Compile complete Speech meaning through deterministic ALYT owners

The Speech result route accepts all ten semantic outcomes, the original context and compiler receipt, audio session and mode, runtime calibration, and exact runner binding. Interpretation is complete semantic data; ALYT does not recover authority from text, a phrase match, or model confidence. Runtime likelihood, margin, out-of-distribution, and audio-quality thresholds come from the current operator policy and calibration revision.

Semantic outcomes and pending plans

HOME_ACTION compiles every operation, scope, exclusion, value, and sequence before the existing deterministic validator. Absolute values preserve units, range, and step; relative and comfort requests require fresh state and an explicit household value policy. Missing, stale, omitted, or unsupported meaning prompts clarification. HOME_QUERY returns bounded fresh readings and labels unknown values. ROUTINE_MATCH resolves the current eligible installed routine and preserves its saved definition.

ALYT owns one expiring pending plan per actor, home, audio session, and execution mode. CONFIRM_PENDING, REJECT_PENDING, and MODIFY_PENDING bind the original pending reference and revision. A modification applies once, creates a new plan revision, and requires approval; it never edits the saved routine. Unsupported timing or an unrepresentable complete correction is clarified. NO_ACTION is silent; CLARIFY asks for missing meaning; PROPOSE_ACTION creates a pending plan. Authorized assistant availability controls handoff; an unavailable handoff returns an explicit unavailable answer.

Shadow, active, and outcome evidence

SHADOW sends zero effects and cannot invoke the dispatcher. ACTIVE requires its separate selected-home cohort, configured qualified artifact or model digest, and current calibration. The existing ledger persists one effect identity, approval rechecks current permission, and fenced owners execute. Sending is not physical completion: the result stays PENDING until ALYT’s existing outcome evidence confirms, partially confirms, fails, or remains unknown. Supersession or cancellation does not undo a sent effect. An uncertain retry requires original ledger reconciliation.

Microphone authority and finite sessions

An anonymous shared microphone acts as HOUSEHOLD_DEVICE, never as an identified person. DeviceService verifies its actual current broker credential and issues a signed proof lasting at most 60 seconds. TenantService resolves exactly one finite Owner grant and checks current enrollment, hardware binding epoch, enabled voice capability, issuer membership, tenant, and home. ALYT rechecks it during context admission, interpretation, approval, and the original execution fence.

The public Owner endpoints are GET, PUT, and DELETE on /properties/{propertyId}/devices/{deviceId}/voice-authority?tenantId={tenantId}. Read the current generation before PUT. Its strict body is { "expectedGeneration": null, "expiresAt": "<current ISO8601 expiry within30 days>", "controls": [{ "capability": "light", "key": "power" }], "routineIds": [] }, substituting an expiry within 30 days of the actual request and the generation just read. A null generation applies only when no grant exists. Ordinary qualified light, switch, cover, thermostat, and fan controls and actual installed routine UUIDs are finite explicit allowlists; locks and security are excluded. Hardware, names, model output, and an installer role cannot grant permission. DELETE revokes original unsent leases, while sent effects retain their original physical result. Enrollment moves, hardware changes, voice disable or settings deletion, and issuer membership withdrawal clear the grant; restoring an old binding does not resurrect it.

Placement and assistant handoff

The selected path requires PHYSICAL_AI_SPEECH_PROPERTY_IDS and the specific PHYSICAL_AI_SPEECH_HUB_PROPERTY_IDS or PHYSICAL_AI_SPEECH_PHONE_PROPERTY_IDS cohort. ACTIVE additionally requires PHYSICAL_AI_SPEECH_ACTIVE_PROPERTY_IDS and the qualified artifact and calibration policy. Empty cohorts preserve the existing path. SHADOW mirrors original input with zero effects without delaying legacy voice. ACTIVE selects exactly one dispatcher and never retries uncertain physical effects through legacy phrase matching.

An eligible YIELD_TO_ASSISTANT requires the separate PHYSICAL_AI_SPEECH_ASSISTANT_PROPERTY_IDS cohort. ASR, TTS, and ASSISTANT are independently placed in the operator-owned PHYSICAL_AI_VOICE_PROCESSING_BINDINGS registry. Original PCM becomes a bounded WAV sent to the actual Whisper /transcribe multipart interface with en or it language; only its real transcript reaches the existing provider formatter. The assistant receives no tools, household context, or physical authority. TTS uses the actual /speak interface and its bounded returned clip. Current immutable context, placement, credentials, and off-property cloudInferenceOptIn are rechecked before exports and after processing. Metadata-only AuditLog admission precedes each export; completion does not imply playback or physical success. Missing or changed placement fails closed, without automatic fallback.

Confirmation with changes

For conditional confirmations, a yes with edits must validate every change you gave, then ask you to confirm the revised plan before anything is sent. It does not run the original plan, and it does not auto-approve the edited one. If the edits are incomplete, unclear, or not supported, the pending plan stays in place and you are asked to clarify. If your edits remove all actions, the unsent plan is withdrawn. Saved routines stay unchanged.

