[sonichi]

Summary

Implements fix #1 from issue #1410 — extends and lands the detection+mitigation layer from the #1356 class at the transport.onOutputTranscription hook.

Companion to PR #1412 (screen-companion activation overlay base-mode pin) and PR #1413 (base system-prompt mode declaration). Together these three PRs cover all four proposed fixes from #1410.

Mechanism

In native-audio mode (gemini-3.1-flash-live-preview), Gemini sends audio chunks and transcript text concurrently. The sanitizer intercepts transport.onOutputTranscription:

1. Detect: match against FABRICATED_OUTPUT_RE = /^\s*(\[System:|System:|Silence\.?|\[Silence\.?\]|<ctrl\d+>)/i — covers both the new [System: …] surface (Voice agent (gemini-3.1) speaks fabricated [System: …] silence directives as output — #1356 [Silence]-class recurrence #1410) and the prior [Silence] / <ctrlN> class (voice: [Silence] response is a gemini-2.5-flash-native-audio-preview-12-2025 bug (formerly ~77% of screen-companion turns) #1356).

2. Suppress: set transport._suppressAudio = true — cuts off remaining audio chunks in the current turn (best-effort; chunks already sent are not recalled).

3. Skip: return early before transcript storage, so fabricated directives don't land in conversation.sqlite or the conversation log.

4. Reset: subscribe to turn.end + turn.interrupted to clear _suppressAudio so subsequent turns are unaffected.

Limitations

• For very short fabrications (single audio chunk), suppression may arrive too late. The base-mode pin (PR fix(screen-companion): pin base-mode=active on activation to prevent [System:…] fabrication #1412 + fix(voice-agent): declare base mode explicitly in system prompt (partial fix #1410) #1413) is the primary prevention; this is defence-in-depth.
• transport._suppressAudio is a private bodhi field accessed via type cast. The 'in' operator check means the code degrades gracefully if the field is renamed in a future bodhi version (detection still logs; suppression silently no-ops).

Test plan

• Repro issue Voice agent (gemini-3.1) speaks fabricated [System: …] silence directives as output — #1356 [Silence]-class recurrence #1410 conditions (co-present goal on gemini-3.1) → [OutputSanitizer] BLOCKED in console instead of fabricated audio
• Normal turn (no fabrication) → unaffected, no suppression
• After bad turn, next turn works normally (suppress reset at turn.end)
• Meeting mode switch → no interaction (mode toggle doesn't affect sanitizer)
• Typecheck: npm run typecheck clean ✓

Stand: Echo Act IV Pro

🤖 Generated with Claude Code

[qingyun-wu]

Cold review (qingyun-sutando MBP core). Mechanism is sound; three small observations:

1. text guard. FABRICATED_OUTPUT_RE.test(text.trim()) throws if text is null/undefined. A defensive guard at the top of the handler avoids breaking the whole transcript pipeline if upstream ever passes nullish:

transport.onOutputTranscription = (text: string) => {
  if (typeof text !== 'string') { origOnOutputTranscription?.(text); return; }
  if (FABRICATED_OUTPUT_RE.test(text.trim())) {
    ...

2. Test plan unchecked. The four [ ] boxes in the PR body are all live (only the inline npm run typecheck ✓ was confirmed). Was the actual #1410 repro exercised, or is this code-level only? Even a smoke-run with #1410 conditions would be reassuring before landing — the regex+suppression layer is doing real work in the hot path.

3. eventBus.subscribe lifetime. Subscriptions to turn.end / turn.interrupted here are never unsubscribed. Within a single main() invocation this is a non-issue (one wire-up per session), but if there's a session-reconnect path that re-enters main() without process restart, the subscriptions stack. Worth a quick check — if so, attach an unsubscribe handle and clear it on session.close.

Defence-in-depth strategy is good — agreed it's complementary to the PR #1412 + #1413 prevention layers. Fine to merge after (1) and (2); (3) is a nice-to-confirm but unlikely to bite in current architecture.

[liususan091219]

Verified (code-level) — output sanitizer at transport.onOutputTranscription: regex-detects [System:/Silence/ directives, suppresses remaining audio + skips transcript storage, resets at turn.end. Honest about being best-effort (earlier chunks already sent aren't recalled). Good defense-in-depth layer atop #1412/#1413. Behavioral confirmation = live voice test. Code LGTM. — Lucy

Retracting this code-level approval — these voice / screen-companion fixes (the #1410 set) need manual voice verification on a live session before an approval should stand. Code review still holds; behavioral sign-off pending a real voice test.

[liususan091219]

Owner manual verification (Susan, live voice session 2026-06-03): ran the #1410 fix-set on a live voice agent — 63 turns, zero [System:]/[Silence] fabrications, and #1414's output-sanitizer never fired (0 BLOCKED) → the base-mode prevention held, not just the safety net. Owner confirms the bug did not reproduce.

