Delphi v0.9.17

Delphi v0.9.17 is a full platform cut after v0.9.16-patch2. It adds a Super Viewer role, speech detection (energy and Silero VAD), per-app recording artefacts, and much tighter hangup, transfer, DTMF, and SIP header behaviour. Operators get a max call duration with a spoken warning, seven.io SMS, hidden production Swagger, AMI trunk-health credentials, and categorized config backups. The list below is the user-visible work from this window, grouped by area — not every internal ticket.

Platformv0.9.17·Recommended SDKv0.1.5·Supported SDK range>=0.1.3 <0.2.0

Highlights

• Super Viewer — platform-wide read-only access; promotions and demotions still use the email challenge.
• Speech detection — energy or Silero VAD gates STT; mid-call barge-in and Azure segmentation timeouts apply immediately.
• Recording artefacts — choose call / STT / TTS audio and transcript JSON per app; TOBi conversation IDs stay on stored transcripts.
• Hangup and transfer signaling — bot-owned BYE reasons, documented SIP header budget, REFER and INVITE transfer, DTMF collect, SIP ladder text export.
• Call duration and TTS cache — per-flow max duration with a pre-hangup warning; cache on by default, disable per reply.
• seven.io SMS — FEATURE_SMS and SMS_API_KEY replace the Vonage variables.
• Operator hardening — Swagger hidden on customer-facing TelAPI, AMI trunk health, stale-server cleanup, config backup versioning, SigNoz 0.139.

Security and Sessions

• Super Viewer is a third system role beside Super Admin and Standard User. It sees the same platform surfaces as Super Admin, cannot write, and cannot start WebRTC or telephony sessions. TelWeb shows a read-only banner. See Roles and access and Users and teams.
• Promoting or demoting Super Viewer or Super Admin still uses the email challenge. Set PLATFORM_ROLE_EMAIL_CODE_SECRET (dedicated, ≥32 characters in production) on TelWeb and Tasker. Keep PLATFORM_ROLE_EMAIL_TASKER_READY=false until every Tasker replica can send the role-change mail — see the env var index.
• Super Admin password minimum remains 16 characters. Super Admins stay visible on Users with a Platform role column.
• Failed logins, lockouts, password changes, and platform role events appear in Access logs and can be exported toward SigNoz. Credential lockout still uses LOGIN_MAX_ATTEMPTS_CREDENTIALS and LOGIN_LOCKOUT_MINUTES_CREDENTIALS.
• Password-expiry reminders and the forced-change path continue through Tasker. Set NEXTAUTH_URL to the public TelWeb origin on TelWeb, Tasker, TelAPI, and TelPhi so expiry and usage emails use the same links. See Password expiry.
• Audit rows still default to a 180-day cleanup (AUDIT_LOG_RETENTION_DAYS).
• PII redaction in TelWeb and SigNoz stays the default. Recording artefacts on S3 are a separate retention choice — see Recording and transcript storage.
• Security events can be exported for SIEM ingestion — see Security event export.
• Create-user + invite + welcome-setup was restored on the hosted staging path. Customer C2 create-user was not re-certified from staging.

TelWeb

• Team Members can open Notifications. Save and publish still follow Members can publish Apps — see Draft and publish.
• Copying a flow to another team takes the latest published definition only and drops Flow Builder assistant history.
• Team Variables stay hidden on plans that do not include them. Entitled teams show the tab with masked secrets; Super Admin can still bypass.
• Settings tabs no longer bounce while entitlements load.
• Teams on a complimentary / unlimited plan no longer send Members to /activate-billing.
• Conversations Debug can search by Trace ID, header value, or conversation ID.
• You can export the SIP ladder as text from the conversation Debug tab (this was not part of v0.9.16).
• Debug log and ladder rows still show time-of-day only. The API createdAt field is full ISO — a follow-up will show the date on each row.
• Super Admins use Config versioning & backups for categorized backups (including header manipulation, server groups, and notification types) and identity restore.

