</li><li data-cid="-0RJBd">GB10 hardware and versioned model artifacts.</li></ul><p data-cid="SR88MH"><strong data-cid="aBI5RZ">Acceptance criteria</strong></p><ul data-cid="H84Fo5"><li data-cid="38QTQ7">Labeled and approved requirements; outstanding items have owners.</li><li data-cid="uNjIK0">No secrets or real voices required for early development.</li><li data-cid="lPsJk2">ADR-001 through ADR-006 have status <code data-cid="RKQuOQ">Proposed</code> or <code data-cid="DLae4W">Accepted</code>.</li><li data-cid="9-Bf99">Critical threats have an associated control and test.</li></ul><p data-cid="hWbp3D"><strong data-cid="9SCYrm">Risks</strong></p><ul data-cid="3cQQFX"><li data-cid="BklWuZ">Ambiguous identity/roles.</li><li data-cid="m0hPqC">Unresolved licensing or voice consent.</li><li data-cid="S6nHXI">MCP tools without idempotency or risk classification.</li></ul>
<h3 id="phase-1-local-vertical-slice-without-write-tools" data-cid="sh6I3o">Phase 1 — Local vertical slice without write tools</h3><p data-cid="hQapZx"><strong data-cid="C8CPdS">Deliverables</strong></p><ul data-cid="EerOaQ"><li data-cid="WCxMZt">Web client + WebSocket, Relay, Orchestrator and Inference Gateway.</li><li data-cid="vf45bF">Streaming STT → LLM → TTS with an authorized test voice.</li><li data-cid="WoJxbJ">State machine, IDs, cancellation and structured logs.</li><li data-cid="XmUMZ6">Deterministic STT/LLM/TTS simulators for CI.</li></ul><p data-cid="A41WNH"><strong data-cid="C_a5oB">Dependencies</strong></p><ul data-cid="dcwHKx"><li data-cid="cAKXzw">Loadable models and compatible runtime.</li><li data-cid="OgLRiK">Service certificates and an isolated environment.</li></ul><p data-cid="R_b7r9"><strong data-cid="EQ4Mtq">Acceptance criteria</strong></p><ul data-cid="qzzFcN"><li data-cid="syjqZR">Reproducible normal conversation.</li><li data-cid="wIR5S_">Reconnection does not duplicate turns.</li><li data-cid="IaVW3-">Canceling a generation prevents late chunks from reaching playout.</li><li data-cid="sX_Ji8">The client-requested voice does not replace the effective voice.</li><li data-cid="8b5vIi">First latency and resource baseline recorded.</li></ul><p data-cid="PQO3Kx"><strong data-cid="ROZbpl">Risks</strong></p><ul data-cid="ODBPUO"><li data-cid="-5634c">GPU contention.</li><li data-cid="PGLph_">Endpointing latency.</li><li data-cid="WfxaqE">Runtime instability or FP16 incompatibility.</li></ul>
<h3 id="phase-2-barge-in-backpressure-and-robust-sessions" data-cid="l2pTnO">Phase 2 — Barge-in, backpressure and robust sessions</h3><p data-cid="l7Mo6S"><strong data-cid="JzoXNp">Deliverables</strong></p><ul data-cid="lVBBSo"><li data-cid="ON4_eD">Priority control queue and <code data-cid="aodW0f">output.stop_and_flush</code>.</li><li data-cid="ZH6DHd">Playout ACK/cursor; history truncation.</li><li data-cid="RXGpjK">Buffer limits, shedding, deadlines and circuit breakers.</li><li data-cid="Tc_KXu">Tests with noise, echo, interjections and degraded networks.</li></ul><p data-cid="HFCFzz"><strong data-cid="Z26Du0">Dependencies</strong></p><ul data-cid="-9D8Tt"><li data-cid="ufPh8a">Per-stage instrumentation.</li><li data-cid="GZmqxb">Dataset of representative conversations and acoustic conditions.</li></ul><p data-cid="EKuWb_"><strong data-cid="stJxG4">Acceptance criteria</strong></p><ul data-cid="gQDm_S"><li data-cid="txw3nK">No stale-generation audio after the approved interruption limit.</li><li data-cid="8Leksd">No unbounded memory growth with a slow client.</li><li data-cid="c3cw2K">No duplicate response after reconnection/cancellation.</li><li data-cid="wP-i-M">False barge-in measured and within the threshold defined by the business.</li></ul><p data-cid="FYdEmT"><strong data-cid="YVNzwQ">Risks</strong></p><ul data-cid="4szb9A"><li data-cid="Bg0RmB">Echo triggers VAD.</li><li data-cid="Ab4592">Inaccurate playout cursor.</li><li data-cid="yNnKe4">Races between cancellation, TTS and network delivery.</li></ul>
