Agentic IVR · voice first · early access
Zephoriam records every call as an append-only ledger of typed events — every prompt, every caller utterance, every routing decision, every piece of evidence the AI consulted — replayable end to end, so QA, compliance and coaching finally read the same record.
Pre-launch, built by a contact-center consultant who got tired of asking vendors questions they couldn't answer. No customers yet — you would be early, and we would rather say that than fake a logo wall.
Sign up is open. It goes to the product itself, at app.zephoriam.com — a passkey instead of a password, a name for the business, and a number to point at us. It is early, and it looks it: you will be shaping the conversation your callers hear, not picking from a catalogue.
Why it exists
Zephoriam began as a short list of things a contact-center consultant kept asking IVR vendors on discovery calls, and kept getting slides back instead of answers.
Every platform reports containment. Almost none can tell you that a caller heard the wrong branch of the menu, said “representative” twice, got no-matched, and hung up forty seconds in — let alone let you watch it happen again. Drop-out gets inferred from aggregates, weeks later, by whoever is best at spreadsheets.
Zephoriam's answer: the drop-out is an event, in sequence, sitting next to the prompt that preceded it and the recognition result that caused it. You replay the call instead of reconstructing it.
Most third-party voice agents bolt on by blind-transferring to an external phone number. From your side the call simply leaves the building: no events, no transcript, no evidence trail, no way to reconcile what the agent told the caller with what your systems know. It comes back as a line item on someone else's dashboard.
Zephoriam's answer: the agent is a node inside your flow, not a phone number. Its turns are events on the same ledger as every prompt and every transfer.
When a caller insists they were quoted a price, when a supervisor coaches on a call the bot handled first, when someone asks how a disclosure was delivered — “the model generated it” is not an answer, and a recording with no reasoning attached is barely better. QA, compliance and coaching each end up with their own partial export.
Zephoriam's answer: every agent turn carries the evidence it was permitted to use, by reference. What was said and why it was said live in one record that all three teams read.
How it works
Three architectural commitments. They are the reason the rest of the product behaves the way it does.
one append-only stream per call
Typed events — call.started, agent.said, caller.said, intent.classified, branch.taken, appointment.booked, handoff.requested. Nothing is ever overwritten: a correction is a new event, so the record can gain detail but can never quietly change its story. Every screen is a replay of those events, which is why QA, compliance and coaching stop arguing about whose export is right.
the model selects; it never invents
At an agentic node the model chooses among the branches the flow declares, by index, against a schema — so it cannot route a caller to a destination that doesn't exist. When it states a policy, a price or an account fact, that fact came back from retrieval and is quoted by reference. No retrieved evidence, no claim. The interesting part is what it makes impossible.
the machine drafts; the person decides
Sensitive actions — a credit, a refund, an exception — stop for a human approval that is itself a recorded event. So do the platform's own improvement proposals: every request the flow couldn't handle is captured in the caller's own words — that capture runs on live calls today — then mined for patterns and turned into a drafted new branch that a human approves or rejects. The system gets faster. The gate does not move.
Some intents now finish on their own — the booking in the ledger above did. The ones that don't should end in a person's hands with the work already done: a transfer to a person is a first-class result with a packet attached — the transcript, the classified intent, the evidence consulted, and what the automation already tried. Design for the handoff and it stops being the thing you hide from the report. A contained call that left the caller furious is a failure that the containment number scores as a win.
Every request the flow had no branch for is kept verbatim, as evidence. Those become drafted proposals — a new branch, with the calls that justify it cited by reference. A human approves every change before it reaches a live flow, and the approval is on the ledger like everything else.
The doctrine
Every decision on this project is written down, numbered and dated, and the ones below are the rulings that bind how the platform behaves. They are on this page because they are the difference — and because a rule nobody can check is a slogan. So each one names the decision that made it and the thing in the code that enforces it: a database trigger, a guard, a test that goes red. This list is generated from that same code; a line that stopped being enforced could not stay on it. The repository is not public yet, so the citations below are precise on purpose — they name exactly what we can be asked to open.
When something breaks, the platform says so and says whose fault it was. A call that ends because our own code fell over is recorded as a platform fault — never as a caller who hung up — and every way a call can stop has a named reason on the ledger.
The run loop writes the honest ending before it re-raises, and a test proves it: test_an_executor_that_explodes_ends_the_call_as_a_platform_fault swaps a working node for one that throws, and requires the call to end as a platform fault rather than as an agent hangup. A second test holds the vocabulary total — test_the_reason_vocabulary_has_a_value_for_every_way_a_call_can_stop — so no ending can arrive without a name.
tests/test_honest_endings.py::test_an_executor_that_explodes_ends_the_call_as_a_platform_fault
tests/test_honest_endings.py::test_the_reason_vocabulary_has_a_value_for_every_way_a_call_can_stop
Nothing on the tape is overwritten and nothing is removed. When a record is wrong the fix is a new event pointing at the old one, so the record can gain detail and can never quietly change its story. And it is not only append-only, it is tamper-evident: once any row on this tape carries a signature, no later row may go unsigned — so a history edited by somebody who got past the database still cannot be made to look untouched.
