@securecoms/agent-bridge 0.30.3 → 0.32.0

package/dist/index.js

@@ -33431,7 +33431,8 @@ var FastLlmClient = class {
       try {
         res = await this.fetchImpl(`${this.cfg.baseUrl}${this.cfg.path ?? "/chat/completions"}`, {
           method: "POST",
-          headers: { "content-type": "application/json", ...this.key ? { authorization: `Bearer ${this.key}` } : {} },
+          // Final fix T8: configured headers first, so they can never displace content-type or the bearer.
+          headers: { ...this.cfg.headers, "content-type": "application/json", ...this.key ? { authorization: `Bearer ${this.key}` } : {} },
           body: JSON.stringify({ model: this.cfg.model, messages, max_tokens: this.cfg.maxTokens, temperature: 0.4 }),
           signal: ac.signal
         });
@@ -33635,7 +33636,9 @@ function settingsToVoiceConfig(s, proxy) {
       model: "securecoms-fast",
       apiKey: proxy.apiKey,
       timeoutMs: 2500,
-      maxTokens: 80
+      maxTokens: 80,
+      // Spec 7.2: tells the proxy this bridge scopes voice turns. Sent to the SecureComs proxy only.
+      headers: { "x-securecoms-bridge-caps": "voice-scope-v1" }
     },
     settings: s
   };
@@ -33643,6 +33646,7 @@ function settingsToVoiceConfig(s, proxy) {
 
 // src/voice/persona.ts
 var CONTINUITY_CLAUSE = "The text messages in this chat and this voice call are one and the same ongoing conversation, and the earlier turns you can see ARE those messages. If asked whether you remember or received a message, answer from that history \u2014 never say you cannot access previous messages.";
+var VOICE_CALL_CLAUSE = "This is a live voice call. The earlier turns you can see are from this call only; during a call you cannot see the typed chat, saved notes or memory. If asked about a message, file or note you cannot see, say plainly that you can't see the chat while on a call and offer to pick it up in the chat afterwards. Never guess at what it said.";
 var schema = z2.object({
   persona: z2.object({
     display_name: z2.string().min(1).optional(),
@@ -33655,6 +33659,8 @@ var schema = z2.object({
     model: z2.string().min(1),
     api_key: z2.string().min(1).optional(),
     api_key_env: z2.string().min(1).optional(),
+    // E.2: only the exact string "direct" opts in; any other value is ignored (today's proxy behavior), never an error.
+    route: z2.unknown().optional(),
     timeout_ms: z2.number().int().min(500).max(1e4).default(2500),
     max_tokens: z2.number().int().min(16).max(400).default(80)
   })
@@ -33679,7 +33685,8 @@ function parseVoiceConfig(raw, env) {
       model: v.fast_path.model,
       apiKey,
       timeoutMs: v.fast_path.timeout_ms,
-      maxTokens: v.fast_path.max_tokens
+      maxTokens: v.fast_path.max_tokens,
+      ...v.fast_path.route === "direct" ? { route: "direct" } : {}
     }
   };
 }
@@ -33723,7 +33730,7 @@ function buildFastMessages(args2) {
   const sp = systemPrompt(args2.persona, args2.settings, args2.agentName);
   const head = sp.slice(0, sp.length - CONTINUITY_CLAUSE.length).trimEnd();
   const notesLine = args2.notesDeferLine ? ` ${FAST_NOTES_DEFER_LINE}` : "";
-  const system = `${head} ${args2.guidance.trim()}${notesLine} ${FAST_DEFER_RULE} ${CONTINUITY_CLAUSE}`;
+  const system = `${head} ${args2.guidance.trim()}${notesLine} ${FAST_DEFER_RULE} ${VOICE_CALL_CLAUSE}`;
   const recent = args2.memory.recent.map((t) => ({
     role: t.role === "agent" ? "assistant" : "user",
     content: t.text
@@ -33760,6 +33767,160 @@ function normalizeFastReply(raw, maxChars = 200, maxSentences = 2) {
   return sentences.slice(0, maxSentences).join(" ").slice(0, maxChars);
 }
 
+// src/voice/voice-scope.ts
+function isVoiceScopedTurn(t) {
+  return t.speaker !== void 0 || t.transcribed === true || t.senderIsRelay || t.text.trim() === VOICE_CALL_START_MARKER;
+}
+function admitsToCallBuffer(t) {
+  return t.speaker !== void 0 || t.transcribed === true;
+}
+
+// src/voice/call-buffer.ts
+var CALL_BUFFER_CAP = 50;
+var CALL_BUFFER_IDLE_MS = 30 * 6e4;
+var CALL_BUFFER_ID_CAP = 5e3;
+var CallBuffer = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  channels = /* @__PURE__ */ new Map();
+  /** messageId -> channelId, insertion ordered (oldest first) for the cap. */
+  voiceIds = /* @__PURE__ */ new Map();
+  /** messageId -> { channelId, the channel's bufSeq at the mark, the channel's generation then }. */
+  seqNotes = /* @__PURE__ */ new Map();
+  /**
+   * Final fix I-1: messageId -> { channelId, the channel's bufSeq just before the turn's own peer entry }. A row the
+   * backend redelivers (a failed ack, runtime_inbox.full backpressure) is ingested again; its id here means its text is
+   * already in the call, so it is not appended again and its snapshot stops before its own entry (A-6).
+   */
+  admitted = /* @__PURE__ */ new Map();
+  /** The last bufSeq handed out per channel (kept across resets, so the sequence never runs backwards). */
+  lastSeq = /* @__PURE__ */ new Map();
+  nextSeq = 1;
+  /** Per-channel reset generation (advanced by every reset, the idle rule included). */
+  gens = /* @__PURE__ */ new Map();
+  /**
+   * Append a spoken turn's text, once per turn id (final fix I-1). Returns false (and appends nothing) when the id was
+   * already admitted in this call, or when the buffer is disabled.
+   */
+  appendPeer(channelId, text, messageId) {
+    if (!this.opts.enabled) return false;
+    if (this.admittedAt(messageId) !== void 0) return false;
+    const before = this.seqAt(channelId);
+    this.append(channelId, { role: "peer", text });
+    this.admitted.set(messageId, { channelId, before });
+    if (this.admitted.size > CALL_BUFFER_ID_CAP) this.admitted.delete(this.admitted.keys().next().value);
+    return true;
+  }
+  /**
+   * Final fix I-1: for a turn already admitted in this call, the channel's bufSeq just before its own entry (the end seq
+   * of its first snapshot); undefined for a turn not admitted (or forgotten by a reset, the idle rule or the id cap).