<h3 id="phase-3-read-only-mcp-gateway" data-cid="4kvzlC">Phase 3 — Read-only MCP gateway</h3><p data-cid="BHYmEF"><strong data-cid="PFryz3">Deliverables</strong></p><ul data-cid="sBcxoZ"><li data-cid="KkWdxs"><code data-cid="65wdb8">StableAdapter_2025_11_25</code>.</li><li data-cid="446xSq">Allowlisted discovery, schema validation and read-only <code data-cid="kv3T-L">tools/call</code> .</li><li data-cid="x3RRxn">Policy Engine, delegated identity, limits, auditing and idempotency.</li><li data-cid="LTwfjo">Simulated MCP server and contract tests.</li></ul><p data-cid="i_QpAf"><strong data-cid="6NC1Mg">Dependencies</strong></p><ul data-cid="Vgbov1"><li data-cid="ix4c8C">Customer MCP server and authorization schema.</li><li data-cid="Hjxq2c">Tool and data classification.</li></ul><p data-cid="0SswkW"><strong data-cid="1mjugL">Acceptance criteria</strong></p><ul data-cid="1JFGe6"><li data-cid="TT0uf7">A tool outside the allowlist is rejected before reaching downstream.</li><li data-cid="HB5j-K">Invalid arguments and results do not reach the LLM/systems.</li><li data-cid="sx4YI8">Every tool call correlates with user, session, turn and policy.</li><li data-cid="JwUjw6">Timeouts do not cause unsafe retries.</li></ul><p data-cid="Bi4lon"><strong data-cid="aBMs70">Risks</strong></p><ul data-cid="VXvL0q"><li data-cid="tgrprO">Prompt injection in results.</li><li data-cid="L14XRy">Overprivileged credentials.</li><li data-cid="GiW3C3">Unstable downstream contracts.</li></ul>
<h3 id="phase-4-writes-confirmation-and-voice-governance" data-cid="gTDZfh">Phase 4 — Writes, confirmation and voice governance</h3><p data-cid="ftWhXV"><strong data-cid="bdhaFl">Deliverables</strong></p><ul data-cid="ucu_pj"><li data-cid="LM2hTB">Confirmation flows bound to hashes and idempotency keys.</li><li data-cid="K-YIBv">Action ledger and unknown status.</li><li data-cid="d-wr2j">Voice Vault, approval workflow, revocation and secure cache.</li><li data-cid="-Uo5MR">Abuse tests and incident runbooks.</li></ul><p data-cid="Ir2IBl"><strong data-cid="oKrfDW">Dependencies</strong></p><ul data-cid="EuSh6P"><li data-cid="UL6d9a">Legal approval of voices/licenses.</li><li data-cid="83KF2Z">Idempotency semantics in enterprise systems.</li></ul><p data-cid="XVp0ez"><strong data-cid="yUFrom">Acceptance criteria</strong></p><ul data-cid="ckTvRr"><li data-cid="eHh_1s">No sensitive action executes without the required policy/confirmation.</li><li data-cid="8P-n77">Repeated events do not repeat side effects.</li><li data-cid="F5mQ7k">Revoking a voice blocks new synthesis and clears caches.</li><li data-cid="73s5OY">Cross-tenant access fails and is audited.</li></ul><p data-cid="mG-nSq"><strong data-cid="cO8erb">Risks</strong></p><ul data-cid="XFSofH"><li data-cid="-CMD0f">Non-idempotent actions.</li><li data-cid="lwuo5F">Incomplete consent.</li><li data-cid="_Cdnbt">Voice exfiltration or misuse.</li></ul>
