The agent works. The intake never reaches it.

This is the finding that should stop a launch. The service has handled 72 sessions. The database the admin page reads contains zero of them, and the file itself was born one minute after the last lead was written.

• agent.log — 22:03 lead written for a live call; 19:57:32 "filled from transcript on lead d171ea9f777c".
• voice.db — 98,304 bytes, mtime 19:58, schema only. App files written 19:56–19:57; service restarted 19:58.
• find / -name "voice.db*" — one file. No backup, no snapshot, no export.
• Workspace source has no data/ directory, so any tree-sync from it to /opt/arnow-voice deletes the production database on the next restart. That is the likely sequence here; the file's creation time is the proof it was replaced, not edited.

A lead store that can be deleted by a copy command is not a lead store. The agent is the only part of this system that cannot be rebuilt from source.

The demo lives on its own subdomain. The business site does not reference widget.js or ArnowVoice anywhere, and if it did, the browser would refuse the microphone.

• Homepage: grep -i 'ArnowVoice\|widget.js' → 0 matches.
• Response header: permissions-policy: geolocation=(), microphone=(), camera=().
• CSP: script-src 'self' https://analytics… and connect-src 'self' … https://intake… — no voice host.
• README: "Styles for the widget live in the demo page today; move them into widget.js before embedding on a light-background page."

So the one thing the agent was built to prove — that a visitor can talk to it from the site — is the one thing a visitor cannot do.

The admin page is built by string interpolation. Only the research blob is escaped; every field a caller controls is not.

# bot.py, admin row()
f"<tr><td>{r['created_at']}</td><td>{badge}{chip}</td><td>{r['name'] or ''}</td>"
f"<td><b>{r.get('phone') or ''}</b></td><td>{r['email'] or ''}</td>"
f"<td>{need_html}</td>…"

• need_html includes summary, next_action and commitment — all model output derived from speech.
• The admin token is in the URL, so the link you click is the link that executes.
• Admin renders with a 200 and the row when given the token; no CSP on that page.

"Resume where we left off" is a good feature with a weak lock. The reference number is 4 digits, and it returns a stranger's full brief.

• find_by_pin returns name, business, phone, email, details and the last four transcript turns.
• Three attempts per session, but a new call resets the counter; the web leg allows 6 calls/hour per IP.
• ws://…/ws/twilio?from=+1… trusts a caller-supplied number, so caller-ID recognition can be spoofed without touching Twilio.
• PIN space is 9,000 (1000–9999) before the schema silently falls back to six digits.

The marketing site's custom error handler is itself failing, so missing paths return "server temporarily busy" instead of 404. That is an SEO and trust problem, and it is hiding dead links.

Section 8 of the system prompt contains a literal example: "I've got you at nine two nine, three seven four, two seven nine seven — is that the best number?" That is the Twilio line, not the caller's number. On the browser leg there is no number on file at all.

• save_intake has no phone property, so the instruction "if they correct it, save the new number" cannot be obeyed.
• Only take_callback accepts a phone, which creates a callback row instead of enriching the lead.
• The same prompt runs on both channels; only CHANNEL_NOTE differs.

The phone channel note says to open with "Thanks for calling Arnow Solutions, this is Kimberly." The actual spoken opener is generated from GREETING["phone"], which is byte-identical to the web greeting and asks "Are you calling about design…?" — an odd question for someone who just dialled you. The model is then told its opening line has already been delivered, and separately told to open with a different sentence.

• GREETING["phone"] == GREETING["web"] — same string, verified in source.
• CHANNEL_NOTE["phone"] instructs a different opener.
• README claims the bot says "Thanks for calling Arnow Solutions, this is Kimberly." It does not.

MAX_CONCURRENT = 3 is checked in /api/offer only. Twilio calls go straight to /ws/twilio and start a pipeline regardless of load. There is also no fallback TwiML: if the app is down or saturated, the caller gets dead air or a Twilio error, not a message and a callback promise.

• Concurrency check appears once, inside the WebRTC offer handler.
• No X-Twilio-Signature validation on the webhook or the socket.
• No status_callback on the number, so failures are invisible outside the CDR.
• Number has SMS enabled with an empty sms_url: texts disappear silently.

Every call is transcribed, stored with the caller's email and company, and enriched with public-source research. The page says "Nothing records until you press" — true of the microphone, misleading about storage. There is no retention window, no deletion path, and no line telling the caller what happens to their words.

• calls.transcript holds the full message array indefinitely.
• Post-call, research.lookup() scrapes Bing for the caller's company and appends it to the lead.
• No privacy line on the voice page or the written form.

A network-facing Python service with an LLM key in its environment should not be UID 0. Separately, startup loads Whisper and Kokoro even though both are unused when Deepgram keys are present — about 690 MB resident for models that never run.

• ps — uvicorn PID runs as root; unit has no User=, no ProtectSystem, no NoNewPrivileges.
• MemoryCurrent 726,245,376 bytes with Deepgram active.
• voice.log uses append: with no rotation (385 KB in five hours); disk is 90% full, 21 GB free.
• The admin token appears four times in the access log because it travels in the query string.

Responsiveness is the whole product. PipelineParams(enable_metrics=True) is set, but the log level is INFO, so metrics are emitted at debug and never written. There is no per-call latency, no TTS seconds, no cost estimate, and no alert if the service stops answering.

• No metrics table; calls stores only seconds, turns, transcript.
• systemd has Restart=always but no ExecStartPost health probe or external watchdog.
• Health endpoint reports counts but nothing consumes it.