Demo · sample data, no client data — governance model mirrored from the real repo (calm-line-platform → withstillwell.com), run against one fictional household.
Stillwell — the answering line that fails closed
Stillwell answers a family member’s call when the primary caregiver can’t, using a finite library of caregiver-approved messages. This demo steps through one fictional call and shows the code-enforced rules firing in order: consent that can be revoked and denies the very next call, a truthful answer the instant someone asks who’s calling, and a deterministic family-alert ladder — not a policy document, a state machine.
What it does
Answers when the caregiver can’t, from a finite approved-clip library — sometimes in the caregiver’s own cloned voice. Consent gates admission per call. A direct identity question gets a truthful answer on the first ask. Risk opens a deterministic family-alert ladder instead of an ad hoc page.
Inputs
An incoming call from an enrolled number · the household’s signed consent documents · the completed onboarding teach-back · the ranked escalation contact list.
Outputs
An admitted or refused call · a spoken response drawn only from the approved clip library · a content-free event on the caregiver dashboard · and, when risk fires, a timed sequence of family notifications.
Household control center
Proposed portfolio interaction · mirrors verified controls, not a production screenshot
Service statusDemo controls ready
Next consent checkAt the start of the next call—not at the next release.
Open family alertNone in this fictional household.
Reasoning routeBounded conversation policy with emergency detection first.
Voice selectionOne consented voice per household; no cross-account pool.
Change authorityCaregiver proposes; consent and safety gates decide admission.
Stored after hangupStructured summary only—no audio or verbatim transcript.
Human in the loopFamily closes alerts; representative review receives failed teach-back.
DeletionVoice biometric deletion due within 30 days of revocation.
Step through the call
The scenario reads the Consent Center’s live state at the moment you press Run — revoke a document first, then run it, to watch the refusal branch render instead.
Governance ledger — rules fired, in order
Escalation ladder — deterministic, not ad hoc paging
Ported unchanged from the real ladder’s rules: notify the primary immediately, wait 45s per backup, repeat the full round every 5 minutes, hard cap at 60 attempts across 30 minutes — then it stays open until a human closes it. It never quietly resolves itself.
t
pass
contact
channels
why
Consent Center — fails closed
Every check reads “is this signed,” never “is this not revoked.” A missing, null, or half-read document denies the call by construction — try revoking Voice Clone Consent below, then re-run the scenario.
Onboarding teach-back
Direct consent is only obtained after the loved one explains these seven facts back, unprompted. A single “not understood” blocks consent outright — it routes to representative review instead of a lower bar.
Voice-donor biometrics
Encrypted at rest, per-family key
Never pooled, never used cross-account
Deleted within 30 days of revocation
Allowed vs. prohibited
Allowed
“Hi Nora.” · “I love you.” · a real Sunday-at-two visit, caregiver-recorded and approved in advance.
Prohibited
Claiming to be the caregiver live (“it’s really me”) · inventing a visit that isn’t on the calendar · promising 911 was called.
Caregiver summary — never the transcript
The model below only ever receives a short list of topic tags, never the words spoken. There is no verbatim transcript for it to leak, because none exists past hangup.