<h3 id="phase-5-preproduction-slos-and-resilience" data-cid="_Z91Vg">Phase 5 — Preproduction, SLOs and resilience</h3><p data-cid="SkBQ5b"><strong data-cid="jw0UvH">Deliverables</strong></p><ul data-cid="w3T8fR"><li data-cid="poBHrT">Load, soak, chaos and recovery tests.</li><li data-cid="ICc2mv">Dashboards, alerts, ratified SLOs and runbooks.</li><li data-cid="7v6nej">Capacity model and admission limits.</li><li data-cid="taoD0U">DR/backup for configuration, auditing and Voice Vault.</li><li data-cid="OzyxTJ">Security review and go-live checklist.</li></ul><p data-cid="0kmDSf"><strong data-cid="yphB6L">Dependencies</strong></p><ul data-cid="il6VyJ"><li data-cid="S12ksi">Representative traffic/profiles.</li><li data-cid="YBDdxT">Production-equivalent environment.</li><li data-cid="XYzm1i">Defined on-call model and ownership.</li></ul><p data-cid="ReYc9F"><strong data-cid="4dm8Mr">Acceptance criteria</strong></p><ul data-cid="7YzG5o"><li data-cid="xUu5O4">Experience targets ratified or renegotiated with evidence.</li><li data-cid="0LohUL">Demonstrated recovery from critical failures.</li><li data-cid="tgJk1v">No open critical vulnerabilities.</li><li data-cid="NwsYzS">Operations can detect, diagnose and mitigate runbook scenarios.</li></ul><p data-cid="6FYP9q"><strong data-cid="O4ZZPt">Risks</strong></p><ul data-cid="v09kaf"><li data-cid="7fpE35">Single GB10 as a SPOF.</li><li data-cid="GL1CTA">Insufficient capacity under a real traffic mix.</li><li data-cid="RCqn2i">Differences between test and field networks.</li></ul>
<h3 id="phase-6-progressive-rollout-and-evolution" data-cid="aMrcFb">Phase 6 — Progressive rollout and evolution</h3><p data-cid="6AYLKY"><strong data-cid="PCgbyN">Deliverables</strong></p><ul data-cid="nF5tWG"><li data-cid="Z5Q0Qt">Canary by user/tenant and automatic rollback.</li><li data-cid="PgoDdO">Post-pilot review of quality, latency, security and task completion.</li><li data-cid="bfcjh7">WebRTC roadmap if WebSocket does not meet targets.</li><li data-cid="1Z6VHt"><code data-cid="LOh-hn">CandidateAdapter_2026_07_28</code> only if the specification has been ratified.</li></ul><p data-cid="Q6_DXb"><strong data-cid="xh8mPA">Acceptance criteria</strong></p><ul data-cid="j044i2"><li data-cid="EePx3V">Canary without SLO/security regression.</li><li data-cid="vA3QWp">Validated support and operational escalation.</li><li data-cid="zH_z6h">MCP migration passes the conformance suite and promotion ADR.</li></ul>
<h2 class="chapter" id="15-testing-strategy" data-cid="9C30TZ">15. Testing strategy</h2><h3 id="15-1-pyramid" data-cid="80JVQD">15.1 Pyramid</h3><p data-cid="5nHw8_"><strong data-cid="c5negy">Unit tests</strong></p><ul data-cid="wOtwf5"><li data-cid="uYkeMK">state machine, sanitization, policy, error mapping, deduplication, expiration and redaction.</li></ul><p data-cid="ApuEnC"><strong data-cid="-qxEhJ">Contract tests</strong></p><ul data-cid="tYyVmA"><li data-cid="yfMcPH">Event JSON Schema, backward compatibility, MCP adapters, profile and identity APIs.</li></ul><p data-cid="ItIWqJ"><strong data-cid="WpUz9Y">Integration tests</strong></p><ul data-cid="LZVPqn"><li data-cid="g18Jbs">Real STT/LLM/TTS; simulated and real MCP; Voice Vault; KMS; stores.</li></ul><p data-cid="1bporE"><strong data-cid="8NHqe2">End-to-end</strong></p><ul data-cid="85TgFY"><li data-cid="p0DJEI">audio to audio with measured playout, direct paths, tools, confirmation, cancellation and reconnection.</li></ul><p data-cid="VWH8BF"><strong data-cid="xkFbrO">Load and soak</strong></p><ul data-cid="p3Mmbf"><li data-cid="ZcSII0">concurrent sessions, mixed turns, long audio, slow clients, slow tools, connection churn and warm/cold models.</li></ul><p data-cid="Dfrojj"><strong data-cid="i4VtZJ">Chaos</strong></p><ul data-cid="wySWFI"><li data-cid="tp6jE7">dead process, GPU OOM, slow store, network loss, late response, expired certificate, partial dependency failure and restart during a tool call.</li></ul><p data-cid="lEU621"><strong data-cid="B2-vSF">Security</strong></p><ul data-cid="3go94P"><li data-cid="Xm-PBC">authn/authz, tenant isolation, replay, prompt injection, schema bombs, SSRF, egress, secrets, DLP, voice abuse and supply chain.</li></ul>