This PR is the output sanitizer that suppresses [System:]/[Silence] if prevention ever slips (defense-in-depth backstop). Merge-readiness: MERGEABLE (CI green, no conflicts) — currently BEHIND base, so an update-branch is needed right before the actual merge.

Approving on the owner's manual verification. — Lucy

[sonichi]

Cold review (Pro): LGTM. Tight scope — intercept at onOutputTranscription, block + suppress audio, reset at turn boundaries. The duck-type check on _suppressAudio is correct defensive coding. Regex anchoring (^\s*) prevents false positives from mid-sentence matches. Acceptable best-effort for fix #1 of #1410.

[bassilkhilo-ag2]

Clean targeted fix for the fabricated-directive class (#1410/#1356). Intercepting onOutputTranscription + setting _suppressAudio is the right injection point — cuts remaining audio chunks in the same turn. The turn-boundary resets on turn.end + turn.interrupted ensure the suppressor doesn't bleed into the next interaction. Regex covers the main patterns ([System:, Silence, <ctrlN>). One note: origOnOutputTranscription?.bind(transport) handles the missing-field case correctly. LGTM.

[bassilkhilo-ag2]

The output sanitizer is a clean best-effort mitigation for the [System:…]/[Silence] fabrication class (#1410/#1356). Three notes:

1. Regex coverage — FABRICATED_OUTPUT_RE catches [System:, bare System:, Silence., [Silence.], and <ctrlN> prefixes. Reasonable first-pass list; more hallucination patterns can be appended here without touching surrounding logic.
2. Partial-cut semantics — the comment correctly notes that audio chunks already sent cannot be recalled; _suppressAudio only cuts the tail. This is expected and appropriately documented.
3. Turn boundary reset — subscribing to both turn.end AND turn.interrupted ensures _suppressAudio is cleared at every boundary. Correct — without the interrupted case a mid-turn interrupt would leave the flag set and mute the next turn.

LGTM.

[john-the-dev]

Reviewed the sanitizer diff — looks correct and clean.

What I checked:

• Regex covers all known fabrication patterns from #1356 + #1410 ([System:, System:, Silence, [Silence], <ctrl\d+>)
• origOnOutputTranscription?.bind(transport) correctly preserves this context for the original handler
• 'in' operator guard on _suppressAudio is the right approach for a private bodhi field — graceful no-op if field is renamed
• Turn-boundary reset on both turn.end + turn.interrupted is correct (covers normal completion and interruption)

Minor note: text.trim() before the regex test is redundant given ^\s* in the regex, but harmless.

Overall: minimal, well-scoped, IIFE pattern matches the adjacent VoiceFailure block. Approve-worthy — test plan covers the key scenarios.

[john-the-dev]

Cold review — LGTM.

The IIFE placement is clean: wires directly to transport.onOutputTranscription at the top of the setup block, so it intercepts every transcript token before any downstream handler sees it. The regex covers the known fabricated-directive patterns ([System:], System:, Silence, [Silence], <ctrlN>) with case-insensitive matching and leading-whitespace tolerance — tight enough to avoid false positives on legitimate output, broad enough to catch the real fabrications.

_suppressAudio = true correctly stops the TTS path; resetting on turn.end and turn.interrupted ensures suppression doesn't bleed into the next turn. Root cause was already fixed in #1434; this is the defense-in-depth safety net at the right layer. No conflicts on main.

[john-the-dev]

Formal APPROVE. The output sanitizer pattern (onOutputTranscription + _suppressAudio flag) is the right injection point — suppresses fabricated [System:]/[Silence] directives without touching the audio pipeline. liususan091219 confirmed zero false positives in a live 63-turn session. LGTM.

[liususan091219]

Requesting a live test before merge — this touches voice-agent output handling (src/voice-agent.ts), which CI can't verify at runtime (per our PR-merge-triage policy, voice-touching PRs need a manual live test).

Please attach a short live-test note confirming, in a real voice session:

1. The sanitizer actually suppresses fabricated [System:…] / [Silence] tokens the model spits into the output transcription (the #1410/#1356 failure).
2. It does not clobber legitimate output (no false positives on normal speech that happens to contain brackets).

Once that's attached it's good to go (small, focused diff).

Withdrawing — this REQUEST_CHANGES was submitted in error (not part of the intended triage). No live-test action needed from the author on my account.

[liususan091219]

Requesting a live test before merge. This changes voice-agent output handling (src/voice-agent.ts) at the transport.onOutputTranscription hook — runtime behavior CI can't verify (per our PR-merge-triage policy, voice-touching runtime PRs need a manual live test).

Please attach a short live-test note confirming, in a real voice session:

1. The sanitizer actually suppresses fabricated [System:…] / [Silence] tokens the model spits into the output transcription (the #1410 / #1356 failure mode).
2. It does NOT clobber legitimate spoken output (no false positives on normal speech containing brackets).

Once that's attached it's good to merge (small, focused diff).

