Skip to content
Hussh
Connect MCP

One Voice Onboarding Journey — first-run setup

Public concept page defining the stages, visual map, and privacy boundaries for One's interactive first-run voice onboarding journey.

Concept

TL;DR: The voice onboarding journey guides users through secure authentication, phone verification, and tool-scoped setup, establishing their local vault with full user oversight.

Status as of 2026-07-13: see body.

Relations

Overview

The voice onboarding journey defines One's first-run interactive setup, establishing a secure, trust-first gateway for users. Under the sovereign design doctrine, the onboarding flow is structured around explicit user-owned capability milestones rather than continuous, unconsented data collection.

Operational Flow

The interaction sequence operates as a secure, coordinated chain:

  • Conversational Owner: The root Hussh One agent manages the ongoing user dialogue.
  • Pure Goal Resolver: Delegates setup tasks to the deterministic agent_onboarding specialist beneath One.
  • Generated Action Gateway: Passes permitted setup actions (e.g. Google/Apple authentication triggers or capability-specific Skip/Finish commands) to the frontend.
  • Browser Local Handler: Executes local actions (such as route transitions to static setups like /one/setup/gmail or /one/setup/location) on the device.
  • OAuth / Local Settlement: Completes verification and connector credentials locally on the client.
  • Correlated Settlement Event: Returns success status to the root One agent via the relay stream, grounding subsequent spoken turns.

To support robust, secure callback transitions, the browser persists an opaque onboardingCallbackAttemptId in Postgres during connector initialization. This correlates external OAuth redirections back to the active browser session, preventing forged or stale completions from affecting the user's active setup state.

Ownership & Boundaries

  • Conversational Head: The root Hussh One agent remains the sole conversational manager throughout setup.
  • Deterministic Onboarding Specialist: The specialist agent_onboarding operates as a manifest-driven, deterministic resolver beneath One. It receives redacted setup state and computes the next permitted step. To prevent voice turns from jumping boundaries, the specialist enforces tight action constraints (_CAPABILITY_TERMINAL_ACTIONS). While a specific capability (such as Location or Gmail sync) is active, only that capability's local Finish/Skip actions can be executed.
  • Authority Delegation: The generated action gateway on the frontend is the only entity permitted to trigger UI events. A voice action can never bypass native platform dialogs, biometric confirmations, or routing contracts.
  • Sovereign Boundaries: No credentials, transcripts, or personal records are transmitted back to the central server during setup. Complete database verification and cryptographic token exchanges are settled directly between local browser clients and the secure PCHP vault.

Sources

  • (none — synthesis only)