+   */
+  admittedAt(messageId) {
+    const a = this.admitted.get(messageId);
+    if (a === void 0) return void 0;
+    this.expireIfIdle(a.channelId);
+    return this.admitted.get(messageId)?.before;
+  }
+  appendAgent(channelId, text, origin) {
+    this.append(channelId, { role: "agent", text, origin });
+  }
+  /**
+   * Record a voice-scoped turn's id (for reply admission only, A-4) and note the channel's seq at this point. Final fix
+   * I-1: a turn already admitted (a redelivered row) keeps the seq of its first admission, so the note never moves past
+   * the turn's own entry.
+   */
+  markVoiceScoped(channelId, messageId) {
+    if (!this.opts.enabled) return;
+    this.expireIfIdle(channelId);
+    this.voiceIds.delete(messageId);
+    this.voiceIds.set(messageId, channelId);
+    if (this.voiceIds.size > CALL_BUFFER_ID_CAP) this.voiceIds.delete(this.voiceIds.keys().next().value);
+    const seq = this.admittedAt(messageId) ?? this.seqAt(channelId);
+    this.seqNotes.delete(messageId);
+    this.seqNotes.set(messageId, { channelId, seq, generation: this.generation(channelId) });
+    if (this.seqNotes.size > CALL_BUFFER_ID_CAP) this.seqNotes.delete(this.seqNotes.keys().next().value);
+  }
+  /** A-4: read ONLY by the bridge's `afterPublish` reply admission. */
+  isVoiceScopedId(messageId) {
+    const channelId = this.voiceIds.get(messageId);
+    if (channelId === void 0) return false;
+    this.expireIfIdle(channelId);
+    return this.voiceIds.has(messageId);
+  }
+  /** The channel's mark noted when `messageId` was marked (the release re-read), or undefined (e.g. after a restart). */
+  seqNoted(messageId) {
+    const note = this.seqNotes.get(messageId);
+    if (note === void 0) return void 0;
+    this.expireIfIdle(note.channelId);
+    const kept = this.seqNotes.get(messageId);
+    return kept === void 0 ? void 0 : { seq: kept.seq, generation: kept.generation };
+  }
+  /** The bufSeq of the channel's newest entry (0 before any append). A snapshot's end seq. */
+  seqAt(channelId) {
+    this.expireIfIdle(channelId);
+    return this.lastSeq.get(channelId) ?? 0;
+  }
+  /**
+   * The channel's last `limit` entries, oldest first. With `upTo` (final fix I-1, a redelivered turn's re-snapshot),
+   * only entries at or below that bufSeq.
+   */
+  recent(channelId, limit, upTo) {
+    if (limit <= 0) return [];
+    this.expireIfIdle(channelId);
+    const all = this.channels.get(channelId)?.entries ?? [];
+    const entries = upTo === void 0 ? all : all.filter((e) => e.bufSeq <= upTo);
+    return entries.slice(-limit).map(deliver);
+  }
+  /**
+   * The channel's AGENT entries appended after `since.seq` (lines spoken or answered since a snapshot), oldest first.
+   * Final fix M-4: nothing when the channel has been reset since the mark (a later call's lines).
+   */
+  agentAfter(channelId, since) {
+    if (this.generation(channelId) !== since.generation) return [];
+    const entries = this.channels.get(channelId)?.entries ?? [];
+    return entries.filter((e) => e.role === "agent" && e.bufSeq > since.seq).map(deliver);
+  }
+  /**
+   * The channel's reset generation: it changes on every reset (explicit or idle) and on nothing else. A caller that
+   * holds text across an await (the coalesce window) compares it to skip an append into a call that has since ended.
+   */
+  generation(channelId) {
+    this.expireIfIdle(channelId);
+    return this.gens.get(channelId) ?? 0;
+  }
+  /** Clear the channel: its entries, its voice-scoped ids, its seq notes and its admitted ids. Only ever removes. */
+  reset(channelId) {
+    this.gens.set(channelId, (this.gens.get(channelId) ?? 0) + 1);
+    this.channels.delete(channelId);
+    for (const [id, c] of this.voiceIds) if (c === channelId) this.voiceIds.delete(id);
+    for (const [id, n] of this.seqNotes) if (n.channelId === channelId) this.seqNotes.delete(id);
+    for (const [id, a] of this.admitted) if (a.channelId === channelId) this.admitted.delete(id);
+  }
+  append(channelId, e) {
+    if (!this.opts.enabled) return;
+    this.expireIfIdle(channelId);
+    let ch = this.channels.get(channelId);
+    if (ch === void 0) {
+      ch = { entries: [], lastAppend: 0 };
+      this.channels.set(channelId, ch);
+    }
+    const bufSeq = this.nextSeq++;
+    this.lastSeq.set(channelId, bufSeq);
+    ch.entries.push({ ...e, bufSeq });
+    if (ch.entries.length > this.opts.cap) ch.entries.splice(0, ch.entries.length - this.opts.cap);
+    ch.lastAppend = this.opts.now();
+  }
+  /** Reset (c): more than `idleMs` since the channel's last append clears it, checked on every read and append. */
+  expireIfIdle(channelId) {
+    const ch = this.channels.get(channelId);
+    if (ch !== void 0 && this.opts.now() - ch.lastAppend > this.opts.idleMs) this.reset(channelId);
+  }
+};
+function deliver(e) {
+  return { role: e.role, text: e.text, seq: 0, ...e.origin ? { origin: e.origin } : {} };
+}
+
 // src/voice/defer-intent.ts
 var NEEDS_RUNTIME = [
   // Current time / date / day.