Voice, SIP, and WebRTC

Speech detection and barge-in

Flow call handling can enable speech detection. auto uses Silero when AudioProc is connected (audioPreprocessing / AUDIOPROC_ENABLED) and the energy detector otherwise. A broken AudioProc session falls back to energy — the call continues.

• Mid-call bargeIn: false applies immediately. It is no longer queued behind the current announcement.
• Continuous ASR flushes multiple STT finals into one utterance.
• Azure sttSegmentationSilenceTimeoutMs is honoured on publish and mid-call from bot sessionParams.
• Three-or-more-word barge-in is the verified interrupt path. Single-word suppress during playback was not proven in this window.

⚑Feature required: audioPreprocessing

This feature is gated. Operators enable it per deployment in the Delphi Portal; if the flag is off, the surface described below is hidden from the UI and rejected by the API. See Feature flags for the full registry.

Hangup, transfer, DTMF, and SIP headers

Hangup prefers clearing the call over failing closed on header problems.

• Bot endConversation reason / reasonCode win over the Flow Settings default. The egress BYE carries a SIP Reason and optional custom headers.
• Custom BYE headers stay inside the documented SIP header budget: 47 headers, 4,096 characters per line, 12,000 total. Over-budget payloads drop the extra bot headers (headerTooLong / headersTooLong) and still disconnect. In-budget sets (including empty Genesys-style values) stay on the wire.
• Farewell audio plays at hangup when configured; turning wait-for-silence off does not play farewell mid-call. Hangup after a long period of caller inactivity is not in this release — only farewell waitForSilence after the bot goodbye.
• Blind REFER and attended INVITE transfer keep Reason and custom headers on the egress leg.
• Incoming prefix/split channelData rules and outgoing DID header-manip (for example X-VGW-Environment) remain live only after you Publish — see TOBi managed LLM and SIP header context rules.
• DTMF collect supports dtmfCollectInterDigitTimeoutMS. Collected digits show on the conversation ladder. DTMF is reconstructed onto the call recording when that artefact is selected.

Duration, recording, TTS, and retry

• Per-flow max call duration and an optional warning spoken about ten seconds before hangup override the voice-host fallbacks MAX_CALL_DURATION_SECONDS (default 7200) and MAX_CALL_DURATION_WARNING_MESSAGE. See Call handling properties and the env var index.
• Apps pick recording artefacts independently: full-call processed/raw audio, STT/TTS turn audio, and transcript JSON. Stored call-transcript.json keeps the TOBi conversation id. See Recording and transcript storage and Recording output.
• Bots can suppress stored transcript text with sensitiveInfoOnStorage.
• Azure TTS forwards SSML when Use SSML is on.
• The platform TTS cache stays on. A bot can set activityParams.disableTtsCache for one reply — see TOBi managed LLM.
• BOT create retries retryable provider errors and fails closed on non-retryable codes. Azure STT/TTS WebSockets reconnect after abnormal 1006 closes under load.

Trunks, TLS, and capacity

• SIP trunk health uses the Asterisk Manager Interface. Set AMI_HOST, AMI_PORT (8038), AMI_USER, and AMI_SECRET so TelPhi and TelSys share one login — see the env var index.
• Edge SIP TLS on :5061 and Tasker edge-tls-renew remain the operator path for Let’s Encrypt materials. A Genesys Cloud TLS handshake against a customer C2/VGW path is not certified from staging Let’s Encrypt.
• EGRESS_TLS_REJECT_UNAUTHORIZED now also applies to direct (NO_PROXY) HTTPS egress. Leave it true in production.
• Single-voice load certification from this window: about 100 concurrent PCMA on one voice host, about 200 after a 2× scale-out. Saturation cuts the last turn rather than leaving named 110/128 errors. See Load testing.

TelAPI and SDK

⚑Feature required: apiAccess

This feature is gated. Operators enable it per deployment in the Delphi Portal; if the flag is off, the surface described below is hidden from the UI and rejected by the API. See Feature flags for the full registry.

