[longzhi]

Closes #162. Stacked on #169 (voice v1 with the session), which is stacked on #168. Each retargets to main as the one below it merges. The token endpoint is vibebuddy-cloud#15 (on staging); its wire format is in #171.

What changes

• When a box gets a token: it must be linked through the Relay and say VOICE DIRECT, and the computer must be signed in and recognizing through the voice service. The daemon then fetches POST /v1/voice/token for the box's key and sends it as {"event":"voice.token","token","expires_at"}.
  • It sends one at once, again whenever the box says VOICE DIRECT again (a new link or a reboot, since the box keeps the token only in RAM), and every 45 minutes for a token that lasts an hour.
  • It retries after a minute when the service gives none, and a 401 signs out.
• VOICE DIRECT is new. It's the firmware's way of saying it can call the service itself; the firmware side is Accounts: voice over the Relay through the link #163. Today's firmware answers any unknown voice.* event with voice.error "unknown voice event", so without this line no box is sent a token.
• With the user's own recognizer, no token is sent (Recognizer::is_voice_service). The box can't hold their key, so its audio keeps coming over the link (ADR-0018).
• docs/protocol.md gains a "Voice commands › Over the Relay" section and lists VOICE DIRECT among the hello replies. How the box hands over the transcript and plays replies on that path is left to Accounts: voice over the Relay through the link #163.

Checked

• cargo test --workspace --locked: all pass. The daemon has 340.
• New tests:
  • Account::voice_token against a fake service: the request, the session, and a 401 signing out;
  • the conditions, one at a time;
  • with a fake token service, a box on the Relay gets vbt1.t0, then vbt1.t1 right after it says VOICE DIRECT again.
• Reverse-checked: without the reset on VOICE DIRECT, the restart test fails.
• cargo clippy --workspace --all-targets --locked: no new warnings.
• Not on a box: no firmware says VOICE DIRECT yet (Accounts: voice over the Relay through the link #163).

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[longzhi]

Closed: the box no longer calls the voice service over the Relay, so it needs no voice token (ADR-0018 amended in #174, which now covers #163).