@@ -34139,6 +34300,7 @@ function lineHash(line) {
   return createHash5("sha256").update(line.trim(), "utf8").digest("hex");
 }
 var LOCAL_REPORT_FILE = "local-config.json";
+var LOCAL_PERSONA_FILE_NAMES = ["IDENTITY.md", "SOUL.md", "AGENTS.md"];
 var SECRET_PATH_COUNT_MAX = 1e4;
 var isCount = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0 && v <= SECRET_PATH_COUNT_MAX;
 function parseSecretPathsReport(raw) {
@@ -34220,18 +34382,23 @@ function readLocalReport(home, identityId) {
   const hasSearchKey = doc.has_search_key === true;
   const hasLlmKey = doc.has_llm_key === true;
   const raw = doc.persona;
-  const persona = raw && typeof raw === "object" && !Array.isArray(raw) ? Object.fromEntries(
-    Object.entries(raw).filter(([, v]) => typeof v === "string")
-  ) : {};
+  const persona = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  const personaFiles = [];
+  for (const name of LOCAL_PERSONA_FILE_NAMES) {
+    const text = persona[name];
+    if (typeof text === "string" && text.trim() !== "") {
+      personaFiles.push({ name, bytes: Buffer.byteLength(text, "utf8") });
+    }
+  }
   const capRaw = doc.owner_dm_search_cap_effective;
   const ownerDmCap = typeof capRaw === "number" && Number.isInteger(capRaw) && capRaw >= 0 && capRaw <= OWNER_DM_SEARCH_DAILY_CAP_MAX ? capRaw : void 0;
   return {
-    persona,
+    local_persona_files: personaFiles,
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
     has_extract_provider: doc.has_extract_provider === true,
     ...ownerDmCap !== void 0 ? { owner_dm_search_cap_effective: ownerDmCap } : {},
-    legacy_memory: localLegacySources(doc).map(({ path: _path, ...source }) => source),
+    legacy_memory: localLegacySources(doc).map(({ path: _path, content: _content, ...source }) => source),
     secret_paths: parseSecretPathsReport(doc.secret_paths)
   };
 }
@@ -34316,16 +34483,6 @@ async function applyLegacyMemoryFactDecisions(home, identityId, rawDecisions, re
   }
   return { sourcesDeleted, factsAssigned };
 }
-function readManagedMemory(home, identityId) {
-  const p = join15(runtimeConfigDir(home, identityId), MEMORY_FILE);
-  if (!existsSync4(p)) return null;
-  try {
-    const body = readFileSync8(p, "utf8").trim();
-    return body || null;
-  } catch {
-    return null;
-  }
-}
 function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   const dir = runtimeConfigDir(home, identityId);
   const path = join15(dir, MEMORY_FILE);
@@ -35113,6 +35270,10 @@ var OWNER_DM_DEFAULT_READ_GRANTS = Object.freeze([
 var ROOM_DEFAULT_READ_GRANTS = Object.freeze([
   Object.freeze({ tool: "current_time", mode: "read" })
 ]);
+var RELAYED_VOICE_GRANTS = Object.freeze([
+  Object.freeze({ tool: "current_time", mode: "read" }),
+  Object.freeze({ tool: "web_search", mode: "read" })
+]);
 var NO_TOOL_GRANTS = Object.freeze([]);
 var WS_CLOSE_SESSION_SUPERSEDED2 = 4409;
 var OWNER_REPLAY_PRUNE_INTERVAL_MS = 5 * 60 * 1e3;
@@ -35472,6 +35633,12 @@ var BridgeAgent = class _BridgeAgent {
       workspaceDir: this.cfg.memoryWorkspaceDir,
       factsCharBudget: this.cfg.memoryFactsCharBudget
     });
+    this.callBuffer = new CallBuffer({
+      cap: CALL_BUFFER_CAP,
+      idleMs: CALL_BUFFER_IDLE_MS,
+      now: () => Date.now(),
+      enabled: (this.cfg.memoryProvider ?? "securecoms") !== "none"
+    });
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -35605,6 +35772,9 @@ var BridgeAgent = class _BridgeAgent {
     this.injectedFastLlm = !!deps.fastLlm;
     this.fileVoiceConfig = cfg.voice;
     this.fastLlm = deps.fastLlm ?? (cfg.voice?.fastPath.enabled ? new FastLlmClient(cfg.voice.fastPath, this.fetchImpl) : void 0);
+    if (this.fileVoiceConfig?.fastPath.route === "direct" && !this.fileVoiceConfig.fastPath.apiKey) {
+      writeServiceLog2("warn", "voice.fast_path_direct_no_key");
+    }
     this.voiceSettingsSource = cfg.voice ? "file" : "none";
     this.latency = deps.latency ?? new LatencyRecorder();
     this.voiceCoalesceWindowMs = Math.max(0, deps.voiceCoalesceWindowMs ?? voiceCoalesceWindowFromEnv());
@@ -36295,6 +36465,11 @@ var BridgeAgent = class _BridgeAgent {
   startedAt = 0;
   store;
   memory;
+  /**
+   * Voice fast-path privacy, Task 4b (spec §2.1, OQ-1 ruled): the current calls' spoken turns, in process only. The
+   * ONLY history a voice-scoped turn sees; read through voiceScopedHistory, once per turn, at ingest.
+   */
+  callBuffer;
   /**
    * Markdown memory 7a: the one owner of every note mutation and of the
    * delivery cache (spec §6.3, §7.2). One per store, so one per identity.
@@ -36399,6 +36574,7 @@ var BridgeAgent = class _BridgeAgent {
       const s = parseVoiceSettings(await res.json());
       if (s.identityDisplayName) this.lastOwnDisplayName = s.identityDisplayName;
       const proxy = settingsToVoiceConfig(s, { baseUrl: this.cfg.apiBase, apiKey: this.cfg.apiKey });
+      const direct = this.fileVoiceConfig?.fastPath.route === "direct" ? this.fileVoiceConfig.fastPath : void 0;
       if (s.version === 0 && this.fileVoiceConfig) {
         const merged = {
           ...s,
@@ -36407,16 +36583,16 @@ var BridgeAgent = class _BridgeAgent {
           quirks: this.fileVoiceConfig.persona.quirks
         };
         this.voiceSettings = merged;
-        this.cfg.voice = { persona: this.fileVoiceConfig.persona, fastPath: proxy.fastPath, settings: merged };
+        this.cfg.voice = { persona: this.fileVoiceConfig.persona, fastPath: direct ?? proxy.fastPath, settings: merged };
         this.voiceSettingsVersion = 0;
         this.voiceSettingsSource = "file";
       } else {
         this.voiceSettings = s;
-        this.cfg.voice = proxy;
+        this.cfg.voice = direct ? { ...proxy, fastPath: direct } : proxy;
         this.voiceSettingsVersion = s.version;
         this.voiceSettingsSource = "backend";
       }
-      if (!this.injectedFastLlm) {
+      if (!this.injectedFastLlm && !direct) {
         this.fastLlm = new FastLlmClient(this.cfg.voice.fastPath, this.fetchImpl);
       }
       writeServiceLog2("info", "voice.settings_loaded", {
@@ -36645,12 +36821,10 @@ var BridgeAgent = class _BridgeAgent {
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
-      // Read AFTER the prunes above, so the owner's next view of memory is
-      // the file as it now stands, not the one they just pruned from.