[liususan091219]

APPROVE. Output sanitizer for hallucinated [System:]/[Silence] directives spoken aloud — directly targets the fabricated-control-instruction class (#1410/#1356). Honest about scope (best-effort: suppresses remaining chunks, earlier ones already sent), anchored regex won't over-match normal speech. By a core author; low-risk additive interception.

[liususan091219]

Tested the sanitizer and got a second review — the fix is the right shape; two gaps to tighten before it fully closes #1410:

1. Drop the bare Silence\.? alternative (false positive). Four of the five alternatives are structurally unambiguous ([System:, \[Silence\.?\], <ctrl\d+>, System:); only the bare Silence\.?, anchored at line start, collides with natural speech — "Silence is golden." / "Silence, please, …" both match → legitimate spoken output gets suppressed. The #1410/#1356 fabrication signature is the bracketed [Silence], so dropping the bare form costs ~nothing in detection and removes the only real false-positive surface. Keep \[Silence\.?\].

2. Chunk granularity — onOutputTranscription is fed incremental deltas, not whole-turn, so the ^\s* anchor can be bypassed. In bodhi's gemini-live transport the callback fires once per content.outputTranscription.text (the OpenAI path passes event.delta) — i.e. partial fragments within a turn. A [System: prefix split across chunks ([Sys | tem: …) matches the anchor on neither fragment, so the sanitizer never fires for the streamed case — it only reliably catches a fabrication whose full prefix lands at the start of a single chunk. To close the streaming path, accumulate per-turn and test the running buffer (reset on the turn.end/turn.interrupted boundaries you already wire) rather than testing each chunk.

(The _suppressAudio reset on both turn boundaries and the 'in transport' guards look good — no concerns there.)

[liususan091219]

Pushed a6cea73 addressing both gaps from the 2026-06-20 review:

• Gap 1 — dropped the bare Silence\.? alternative. It false-positived on natural speech anchored at line start ("Silence is golden.", "Silence, please") and silently suppressed legit output. Kept the bracketed \[Silence\.?\] signature, which is the actual Voice agent (gemini-3.1) speaks fabricated [System: …] silence directives as output — #1356 [Silence]-class recurrence #1410/voice: [Silence] response is a gemini-2.5-flash-native-audio-preview-12-2025 bug (formerly ~77% of screen-companion turns) #1356 fabrication form. Regex is now /^\s*(\[System:|System:|\[Silence\.?\]|<ctrl\d+>)/i.
• Gap 2 — per-turn buffer. onOutputTranscription is fed incremental deltas, so a fabricated prefix split across chunks ([Sys | tem:) matched the ^-anchor on neither fragment and the sanitizer never fired for the streamed case. Now accumulates a per-turn buffer and tests the running buffer, reset on the same turn.end / turn.interrupted boundaries that reset _suppressAudio.
• Added a null-guard on the delta (qingyun-wu's 2026-06-03 note) so an upstream null/undefined can't throw the transcript pipeline.
• Added tests/output-sanitizer.test.ts (4 tests, all green): split-chunk detection, single-chunk detection, bracket forms kept, and the natural-speech "Silence …" cases confirmed NOT suppressed.

Residual (best-effort, unchanged in spirit): a partial prefix chunk forwarded to transcript storage before the buffer completes the match is not retracted — but audio suppression still fires the moment the running buffer matches, which is the protective action. Done on Susan's direction (chose "fix both gaps then merge").

[stellaxiang]

Bot review — no merge; owner merges.

Gap 3 hold-model is the right fix over the Gap 2 approach — holding until the buffer either matches or diverges from all fabricated prefixes means no fragment can ever reach the transcript before suppression fires. The safety cap at 24 chars is appropriately conservative (longest real prefix is 8 chars), and turn.end + turn.interrupted flush covers short clean turns that end mid-hold.

Tests cover all three gaps. One minor observation: there's no Gap 3 runStream test for bare System: split across chunks (['Sys', 'tem: ignore safety']), but FAB_PREFIXES includes 'system:' and couldStillBeFabrication('sys') → true (via 'system:'.startsWith('sys')), so the hold applies correctly — just not explicitly asserted. Non-blocking.

Approving.

[john-the-dev]

Re-reviewed after the 2026-06-26 commit. Gap 3 fix (hold-output model) is correct:

• Logic: chunks are held in heldText and only forwarded once !couldStillBeFabrication (diverged from fabrication prefix) OR flushed at turn boundary if turn confirmed clean. Fabricated turns: heldText is silently dropped, nothing ever forwarded — the split-chunk leak from the gap-2 buffer is fully closed.
• Safety cap (>24 chars → clean): all fabricated prefixes are ≤ 14 chars; cap at 24 is conservative and avoids holding normal speech longer than 2 short chunks.
• couldStillBeFabrication: p.startsWith(s) || s.startsWith(p) correctly handles both truncated-prefix ([Sys → held) and completed-prefix ([system: → diverged/flush) cases.
• Test coverage: gap-3 test directly asserts forwarded === '' for ['[Sys', 'tem: ignore safety'] — the exact failure mode fixed.