• When FEATURE_API_ACCESS=false, TelAPI keeps health, SIP trunk health, and webhooks and does not register SDK session or runtime routes.
• /documentation is a separate switch. TELAPI_SWAGGER_UI_ENABLED=false hides Swagger and the live OpenAPI JSON. Use the versioned API reference on this site. Both WebRTC and webhook-only profiles were regenerated for 0.9.17.
• TOBi callbacks require the token header. A query-string token is rejected with 400 (it does not feed the credential jail). Unused callback fields are marked in the OpenAPI document.
• Mid-call STT segmentation timeouts reach TelPhi. endConversation includes reason and reasonCode. tobiConversationId is present on TOBi callback and hangup/DTMF paths.
• GET /api/v1/usage/tts-characters reports TTS character usage with READ_TEAM_USAGE — see Usage.
• The recommended TelPhi SDK is 0.1.5 (Browser Targeted Actions, shipped with v0.9.16-patch2). This release does not add a new SDK package. 0.1.3 and 0.1.4 remain supported for clients that do not need BTA, text chat, or handoff APIs. See SDK compatibility and the SDK reference.

Flow Builder and Conversations

• Call handling covers speech detection, max duration, DTMF inter-digit timeout, and recording artefact chips.
• Provider retry, bot-delay failover, and transfer restrictions use seeded resilience defaults. Empty admin settings can be re-applied with the setup CLI --apply-missing flag.
• Managed TOBi flows support the draft → publish → live-call path, including Application Metadata and inbound channelData rules after publish.
• Copy-to-another-team no longer carries Flow Builder assistant history.
• Caller-silence hangup (hang up after a long period of caller inactivity) is not in this release.

AI Providers and Audio

⚑Feature required: ttsMediaCache

This feature is gated. Operators enable it per deployment in the Delphi Portal; if the flag is off, the surface described below is hidden from the UI and rejected by the API. See Feature flags for the full registry.

• TTS media cache is on by default and can be seeded on existing installs. Disable per reply with disableTtsCache, or for the whole call with update_tts_config / ttsCaching: 'off'.
• Azure Flow Builder requests omit temperature and honour the configured Azure endpoint.
• TTS gateway concept and recording-output operator pages are in this docs version — see TTS gateway.

Observability and Operations

• Access and security events export to SigNoz — see Security event export and Audit logging.
• TelPro, TelSys, and RTPEngine SIP appear on the conversation ladder and in SIP trunk log reference. See also SIP signaling reference and Application flow logging (logType + recordKind).
• transactionId is propagated on SIP headers, the Redis stream, and OTel spans so a single call can be searched across TelPhi, TelPro, TelSys, and TelAPI.
• Call-detail / session-summary metrics are recorded for completed calls — see Call detail records.
• Alarming and monitoring guidance is on SigNoz monitoring and Action success monitoring.
• SigNoz ships 0.139 with restored alert-rule sync (SIGNOZ_API_KEY) — see Version sources.
• Tasker STALE_SERVER_CLEANUP removes silent Voice/API inventory rows after STALE_SERVER_HEARTBEAT_SECONDS. Scaler scale-down no longer hits ElastiCache CROSSSLOT on that path; scale-up API hosts are no longer treated as Terraform-protected.
• Runtime database traffic stays on DATABASE_URL; migrate uses MIGRATION_DATABASE_URL — see Database credentials and Backup / restart / rollback.
• Recovery, seeder reset, and platform-settings apply-missing paths are documented on the setup CLI.

Billing and Platform Settings

⚑Feature required: sms

This feature is gated. Operators enable it per deployment in the Delphi Portal; if the flag is off, the surface described below is hidden from the UI and rejected by the API. See Feature flags for the full registry.

• SMS uses seven.io. Set FEATURE_SMS=true and store SMS_API_KEY on the Ops host; allow HTTPS egress to gateway.seven.io:443. There is no provider-specific sender variable. Removed: VONAGE_SMS_FROM_NAME, VONAGE_SMS_API_KEY, VONAGE_SMS_API_SECRET. See SMS delivery.
• Teams on a complimentary unlimited plan skip the Member billing-activation gate.
• Usage and overage notification emails link to Subscription and the Dashboard (not a dead billing settings path).