-      memory: readManagedMemory(this.home, this.cfg.identityId),
-      // E13: pass through what the runtime reported. The daemon does not
-      // interpret any of it.
-      local_persona: local?.persona ?? null,
+      // F-0 (G-5): the report carries no content. No MEMORY.md text, no persona text, no legacy
+      // text. E13 needs only to know which of the runtime's own persona files hold something, so
+      // this is [{name, bytes}] for each non-blank file and nothing else.
+      local_persona_files: local?.local_persona_files ?? [],
       // Only the runtime knows whether a search key file is configured — it
       // is an environment value on that process, invisible to the daemon and
       // to the backend. The backend needs it to generate a truthful tool
@@ -36683,9 +36857,9 @@ var BridgeAgent = class _BridgeAgent {
       ...this.reportedClearGeneration(),
       // 7b spec §9.2 (Task 19): capability versus state. Read-only: the report never starts the embedder.
       ...this.reportedRecall(),
-      // Inert legacy files only. `readLocalReport` revalidates the current
-      // regular-file bytes and strips every local path before this leaves the
-      // machine.
+      // Inert legacy files only, metadata only. `readLocalReport` revalidates the current
+      // regular-file bytes and strips every local path and every `content` before this
+      // leaves the machine.
       legacy_memory: local?.legacy_memory ?? [],
       // §B.4: counts of server-named secret paths inside / allowlisted /
       // outside the secrets directory, and the runtime's mode. Numbers and
@@ -37942,6 +38116,9 @@ var BridgeAgent = class _BridgeAgent {
     const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
     const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(body.text);
     if (opts.inReplyTo !== void 0 && this.isOwnerVerifyFailed(opts.inReplyTo)) return;
+    if (body.kind === "text" && opts.callBufferReply === true && opts.inReplyTo !== void 0 && !this.spokenReplyIds.has(id) && !isBridgeMemoryLine(body.text) && this.callBuffer.isVoiceScopedId(opts.inReplyTo)) {
+      this.callBuffer.appendAgent(channelId, body.text, "reply");
+    }
     const origin = this.spokenReplyIds.has(id) ? "fast_path" : !this.taintScope(channelId) ? "reply" : opts.inReplyTo !== void 0 && this.cleanTurns.has(opts.inReplyTo) && !this.taintedTurns.has(opts.inReplyTo) ? "reply" : "untrusted";
     if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, body.text, id, modality, purgeEpoch, origin);
     if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, body.text, id, replyCapture ?? null, origin);
@@ -38712,6 +38889,27 @@ var BridgeAgent = class _BridgeAgent {
   mayReadHistoryForTurn(messageId, authorization) {
     return !this.isOwnerVerifyFailed(messageId) && this.mayReadOpenClawMemoryForTurn(authorization);
   }
+  /**
+   * Voice fast-path privacy (spec §2.1, OQ-1 ruled): the ONLY history source of a voice-scoped turn, the call buffer.
+   * Never reads the memory provider, the store, the unified store or the 7b index. A-6: called once per turn, at ingest
+   * (takeVoiceSnapshot), after the reset signals and before the turn's own append.
+   */
+  voiceScopedHistory(channelId, limit, upTo) {
+    return this.callBuffer.recent(channelId, limit, upTo);
+  }
+  /**
+   * Task 4b (A-6): the turn's snapshot, taken BEFORE its own text is appended (audit finding 2). Final fix I-1: a turn
+   * already admitted to this call (a redelivered row) is snapshotted up to just before its own entry, as it was the
+   * first time, so its snapshot never contains itself.
+   */
+  takeVoiceSnapshot(channelId, messageId) {
+    const upTo = this.callBuffer.admittedAt(messageId);
+    return {
+      recent: this.voiceScopedHistory(channelId, _BridgeAgent.TURN_MEMORY_LIMIT, upTo),
+      endSeq: upTo ?? this.callBuffer.seqAt(channelId),
+      generation: this.callBuffer.generation(channelId)
+    };
+  }
   /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
   mayReadOpenClawMemoryForTurn(authorization) {
     return this.cfg.memoryProvider !== "openclaw" || authorization.sender_membership === "active" && authorization.audience === "owner_dm";
@@ -38721,16 +38919,26 @@ var BridgeAgent = class _BridgeAgent {
    * stays owner-DM-only; every provider failure degrades to empty context and
    * never falls back to the runtime's retired plaintext JSON files.
    */
-  async memoryForTurn(channelId, messageId, authorization, limit = 50) {
+  async memoryForTurn(channelId, messageId, authorization, limit = 50, voice) {
     if (!this.mayReadHistoryForTurn(messageId, authorization)) {
       return { recent: [], facts: [] };
     }
+    if (voice) return { recent: this.voiceFrameTurns(voice.snapshot?.recent ?? []), facts: [] };
     try {
       return this.fenceMemory(channelId, await this.memory.context(channelId, limit), holdsManifestGrant(authorization));
     } catch {
       return { recent: [], facts: [] };
     }
   }
+  /**
+   * Task 6 (spec §2.2 A-1, N1): call-buffer entries as runtime-frame turns. Under the voice fence (a pin is loaded) the
+   * fast model's own lines (origin "fast_path") are dropped, as fenceMemory drops them from store history; the fast
+   * prompt keeps them. The internal origin is not carried into the frame; `seq` stays 0 (A-5).
+   */
+  voiceFrameTurns(entries) {
+    const fenced = this.voiceFenceOn();
+    return entries.filter((e) => !(fenced && e.origin === "fast_path")).map((e) => ({ seq: e.seq, role: e.role, text: e.text }));
+  }
   /**
    * Owner grants plan 4 Task 16 (T-30, audit r2 H-1): the voice fence is on whenever a pin is loaded, on EVERY runtime
    * turn (manifest, fallback, greeting, relayed, constants-only alike). It never depends on a turn's grants.