<h3 id="15-2-minimum-scenario-matrix" data-cid="R4UbMA">15.2 Minimum scenario matrix</h3><div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="TpgppD"><table data-cid="3KcwlB"><thead data-cid="5kVgY5"><tr data-cid="UJaSYk"><th data-cid="iSJ9AY">Dimension</th><th data-cid="Mo_hGC">Cases</th></tr></thead><tbody data-cid="ZLD1Ux"><tr data-cid="ESbnN8"><td data-cid="CW_B0x">Audio</td><td data-cid="_uW2BS">silence, noise, echo, clipping, variable bitrate, distant microphone</td></tr><tr data-cid="2aqsgg"><td data-cid="fl9aeU">Speech</td><td data-cid="Et2g_M">target accents, speed, numbers, proper names, domain terms</td></tr><tr data-cid="rxTPLl"><td data-cid="gFBP8w">Turns</td><td data-cid="1Jdg_r">long pause, overlap, backchannel, interruption, push-to-talk</td></tr><tr data-cid="Bt6pDM"><td data-cid="hQv2kh">Network</td><td data-cid="zDEq52">latency, jitter, loss, reconnection, slow client</td></tr><tr data-cid="wJvPaw"><td data-cid="Nkgcyr">Tools</td><td data-cid="DIPDwU">success, empty, invalid, timeout, 4xx/5xx, confirmed side effect, unknown status</td></tr><tr data-cid="NwKS-h"><td data-cid="oM59kR">Models</td><td data-cid="Kr7MV6">cold start, OOM, late response, excessive tokens/audio, cancellation</td></tr><tr data-cid="HbmxZu"><td data-cid="BHK-XC">Security</td><td data-cid="5PWnx4">prohibited tool, insufficient scope, injection, cross-tenant access, revoked voice</td></tr></tbody></table></div>
<h3 id="15-3-test-oracles-and-reproducibility" data-cid="YicOXU">15.3 Test oracles and reproducibility</h3><ul data-cid="c_hnMM"><li data-cid="db9LYj">Versioned test audio with consent and labels.</li><li data-cid="79XIYX">Deterministic fakes for races and errors.</li><li data-cid="PddsV0">Recorded generation seeds/parameters where applicable.</li><li data-cid="RYZbk2">Golden transcripts and schemas with defined acoustic tolerances.</li><li data-cid="pbU_9V">Capture monotonic timestamps at every boundary.</li><li data-cid="-ON-Uo">Report percentiles and conditions, not only averages.</li><li data-cid="JRBNFQ">A/B comparison of VAD, chunking and voice configurations.</li></ul>
<h2 class="chapter" id="16-decision-matrix-and-adrs" data-cid="CJ3JMO">16. Decision matrix and ADRs</h2><div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="KMza5Q"><table data-cid="Sq4ZgU"><thead data-cid="LR0D7d"><tr data-cid="ArHA2H"><th data-cid="dfmP9h">ADR</th><th data-cid="RYE4oj">Decision</th><th data-cid="d6mX8B">Initial status</th><th data-cid="_tzUj1">Alternatives</th><th data-cid="i6y26h">Evidence for acceptance</th></tr></thead><tbody data-cid="mEPSGR"><tr data-cid="XYCSOR"><td data-cid="RQstdy">ADR-001</td><td data-cid="iCHYf_">Decoupled STT → LLM → TTS pipeline</td><td data-cid="qX0CQb">Accepted by requirement</td><td data-cid="nerbJu">Native S2S model</td><td data-cid="OD3OUr">Benchmark and per-component control</td></tr><tr data-cid="4wNifM"><td data-cid="i81Rav">ADR-002</td><td data-cid="pE3QXS">Initial WebSocket; WebRTC as an evolution</td><td data-cid="MidZvo">Proposed</td><td data-cid="IbScYp">WebRTC from MVP; both</td><td data-cid="vUJ9Og">Network testing and operational complexity</td></tr><tr