What Voice currently provides
Voice records local call events, failure reports and remote recording/transcript/voicemail URL metadata. Its thirteen published actions do not place or answer calls, bridge provider connections, configure telephony credentials, record audio, generate transcripts or host remote artifacts.
Discover the correct identity and workspace
Auth owns canonical workspace identity and grants. Bootstrap returns user/organization projections only. Discover a granted Voice workspace before reads and workflow actions; overview/widget reads can create its local identity-only mirror. API-key requests need their exact granted resource binding. Supplied ids never establish membership.
Record real event state
Record an actual incoming event and retain data.id. Complete or miss only a ringing local call; terminal transitions reject repeats. The provider call tuple is unique and duplicate incoming events currently return plain-text HTTP 500. These state changes do not operate a provider connection. Provider failure records do not change call state and have no published resolve action.
Register artifact references accurately
Recording/transcript actions accept any existing scoped call and store ready URL metadata. Voicemail requires a missed call and targets the original call operator. Multiple submissions create multiple rows; there is no per-artifact undo or read/played action. URL schema validation does not prove remote content, accessibility, ownership, retention or audio/transcript quality.
Interpret counts and recent lists
Overview counts all local workspace data but each recent call/failure array is capped at 25 without a cursor. Minutes is floor of summed duration seconds divided by 60. Open-failure count differs from the all-status recent failure array. Widget queued counts ringing records and its ready status establishes no provider availability. Separate queries are not an atomic snapshot.
Verify notifications separately
Configured event notifications are best effort after local writes. Voice has no durable app notification outbox, and a local action acknowledgement gives no delivered-recipient receipt. Widget engagement metering is also nonfatal and separately verified. Local captures disable these integrations and contact no telephony or remote artifact provider.
Export, erase and archive with the right scope
Organization export reads six local table sets across all workspaces and redacts artifact/recording URLs to presence flags, while phone and operator/recipient metadata remains. Exact ERASE deletes those local rows sequentially and verifies zero; remote provider bytes, Auth, delivered messages, copies and backups remain outside. Later reads can recreate mirrors. Archive requires local emptiness and canonical Auth approval, then removes the mirror and returns empty HTTP 204; there is no published restore.
Use reviewed execution guidance
Inspect the credential, published action and actual granted resource, validate input, inspect the unchanged plan, authorize effects and retain exact responses. Follow the per-action verification/recovery steps. Worked examples come from the real local worker and all four migrations with synthetic identity/grant/archive transport; they do not establish deployed provider effects. Typed agent guidance is stored separately from human Markdown.
Action reference
Evidence
Actual worker and isolated migrated D1; synthetic Auth identity, nondefault workspace grants and archive transport. Notify and Nexus are disabled. No live telephony, remote audio or transcript hosting/deletion is tested.