@@ -38765,7 +38973,7 @@ var BridgeAgent = class _BridgeAgent {
     if (!strict && !ctx.recent.some((t) => t.role === "agent")) return ctx;
     const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
     const securecoms = (this.cfg.memoryProvider ?? "securecoms") === "securecoms";
-    const meta = securecoms ? this.store.memoryLineMeta(channelId, ctx.recent.filter((t) => strict || t.role === "agent").map((t) => t.seq)) : /* @__PURE__ */ new Map();
+    const meta = securecoms ? this.store.memoryLineMeta(channelId, ctx.recent.filter((t) => (strict || t.role === "agent") && t.seq !== 0).map((t) => t.seq)) : /* @__PURE__ */ new Map();
     const fence = this.fenceContext(channelId);
     const recent = ctx.recent.filter((t) => {
       const m = meta.get(t.seq);
@@ -38784,7 +38992,7 @@ var BridgeAgent = class _BridgeAgent {
     if (recent.length === 0) return false;
     const ownerId = this.cfg.ownerGrantPin?.pin?.ownerIdentityId ?? "";
     const securecoms = (this.cfg.memoryProvider ?? "securecoms") === "securecoms";
-    const meta = securecoms ? this.store.memoryLineMeta(m.channel_id, recent.filter((t) => t.role !== "agent").map((t) => t.seq)) : /* @__PURE__ */ new Map();
+    const meta = securecoms ? this.store.memoryLineMeta(m.channel_id, recent.filter((t) => t.role !== "agent" && t.seq !== 0).map((t) => t.seq)) : /* @__PURE__ */ new Map();
     return recent.some((t) => t.role !== "agent" && isRelayClassPeer({ peerId: t.peerId, modality: meta.get(t.seq)?.modality }, ownerId));
   }
   /**
@@ -39080,9 +39288,18 @@ var BridgeAgent = class _BridgeAgent {
       writeServiceLog2("warn", "memory.recall_prepare_failed", {}, e);
     }
   }
+  /**
+   * Voice fast-path privacy, Task 7 (spec §4): the frame-keyed delivery check. A voice-scoped frame gets no notes, no
+   * recall and no unified items, whatever its authorization says. Keys on the frame's own marks, NEVER on the call
+   * buffer's id set (a reset evicts ids; the staged frame must stay scoped).
+   */
+  frameIsVoiceScoped(m) {
+    return m.voice_scoped === true || m.transcribed === true || m.speaker !== void 0;
+  }
   /** ws flush (synchronous). Q1 to Q3 and Q6 again at delivery, on the ORIGINAL message; Q4 lives in withConsumerRecall. */
   recallForDelivery(m) {
     if (this.unifiedOn) return void 0;
+    if (this.frameIsVoiceScoped(m)) return void 0;
     if (!this.recallProviderOn() || !this.notesReadable(m.authorization)) return void 0;
     return this.recall.deliverable(m.message_id, m.channel_id);
   }
@@ -39315,6 +39532,7 @@ var BridgeAgent = class _BridgeAgent {
   /** ws flush (synchronous). The predicate and the owner scope again at delivery, on the ORIGINAL message (H-4, Review Focus 3). */
   unifiedForDelivery(m) {
     if (!this.unifiedProviderOn()) return void 0;
+    if (this.frameIsVoiceScoped(m)) return void 0;
     const a = m.authorization;
     if (!(a?.memory_write === true || a?.relay_speaker === "owner")) return void 0;
     const scopeId = this.ownerScopeNow(m.channel_id);
@@ -39550,6 +39768,7 @@ var BridgeAgent = class _BridgeAgent {
   notesForDelivery(m) {
     if (this.unifiedOn) return { generation: this.notes.appliedGeneration() };
     const generation = this.notes.appliedGeneration();
+    if (this.frameIsVoiceScoped(m)) return { generation };
     if (!this.notesReadable(m.authorization)) return { generation };
     const d = this.notes.deliverable(m.channel_id);
     if (d.miss) {
@@ -39909,7 +40128,7 @@ var BridgeAgent = class _BridgeAgent {
    * deferring fast reply was actually published — F3).
    */
   async speakAndSettle(turn, plan, held, heldAfterAck, fastText, guidance, fastSpeaker, greeting) {
-    const outcome = plan.kind === "ack" ? await this.sendFastLine(turn.channelId, turn.messageId, plan.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidance, fastSpeaker, greeting);
+    const outcome = plan.kind === "ack" ? await this.sendFastLine(turn, plan.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidance, fastSpeaker, greeting);
     if (outcome === "answered") await this.settleHeldRuntimeMessage(held, false);
     else await this.settleHeldRuntimeMessage(outcome === "deferred" ? heldAfterAck : held, true);
   }
@@ -39928,19 +40147,29 @@ var BridgeAgent = class _BridgeAgent {
   async settleFastReplies() {
     while (this.fastReplyChains.size) await Promise.all([...this.fastReplyChains.values()]);
   }
-  /** Send a line the voice fast path speaks: its memory record is "voice" (H1). */
-  async sendSpoken(channelId, text, messageId) {
+  /**
+   * Send a line the voice fast path speaks: its memory record is "voice" (H1).
+   * Task 4b (spec §2.1 agent appends (1), A-1, A-2): once published, the line enters the call buffer as "fast_path",
+   * unless the turn it answers failed owner verification (its id, or any fragment of a coalesced turn). A line answering
+   * a turn the ingest did not find voice-scoped is not appended either (defense in depth: the fast path fires only on
+   * voice-scoped turns, Task 5).
+   */
+  async sendSpoken(channelId, text, messageId, turn) {
     this.spokenReplyIds.add(messageId);
     try {
       await this.send(channelId, text, messageId);
     } finally {
       this.spokenReplyIds.delete(messageId);
     }
+    if (turn.voiceScoped === true && turn.anyFragmentVerifyFailed !== true && !this.isOwnerVerifyFailed(turn.messageId)) {
+      this.callBuffer.appendAgent(channelId, text, "fast_path");
+    }
   }
   /** Speak a fixed acknowledgement line; failures are counted, never thrown. */
-  async sendFastLine(channelId, messageId, line) {
+  async sendFastLine(turn, line) {
+    const { channelId, messageId } = turn;
     try {
-      await this.sendSpoken(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId));
+      await this.sendSpoken(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId), turn);
       this.fastPathSent++;
       return true;
     } catch (e) {
@@ -39954,8 +40183,8 @@ var BridgeAgent = class _BridgeAgent {
    * the fast model's reply — or, in `ack_only`, the greeting template — is
    * spoken, and the outcome decides whether the runtime answers next.
