A prospective client opens a page and gives their consent in writing before any voice flows: four typed fields (name, phone, email, and what the enquiry is about), a deliberate tap on call, and the operating system’s own microphone permission, all on camera. Then a voice answers by name, openly an AI, in the studio’s own register. It speaks to the stated purpose, proposes real open slots from the founders’ calendar, reads the chosen slot back, and books only on an explicit yes. The moment the booking lands, a calendar event reaches both sides and a confirmation email reaches the caller’s phone while the call is still open. On screen, an orb breathes with the agent’s voice. This is an internal research preview we built in four days in June 2026, and the recording below is one continuous, uncut take of the whole flow, exactly as it ran.
transcript of the recorded demo, word for word
[the completed consent form is on screen: name, phone, email, purpose of
enquiry. the caller taps call and grants the microphone permission.]
agent: Hi Shaikh, welcome to Orfloat. How can I help with AI strategy
and advisory?
caller: Hi there, so we are a manufacturing company, we assemble electrical
components for our customers who are mainly distributors across
Oman. We are just exploring how to integrate AI in our business,
so we want to understand what Orfloat does.
agent: Got it. You're exploring how AI could fit your manufacturing
workflow and want a clear picture of how we work. Are you mainly
looking at customer-facing automation or internal operations like
scheduling and inventory?
caller: Mostly internal operations.
agent: Nice, that's a strong place to start. A short intro with the
founders can map where scheduling, inventory, and forecasting can
actually benefit from AI without over-engineering. Would you
prefer that intro as a phone call, a video call, or in person?
caller: Video call.
agent: Sure! Let me check the founders' calendar for the next few days.
I can do Sunday at 11am, Monday at 10am, or Tuesday at 9am Muscat
time. Which one suits you?
caller: Monday 10am.
agent: That's Monday, June 15th, at 10am Muscat time on a video call.
Shall I lock that in?
caller: Yes, please.
agent: Perfect! I'll lock that video slot down. You're all set! Invite
and confirmation email are on the way, and the founders are
looking forward to it!
caller: Thank you!
[the booking confirmation email lands on the caller's phone while the call
is still open; the screen settles on: booked, shaikh. monday 10am, muscat
time.]The form does the hard part
The single most consequential design decision is not in the audio stack. It is the four typed fields in front of the call. Voice interfaces fail worst at exactly the things a form does effortlessly: names spelled right, phone numbers exact, email addresses unambiguous. So the page captures contact before the agent says a word, and the agent never captures contact by voice at all. By the time the call opens, the agent already knows who it is talking to and why, and the read-back gate (the discipline we carry from the appointment agent) shrinks to confirming the one thing voice does reliably: a chosen slot, spoken back, answered with a yes.
That split sounds small. It removes the entire class of transcription errors that makes most voice booking flows untrustworthy, and it means the conversation starts useful instead of starting with a form read aloud.
The same gate is also the consent posture. Under Oman’s data protection law, processing personal data rides on explicit consent, and this design collects it in the most legible form there is: the caller types their own details, states their own purpose, taps call deliberately, and grants the microphone at the operating-system level, all before the agent hears a word. The demo recording shows every one of those steps on camera. Consent here is not a checkbox buried in a policy; it is the visible first act of the product.
Native speech-to-speech, chosen deliberately
The lab’s default posture is cascaded: a text model in the middle, speech recognition in front, synthesis behind. This preview is the deliberate exception. The agent runs on a native speech-to-speech realtime model over WebRTC: audio in, audio out, one model holding the conversation, with barge-in handled by semantic voice-activity detection rather than by us. We hold the model on a short leash: reasoning effort low (latency is the product in a phone call), a hard backstop on output tokens per turn, and a byte-stable instruction head (persona, rules, the studio’s canonical answers) with only the caller’s four fields appended per call, so the prompt stays cacheable and the call opens fast.
The browser holds the conversation; the server holds the keys. The page never sees a long-lived credential: the backend mints a short-lived ephemeral key per call, the browser connects directly to the model with it, and media never transits our server. The two tools the model can call (check availability, book the slot) are thin proxies back to our API. The model decides when to call them. Our code decides what they are allowed to do.
The orb is the one flourish, and even it is evidence: it is driven by the agent’s output audio, tapped from the playback element, so what you see moving is literally the voice you hear.
The boring parts, enforced in code
Nothing consequential in this agent is trusted to the prompt. The booking write lives behind a server-side gate: the event exists only if the calendar API returns an id, idempotency keys make a retried call book once, and every event the preview creates carries a demo prefix in its title so a real calendar never silently fills with test bookings that look real (with a sweep script that can clear them by prefix). The same pattern we keep returning to across the research room: a rule the harness enforces survives a long conversation; a rule the prompt hopes for does not.