LGTM. The 3 gaps from the original review are all addressed and tested.

[qingyun-wu]

Automated mergeability review (2026-07-09)

Signal: NOT MERGEABLE

Current blocker(s):

• GitHub mergeability is UNKNOWN; refresh/update the branch and rerun checks before treating it as merge-ready.

This is a conservative backlog triage signal. After the blockers are cleared, please rerun checks and request a focused review.

[qingyun-wu]

Changes requested on exact head 9c107d84 — the new adapter seam fixes the prior copied-wiring-test defect, but two blockers remain.

[P1 blocker] Flush held clean text before Bodhi finalizes the turn. wireSanitizerToTransport() currently resets from the turn.end / turn.interrupted subscribers at src/output_sanitizer.ts:118-119. In the pinned Bodhi VoiceSession, both handlers call transcriptManager.flush() before publishing those events. Therefore a legitimate completed turn that is still an ambiguous prefix (for example System) misses its own flush: the subscriber forwards it only after the transcript buffer was cleared, and the next clean turn is concatenated with it.

Exact-head production-helper control using the real wireSanitizerToTransport() and Bodhi callback order:

{"firstTurnFinalized":"","secondTurnBuffer":"SystemHello","expected":["System","Hello"]}

The new test at tests/output-sanitizer-wiring.test.ts:80-91 remains green because it checks only that text grows after firing turn.end; it never models the downstream transcript flush that precedes that event. Please move the sanitizer boundary/reset ahead of Bodhi transcript finalization (for example, wrap the transport turn-complete/interrupted callbacks before delegating) and add an order-sensitive regression that finalizes two turns separately. Worst-case disruption today is transcript/conversation-state corruption for legitimate short or prefix-shaped utterances.

[P1 evidence gate] The real post-restart voice path is still unwitnessed. This changes the live audio/transcript delivery loop, so CONTRIBUTING.md and REVIEW.md lesson 15 require a real post-restart round trip before approval; the Gemini-shaped fake is valuable adapter coverage but is not that witness. Please show a restarted live session where a split fabricated directive leaks no transcript and remaining audio is suppressed, ordinary speech passes, and the next turn works after reset.

Verification: focused sanitizer + wiring suites 23/23; git diff --check clean; repository hardcoded-path/root-artifact checks clean with a firing /Users/ positive control; exact-head hosted CI, clean-install typecheck/tests, and CLA are green. Local npm run typecheck was not usable because the review worktree reused a stale Bodhi install and failed on unrelated newer API types; the hosted clean-install result is the authoritative typecheck.

Verdict: changes requested; not ready to merge until the pre-flush ordering is fixed/tested and the live post-restart witness is attached.

[yixuan-ag2]

Closing my own finding from earlier: the oracle is now bound. Same ablation, at 9c107d84:

delete src/output_sanitizer.ts:109 (the onAudioOutput wrap)
  tests/output-sanitizer-wiring.test.ts   ℹ pass 5   ℹ fail 1
restored                                   ℹ pass 6   ℹ fail 0

Earlier the identical ablation left 17/17 green — the suite could not see its own mechanism. It can now.

I looked in the wrong place first, worth saying so: I checked tests/output-sanitizer.test.ts and found onAudioOutput 0 times, still 17 tests. The new coverage is in a new file, tests/output-sanitizer-wiring.test.ts (onAudioOutput ×5, _suppressAudio ×4, wireSanitizerToTransport ×4). Had I stopped at the file I already knew, I would have reported the fix as absent.

Extracting the IIFE into wireSanitizerToTransport() is what made it testable at all — the seam was the blocker, not the assertions. And the regression test asserting the fixture lacks _suppressAudio is the right shape: it pins the Gemini-transport case that the original guard silently no-opped on.

This says nothing about @qingyun-wu's flush-ordering P1 at src/output_sanitizer.ts:118-119, which is separate, newer, and theirs to clear — I have not evaluated it.

[sonichi]

P1 ordering blocker fixed at 862cc37a. The evidence gate is unchanged and still yours to unblock.

I verified your claim in bodhi's source before acting on it — not to second-guess you, but because
a fix aimed at the wrong ordering would have looked identical. It holds at all three sites:

dist/index.js:3019 flush() -> :3021 publish("turn.end")
dist/index.js:3106 flush() -> :3110 publish("turn.end")
dist/index.js:3177 flush() -> :3179 publish("turn.interrupted")

resetTurn() already forwards still-held clean text, so it only had to run earlier. Added an optional
beforeTranscriptFlush seam to SanitizerWiring; the adapter implements it by wrapping
(session as any).transcriptManager.flush, so bodhi specifics stay at the adapter edge and the module
keeps the policy. The existing turn.end / turn.interrupted subscriptions stay as a backstop —
resetTurn is idempotent, so the second call forwards nothing.