    *
-   * MUST NEVER throw: every failure path (memory lookup, the LLM call,
-   * normalization, or the send itself) is caught, counted in
+   * MUST NEVER throw: every failure path (the LLM call, normalization,
+   * or the send itself) is caught, counted in
    * `fastPathFailed`, and logged WITHOUT the turn text or the model's reply.
    * The `fastReplyId(...)` send id is deterministic, so a duplicate that
    * slipped past the in-memory dedupe (e.g. a restart) resolves to the same
@@ -39969,20 +40198,18 @@ var BridgeAgent = class _BridgeAgent {
     try {
       if ((this.cfg.voiceFastPathMode ?? "full") === "ack_only") {
         if (!isGreeting) return "failed";
-        const ok = await this.sendFastLine(m.channelId, m.messageId, ackOnlyGreeting(this.voiceAgentName(), speaker?.displayName));
+        const ok = await this.sendFastLine(m, ackOnlyGreeting(this.voiceAgentName(), speaker?.displayName));
         return ok ? "answered" : "failed";
       }
       const fastLlm = this.fastLlm;
       if (!fastLlm || !this.cfg.voice) return "failed";
-      let memory;
-      if (!this.mayReadHistoryForTurn(m.messageId, m.authorization)) {
-        memory = { recent: [], facts: [] };
-      } else {
-        try {
-          memory = await this.memory.context(m.channelId, FAST_PATH_MEMORY_TURNS);
-        } catch {
-          memory = { recent: [], facts: [] };
-        }
+      let memory = { recent: [], facts: [] };
+      const snapshot = m.voiceSnapshot;
+      if (m.voiceScoped === true && snapshot !== void 0 && m.anyFragmentVerifyFailed !== true && this.mayReadHistoryForTurn(m.messageId, m.authorization)) {
+        memory = {
+          recent: [...snapshot.recent, ...this.callBuffer.agentAfter(m.channelId, { seq: snapshot.endSeq, generation: snapshot.generation })].slice(-FAST_PATH_MEMORY_TURNS),
+          facts: []
+        };
       }
       const messages = buildFastMessages({
         persona: this.cfg.voice.persona,
@@ -40005,7 +40232,7 @@ var BridgeAgent = class _BridgeAgent {
       const refusal = !isGreeting && isRefusal(split3.reply);
       const defer = split3.defer || refusal;
       const reply = refusal ? deferAck(m.messageId) : split3.reply;
-      await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
+      await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId), m);
       this.fastPathSent++;
       if (defer) this.fastPathDeferred++;
       if (refusal) this.fastPathRefusalDeferred++;
@@ -40069,6 +40296,15 @@ var BridgeAgent = class _BridgeAgent {
   async memoryAtRelease(message) {
     const prior = message.memory;
     if (!prior || !this.mayReadHistoryForTurn(message.message_id, message.authorization)) return prior;
+    if (this.frameIsVoiceScoped(message)) {
+      const tails = this.voiceCoalescedTails.get(message.message_id) ?? [];
+      if (tails.some((id) => this.isOwnerVerifyFailed(id))) return prior;
+      const noted = this.callBuffer.seqNoted(message.message_id);
+      if (noted === void 0) return prior;
+      const spoken2 = this.voiceFrameTurns(this.callBuffer.agentAfter(message.channel_id, noted));
+      if (spoken2.length === 0) return prior;
+      return { recent: [...prior.recent, ...spoken2].slice(-_BridgeAgent.TURN_MEMORY_LIMIT), facts: [] };
+    }
     let fresh;
     try {
       fresh = await this.memory.context(message.channel_id, _BridgeAgent.TURN_MEMORY_LIMIT);
@@ -40580,9 +40816,9 @@ var BridgeAgent = class _BridgeAgent {
     });
   }
   /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
-  async authorizeTurn(channelId, messageId, senderId, ownerVerdict, relaySpeakerId) {
+  async authorizeTurn(channelId, messageId, senderId, ownerVerdict, relaySpeakerId, voiceScoped) {
     const held = await this.heldPosition(channelId);
-    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId, { ownerVerdict });
+    const auth = this.authorizationFor(channelId, senderId, relaySpeakerId, held.epoch, held.groupId, { ownerVerdict, voiceScoped });
     if (!(auth.audience === "team_room" && auth.tool_grants.length > 0)) return auth;
     if (this.roomGrantEpochs.size >= ROOM_GRANT_TRACK_MAX || held.epoch === null || held.groupId === null) {
       writeServiceLog2("warn", "room_grant.untracked");
@@ -40597,17 +40833,22 @@ var BridgeAgent = class _BridgeAgent {
    * guess. The returned object and grant array are frozen before they cross the
    * daemon boundary so one consumer cannot widen a later execution check.
    *
-   * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
-   * the kill switch is on, the channel is a DM, and EITHER
+   * Grants (architect ruling 2026-10-02; P-5 and G-1, spec §9): an owner-DM
+   * constant only when the kill switch is on, the channel is a DM, and EITHER
    *   (a) audience is owner_dm AND the sender is the channel's pinned DM
    *       counterpart (`channelOwner`, never "anomalous"). A server-marked
    *       `is_agent_owner` on a member who is NOT the DM's single human
    *       counterpart gets nothing; on the counterpart it is trusted (see
-   *       LIMIT below); OR
+   *       LIMIT below). OWNER_DM_DEFAULT_READ_GRANTS on a typed turn;
+   *       RELAYED_VOICE_GRANTS and no memory_write when `opts.voiceScoped`
+   *       (G-1: the ingest predicate isVoiceScopedTurn, spec §1); OR
    *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
    *       relayed `speaker_identity_id` (passed by the caller only for relay
    *       turns) is that same pinned owner, whose roster row is the agent's
-   *       owner. A speaker claim from any non-relay sender gets nothing.
+   *       owner: RELAYED_VOICE_GRANTS. A speaker claim from any non-relay
+   *       sender gets nothing.
+   * RELAYED_VOICE_GRANTS is never manifest-eligible: effectiveToolGrants gives
+   * the constant by reference, or the fallback when a good manifest is held.