Local voice orchestration

The installed Linux voice entrance receives faithful text from its separately placed ASR adapter. The complete bilingual router accounts for every clause, quantity, unit and exclusion using current approved names, aliases and capabilities. Exact safe requests need no neural reasoning. Complex household requests go only to the installed local reasoning adapter with bounded canonical graph facts and at most two original query receipts. Invalid model output is an explicit failure and clarification, never a physical action or automatic cloud fallback.

The additive private Linux context and result adapters reuse this controller and all ten original semantic outcomes. Exact package and model inventories, original actor, session, context digest and explicit opaque reference bindings are required. Deterministic matching has completeness evidence, not invented model likelihood. Explicit numeric relative changes preserve their units and original observation; implicit relative and comfort values still require approved household policy. Native preconditions, dependencies and uncertainty remain intact. Protected rooms and devices stay outside model discretion, and unknown occupancy does not become empty.

General-assistant escalation sends only the original text to the existing current consent and placement owner. It receives no graph or tools and performs no second transcription. Empty installation cohorts preserve the existing selected voice path. Emulator integration, model acceptance and physical target qualification are separate gates; no unqualified model-generated household effects are enabled.

Post-send receipts check current actor authority without treating the command’s own state change as stale pre-send evidence. Exact retries retrieve original owner receipts and do not redispatch; revocation and original expiry still apply.

The internal Speech result route accepts all ten semantic outcomes, the original context and compiler receipt, audio session and mode, runtime calibration and exact runner binding. Interpretation is complete semantic data; ALYT does not recover authority from text, a phrase match or model confidence. Runtime likelihood, margin, out-of-distribution and audio-quality thresholds come from the current operator policy and calibration revision.

HOME_ACTION compiles every operation, scope, exclusion, value and sequence before the existing deterministic validator. Absolute values preserve units, range and step; relative and comfort requests require fresh state and an explicit household value policy. Missing, stale, omitted or unsupported meaning prompts clarification. HOME_QUERY returns bounded fresh readings and labels unknown values. ROUTINE_MATCH resolves the current eligible installed routine and preserves its saved definition.

ALYT owns one expiring pending plan per actor, home, audio session and execution mode. CONFIRM_PENDING, REJECT_PENDING and MODIFY_PENDING bind the original pending reference and revision. A modification applies once, creates a new plan revision and requires approval; it never edits the saved routine. A confirmation carrying modifications follows the same complete modification validation, produces a fresh unapproved pending revision, and requires confirmation of that revised plan. It never dispatches the original plan or inherits approval from the conditional answer. Every supplied exclusion, original-component cancellation, value override, added operation and replacement operation is validated together. If any complete edit is unsupported or ambiguous, clarification preserves the original pending plan and sends no effect. Modifications attached to rejection, deferral or replacement-action outcomes are ambiguous and clarify instead of being silently ignored. Unsupported timing or an unrepresentable complete correction is clarified. NO_ACTION is silent; CLARIFY asks for missing meaning; PROPOSE_ACTION creates a pending plan. Authorized assistant availability controls handoff; an unavailable handoff returns an explicit unavailable answer.

SHADOW sends zero effects and cannot invoke the dispatcher. ACTIVE requires its separate selected-home cohort, configured qualified artifact and model digest, and current calibration. The existing ledger persists one effect identity, approval rechecks current permission, and existing fenced owners execute. Sending is not physical completion: the result stays PENDING until ALYT’s existing outcome evidence confirms, partially confirms, fails or remains unknown. Supersession and cancellation do not undo a sent effect. An uncertain retry requires original ledger reconciliation.

Explicit microphone authority and current session boundaries

An anonymous shared microphone acts as HOUSEHOLD_DEVICE, never as an identified person. DeviceService verifies its actual current broker credential and issues a signed proof lasting at most 60 seconds. TenantService resolves exactly one finite Owner grant and checks current enrollment, hardware binding epoch, enabled voice capability, issuer membership, tenant and home. The private actor has empty human membership maps. ALYT rechecks it during context admission, interpretation, approval and the original execution fence.

The public Owner endpoints are GET, PUT and DELETE /properties/{propertyId}/devices/{deviceId}/voice-authority?tenantId={tenantId}. Read the current generation before PUT. Its strict body is { "expectedGeneration": null, "expiresAt": "<current ISO8601 expiry within 30 days>", "controls": [{ "capability": "light", "key": "power" }], "routineIds": [] }, substituting an expiry within 30 days of the actual request and the generation just read. A null generation applies only when no grant exists. Ordinary qualified light, switch, cover, thermostat and fan controls and actual installed routine UUIDs are finite explicit allowlists; locks and security are excluded. Hardware, names, model output and an installer role cannot grant permission. DELETE revokes original unsent leases, while sent effects retain their original physical result. Enrollment moves, hardware changes, voice disable and settings deletion, and issuer membership withdrawal clear the grant; restoring an old binding does not resurrect it.