data-cid="INHtmK"><td data-cid="2PF4KT">ADR-003</td><td data-cid="baGuSn">Separate Relay and Session Orchestrator</td><td data-cid="UreEOU">Proposed</td><td data-cid="v8LY1P">Monolithic service</td><td data-cid="3znkTY">Load profile, isolation and maintainability</td></tr><tr data-cid="LOe86m"><td data-cid="mxu3oS">ADR-004</td><td data-cid="R2-Frc">Stable MCP <code data-cid="omkq1e">2025-11-25</code> + versioned adapters</td><td data-cid="HPdRCz">Proposed</td><td data-cid="zRRoaC">Adopt a future RC</td><td data-cid="ViUeve">Ratification, conformance and compatibility</td></tr><tr data-cid="jdL9NF"><td data-cid="Yqy-tc">ADR-005</td><td data-cid="zEWDl0">Voice Vault and server-side references</td><td data-cid="8xkIMh">Proposed</td><td data-cid="OmTM2_">Send <code data-cid="m3tVOV">ref_audio</code> per session</td><td data-cid="Nhe2R7">Threat model, cache latency and governance</td></tr><tr data-cid="K_fWdZ"><td data-cid="7FICrh">ADR-006</td><td data-cid="xxSvME">External ephemeral state with TTL and leases</td><td data-cid="LuuWQ4">Proposed</td><td data-cid="lur_6P">Local memory/sticky sessions</td><td data-cid="TB23nt">Recovery and load</td></tr><tr data-cid="eYlFKi"><td data-cid="ElHqvq">ADR-007</td><td data-cid="a9HGsh">Priority control queue for barge-in</td><td data-cid="6HGIRp">Proposed</td><td data-cid="vjC8jp">Single FIFO queue</td><td data-cid="U4P-Z4">Race tests and interruption target</td></tr><tr data-cid="WLN5Zs"><td data-cid="fUuYoE">ADR-008</td><td data-cid="N4hV17">Policy Engine outside the LLM</td><td data-cid="zYtkhx">Proposed</td><td data-cid="GEICvp">Prompt-only controls</td><td data-cid="hQUpX1">Bypass tests and auditing</td></tr><tr data-cid="qPAao6"><td data-cid="OMHs5U">ADR-009</td><td data-cid="6VSAbI">Confirmation + idempotency for writes</td><td data-cid="9IFpRN">Proposed</td><td data-cid="R-Of8O">Immediate execution</td><td data-cid="s6TrL3">Downstream semantics and UX</td></tr><tr data-cid="Tcn_oo"><td data-cid="FzxApo">ADR-010</td><td data-cid="vhijQY">One GB10 in the MVP with admission control</td><td data-cid="Vxo_ue">Proposed</td><td data-cid="Gm-xzK">Cluster from the start</td><td data-cid="WG848K">Capacity/cost/risk benchmark</td></tr><tr data-cid="-3HqXa"><td data-cid="Ost_RT">ADR-011</td><td data-cid="8ASQoT">OpenTelemetry end-to-end</td><td data-cid="7VBWNn">Proposed</td><td data-cid="_6qOau">Uncorrelated logs</td><td data-cid="4GEc_V">Trace coverage and cost/cardinality</td></tr><tr data-cid="C2IyFU"><td data-cid="Z4N9R2">ADR-012</td><td data-cid="cj1LuT">Versioned event contracts v1</td><td data-cid="UOBLvO">Proposed</td><td data-cid="pdTdrV">Ad hoc provider payloads</td><td data-cid="cJjOft">Compatibility tests</td></tr></tbody></table></div><p data-cid="g0ut5E">Each ADR must include context, decision, alternatives, consequences, risks, status and review condition. Reversible decisions may start as <code data-cid="vcWfZS">Proposed</code>; decisions affecting security, data, licenses or external compatibility require explicit approval.</p>
<h2 class="chapter" id="17-outstanding-items-and-open-questions" data-cid="f_blRy">17. Outstanding items and open questions</h2><h3 id="product-and-experience" data-cid="Jl4C_a">Product and experience</h3><ul data-cid="ceQdBO"><li data-cid="OxMR-2">Which channels are included: browser only, mobile, telephony or all?</li><li data-cid="m8J5oA">Which languages, accents, vocabulary and acoustic conditions take priority?</li><li data-cid="Zt2tVk">What behavior is expected when voice fails: text, an alternative voice or closure?