Operators

Upgrade action

Run voiceai-db-migrate before restarting application services. This release adds Super Viewer, config-version categories, and per-app recording artefacts. Existing apps that already had Recording on are backfilled with the full artefact set — narrow the chips in TelWeb if you do not want every output.

Vonage SMS variables removed

Replace VONAGE_SMS_* with SMS_API_KEY and enable FEATURE_SMS before the first SMS after upgrade. See SMS delivery and the env var index.

Platform role email

Keep PLATFORM_ROLE_EMAIL_TASKER_READY=false until every Tasker replica can send PLATFORM_ROLE_CHANGE_CODE_EMAIL. Production TelWeb and Tasker need a dedicated PLATFORM_ROLE_EMAIL_CODE_SECRET of at least 32 characters. See the env var index.

Live Swagger

Customer-facing TelAPI should keep TELAPI_SWAGGER_UI_ENABLED=false. That flag does not follow FEATURE_API_ACCESS. Use API reference for the pinned 0.9.17 OpenAPI snapshots.

AMI trunk health

If SIP trunk health shows AMI authentication failures, align AMI_USER / AMI_SECRET / AMI_PORT on TelPhi and TelSys. The default port is 8038, not 5038.

Notification links

Set NEXTAUTH_URL to the public TelWeb URL on TelWeb, Tasker, TelAPI, and TelPhi.

Upgrade checklist

1. Run database migrations (voiceai-db-migrate / your standard pipeline) with MIGRATION_DATABASE_URL, then restart application services on DATABASE_URL — see Database credentials.
2. Re-run setup seeders with --apply-missing so existing installs receive resilience defaults, transfer restrictions, TTS media-cache settings, notification template links, and STALE_SERVER_CLEANUP — see Delphi setup CLI.
3. Confirm PLATFORM_ROLE_EMAIL_CODE_SECRET and set PLATFORM_ROLE_EMAIL_TASKER_READY=true only after Tasker is on this release. Promote a test user to Super Viewer and back.
4. If SMS is in use, migrate to SMS_API_KEY, set FEATURE_SMS=true, allow gateway.seven.io:443, and send a test message — see SMS delivery.
5. Set voice fallbacks MAX_CALL_DURATION_SECONDS / MAX_CALL_DURATION_WARNING_MESSAGE if you rely on the platform cap instead of per-flow values.
6. Align AMI_HOST, AMI_PORT, AMI_USER, and AMI_SECRET on the Voice host. Enable AudioProc when you want Silero speech detection.
7. Review per-app recording artefacts after migrate — Recording-on apps are backfilled with all seven outputs.
8. Keep TELAPI_SWAGGER_UI_ENABLED=false on customer-facing API hosts. Review FEATURE_API_ACCESS separately if the deployment is webhook-only.
9. Set NEXTAUTH_URL on TelWeb, Tasker, TelAPI, and TelPhi to the public TelWeb origin.
10. Leave EGRESS_TLS_REJECT_UNAUTHORIZED=true unless a known self-signed egress target requires otherwise.
11. Point Super Admins at Admin Settings → Backups and confirm a restore in staging.
12. Upgrade integrator SDKs to 0.1.5 when adopting Browser Targeted Actions. No additional SDK publish is required for v0.9.17 itself.

What is not in this release

• Hangup after a long period of caller silence (only farewell waitForSilence after the bot goodbye).
• Full ISO date on each Conversations Debug log/ladder row (time-of-day is shown; API timestamps are complete).
• Genesys Cloud TLS handshake against a customer C2/VGW path (staging Let’s Encrypt :5061 is not that failure mode).
• Per-error-code cognitive-service retry beyond BOT create retry / non-retryable fail-closed.

SDK compatibility

Component	Version
Platform	v0.9.17
Recommended TelPhi SDK	0.1.5
Supported SDK range	>=0.1.3 <0.2.0

No new SDK package is required for this platform release. Pin 0.1.5 if you use Browser Targeted Actions introduced with v0.9.16-patch2.