The selected path requires PHYSICAL_AI_SPEECH_PROPERTY_IDS and the specific PHYSICAL_AI_SPEECH_HUB_PROPERTY_IDS or PHYSICAL_AI_SPEECH_PHONE_PROPERTY_IDS cohort. ACTIVE additionally requires PHYSICAL_AI_SPEECH_ACTIVE_PROPERTY_IDS and the qualified artifact and calibration policy. Empty cohorts preserve the existing path. SHADOW mirrors original input with zero effects without delaying legacy voice. ACTIVE selects exactly one dispatcher and never retries uncertain physical effects through legacy phrase matching. Phone calls retain the original user session; device calls retain the signed microphone actor. Audio sessions are finite nonsliding 60-second scopes, never cross actors, homes or token families.

An eligible YIELD_TO_ASSISTANT requires the separate PHYSICAL_AI_SPEECH_ASSISTANT_PROPERTY_IDS cohort. ASR, TTS and ASSISTANT are independently placed in the operator-owned PHYSICAL_AI_VOICE_PROCESSING_BINDINGS registry. Original PCM becomes a bounded WAV sent to the actual Whisper /transcribe multipart interface with en and it language; only its real transcript reaches the existing provider formatter. The assistant receives no tools, household context or physical authority. TTS uses the actual /speak interface and its bounded returned clip. Current immutable context, placement, credentials and off-property cloudInferenceOptIn are rechecked before exports and after processing. Metadata-only AuditLog admission precedes each export; completion does not imply playback or physical success. Missing or changed placement fails closed, without automatic fallback.

The Linux entrance adds four internal-only adapters across Tenant, HomeAgent and AI Gateway. It adds no public developer or app route or SDK operation; existing production voice stays selected until the replacement installation qualifies.

The installed router is verified against its immutable source inventory; a different artifact, context or withdrawn authority cannot admit an action.

A negotiated local routine profile is reacquired from its original source after replay even when event inference is disabled. Cached invalid profiles are never rebound or treated as new authority. The current working production voice selection is preserved.

The qualified Linux entrance preserves the current production selection until replacement qualification. Original snapshot and routine-profile reacquisition after replay is distinct from renewing cached permission.

Publication wording must distinguish original profile reacquisition from cached authority and preserve the installed qualified-profile condition.

Negotiated pending amendments

The installed Linux router uses alyt.pending-amendment-choice/1.0.0 for exact absolute OVERRIDE_VALUE edits to current pcN pending components. VOICE_CAPTURE supplies dialogue.pending_proposal, original plan revision, original target refs and units; private immutable IDs remain in ALYT. GRAPH_ONLY lacks that descriptor. The existing private /turn and /audio paths remain unchanged. A qualified model adapter selects /pending-amendment for an edit interpretation; its body is the original transcript. Pending presence alone never reroutes other requests. No source selector, replay, profile-reacquisition or replacement CLI is defined by this interface. Original source snapshot/routine-profile reacquisition after replay is an owner API behavior, not a guessed command.

/tokenize-pending-amendment returns alyt.pending-amendment-token-count/1.0.0 for this exact prompt and template and selected artifact and view; native /tokenize-view counts cannot certify it. /reason-pending-amendment returns alyt.pending-amendment-model-reply/1.0.0, binding original requestId and selected modelArtifactSha256, bounded outputTokens and explicit choice. A strict UNAVAILABLE choice covers unsupported whole edits or ambiguous values without pending mutation. Cancellation, exclusion and mixed media requests must not be reduced to partial absolute edits. Model calls, refusals, raw outputs and original source failures remain separate from learned-goal or physical qualification.

The original authenticated controller consumes POST /internal/physical-ai/properties/:propertyId/linux-voice-pending-amendment with tenantId. PHYSICAL_AI_LINUX_PENDING_AMENDMENT_PROPERTY_IDS, original Linux selection and installed policy are required; unset remains disabled. SHADOW is the default. ACTIVE staging additionally requires PHYSICAL_AI_LINUX_PENDING_AMENDMENT_ACTIVE_PROPERTY_IDS, the original active Speech cohort and explicit operator pendingAmendmentActive: true. It replaces only an unsent original ledger proposal with a new unapproved revision. Neither mode approves or dispatches; later exact confirmation uses original authority, approval, fencing and physical-result owners. Begun attempts cannot be replaced.

ALYT rebinds the complete original pending plan, preserves independent guards and direct dependency semantics or refuses atomically, and retains untouched operations. Stale revision, source or actor, unsupported component, unit, range, step, unresolved exclusions or unpreservable DAG leave the old plan unchanged. The preservation requirement stays on the staged plan for subsequent edits. Existing native/source-choice1.0.0 and Speech contracts, public SDK operations and the currently selected production voice remain unchanged by this optional profile.