</li><li data-cid="02pJoA">Which actions require verbal confirmation, visual confirmation or stronger authentication?</li></ul><h3 id="identity-and-authorization" data-cid="R--VY8">Identity and authorization</h3><ul data-cid="M8N0u6"><li data-cid="twY_OW">Actual contract for <code data-cid="Pi3Xuf">/api/v1/auth/user-by-phone</code> and authentication mechanism.</li><li data-cid="VlDlV5">Roles, tenants, scopes and data-isolation model.</li><li data-cid="BqBIMg">Token exchange/delegation to MCP and downstream systems.</li></ul><h3 id="mcp" data-cid="fUCo8n">MCP</h3><ul data-cid="RcxOfe"><li data-cid="4Va97K">Inventory of servers, tools, schemas, side effects, idempotency and downstream SLOs.</li><li data-cid="VyBAiB">Stable version actually supported by the customer's server.</li><li data-cid="9G1byu">Discovery cache/refresh strategy.</li><li data-cid="GU9Qg2">Future ratification of <code data-cid="rTeO_4">2026-07-28</code> and SDK/conformance-suite availability.</li></ul><h3 id="inference-and-capacity" data-cid="QXz8Ty">Inference and capacity</h3><ul data-cid="zeg81Y"><li data-cid="8t35GA">Exact runtime for LLaMA, memory allocation and KV cache policy.</li><li data-cid="6uksQf">Sustainable STT + LLM + TTS concurrency on GB10.</li><li data-cid="ZufRfl">Effects of context length, agent prompts and tool results on TTFT.</li><li data-cid="ljxIkF">Cold start, model loading, fragmentation and OOM recovery.</li><li data-cid="UxUfqU">Parakeet quality on real audio and domain content.</li></ul><h3 id="voice-and-legal-considerations" data-cid="D_TNr7">Voice and legal considerations</h3><ul data-cid="CFSUEq"><li data-cid="OIa0jG">Owner and consent evidence for every voice.</li><li data-cid="3MoKhG">Applicable licensing for weights, code, redistribution and commercial use.</li><li data-cid="JSpLqw">Disclosure, retention, localization and revocation-right rules.</li><li data-cid="7elYwH">Fidelity/security metric and acceptance threshold.</li></ul><h3 id="operations" data-cid="YvCjB2">Operations</h3><ul data-cid="TwaI3E"><li data-cid="M2_swY">Environments, topology, certificates, secrets, KMS, stores and backups.</li><li data-cid="M_Pdz2">RTO/RPO and on-call model.</li><li data-cid="Q-pW6Q">Logging, sampling, redaction and retention policy.</li><li data-cid="NHLeFO">Spare-node capacity or alternative service.</li></ul>
<h2 class="chapter" id="18-consolidated-risks" data-cid="qLIw8g">18. Consolidated risks</h2><div class="sk-doc-native-table-frame" data-scroll-left-active="false" data-scroll-right-active="false" data-scrolling="false" data-cid="SfgbpF"><table data-cid="sZRwi_"><thead data-cid="vYCC3V"><tr data-cid="d39Qex"><th data-cid="2lmzjA">Risk</th><th data-cid="tv4B9j">Initial likelihood</th><th data-cid="8X1Hcx">Impact</th><th data-cid="LMj4vz">Treatment</th></tr></thead><tbody data-cid="dk6iD2"><tr data-cid="AC8hsn"><td data-cid="QkZgdv">Complete pipeline exceeds GB10 capacity</td><td data-cid="qZreW8">Unknown</td><td data-cid="DhGMwn">High</td><td data-cid="yKnZLO">Early benchmark; admission control; separation options</td></tr><tr data-cid="gOf5tb"><td data-cid="aZ1QUq">Late or false barge-in</td><td data-cid="w_OsOq">Unknown</td><td data-cid="kmQ5XY">High</td><td data-cid="2BdZYb">Priority queue, AEC, playout ACK, noise corpus</td></tr><tr data-cid="1e1MRO"><td data-cid="qA3Cha">MCP permits an improper action</td><td data-cid="sFeoIm">Medium until tested</td><td data-cid="w6_elM">Critical</td><td data-cid="MaBYg2">External policy, scopes, confirmation, auditing, idempotency</td></tr><tr data-cid="dDmEHC"><td