    * Both need the roster fetched at `heldEpoch` (the agent's current MLS
    * epoch for the channel), or the DM marked epoch-fresh at this ingest
    * cycle's refresh (audit M-B4).
@@ -40651,9 +40892,11 @@ var BridgeAgent = class _BridgeAgent {
         const ownerDirect = audience === "owner_dm" && senderId === ownerId;
         const owner = roster?.get(ownerId);
         const ownerRelayed = relaySpeakerId !== void 0 && sender.is_relay && relaySpeakerId === ownerId && owner !== void 0 && !owner.is_agent && owner.is_agent_owner;
-        if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
+        if (ownerDirect) tool_grants = opts.voiceScoped === true ? RELAYED_VOICE_GRANTS : OWNER_DM_DEFAULT_READ_GRANTS;
+        if (ownerRelayed) tool_grants = RELAYED_VOICE_GRANTS;
         if (ownerRelayed) relaySpeaker = "owner";
-        if (ownerDirect && relaySpeakerId === void 0 && (this.cfg.memoryProvider ?? "securecoms") === "securecoms" && // Final review M-4: the live payload flag too, so with notes off the
+        if (ownerDirect && relaySpeakerId === void 0 && // G-1: never on a voice-scoped turn.
+        opts.voiceScoped !== true && (this.cfg.memoryProvider ?? "securecoms") === "securecoms" && // Final review M-4: the live payload flag too, so with notes off the
         // runtime does not offer memory_note at all. Not memoryConfigConfirmed:
         // a turn the boot drain pulls before the boot refetch keeps its mark,
         // and the read and write gates (notesProviderOn) hold it until then.
@@ -40670,11 +40913,11 @@ var BridgeAgent = class _BridgeAgent {
     const binding = this.manifestBinding;
     const boundNow = binding !== null && binding.state === "bound" && binding.counter === this.toolGrantCounter;
     const signedTargets = boundNow ? binding.signedTargets : { endpoints: 0, databases: 0 };
-    if (tool_grants === OWNER_DM_DEFAULT_READ_GRANTS) {
-      const eligible = relaySpeakerId === void 0 && opts.ownerVerdict?.kind === "verified" && manifest?.owner_dm_channel_id === channelId && boundNow && this.manifestConsumer !== null;
+    if (tool_grants === OWNER_DM_DEFAULT_READ_GRANTS || tool_grants === RELAYED_VOICE_GRANTS) {
+      const eligible = relaySpeakerId === void 0 && opts.ownerVerdict?.kind === "verified" && manifest?.owner_dm_channel_id === channelId && boundNow && this.manifestConsumer !== null && tool_grants !== RELAYED_VOICE_GRANTS;
       const r = effectiveToolGrants({
         audience: "owner_dm",
-        base: OWNER_DM_DEFAULT_READ_GRANTS,
+        base: tool_grants,
         manifest,
         eligible,
         manifestSwitchOn: this.ownerDmManifestGrants,
@@ -41396,6 +41639,7 @@ var BridgeAgent = class _BridgeAgent {
     const acked = [];
     for (const m of entries) {
       try {
+        if (m.voiceMode === false) this.callBuffer.reset(m.channelId);
         const encId = m.envelope.enclave_id;
         if (encId && !this.channelEnclaveRecorded.has(m.channelId)) {
           this.channelEnclaveRecorded.add(m.channelId);
@@ -41553,6 +41797,7 @@ var BridgeAgent = class _BridgeAgent {
           continue;
         }
         if (typeof parsed.text === "string") {
+          if (parsed.text.trim() === VOICE_CALL_START_MARKER) this.callBuffer.reset(m.channelId);
           const meta = this.freshMeta(m.channelId);
           const senderType = m.envelope.sender_type;
           const senderIsAgent = senderType === "agent" ? true : senderType === "human" ? false : void 0;
@@ -41594,23 +41839,39 @@ var BridgeAgent = class _BridgeAgent {
             const senderName = this.freshRoster(m.channelId)?.get(
               m.envelope.sender_id
             )?.name;
+            const voiceScoped = isVoiceScopedTurn({
+              speaker,
+              transcribed: parsed.transcribed,
+              senderIsRelay: this.freshRoster(m.channelId)?.get(m.envelope.sender_id)?.is_relay === true,
+              text: parsed.text
+            });
             const ownerVerdict = await this.verifyOwnerTurn(m);
             const turnAuthorization = await this.authorizeTurn(
               m.channelId,
               m.messageId,
               m.envelope.sender_id,
               ownerVerdict,
-              speaker?.identityId
+              speaker?.identityId,
+              voiceScoped
             );
             await this.prepareNotesForTurn(m.channelId, turnAuthorization);
-            const runtimeMemory = this.memoryForTurn(m.channelId, m.messageId, turnAuthorization);
             const voiceGuidance = m.voiceMode ? selectVoiceGuidance(meta?.is_dm, m.voiceDefaultResponder) : void 0;
             const humanTurn = senderIsAgent !== true || speaker !== void 0;
-            const fastPathEligible = Boolean(m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
+            const fastPathEligible = Boolean(voiceScoped && m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
             const turnText = parsed.text;
             const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
             const windowEligible = voiceWindowEligible({ voiceMode: m.voiceMode, speaker, transcribed: parsed.transcribed, voiceGuidance, isCallStart });
             const coalescible = this.voiceCoalesceWindowMs > 0 && windowEligible;
+            const callPeer = admitsToCallBuffer({ speaker, transcribed: parsed.transcribed });
+            let voiceSnapshot;
+            if (voiceScoped) {
+              this.callBuffer.markVoiceScoped(m.channelId, m.messageId);
+              if (!coalescible) {
+                voiceSnapshot = this.takeVoiceSnapshot(m.channelId, m.messageId);
+                if (callPeer && !this.isOwnerVerifyFailed(m.messageId)) this.callBuffer.appendPeer(m.channelId, parsed.text, m.messageId);
+              }
+            }
+            const runtimeMemory = this.memoryForTurn(m.channelId, m.messageId, turnAuthorization, void 0, voiceScoped ? { snapshot: voiceSnapshot } : void 0);
             if (!coalescible) {
               const kind2 = m.voiceMode === true || parsed.transcribed === true ? "voice" : "text";
               if (this.unifiedOn) await this.prepareUnifiedForTurn({ channelId: m.channelId, messageId: m.messageId, text: parsed.text, authorization: turnAuthorization, kind: kind2 });
@@ -41626,7 +41887,9 @@ var BridgeAgent = class _BridgeAgent {
             const fastGreeting = isCallStart && fastPathFiring;
             const runtimeVoice = (ackSent) => m.voiceMode ? {
               voice: true,
-              guidance: ackSent ? `${voiceGuidance} ${FAST_PATH_SPOKEN_GUIDANCE}` : voiceGuidance
+              // Task 6 (OQ-3): a voice-scoped frame's guidance ends with VOICE_CALL_CLAUSE, on all three frames
+              // (held, coalesced after-ack, after-ack); a typed turn during a call keeps its guidance.