Overwriting and deleting are refused by the database itself — triggers on the events table, not application code somebody could route around — and tests prove it: test_update_is_refused_by_the_database issues an update and requires the database to raise, test_delete_is_refused_by_the_database does the same for a delete, and test_correction_is_an_append_not_a_mutation corrects a misheard intent and requires the original row to still read the way it did. A trigger cannot stop somebody who drops the trigger first, so each row can also carry a signature chained to the row before it: test_red_an_altered_payload_is_caught drops the triggers, edits a payload by hand, and requires the chain to name the row that changed. Once that chain is live the tape itself refuses a writer holding no key — test_RED_an_unarmed_writer_CANNOT_append_to_a_live_chain restarts a process without the key against a signed tape and requires the write to be turned away before it reaches the ledger, naming the three settings it is missing. And when this platform's own arming ceremony left a gap, the chain said so — out loud, on the day, about us. The unsigned rows are still there and still unsigned, forgiven by name in a signed declaration every check reports forever: test_a_reanchor_makes_the_incident_verify_and_REPORTS_the_false_start requires the three honesty states to stay three different numbers, and test_cli_the_reanchor_COUNT_is_the_pin_that_catches_a_deletion_behind_it re-signs the whole history with the attacker holding the key, then shows that the count written down away from the machine is what says something is missing.
tests/test_tape.py::test_update_is_refused_by_the_database
tests/test_tape.py::test_delete_is_refused_by_the_database
tests/test_tape.py::test_correction_is_an_append_not_a_mutation
tests/test_the_tape_mac_chain.py::test_red_an_altered_payload_is_caught
tests/test_the_tape_mac_chain.py::test_RED_an_unarmed_writer_CANNOT_append_to_a_live_chain
tests/test_the_tape_mac_chain.py::test_a_reanchor_makes_the_incident_verify_and_REPORTS_the_false_start
tests/test_the_tape_mac_chain.py::test_cli_the_reanchor_COUNT_is_the_pin_that_catches_a_deletion_behind_it
The machine drafts; the person decides. Anything outside the published policy — a booking outside the organization's own hours, an outbound call to a real number — stops for a human approval that is itself a recorded event, naming who decided and what they were answering.
test_no_path_writes_an_appointment_outside_policy_without_a_grant_on_the_tape walks every out-of-policy booking on a finished tape and requires each one to cite a granted approval as its cause — so a write cannot arrive by some other road and be argued about later. test_a_second_decision_on_a_decided_request_loses_at_the_append proves a second decision on an already-decided request loses at the database, not in a branch somebody could delete. And test_the_request_is_written_for_the_promise_and_CITES_it proves the platform asks before it would ring somebody back: the request names the obligation it is about, by sequence number.
tests/test_the_gate.py::test_no_path_writes_an_appointment_outside_policy_without_a_grant_on_the_tape
tests/test_the_gate.py::test_a_second_decision_on_a_decided_request_loses_at_the_append
tests/test_the_promise_asks.py::test_the_request_is_written_for_the_promise_and_CITES_it
A number this platform shows you names the events it was folded from, and clicking it unspools the call to them. If a number cannot cite its sources it does not ship as a number — a rule we point at our own marketing as hard as at the product.
test_every_figure_the_console_renders_cites_the_seqs_it_is_a_fold_over opens four operator screens through the real HTTP door and requires every figure on them to link to the sequence numbers it folds over — and the citation to land inside the tape it claims. This page is held to the same rule: the status section below is generated from the code by the command that generated this list, and test_the_shipped_status_section_is_byte_identical_to_the_fold fails if the published page and the platform disagree by one byte.
tests/test_console.py::test_every_figure_the_console_renders_cites_the_seqs_it_is_a_fold_over
tests/test_website_status.py::test_the_shipped_status_section_is_byte_identical_to_the_fold
At an agentic node the model returns an index into the branches the flow declares. A destination name, a number off the end of the list, a decimal, nothing at all — every one of those is an illegal answer, and the call takes its declared failure edge instead of guessing. And no sentence may claim a completed action unless a write on the ledger licensed it.