data-cid="prfU4M">Voice compromise or unauthorized use</td><td data-cid="Dc0nHW">Medium until governed</td><td data-cid="xdB3Zv">Critical</td><td data-cid="Cj8x-J">Voice Vault, consent, isolation, revocation</td></tr><tr data-cid="leE8kf"><td data-cid="IV8RS8">Dependency on a candidate MCP version</td><td data-cid="UOdhna">Avoidable</td><td data-cid="wW8qUi">High</td><td data-cid="nkpT9x">Stable adapter by default and feature flag</td></tr><tr data-cid="Gxj45j"><td data-cid="j0CGPJ">Tool result injects instructions</td><td data-cid="I0B2O4">Medium</td><td data-cid="7m6-59">High</td><td data-cid="smbICx">Treat content as untrusted; sanitize, limit and evaluate</td></tr><tr data-cid="1V13U_"><td data-cid="sg8zFM">Inconsistent state after reconnection</td><td data-cid="L73Apu">Medium</td><td data-cid="ff-qcM">High</td><td data-cid="a6DPVf">IDs, versioning, leases, deduplication and cancellation</td></tr><tr data-cid="xhv0Sx"><td data-cid="lE4SkX">Observability leaks PII</td><td data-cid="yExuZg">Medium</td><td data-cid="0RHAVJ">High</td><td data-cid="7mxDs4">Redaction, attribute allowlist, access and retention</td></tr><tr data-cid="Qgxeub"><td data-cid="XQTiCu">Single inference node fails</td><td data-cid="WzilrP">High in the initial topology</td><td data-cid="eVl8b_">High</td><td data-cid="eePeHG">Runbook, spare/failover, degradation and communication</td></tr><tr data-cid="DqUQsn"><td data-cid="6mw6uF">Incomplete licensing/consent</td><td data-cid="vxyNRj">Unknown</td><td data-cid="SM4SMs">Critical</td><td data-cid="j4G4Z6">Legal gate before production</td></tr></tbody></table></div><p data-cid="6Zl8ld">Nonnumeric likelihoods reflect missing data; update them after testing and organizational review.</p>
<h2 class="chapter" id="19-pilot-readiness-criteria" data-cid="arZmBo">19. Pilot readiness criteria</h2><p data-cid="uR30t1">The solution is ready for a pilot only when:</p><ol data-cid="ynesbu"><li data-cid="nNHIQB">requirements and critical ADRs are approved;</li><li data-cid="9D9Drf">the stable MCP path is tested and the future candidate remains isolated;</li><li data-cid="_bPqWH">the end-to-end benchmark demonstrates capacity for the pilot load;</li><li data-cid="N4sz6z">barge-in and backpressure pass acoustic and network tests;</li><li data-cid="pJeLyj">sensitive tools have policy, confirmation and idempotency;</li><li data-cid="1gKjc1">the voice is authorized, versioned and revocable;</li><li data-cid="hbtlHU">security has no open critical findings;</li><li data-cid="uhxvaw">dashboards, alerts and runbooks enable service operation;</li><li data-cid="7esu67">provisional SLOs were ratified or replaced with evidence;</li><li data-cid="9OMzWu">tested application, profile, model and configuration rollback exists.</li></ol>
<h2 class="chapter" id="20-sources" data-cid="01Xvoh">20. Sources</h2><ol class="references" data-cid="GKFeGe"><li id="ref1" data-cid="4yhNhc">[1] OpenAI — Realtime and audio — <a href="https://developers.openai.com/api/docs/guides/realtime" rel="noreferrer" target="_blank" data-cid="Xhl1V6">https://developers.openai.com/api/docs/guides/realtime</a></li><li id="ref2" data-cid="UcBcG1">[2] Microsoft Azure — Realtime audio — <a href="https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/realtime-audio" rel="noreferrer" target="_blank" data-cid="NUU3cr">https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/realtime-audio</a></li><li id="ref3" data-cid="B5f3Ub">[3] LiveKit — Turns overview — <a href="https://docs.livekit.io/agents/logic/turns/" rel="noreferrer" target="_blank" data-cid="i2aVMK">https://docs.livekit.io/agents/logic/turns/</a></li><li