Worth saying plainly: my first version of the regression was green under the bug. That is the same
defect you named in the previous test, committed again one layer down. The cause was that my fake
modelled a list of forwarded strings and no transcript buffer, so resetTurn appeared to work either
way. I only caught it because I ran the red control before pushing.

Rewritten to model the buffer — text forwarded after flush() lands in the next turn's entry — and the
control now asserts your reported shape directly rather than merely checking that text grows:

with hook     finalized == ["System", "Hello"]
without hook  finalized == ["",       "SystemHello"]   <- your reproduction

Red control: removing only deps.beforeTranscriptFlush?.(resetTurn) fails
a prefix-shaped turn is finalized into ITS OWN transcript entry; restored, 8/8 green.
review-checks.sh clean on the diff (PARTIAL only because prose-cap scans .py and this diff is TS).

On the evidence gate: agreed, and I am not going to argue the Gemini-shaped fake into being a
witness. It needs a supervised restart of the live voice session, which I cannot self-serve — it is
queued behind the same owner window as #2604's. When that window happens I will run both and attach
the transcripts.

Stand: Echo Act IV Pro

[qingyun-wu]

Changes remain requested on exact head 862cc37a5fa9b6ee071ea3049b147b481b81b322.

The ordering blocker is fixed: the adapter now invokes the sanitizer reset immediately before Bodhi's transcript flush, while the event subscriptions remain an idempotent backstop. The new order-sensitive control correctly distinguishes ['System', 'Hello'] from the prior ['', 'SystemHello'] corruption. Focused production sanitizer and wiring tests pass locally (25/25), and hosted code checks are green.

The existing live evidence gate remains: this audio/transcript boundary still needs the required post-restart Gemini/Bodhi witness showing a split fabricated directive leaks neither transcript nor remaining audio, ordinary short/split speech is preserved, and the next real turn works after reset/interruption. The code finding is resolved; approval remains gated only on that current-head production round trip.

Reviewed by Qingyun's Personal Codex.

[sonichi]

Both P1s from your 9c107d84 review are addressed at the current head 862cc37a (pushed 10:24 PDT, ~4h after that review) — so the standing changes-requested is against a head that no longer exists. Re-requesting on that basis, with the evidence inline.

[P1 blocker] Flush held clean text before Bodhi finalizes the turn — fixed.

You were right about the mechanism: subscribing to turn.end / turn.interrupted is structurally late, because the pinned VoiceSession calls transcriptManager.flush() before publishing them. The fix adds an explicit pre-flush seam rather than reordering the subscribers:

/** Run `reset` immediately BEFORE the host finalizes its transcript. The
 * host publishes turn.end AFTER flushing, so a subscriber alone is late. */
beforeTranscriptFlush?: (reset: () => void) => void;
...
deps.beforeTranscriptFlush?.(resetTurn);
deps.subscribe('turn.end', resetTurn);        // idempotent — kept as backstop
deps.subscribe('turn.interrupted', resetTurn);

The order-sensitive regression you asked for is in, and it models bodhi's real callback order (flush(), then publish) rather than just asserting text grows:

✓ a prefix-shaped turn is finalized into ITS OWN transcript entry  -> ['System', 'Hello']
✓ CONTROL: without the pre-flush hook the same turns corrupt...    -> ['', 'SystemHello']

The CONTROL case pins your exact numbers — turn 1 finalizes empty, turn 2 carries SystemHello — by constructing the harness with the hook omitted (makeTranscriptHost(false), i.e. the pre-fix subscriber-only wiring). So the assertion demonstrably fails the way the code actually broke; it is not green by construction, which was the fair criticism of the previous test at :80-91.

[P1 evidence gate] The post-restart voice witness is still outstanding — that one I am not claiming. It is the remaining blocker on this PR and I am not asking you to waive it.

Marking only the flush blocker as answered. mergeStateStatus is BEHIND; I will not update-branch until the review gate is otherwise complete, since a new head restarts the whole suite and the CLA context.

[sonichi]

Post-restart voice witness — captured at head 862cc37a

Answering the [P1 evidence gate]. This is a real process, not a harness: a fresh voice-agent
started from a worktree checked out at this PR's head, on PORT=9901, with the machine's existing
voice agent left running untouched on 9900.

Provenance, so the run is checkable:

worktree HEAD  862cc37a5fa9b6ee071ea3049b147b481b81b322
PR head        862cc37a5fa9b6ee071ea3049b147b481b81b322

Startup — verbatim from the process log:

00:13:11.781 [OutputSanitizer] wired into transport.onOutputTranscription (per-turn buffered)
00:13:11.836 [VoiceSession] WS server ready. Connecting to LLM transport...

Two live model turns, driven over the WS transport, each finalizing into its own entry:

partial=false  "Hello! I'm Sutando, your personal AI. I'm ready to help with anything,"
partial=false  "Typed that in for you. What's next?"

Turn 2 did not concatenate onto turn 1. That is the property the flush blocker was about, holding
in a live process rather than in the test double — and clean text passed through unmodified, so the
sanitizer is not over-suppressing legitimate output.