test_a_router_that_returns_anything_but_a_legal_index_takes_on_failure feeds the router six illegal answers in turn and requires the failure edge and one recorded error every time; on the model lane, test_a_hallucinated_index_is_voided_evented_and_not_retried requires an out-of-range answer to be voided on the tape and not asked again. test_a_flow_that_reaches_the_confirmation_without_a_booking_goes_red rewires a flow so the confirmation is reachable with no booking behind it, and requires both the publish lint and the running call to refuse to say it.
tests/test_interpreter.py::test_a_router_that_returns_anything_but_a_legal_index_takes_on_failure
tests/test_model_lane.py::test_a_hallucinated_index_is_voided_evented_and_not_retried
tests/test_first_completion.py::test_a_flow_that_reaches_the_confirmation_without_a_booking_goes_red
Caller ID is a routing hint and never proof of who is calling. So before a caller has been verified the agent may confirm that they have an appointment with the organization — never the day, the time, the provider or the name. The rule is here because a spoofed number should not be able to find out where somebody is going to be.
The floor is not configurable, and a test proves an organization cannot lower it: test_ani_only_can_never_satisfy_a_content_disclosure takes every gate that discloses content, sets it to the lowest rung, and requires the platform to refuse the configuration by name and to name the decision in the refusal. test_a_disclosure_node_REFUSES_TO_SPEAK_without_a_rung_on_the_tape drives a real call to the disclosure with no verification recorded, and requires the node to refuse to speak.
tests/test_the_ladder.py::test_ani_only_can_never_satisfy_a_content_disclosure
tests/test_the_ladder.py::test_a_disclosure_node_REFUSES_TO_SPEAK_without_a_rung_on_the_tape
When a caller asks for something the flow has no branch for, the platform does not paraphrase it and does not throw it away. The words are stored verbatim as evidence, the event cites the turn they were said on and the options that were actually on offer, and the caller is offered a person.
test_an_unhandled_request_lands_citing_the_caller_turn_and_the_caller_words calls the live flow with a request nothing handles, then requires the recorded miss to cite the caller's own turn, to list the branches that were declared at that node, and to hand back the caller's exact bytes from the vault. test_an_unhandled_utterance_cannot_cite_a_turn_that_does_not_exist refuses a miss whose citation does not resolve, and test_an_unsupported_request_hears_the_human_first_offer holds the offer of a person.
tests/test_unhandled.py::test_an_unhandled_request_lands_citing_the_caller_turn_and_the_caller_words
tests/test_unhandled.py::test_an_unhandled_utterance_cannot_cite_a_turn_that_does_not_exist
tests/test_unhandled.py::test_an_unsupported_request_hears_the_human_first_offer
When several people are working the same list, an item is claimed exactly once. The winner is not picked by a check our own code runs and hopes about: the store refuses the second claim at the write, so the guarantee holds across a second process, a second server and a redeploy. Nobody rings the same person twice about the same thing.
A partial unique index over the claim's own subject is the referee, and the refusal is the append failing rather than a branch somebody could delete. test_RED_CASE_6_two_claimants_race_one_obligation_and_the_STORE_picks_one starts two real threads at a barrier, lets both of them fold the same unclaimed item, and requires exactly one row to land, the loser to learn it as a typed refusal naming who holds the item, and the item to be gone from the loser's next fold — not greyed out, gone. test_the_partial_unique_index_exists_over_the_SUBJECT_and_is_partial_on_the_KIND then reads the guard's definition back out of the schema, because a fence nobody can find in the database is a fence that can quietly stop being there.
tests/test_the_claim.py::test_RED_CASE_6_two_claimants_race_one_obligation_and_the_STORE_picks_one
tests/test_the_claim.py::test_the_partial_unique_index_exists_over_the_SUBJECT_and_is_partial_on_the_KIND
The most valuable thing on a screen gets the most room; everything else takes as little as it can without becoming harder to use. It is a design rule, and it is enforced the only honest way a design rule can be — as a number a test reads.
test_the_console_centres_in_its_column_and_its_chrome_rows_are_the_same_height reads the operator console's own stylesheet and requires three things: that the console's width follows the founder's ruling -- full width until 789, a centred 1,180 px column since, the customer door keeping the full width where its side pane earns it -- that the two rows of chrome above the work declare the same height as each other, and that the height is smaller than it was before the ruling. The same test requires the Roll's own width cap to be still standing, because a ruling may not widen a surface it did not name.
tests/test_console.py::test_the_console_centres_in_its_column_and_its_chrome_rows_are_the_same_height
Honest status
Most of this page describes architecture that exists, is under test, and has now taken real calls on our own phone number — and on one of them, booked a real appointment end to end. Here is the line between what is built, what is being built now, and what simply is not true yet.
Early access means small numbers of design partners, direct access to the build, and a real say in what the first flows look like.
Both go to the founder — a contact-center consultant, not a sales team.