[tlongwell-block]

Goose agents can join huddles with an optional voice model while using their existing ACP session for delegated tools. Voice defaults off on each device. The Goose settings dialog reads and edits OpenAI or Custom GPT-Live settings through goose's config and keyring.

The voice model also gets who the agent is: each start sends goose's per-start instructions (aaif-goose/goose#13375) with the agent's name, instructions, team and core memory, read from the host's core-memory cache. goose appends them after its own voice instructions, for that start only. A goose without the field ignores it.

The implementation reuses the Codex WebRTC/PCM media graph and shared settings controls. Typed work queues for the whole live interaction, including quiet gaps, and runs after voice stops and prompt cleanup finishes. Canceling an opening releases its lease while preserving existing typed work and tool authority. Before voice starts, the retained session selects the agent’s provider, model and thinking level while typed work is reserved. A failed selection releases the reservation without opening voice. Marked live transcripts stay out of typed responses.

Configuration saves and voice starts are serialized. Changing the endpoint requires a new key; failed writes disable voice; every start checks the local switch. Switch changes retire idle processes, and new work waits for shutdown before using a replacement. Endpoint/key edits keep the process, relying on goose reading credentials freshly on each start.

For development with a compatible build, GOOSE_ACP_BIN=/absolute/path/goose-acp just desktop stages local bytes and prints their SHA-256. The same macOS system-library check applies. Package builds refuse the override; a subsequent run without it restores the pinned release. The shipped pin remains 1.57.0.

Validation:

• Voice instructions 0dac5d614 (over a merge of main c9239f73): a runtime test pins the exact start text and a voice test pins the field on live-voice/start; both fail with the wiring removed. Goose suites 369 passed, 9 skipped; pnpm check clean; push hook 2,280 passed. Live through the ACP field to Frankie with a real 5.9 KB instructions + core memory payload, built from #13375: greeting addressed the owner by name 2/2, a hostname delegation returned a spoken result, and a control without the field gave the generic greeting. goose main 5bad61a8 accepts and ignores the field. Not yet run in a native huddle or on hosted OpenAI.
• Test-only follow-up 75096f8e0 removes Rust toolchain discovery from staging tests by supplying target fixtures; macOS library validation remains active. All 43 script tests pass. Single-file local duration fell from 504ms to 173ms (single samples). Hosted timeout resolution remains to be confirmed.
• Model-selection correction b556155fe: the new runtime regression fails on 318ed215 because no model/thinking settings are applied before voice opens. Goose/shared ACP tests pass 387 tests with 8 skipped after the fix, including selection-failure cleanup. Wren’s exact-head independent Goose/ACP run also passes 387/8 skipped, with review 9/9/9. Push hooks pass. Full fresh-cache suite: 19,527 passed, 22 skipped (1,035 files, 517.37s). Production code was unchanged during the run; one unrelated test assertion was restored to its original form, then the final runtime file passed 74/74 at the committed head. Eva’s native A2 rerun passes with the frontend at b556155fe, unchanged native binary at 318ed215, and goose 57fcbe3c: with the provider default restored, the session used the agent-selected model, ran hostname locally, and returned a spoken result.
• Integration head 318ed215395b606c5c8eeaa2eb1d8a6673bdd5a4: full Vitest suite passes with a fresh transform cache and four workers: 19,525 passed, 22 skipped, 1,035 files, 545.07s. HEAD verified before and after; working tree clean. All 43 script tests pass, including local staging, absolute/missing-path rejection and rejection outside development. Pre-push typecheck/related tests and design checks pass.
• Binary override independently reviewed at 9/9/9 on 7cebffc9, whose tree is identical to the integration head. Its three override tests pass; the full Node dev-command suite passes 45/45 when inherited TAURI_CONFIG is unset. With that variable set, two launch-resolution tests fail.
• Lifecycle head 1d7d43182: owner full Vitest run passed 19,522 tests with 22 skipped; final test-only lint cleanup separately passed 72 runtime tests. Independent re-review scored 9/9/9 for lifecycle correctness and Desktop guards. Its full run under heavy load had 69 failures and six unhandled errors; all 27 failing files then passed with two workers (1,515 tests). This is evidence of contention sensitivity, not an independently green full-suite run.
• Mutation controls catch missing switch-off abort, admission before failed storage, enabled launch env at either site, and missing whole-interaction reservation. The fake enforces goose's live-session reservation. Pre-start cancellation and delayed-process-shutdown regressions fail against their former implementations.
• Dawn’s direct ACP probes at goose 57fcbe3ca confirm the card’s read sequence returns a CLI-written endpoint and missing secret, and its OpenAI save sequence removes the endpoint. Native rendering of that state (D4) remains unverified.
• Browser inspection used actual settings components with fake ACP: light/dark, wide/narrow, enlarged text, keyboard focus and saving. This is component-in-host-fixture evidence, not native huddle acceptance.

Draft gates and limits:

• Voice instructions need goose #13375 in a release; until then the 1.57.0 pin and goose main start voice without them.
• Requires goose-acp with live voice, configurable endpoint/model, fresh secret reads and the goose.liveTranscript marker. The bundled 1.57.0 lacks these capabilities; the development override enables testing without changing the release pin.
• Native rig at 318ed215 connected the huddle seat and passed spoken A1, then exposed missing agent-model selection in A2. A2 now passes with the model-selection correction. Further native checks passed four consecutive delegated tool requests with spoken results, barge-in, leave/rejoin and key rotation (old seat survives, rejoin with invalid new key fails, restoring key succeeds). Owner-only input, stale-result rejection and human tryout remain open; the custom server still intermittently announces delegation without starting a tool run, and one spoken response exposed a thinking delimiter.
• Hosted CI at both earlier heads failed the same Drafts/sidebar geometry assertion in Chromium and WebKit (sidebar-geometry.spec.mjs:245). This PR does not change that surface; baseline causality has not been independently reproduced. At b556155fe, the staging test exceeded its five-second timeout in a JavaScript shard and flake check. The test-only follow-up removes unnecessary Rust discovery; its hosted checks are pending.
• Saving voice settings rewrites goose’s config.yaml in goose’s current format through its existing config migration.
• Independent goose CLI/desktop writes bypass Buzz's save/start serialization. Existing calls keep their endpoint/key until rejoin; turning the Buzz switch off ends them.
• Transcript chunks flush when the next message starts; the last utterance may be absent on leave. Protected agents do not support voice.

To try: launch with the compatible development binary, open agent settings → Voice settings → Voice, choose a provider, save endpoint/key/model/voice, enable Goose in huddles, and invite a Goose agent. Ask it to run a simple tool and speak the result, then leave and verify queued typed work succeeds.