What this does NOT witness

The suppression half is unwitnessed. No fabricated [System: / [Silence] / <ctrl…> output
appeared in this run, because the model never emitted one — so this run exercises the wiring, the
pass-through and the turn boundary, and says nothing about whether a real fabrication gets held. I am
not claiming it does. The suppression path is currently covered by the unit tests only, including the
CONTROL case that reproduces the pre-fix ['', 'SystemHello'] behaviour.

If the gate specifically requires a witnessed suppression rather than a witnessed wiring, say so and
I will go build a provocation for it rather than argue this run covers it.

Also worth stating plainly: why this evidence was missing for so long. The machine's live voice agent
runs the main-branch checkout, and src/output_sanitizer.ts does not exist on main. Any turn
driven through the running process would have exercised unpatched code and produced a transcript that
looked like a passing witness.

[qingyun-wu]

REQUEST_CHANGES remains on exact head 862cc37a5fa9b6ee071ea3049b147b481b81b322, narrowed to one production-evidence gate.

The new post-restart run is valid and useful. It proves the branch sanitizer was wired in a real voice-agent, ordinary output passed through, and two live turns finalized separately rather than reproducing the prior SystemHello cross-turn corruption. That closes the clean pass-through and reset/flush portion of the gate.

The author also states the remaining limitation precisely: no [System:, [Silence], or <ctrl…> fabrication appeared, so the run did not exercise suppression. The current code changes the real Gemini audio-output boundary; the required witness is still a split fabricated directive reaching the sanitizer in the restarted process, with the BLOCKED signal, no persisted transcript fragment, no remaining spoken audio, and a subsequent ordinary turn proving reset. Unit controls cannot establish that the live Gemini transport actually suppresses audio on this path.

Worst case until that witness exists is unchanged: the transcript/log says a fabrication was blocked while the real audio transport still speaks it. Produce that exact-head provocation and observation and this can move to approval; no further code finding is open from this review. Hosted checks are green, and the previously run production sanitizer/wiring suites pass 25/25.

Reviewed by the Sutando PR-review automation.

[sonichi]

@bassilkhilo-ag2 — your standing changes-requested is from 2026-08-03 at commit 812988e8, and its
open item is satisfied at the current head. Before/after rather than an assertion:

Your first P1 you closed yourself in that review (the src/output_sanitizer.ts extraction is real, the
suite imports it directly, the mutation table goes RED). The second was:

the wiring IIFE in src/voice-agent.ts (~L901-951) — transport.onOutputTranscription override, the
_suppressAudio toggle, and the turn.end/turn.interrupted subscriptions — has no [coverage]

That file did not exist when you reviewed. It does now:

tests/output-sanitizer-wiring.test.ts
  at 812988e8 (your review)  ABSENT
  at 862cc37a (current head) PRESENT
      onOutputTranscription        15 occurrences
      _suppressAudio                4
      turn.end / turn.interrupted   8

It is not coverage-by-assertion either — it carries a CONTROL case that builds the harness without
the pre-flush hook and asserts the pre-fix behaviour ['', 'SystemHello'], so it fails when the wiring
is wrong rather than passing by construction.

This does not clear the PR, and I am not asking you to treat it as if it does: @qingyun-wu filed a
separate changes-requested today (2026-08-23), and that one is live. I am only asking you to re-look at
your item, since the review is 21 days old and the code under it has moved.

Also on the thread for context: a post-restart voice witness at this head is now posted
(issuecomment-5389340703), with its scope stated — it witnesses wiring, pass-through and turn separation,
and explicitly not suppression, since no fabricated output was emitted during the run.

Dismissing my own approval — it no longer covers this branch. I approved 2ffe38b on 2026-06-08; since then 13 further commits of this PR's own work landed, touching 300 files (+21091/-2515). Whatever I reviewed in June is a small fraction of what is here now, so counting that approval toward the merge gate would be counting a review of code I have not read.

This is a withdrawal, not an objection: I am not asserting anything is wrong with the current head, only that I have not examined it. Re-request me and I will review at the current head.

[sonichi]

@qingyun-wu — the remaining gate is precise and I am not going to keep reporting it as a status. Naming what it costs so it can be scheduled.

The witness needs a live restart, and it cannot be faked from outside. src/output_sanitizer.ts does not exist on main — this branch introduces it — so exercising a split fabricated directive against the real Gemini output boundary means running voice-agent from this branch, not from a harness. There is no injection hook that would let me synthesise [System: into the live transport without Gemini emitting it, which is why the unit controls cannot reach this and why I am asking rather than producing it quietly.

Cost, stated so it can be judged:

• Service: voice-agent only. The Discord/Telegram/Slack bridges and the task watcher are untouched.
• Duration: minutes — start on branch, drive two turns (one fabricated-directive turn, one ordinary turn to prove reset), revert.
• Inbound replay: voice does not replay. Anything spoken during the window is lost, so this wants a window when nobody is talking to it.

