Feature index
Every capability in the system, one line each, with a link to where it is documented in depth. If it is not on this page, Elle does not do it.
Voice conversation
| Feature | What it does | Where |
|---|---|---|
| Instant greeting | Deterministic opening line the moment the call connects; no LLM round-trip, no dead air | Voice pipeline |
| Uninterruptible greeting | Three coordinated layers guarantee the opening message always plays to the end | Voice pipeline |
| Sentence streaming | Elle starts speaking the first finished sentence while the rest is still generating; ≈1s to first word | Voice pipeline |
| Barge-in | Callers interrupt mid-sentence; one turnSeq increment cancels LLM, TTS, and playback together | Voice pipeline |
| Echo suppression | Elle's own line-echo never registers as caller speech; exact matching mid-call, loose matching during the greeting only | Voice pipeline |
| Utterance merging | A caller talking in bursts gets one coherent answer, not stacked replies; one LLM call instead of several | Voice pipeline |
| Drift-corrected pacing | Audio ships to Twilio in exact 20 ms frames on a wall-clock schedule; no stutter, no slur | Voice pipeline |
| Turn-failure recovery | A provider hiccup gets one fast retry, then a spoken apology in the caller's language; the call never drops | Voice pipeline |
| Warm TTS sockets | One WebSocket per voice for the whole call, pre-warmed while the LLM thinks | Voice pipeline |
Languages
| Feature | What it does | Where |
|---|---|---|
| Bilingual calls (EN/ES) | Code-switching STT tags every word; the caller changes language mid-sentence and Elle follows | Bilingual mode |
| Per-language house voice | English and Spanish Aura voices, chosen per reply chunk; Spanish socket connects lazily | Bilingual mode |
| Greeting invite | The greeting closes with one Spanish sentence, spoken by the Spanish voice | Bilingual mode |
| Mirror rule | One persona instruction keeps every reply in exactly the caller's language, on every channel | Bilingual mode |
Knowledge and persona
| Feature | What it does | Where |
|---|---|---|
| Grounded answers | Everything about the owner comes from the markdown knowledge base; anything absent is 'I don't know' | Data and knowledge |
| BM25 retrieval | Lexical RAG with no vector database; instant, offline, debuggable by reading | Data and knowledge |
| Inline grounding on the phone | The whole knowledge base rides the (cached) prompt, removing a retrieval round-trip per turn | Cost engineering |
| Caller memory | Per-number facts recalled on the next contact, on any channel | Database |
| Identity hard rule | Stored notes are never the current speaker's identity; no name until stated in this conversation | Booking |
Booking and SMS
| Feature | What it does | Where |
|---|---|---|
| Tentative booking | Free/busy-checked calendar holds, explicitly pending until the owner confirms | Booking |
| Verbal SMS consent | Full carrier-required consent script spoken on-call; a clear yes triggers the confirmation text and the audit ledger | Booking |
| Bookings by text | The SMS agent checks, reschedules, and cancels bookings conversationally | Channels |
| Owner-directed outreach | The owner names a person and topic on the private channel; Elle sends a compliant first text and recognizes the reply | Channels |
Web
| Feature | What it does | Where |
|---|---|---|
| Website chat | Same brain and grounding as the phone, embedded on the owner's site | Channels |
| Live call pairing | A spoken code joins a browser: transcripts stream both ways in real time | Channels |
| Typed input into calls | Messages typed in the paired browser become spoken turns Elle answers out loud | Channels |
| On-screen visuals | show_work and show_choices put screenshots and tappable options on the paired screen | Channels |
Operations and control
| Feature | What it does | Where |
|---|---|---|
| Runtime architecture switch | The owner flips cascade/demo voice stacks from the private channel; takes effect next call, survives restarts | Architecture |
| Prompt caching (3 layers) | Cross-call static block, per-call conversation breakpoint, turn batching; ~85% off the LLM line | Cost engineering |
| Owner call report | "Has anyone called?" on the private intake channel returns each call with duration, repeat-caller history, per-call notes, and any booking | Channels |
| Live status probes | /admin/status proves Calendar and the intake bot actually work, not just that they are configured | Operations |
| Call log with transcripts | /admin/calls answers 'who called?' without log spelunking | Operations |
| Token telemetry | [llm] lines log input/cacheRead/cacheWrite/output per call; caching is verified, not assumed | Cost engineering |
| Offline verification suites | Seven fake-backed suites assert the orchestration before any deploy | Code reference |
| Call recording (off by default) | App-side stereo WAV + transcript sidecar to GCS; consent-first | Compliance |
Protection
| Feature | What it does | Where |
|---|---|---|
| Webhook signatures | Every Twilio webhook validated; forgeries dropped | Security |
| Media-stream token | The raw audio socket requires a fresh HMAC token minted per call | Security |
| API rate limits | Per-IP windows on chat and pairing; message length caps | Security |
| Repeat-caller tiers | Normal → limited → blocked by call count; blocked calls never start the paid pipeline | Security |
| Silent-call hangup | A caller who says nothing for 75s (a robocall probe) is disconnected | Security |
| Global duration cap | No call can exceed the ceiling (default 10 min); autodialers cannot run an open-ended bill | Security |
| Two-gate owner channel | Secret header plus owner-id allowlist; everyone else is silently dropped | Security |
| Timing-safe admin | Owner views 404 without the token; comparison closes the timing channel | Security |