The audio path got the same treatment. The microphone is acquired inside the call gesture but held muted until the agent’s one-line greeting starts, so the first turn is deterministic and room echo cannot fire a phantom turn before the call has properly begun. Playback stays native, never routed through the page’s audio graph, because the platform’s echo cancellation depends on it: on a phone on speaker, that is the difference between a conversation and a feedback loop.
The night the infrastructure failed
The first demo, on 10 June 2026, did not fail because of the agent. It failed because of everything around it: a key-mint request with no timeout meeting an idle-socket kill, a chain of access and tunnel layers each adding its own way to be unavailable, and a network path that filtered what the call needed. The model, the prompt, and the booking gates were fine; seven out of seven key mints succeeded the moment they ran from a stable network. The lesson was old and humbling: in realtime voice, the model is the easy dependency. The infrastructure is the product.
We rebuilt overnight. The rebase collapsed the stack onto one edge platform: a single worker serving both the page and the API from the same origin, session state in a strongly consistent durable object, and a TURN relay minted per call so the media path can fall back to TCP on port 443 where Omani carriers filter VoIP-shaped UDP. The next day the same agent ran end to end from an iPhone on Omani mobile data, and that run is the one recorded above. We are publishing the failure alongside the result because the failure is where the engineering is: the post-mortem produced the architecture.
What the live runs taught us
Three findings from running this against real air, none of which a spec sheet would have surfaced. First, voice-activity eagerness is a product decision, and a sensitive one. The eager setting had the agent crowding the caller; the conservative setting added a dead beat after every caller turn; we settled on the API’s default. Reading the documentation closely corrected our own mental model along the way: the default is not an adaptive mode (it is an alias for the middle setting), and the adaptivity that makes semantic turn-taking feel natural lives in the turn classifier itself, which scores whether the caller sounds finished. The eagerness dial tunes patience, not intelligence. Second, phantom turns are the failure mode to design against: before the turn discipline went in, room noise could convince the agent the caller had spoken, and it would cheerfully build on words nobody said (at one point booking a meeting with itself). The fix was both prompt rules (never speak twice in a row, never build on imagined words) and the mute-until-greeting handshake enforced in code. Third, the whole flow has to be rehearsable without live credentials: the entire system runs credlessly against mocks (the 59 tests run with no keys at all), so a rehearsal risks nothing and demo day holds no first-time surprises.
Why a recording, and not a live widget
A live widget on a research page is a strange artifact: it either stands open to the whole internet or sits behind a key and shows nothing. And a live call is a performance, hostage to the network, the room, and the hour. So the preview’s public face is one professionally recorded take: the real agent, the real network, the real booking, captured once. The demo is always available, to a visitor today or a prospect in a meeting next quarter, identical at every viewing and immune to demo-day conditions. This is the pattern we intend to keep as the research room grows: when a preview is ready to be seen, it gets one good recording, embedded beside the technical account, instead of a gated toy or a declared claim.
Where this honestly stands
We are not entirely happy with the result, and saying so is the point of publishing it. At moments in the recorded conversation the agent hurries itself toward the close, a cadence we have not fully tamed. The calm of a voice agent turns out to be governed jointly: the system prompt sets the temperament, but turn detection decides whether that temperament survives contact with a real caller, and the two have to be tuned together. We intend to keep iterating on the architecture until the performance is consistent, not just impressive in a good take.
The deeper lesson is that realtime voice is a discipline of trade-offs. Consistency is a countermove to adaptiveness: the more freely the agent adapts its turn-taking and reasoning to the caller, the harder it becomes to guarantee the same behavior twice. And reasoning depth trades directly against latency: the platform documents that higher reasoning effort increases response time, and its own guidance for production voice agents is to start at low effort and buy intelligence only where the workflow proves it needs it. Our settings (low effort, default turn detection) are that documented posture, not a shortcut.
It is also worth being precise about where this technology actually is. Voice bots, cascaded pipelines of speech recognition, a text model, and synthesis, have been commercially ordinary for years. What is new is the voice agent: a native audio-to-audio model holding the conversation while reliably calling tools mid-call. The cascade was removed when the native speech-to-speech generation shipped in 2025; the model this preview runs on, released in May 2026, is a leap in reasoning, instruction following, and tool-call reliability rather than in audio nativeness itself. That reliability frontier is exactly where the industry still strains: analyst houses predict that a large share of agentic AI projects will be cancelled before reaching production, and the public benchmarks that test voice agents under real conditions still place them short of consistently human-level conversation, even as raw response latency has largely been closed. The underlying generation is autoregressive over audio tokens today; diffusion and flow-matching approaches are the candidate alternatives, each trading streaming latency against output stability, and progress there belongs to the frontier labs. Our own expectation, and it is speculation we choose to label as such, is that dependably human-like realtime voice arrives over the next twelve to eighteen months; published expert timelines vary too widely to lean on.
