# ADR-0084: Eve governed asynchronous voice depth

- Status: accepted for Phase 8 Task 8.7
- Date: 2026-09-12
- Owners: Eve Product, Privacy, Accessibility, Web, and Evaluation
- Scope: customer-web asynchronous voice input and opt-in spoken replies

## Context

Eve already shipped microphone capture, VAD auto-stop, server STT with browser
recognition fallback, transcript review in the text composer, opt-in TTS, and
captions. Task 8.7 asks for a depth decision based on that path. It expressly
forbids rebuilding the microphone/TTS lane and requires evidence for controls,
interruption, privacy, accent/noise/empty audio, and text fallback.

The source review found real depth but four consequential seams: starting a new
capture did not interrupt current playback, capture/transcription did not state
where audio was or when it crossed a provider boundary, an active recorder was
not cancelled when the panel unmounted, and recognition forced `en-US` instead
of respecting the browser locale. Low-confidence results also lacked a visible
review cue, and the transcript response did not explicitly opt out of caches.

## Decision

Harden and retain the existing asynchronous, review-before-send contract.
Decline a live-duplex/realtime redesign for this task.

The admitted contract is:

1. Start with the shipped server-STT capture and fall back to browser speech
   recognition only when the server path is unavailable.
2. Keep microphone state, the on-device-before-stop boundary, and provider or
   browser transcription state visible in the existing bounded assistant
   surface.
3. Put recognized words in the authoritative text composer. Never submit a
   transcript without member review and an explicit Send.
4. Respect the browser's preferred locale, warn when the provider reports low
   confidence, and make empty/error states recover to text without data loss.
5. Keep voice output opt-in, visibly labelled as synthetic, captioned alongside
   the written reply, and stoppable. Starting the microphone is also a barge-in
   gesture that stops active server audio or browser speech before capture.
6. Cancel recording/recognition on teardown. Do not cache transcript responses;
   do not log audio or provider response bodies; delete private normalization
   files on every server exit.

## Admission evidence

The checked-in live measurement calls the shipped OpenRouter
`microsoft/mai-transcribe-2` binding with four reproducible speech fixtures and
one silence fixture, repeated three times each. Every speech sample must be
non-empty and inside its per-case word-error budget, every silence sample must
stay empty, and nearest-rank p95 across all 15 calls must be at most 5 seconds.

The decision also requires component/route tests, a real Chromium capture and
playback journey, fault/recovery coverage, a privacy review, and an eight-part
operator rubric. Machine verification binds those results to the current source
and observes deliberate red controls before the final green result.

## Consequences

- Voice remains a reversible input/output aid around the text conversation, not
  a second conversation protocol.
- There is no always-listening mode and no automatic transcript submission.
- Browser synthesis exposes approximate word captions; server TTS exposes the
  exact written reply as a plain caption because the provider supplies no audio
  timing contract. Timings are never fabricated.
- Synthetic accents make the quality probe reproducible but do not establish
  demographic accent fairness. A consented-human-speech study remains a future
  product-research responsibility if voice scope expands.
- Manual assistive-technology interoperability remains Task 8.8. Mobile voice
  parity remains Task 8.9. Phase 8 and G9 remain open.