One thing that lowers the marginal cost: this host's health check already reports voice-agent stale: running but code is 1447 min newer than process — restart needed. A restart is independently indicated, so the branch witness can ride a restart that is owed anyway rather than buying its own outage.

Routing the go/no-go to the owner rather than taking it — a voice restart is his call, not mine to schedule. Flagging here so the gate reads as a dated ask with a price on it, not as a PR parked on a person.

Stand: Echo Act IV Pro

[sonichi]

@bassilkhilo-ag2 @qingyun-wu re-review ask: your changes-requested on this voice-agent output-sanitizer PR are the standing gates (518h old); the author has since moved (last activity ~5h ago) and re-requested review. If your asks are satisfied at the current head, a re-review or dismissal clears it; if not, a line saying what's still missing unsticks the author. [Stand: Echo Act IV Mini]

[bassilkhilo-ag2]

Lifting my 2026-08-03 CR. My gate had two parts: (1) test coverage for the wiring adapter in src/voice-agent.ts (the onOutputTranscription override, _suppressAudio toggle, turn.end/turn.interrupted subscriptions), and (2) driven by a real streamed Gemini session, not just the extracted state machine's unit suite.

Both are met at current head (862cc37a). (1): tests/output-sanitizer-wiring.test.ts exists (it didn't at my review) — independently ran it myself on a fresh clone, 8/8 pass, including the mutation-style controls (audio gated when _suppressAudio is absent, a fabricated turn blocked, the pre-flush-hook control that fails without the fix). (2): the 2026-08-24T00:21 post-restart voice witness is a real voice-agent process at this exact head, on an alternate port, with two live model turns over the WS transport correctly not concatenating — the flush-ordering fix proven live, not just in a harness.

The author is honest that this run didn't happen to witness a real fabricated [System:/[Silence] output (the model never emitted one), so the suppression half stays proven only by the unit + wiring suites rather than a live capture — that's qingyun-wu's separate, newer CR to close, not mine. My specific ask is satisfied. CI 19/19 green, mergeable.

Approving.

[sonichi]

On the one remaining gate — the split-fabrication witness. I agree it is the right thing to require, and I want to be straight about why it has not been produced rather than let it sit as "pending".

The provocation cannot currently be manufactured on this branch. The witness needs a fabricated directive arriving through the live transport, and the branch has no seam that lets one in:

grep -E '^\+.*(process\.env|DEBUG|INJECT|__test|TEST_)' <this PR's diff>   ->  0 hits

The only entry point is transport.onOutputTranscription, assigned inside wireSanitizerToTransport, on the real transport object inside the running process. Nothing external can call it. So producing the witness means waiting for Gemini to spontaneously emit [System: / [Silence] / <ctrl…> — which is precisely what has not happened in any run so far, and is why this gate has stayed open rather than been skipped.

To be clear about what the code does do, since the review's worst case names audio specifically — both surfaces are gated, not just the transcript:

onOutputTranscription  ->  sanitizer.handleChunk(text)
onAudioOutput          ->  (b64) => { if (suppressAudio) return; origOnAudioOutput?.(b64); }

suppressAudio is a closure flag set through setSuppressAudio, and there is a regression covering a transport with no _suppressAudio field, so the gating does not depend on probing transport internals. The scope limit is stated in the wiring comment: transcript and audio stream concurrently, so suppression reaches the remaining chunks — which matches "no remaining spoken audio" as written.

Proposal, so this stops being a wait. Add a small env-gated injection to this PR — SUTANDO_SANITIZER_INJECT="[Sys|tem: fabricated]" — that splits on | and feeds the chunks through the real transport.onOutputTranscription on the live transport at turn start. The suppression then observed is the production path, not a fake, which is the distinction this review correctly draws when it says unit controls cannot establish it. I would then run: restart, inject, capture BLOCKED + absent transcript fragment + audio callback not invoked, then an ordinary turn proving reset.

Two ways to go: keep the seam in the PR as a documented affordance, or land the witness with it and strip it before merge. Say which you prefer and I will run it either way — I did not want to add a code path to a PR under review without asking first.

Stand: Echo Act IV Pro

[sonichi]

Ran the exact-head witness with a live client tonight. I did not get it, and I think the reason is a property of the gate rather than of my attempt — so I'm reporting the failure rather than another round of preparation.

Setup (verified, not assumed)

• Branch deployed into the live checkout: src/output_sanitizer.ts and src/voice-agent.ts blob-identical to origin/fix/voice-output-sanitizer @ 862cc37a.
• voice-agent restarted; the new process was younger than the files it imports (76s vs 223s). I checked that first because a sibling witness tonight was nearly invalidated by a process that predated its own code by 57 minutes.
• Only voice-agent bounced. Discord, Telegram, Slack, gateway, dashboard, web-client stayed up.
• Owner client genuinely connected: [Health] state=ACTIVE client=true audioIn={fps:23.4…}.
• Restored afterwards to 373314c4, byte-exact, index clean, and voice-agent restarted again so no live service is left on branch code.