+              guidance: `${ackSent ? `${voiceGuidance} ${FAST_PATH_SPOKEN_GUIDANCE}` : voiceGuidance}${voiceScoped ? ` ${VOICE_CALL_CLAUSE}` : ""}`
             } : {};
             const runtimeEntry = (ackSent, memory) => ({
               channel_id: m.channelId,
@@ -41647,6 +41910,7 @@ var BridgeAgent = class _BridgeAgent {
               // identify: the envelope's own claim (relay or on-device
               // transcript) or a relay-attributed turn.
               ...parsed.transcribed === true || speaker !== void 0 ? { transcribed: true } : {},
+              ...voiceScoped ? { voice_scoped: true } : {},
               ...runtimeVoice(ackSent)
             });
             if (coalescible) {
@@ -41676,6 +41940,7 @@ var BridgeAgent = class _BridgeAgent {
                 acked.push(m.queueId);
                 continue;
               }
+              const bufferGeneration = this.callBuffer.generation(m.channelId);
               const held = runtimeEntry(false, await runtimeMemory);
               if (!await this.stageHeldRuntimeMessage(held)) continue;
               this.noteVoiceCoalesced(m.messageId);
@@ -41686,7 +41951,8 @@ var BridgeAgent = class _BridgeAgent {
                 closed: false,
                 pending: Promise.resolve(),
                 purgeEpoch: purgeEpochAtReceipt.get(m.channelId),
-                itemCapture: itemCaptureAtReceipt.get(m.channelId)
+                itemCapture: itemCaptureAtReceipt.get(m.channelId),
+                bufferGeneration
               };
               this.voiceCoalescing.set(windowKey, win);
               const openedAt = Date.now();
@@ -41702,9 +41968,18 @@ var BridgeAgent = class _BridgeAgent {
                 const [firstId, ...tailIds] = win.ids;
                 if (tailIds.length) this.voiceCoalescedTails.set(firstId, tailIds);
                 const text = win.parts.join(" ");
+                const sameCall = this.callBuffer.generation(channelId) === win.bufferGeneration;
+                const anyFragmentVerifyFailed = win.ids.some((id) => this.isOwnerVerifyFailed(id));
+                let windowSnapshot;
+                if (sameCall) {
+                  this.callBuffer.markVoiceScoped(channelId, firstId);
+                  windowSnapshot = this.takeVoiceSnapshot(channelId, firstId);
+                }
+                if (callPeer && sameCall && !anyFragmentVerifyFailed) this.callBuffer.appendPeer(channelId, text, firstId);
                 if (this.unifiedOn) await this.prepareUnifiedForTurn({ channelId, messageId: firstId, text, authorization: turnAuthorization, kind: "voice" });
                 else await this.prepareRecallForTurn({ channelId, messageId: firstId, text, authorization: turnAuthorization, kind: "voice" });
-                const merged = { ...held, text };
+                const windowMemory = await this.memoryForTurn(channelId, firstId, turnAuthorization, void 0, { snapshot: anyFragmentVerifyFailed ? void 0 : windowSnapshot });
+                const merged = { ...held, text, memory: windowMemory };
                 if (this.unifiedOn) {
                   const snap = win.itemCapture ?? { ...this.store.itemCapture(channelId), purgeEpoch: -1 };
                   const work = this.tapUnifiedVoice(merged, { stamp: this.ingestGeneration.get(firstId), capture: { ...snap, purgeEpoch: win.purgeEpoch ?? -1 } });
@@ -41732,7 +42007,7 @@ var BridgeAgent = class _BridgeAgent {
                 const release = this.reserveFastReply(channelId);
                 try {
                   await this.speakAndSettle(
-                    { channelId, messageId: firstId, senderId, authorization: turnAuthorization },
+                    { channelId, messageId: firstId, senderId, authorization: turnAuthorization, voiceScoped: voiceScoped && sameCall, voiceSnapshot: windowSnapshot, anyFragmentVerifyFailed },
                     plan,
                     merged,
                     { ...merged, ...runtimeVoice(true) },
@@ -41764,7 +42039,9 @@ var BridgeAgent = class _BridgeAgent {
                   channelId: m.channelId,
                   messageId: m.messageId,
                   senderId: m.envelope.sender_id,
-                  authorization: turnAuthorization
+                  authorization: turnAuthorization,
+                  voiceScoped,
+                  voiceSnapshot
                 };
                 const guidanceForFast = voiceGuidance;
                 const greeting = fastGreeting;
@@ -44033,10 +44310,13 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       sendJson(sock, wsErrorFrame("invalid_request"));
       return;
     }
+    const record = typeof m.in_reply_to === "string" ? inflight.get(m.in_reply_to) : void 0;
+    const callBufferReply = session.consumer === "runtime" && session.perToolGrants === true && session.harnessClaimed !== true && typeof m.in_reply_to === "string" && record !== void 0 && session.deliveryToken.get(m.in_reply_to) !== void 0 && record.channel_id === m.channel_id && !agent.isRuntimeMessageRetired(m.in_reply_to);
     const sendOpts = {
       agentTurn: isAgentTurn(agent, m),
       ...typeof m.in_reply_to === "string" ? { inReplyTo: m.in_reply_to } : {},
-      ...typeof m.idempotency_key === "string" ? { idempotencyKey: m.idempotency_key } : {}
+      ...typeof m.idempotency_key === "string" ? { idempotencyKey: m.idempotency_key } : {},
+      ...callBufferReply ? { callBufferReply: true } : {}
     };
     if (m.a2a && typeof m.a2a === "object") {
       const a = m.a2a;