Production voice and chat agents
that are measured,
not demonstrated.

Financials and News agents fan out in parallel on Claude Haiku 4.5, pulling live price, fundamentals and headline sentiment through tools. A Risk agent flags key risks using RAG over the company's SEC EDGAR 10-K. A Writer drafts thesis, bull and bear case and rating; a Critic on Claude Sonnet 5 approves or returns structured feedback for one capped revision.

Then the Verifier re-fetches live data and fact-checks every figure — emitting find/replace patches rather than prose, which a deterministic Finalize node applies with no LLM call. That design is the point: a model that rewrites a memo to "fix" it can also quietly destroy it. Patches can only change what they name.

Every figure comes from a tool. The verifier exists because an LLM that writes "revenue grew 12%" is not the same as one that checked.

The same tools are exposed as a standalone FastMCP server, so the research capability is reusable outside the UI.

Measured against an adversarial harness

Metric	NVDA	AAPL	How it's measured
Numeric accuracy	94%	96%	every figure regex-extracted, matched against tool data
Verifier catch-rate	4/4	4/4	numeric errors deliberately planted in the memo
Critic catch-rate	100%	100%	sabotaged memos must be rejected
Latency	37s	54s	full 7-node run, end to end
Cost	$0.068	$0.090	tokens tracked per LLM call via a LangChain callback

Per-agent cost attribution exposed where the spend actually was. Routing the fan-out to Haiku and keeping Sonnet for the Critic cut cost 27% and latency 24% with the catch-rate unchanged — the kind of result you can only get by measuring per agent rather than per run.

A guard that runs before any model call

A guard sub-workflow runs before any model call and before anything is stored. It masks emails, phones, Luhn-checked card numbers, Aadhaar, PAN and secrets into typed tags, flags prompt injection, and fails closed.

In a live test the model ignored an injected instruction but did not request review. The guard did. That is the argument for not putting safety inside the thing you are trying to make safe.

Three layers against hallucinated answers

A similarity score gate, a grounded prompt, and a code check that the SOP the model cited was genuinely among those retrieved. Retrieval accuracy improved from 7 of 8 to 9 of 9 across two gate revisions — each revision driven by a real failure, including a live P1 ticket that scored just under the previous threshold.

Permissions the model cannot talk its way around

The HR agent scopes retrieval with a Pinecone metadata filter built in code rather than by the model — by country, audience and policy status. Identity is kept outside the model too: the requester's email is read from the verified session, never from a tool argument, and no tool can approve, close or delete.

Eval	Result	Note
HR retrieval with metadata filter	14/14	failures without it included wrong-country answers and manager-only guides leaking to non-managers
HR retrieval without the filter	6/14
Classifier, 20 labelled tickets	18/20 category · 17/20 priority	every miss on the safe side — no risky ticket skipped review
SOP retrieval	9/9	including two that must return "no match"

Human approval, idempotency, and a phone call that never rings twice

Anything risky waits in Slack for approval with timeout escalation. Intake is idempotent on a key derived from the ticket. P1 incidents email the on-call engineer and place a phone call that is never retried, on purpose, so the phone cannot ring twice.

The voice agent confirms who answered before it will say anything about the incident — a wrong number hears only "sorry to disturb you, I will try again later" — then reads the alert word for word, takes the engineer's reply, and writes it back to Postgres while the call is still open.

The model classifies and code decides. The router is roughly 200 lines of plain Python covered by 26 tests that run with no Azure calls and no mocks.

That is not an aesthetic preference. Every routing decision becomes a logged value instead of a hidden step inside a model, and the rule "a safety issue always reaches escalation" is an if statement. An if statement does not drop a safety rule under competing instructions.

A failure that changed the retrieval design

A confident brake-safety answer once shipped without ever calling retrieval. Retrieval became hybrid over 370 chunks with reciprocal rank fusion — and more importantly, the eval suite was rewritten to score the execution trace rather than the prose. Judging the words would have passed that answer. Judging the trace catches it. The suite went from 6 of 16 cases passing to 16 of 16.

Latency came down from 20.1s to 11.9s, and the whole environment is Terraform across 17 resources.

Lead capture, call history and configuration, with phone-number normalisation across input formats, duplicate rejection and a persistent do-not-call list — the unglamorous parts that decide whether a CRM is trusted or worked around.

The voice agent

An outbound agent on ElevenLabs Conversational AI over Vobiz SIP telephony, qualifying inbound interest and capturing use case, quantity and preferred contact channel.

It agrees callbacks explicitly — reading the date and time back to the person before saving it — then resumes the thread on the return call. Confirming before writing is the same rule as the healthcare portal: the model proposes, the write happens after a human says yes.

An auto-dialler is in development, and the operational limits were designed in from the start rather than bolted on: a 9am–9pm IST calling window, concurrency capped at two, retries after three hours to a maximum of three attempts, incomplete calls flagged for review, and the dialler disabled by default.

A dialler that is off unless someone deliberately turns it on is a different product from one that is on unless someone stops it.

WhatsApp runs alongside it, including coexistence — the webhook receives echoes of messages a rep sends from the WhatsApp Business app on their own phone, so the CRM thread matches what the customer actually sees. New numbers become leads automatically.

Built in TypeScript on Node with an OpenAI vision and voice front end. It acts as an MCP client against Swiggy Instamart and Zepto over OAuth 2.1 with PKCE, using structured outputs to classify every match as same, substitute or none.

The model is never given the checkout tool. It can only propose an order; the purchase runs as plain code after the owner replies YES.

That is the same boundary as the booking write in the healthcare portal and the callback in the Moo's Farm voice agent. An agent that can spend money without a human turn is not a feature, it is an incident waiting for a cause.

A Vite + React single-page site with a live chat widget. The interesting part is not the site — it is that it started inside a no-code builder and was migrated out onto a repo, a build pipeline and a custom domain, so it could be versioned, reviewed and deployed like anything else.