id="ref4" data-cid="nEW34C">[4] Model Context Protocol — 2026-07-28 Release Candidate — <a href="https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/" rel="noreferrer" target="_blank" data-cid="nQ_cmq">https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/</a></li><li id="ref5" data-cid="AeyX3d">[5] Model Context Protocol — Transport specification 2025-11-25 — <a href="https://modelcontextprotocol.io/specification/2025-11-25/basic/transports" rel="noreferrer" target="_blank" data-cid="hXuvg_">https://modelcontextprotocol.io/specification/2025-11-25/basic/transports</a></li><li id="ref6" data-cid="dzUmDw">[6] Model Context Protocol — Architecture overview — <a href="https://modelcontextprotocol.io/docs/learn/architecture" rel="noreferrer" target="_blank" data-cid="j97WIU">https://modelcontextprotocol.io/docs/learn/architecture</a></li><li id="ref7" data-cid="1fhg7D">[7] Qwen — Qwen3-TTS 12Hz 1.7B Base model card — <a href="https://huggingface.co/Qwen/Qwen3-TTS-12Hz-1.7B-Base" rel="noreferrer" target="_blank" data-cid="LyBH3y">https://huggingface.co/Qwen/Qwen3-TTS-12Hz-1.7B-Base</a></li><li id="ref8" data-cid="ZU5hCj">[8] QwenLM — Qwen3-TTS repository — <a href="https://github.com/QwenLM/Qwen3-TTS" rel="noreferrer" target="_blank" data-cid="RT41cx">https://github.com/QwenLM/Qwen3-TTS</a></li><li id="ref9" data-cid="jXiUsl">[9] Telnyx — Inference Benchmark: TTFT vs E2E Latency — <a href="https://telnyx.com/resources/inference-benchmark-ttft-vs-e2e" rel="noreferrer" target="_blank" data-cid="jeborg">https://telnyx.com/resources/inference-benchmark-ttft-vs-e2e</a></li><li id="ref10" data-cid="_86WDW">[10] Arun Baby — Real-Time Agent Pipelines — <a href="https://www.arunbaby.com/ai-agents/0016-real-time-agent-pipelines/" rel="noreferrer" target="_blank" data-cid="fqPCe1">https://www.arunbaby.com/ai-agents/0016-real-time-agent-pipelines/</a></li><li id="ref11" data-cid="sVvjbN">[11] NVIDIA — Parakeet TDT 0.6B v3 model card — <a href="https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3" rel="noreferrer" target="_blank" data-cid="FpoLAd">https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3</a></li></ol>
<h2 class="chapter" id="appendix-a-implementation-checklist" data-cid="8bM9Xw">Appendix A — Implementation checklist</h2><ul data-cid="77ExNK"><li data-cid="Fi1YZY">[ ] Requirements [REQ], recommendations [REC] and assumptions [BENCH] reviewed.</li><li data-cid="tzDmsg">[ ] Critical ADRs approved.</li><li data-cid="IA1GZ-">[ ] Models and hashes pinned; SBOM and licenses reviewed.</li><li data-cid="uHb47h">[ ] Identity, roles, scopes and tenants defined.</li><li data-cid="aEJisM">[ ] Event schemas v1 published and contract-tested.</li><li data-cid="hFNw1t">[ ] Stable MCP adapter tested against <code data-cid="jPqFog">2025-11-25</code>.</li><li data-cid="WVwro6">[ ] Candidate MCP adapter disabled by default.</li><li data-cid="ZjaQKO">[ ] Voice Vault, consent, rotation and revocation operational.</li><li data-cid="WSAI8G">[ ] Admission control and buffer limits configured.</li><li data-cid="6w_t-m">[ ] Barge-in measured through actual playout.</li><li data-cid="q1dBor">[ ] Tool confirmation and idempotency verified.</li><li data-cid="gnKHyH">[ ] Telemetry redacted and correlated.</li><li data-cid="fum9N2">[ ] SLOs ratified through benchmarking.</li><li data-cid="H1o7Up">[ ] Runbooks and rollback rehearsed.</li><li data-cid="UenBIO">[ ] Security review and go-live completed.</li></ul>
</article>
</body></html>