Portfolio voice contract

Moved from the roadmap. Status: Planned.

Every global, optional Workspace/Project coordinator, worker and ordinary Session has a text composer plus a capability-aware voice control. A typed or spoken message addresses the visible exact Session; global routing occurs only when explicitly requested in an authorized global scope. Starting voice in a worker chat does not wake a coordinator or create a second durable chat. Keep one active capture target per client; changing Session while speaking must stop/close or explicitly rebind capture, never silently send the unfinished turn elsewhere. Typed send and voice finalization share a target-bound client turn identity. Same key + same actor/Session/normalized payload returns one receipt; same key + different payload is a conflict with no second send/start. A correction after submission is a separately authorized new instruction, not a changed retry. DF-18 races both identical and differing text/speech payloads. Drafts and pending previews remain target-bound.

Only deliberately submitted messages/normalized operations reach the Session, where the Node keeps their trace and holds content only in transit (D-168). Unsubmitted typed/dictated drafts are target-bound client memory, not Node history, audit content, disk drafts, or worker/evaluator input. Capturing speech may transmit it to the selected speech provider under explicit voice data consent; that does not authorize further draft export or passive transcript retention. Partial speech, raw audio and full transcripts are not silently stored; full transcript persistence remains opt-in. Dictation may be edited before send. Provider/audio failure preserves in-memory drafts where possible, closes owned media and never automatically resends. Renderer crash may lose unsent drafts; report that loss instead of persisting them covertly. Submitted history recovers from the Node's trace and the harness's transcript (D-168); receipts from the Node.

1. V0 — understand and inspect: explicit foreground capture or synthetic transcript → exact authorized candidate lookup → resolve/clarify → bounded portfolio read → grounded response with freshness and target labels. One global conversation may span authorized Workspaces; detailed worker history is retrieved only when needed. Duplicate names and “that worker” require unambiguous prior identity, not guesses based on the last UI click.
2. V1 — act: produce a proposal using already qualified operation contracts. Resolve phrases such as “pause work in both Workspaces” to a frozen, bounded list of exact eligible targets. Display Workspace/Project/server, operation, expected effects, revisions, expiry and any exclusions before trusted confirmation. One proof authorizes one registered operation ID with its exact normalized input and supported frozen target set. Different operations require separately bound proofs/confirmations; a multi-Project request is not a shared proof or new batch operation. Exceeding the bound requires explicit smaller selections. No generic all or hidden automatic mutation pagination.
3. V1 — reconcile: a confirmed multi-target composition has separate receipts and visible partial outcomes, not an invented distributed transaction. Keep the original keys after disconnect; never repeat work on a revised transcript or an inferred “yes.” “Stop talking” stops playback; “cancel the reviewer” is exact worker control. Stop-capture and safety controls never wait for Jev.
4. V2 — qualify real speech: test actual microphone/speaker, interruption, ambiguous names, noisy speech, corrections and network loss on approved devices/providers. No raw audio retention; separate optional transcript content from minimal redacted operation/audit records. Visible recording state, permission denial and text/CLI fallback are mandatory.

Current human-only confirmations still require a trusted screen/CLI gesture. Fully hands-free consequential approval is not promised. A future accessible trusted alternative needs its own reviewed identity/consent contract; voice-model output cannot mint proof. Revocation or any changed target invalidates a preview.