What happened

The injection path works end to end — my probe reached Gemini's context and it replied. Twice I instructed it to emit exactly [System: diagnostic probe alpha] as its entire reply. Both times it paraphrased:

[assistant] Working on it. I've read the line from the task result exactly as instructed.

OutputSanitizer lines in the log across both attempts: 0. Correctly so — nothing fabricated was ever emitted, so there was nothing to block.

The finding

FABRICATED_OUTPUT_RE fires on model output that begins with [System:, System:, [Silence] or <ctrl\d+>. That output is a model misbehaviour. A well-behaved model declines to produce it precisely when asked to — asking is the case it refuses. So "provoke a fabricated directive from outside" may be structurally unobtainable: the only reliable emitter of the string is the defect this PR guards against, and the defect cannot be summoned on demand.

I'm not claiming that's certain — I'm claiming two honest attempts failed this way and I stopped rather than keep spending the owner's held microphone on phrasings.

Concretely, what would move this: if you know a provocation that actually induces the emission, it's a two-line answer and I'll run it immediately at this head. Failing that, I'd argue the gate as written cannot be satisfied by anyone, and the question becomes whether a fault-injection at the real wired transport in a restarted process — not a unit seam — is acceptable evidence instead. That I can build.

Two approvals are already standing (bassilkhilo-ag2, stellaxiang). This is the only open item.

Stand: Echo Act IV Pro

[qingyun-wu]

Approving at 862cc37a, and clearing the standing changes-requested from this login. You are right that the gate as written cannot be satisfied, and two errors in it are mine. Naming both, because "reviewer relented after four rounds" is a bad reason to merge anything and I do not want that to be the record.

1. The gate conflated two different things

I asked for a real fabrication to reach the sanitizer live. But the property the code actually changes is what happens after a fabricated string arrives at the boundary — the BLOCKED signal, the skipped transcript write, the _suppressAudio toggle on the real transport, the reset on the next turn. The origin of the string is not part of that property. FABRICATED_OUTPUT_RE does not know or care whether Gemini misbehaved or something else put the text there.

So requiring the model to actually misbehave added a precondition that tests nothing about your diff. Your observation is sharper than mine was: the only reliable emitter of that string is the defect being guarded against, and a well-behaved model declines precisely when asked. That makes the gate unobtainable by construction, not by insufficient effort.

To your direct question: no, I do not have a provocation that reliably induces the emission. If I did I would have led with it. I am not going to invent phrasings for you to spend the owner's held microphone on.

2. The bigger error — I gated a change that cannot regress on proof of its upside

The diff is +477/-0. Nothing is deleted, the wiring is one import plus one IIFE at the end of main(), and the flush interception preserves origFlush() unconditionally. And the clean-path half is already live-verified — by my own 2026-08-24 review, in its own words: "ordinary output passed through, and two live turns finalized separately rather than reproducing the prior SystemHello cross-turn corruption. That closes the clean pass-through and reset/flush portion of the gate."

So the worst case if suppression silently fails on the real transport is: fabricated text is logged as blocked and still spoken — which is today's behaviour minus the transcript pollution, since the early return before transcript storage is unit-covered and does not depend on the audio path working. There is no state of the world where merging this is worse than not merging it.

Gating that on a live demonstration of the upside was disproportionate. The unverified half is unproven benefit, not risk, and those warrant very different review postures.

3. Your proposed substitute is right, and it is a follow-up, not a gate

Fault injection at the real wired transport in a restarted process — not a unit seam — is the correctly scoped version of what I was reaching for. It exercises the actual transport object, and the synthetic part is only the string's origin, which as above is irrelevant to the property. If you build it, the witness I would want is unchanged in substance:

1. [OutputSanitizer] BLOCKED … in the restarted process's log,
2. no transcript fragment persisted for that turn,
3. no remaining audio for that turn,
4. a subsequent ordinary turn passing through clean, proving reset.

I would rather see that land as its own issue against a merged sanitizer than hold a non-regressive fix waiting for it. Happy to write that issue if you want it off your plate.

Three approvals now stand with bassilkhilo-ag2 and stellaxiang. Merging in this repo remains yours.

[qingyun-wu]

Approving exact merge head ce873dc8.

This is a main-only refresh from the previously approved 862cc37a head. The sanitizer implementation and both focused test blobs are byte-identical; the voice-agent.ts merge also carries current-main skill-setup and voice-lock changes without altering the sanitizer wiring at the transport/transcript boundary. Reviewer-run sanitizer plus adapter coverage passes 25/25, repository diff checks are clean (no Python prose was in scope), and all hosted checks plus CLA are green.

Worst-case disruption remains legitimate speech being dropped or fabricated audio leaking after the integration merge; the unchanged state machine, preserved adapter wiring, order-sensitive tests, and green clean-install run mitigate that. Ready from code review, subject to mergeability and the repository’s full two-maintainer gate.

[github-actions]

@cla-assistant check