The legal frame matters as much as the model. Oman’s data protection law has been fully enforceable since February 2026, months before this piece: explicit written consent as the default basis for processing, and cross-border transfer permitted on consent plus an assurance that the recipient protects the data to no lower a standard, with unlawful transfer sitting in the law’s heaviest penalty tier. A voice call is personal data in motion, and one nuance is worth recording: a voice recording is ordinary personal data, and only becomes regulated biometric data, with its separate permit regime, if it is processed to identify the speaker, which this agent does not do. The policy layer around AI here is still soft law (a national ethics policy in force since April 2025, no binding AI statute, and no harmonized GCC frame), and we watch its evolution closely, because how these rules mature will decide how fast an agentic economy can adopt voice.
Native audio sharpens that legal question in a way text systems never faced. A cascaded pipeline has a text bridge in the middle, and a text bridge is where anonymization, redaction, and policy filters live. A native speech-to-speech stream has no such stage: the transcription it offers runs as a parallel, asynchronous channel, a monitor rather than a gate, so nothing can scrub the live audio before the model hears it or before the synthesized reply is spoken. Engineering cannot insert the middleware, so the design has to do the work instead: capture identity in typed fields under explicit consent, keep the voice channel to the conversation itself, and gate every consequential action server-side. The form-first design in this preview is not just an ergonomic choice; it is the compliance architecture.
Infrastructure closes the loop. No hyperscaler operates a cloud region inside Oman; the one hyperscaler edge presence in Muscat is general compute, not frontier-model inference; and the realtime voice models are served with inference homed in the United States (or US and EU regions on the hyperscaler that hosts them), with media accepted at distributed edge nodes and the inference geography undisclosed. The regional data-residency options that do exist cover data at rest, not where the model runs. So a call from Muscat is a cross-border transfer by default, the consent posture above is load-bearing, and we treat the arrival of nearer inference as one of the signals we are waiting on.
All of that shapes where we would deploy this first. Our posture is internal operations before customer-facing roles, and inbound-only where it is customer-facing. The inbound rule is regulation-backed: outbound AI-voice calling already requires prior express consent under the US robocall ruling of 2024, and Gulf telemarketing regimes impose their own written-consent burdens. The internal-first rule we hold as discipline rather than as analyst consensus, and honestly: the industry data shows enterprises pushing customer-facing conversational AI aggressively in parallel, so internal-first is our risk judgment, not the market’s verdict.
What transfers
The frontier moved the conversation off our plate; it did not move the engineering. A native speech-to-speech model holds a fluent, interruptible call out of the box, and that was never the part we would put in front of a business. What makes a voice agent fit to take a real call is the ring around it: contact captured by form so voice never transcribes what typing already settled, every write behind a server-side gate with idempotency and a sweepable blast radius, credentials minted short-lived and never shipped to the page, an audio path that respects the platform’s echo cancellation, and infrastructure treated as the first-class risk it proved to be. None of that is voice-specific. It is the same discipline we filed for a text agent on a CEO’s calendar, applied to a harder transport.
If your business answers the phone, takes bookings, or fields the same twenty questions every week, this preview is what embedding AI into that operation can look like when the guardrails are real. Start a conversation, and we will scope it.
References
- OpenAI. Realtime API. platform.openai.com/docs/guides/realtime
- OpenAI. Realtime API: voice activity detection. developers.openai.com/api/docs/guides/realtime-vad
- OpenAI. gpt-realtime-2. developers.openai.com/api/docs/models/gpt-realtime-2
- Sultanate of Oman. Personal Data Protection Law, Royal Decree 6/2022. decree.om/2022/rd20220006
- MTCIT. Personal Data Protection Law and Executive Regulations. mtcit.gov.om
- MTCIT. General policy for the safe and ethical use of artificial intelligence systems. mtcit.gov.om
- FCC. Declaratory ruling: AI-generated voices under the TCPA. fcc.gov
- Gartner. Over 40 percent of agentic AI projects will be canceled by end of 2027. gartner.com
- Scale AI. Voice Showdown: a real-world benchmark for voice AI. scale.com/blog/voice-showdown
- Cloudflare. Workers, Durable Objects, and TURN. developers.cloudflare.com
- W3C. WebRTC: Real-Time Communication in Browsers. w3.org/TR/webrtc
- Orfloat. A CEO’s appointment-management agent, ported from Telegram to WhatsApp. orfloat.com/research/appointment-agent