Merlin is the voice agent answering our own front door: the assistant a visitor talks to at merlin.artificersai.com, embedded live in the intake page at artificersai.com. It is also the proof of something bigger. Behind Merlin sits a suite that compiles purpose-built voice agents, an intake agent, a sales and booking agent, an agent that gathers the details you would normally book an interview to collect, and deploys them on the fly, each one treated as software to be compiled, tested and signed, not a prompt edited in place.
The problem
A voice agent that talks to prospects carries real risk the moment it goes past a demo: a prompt tweak that ships straight to production with nobody checking it, a tool call that leaks a caller's name into a model message, a bad deploy with no way to prove what actually shipped. Putting Merlin in front of real enquiries meant holding it to the same discipline we would expect around any other production service: versioned changes, a real test suite, and a deploy path that cannot push code nobody reviewed.
What we built
Two agent variants run today: the intake conversation live at merlin.artificersai.com/intake, and a sales and booking variant behind it. Both are compiled from the same suite, so a new variant, say one that runs a structured client interview and hands you the transcript and the structured answers, is a new project through the same pipeline, not a new build. Merlin runs on OpenAI's Realtime API. The browser opens a direct WebRTC audio channel to OpenAI, and Merlin's own Node server joins the same call over an authenticated sideband to run tools, check business rules and steer the conversation, so the audio itself never has to proxy through our infrastructure.
Behind the public agent sits Forge, a private authoring and deployment control plane. A new agent project, its prompt, its tools and its test scenarios, is written by hand, then run through a 7-package pipeline (project-schema, project-service, project-compiler, tool-catalog, tool-sdk, runtime-kernel, deployment-control) that compiles it into an immutable definition and commits it under a canonical SHA-256 hash before it is ever allowed to run. Nothing reaches production off the back of an edited prompt file. It reaches production off the back of a hash anyone can check.
How it runs
Four isolated worker processes keep the risky parts away from the main service: one runs untrusted custom tools in a sandbox, one gates every outbound network call against a network policy, one runs a project through a text-only simulated trial before it goes anywhere near a caller, and one holds the only path to a live deploy, authenticated with HMAC-signed envelopes and canary-only, meaning it accepts a change tied to a proven clean commit on origin/main and nothing else.
Identity capture is deliberately narrow. A caller's name, email and organisation are held in a private server-side capture store and are explicitly forbidden from ever appearing in a model message, a tool argument or a spoken recap, so the model itself never has to be trusted with the one piece of information most worth protecting. 140 test files run per workspace on every change, gated by a full-suite merge check. The latest run before publish passed 909 of 913, with the four failures tracked, not hidden.
Under the hood
An internal audit log tracks defects the way a serious engineering team should, graded by severity rather than smoothed over for appearances: one entry covers PII-retention governance, another covers idempotency on a booking-system mutation, and both sit in the same register as every other finding, good or bad. A SIGTERM or SIGINT drains every active call, hangs up authoritatively on OpenAI's side, and force-closes anything stalled, inside a bounded shutdown window, so a deploy never leaves a caller stranded mid-sentence.
What changed
Merlin went from a prompt anyone could edit in place to an agent that ships the way software should: compiled, hash-signed, tested, and deployed through a worker that only accepts a proven commit. A caller's personal details never reach the model. A failing test blocks a merge before it can ever reach a real conversation. The audit trail is something we would hand a client, not something we would hide from one, because it is exactly what we tell clients to build for their own agents.
The same suite is how we ship voice agents for clients. Tell us the conversation you need handled, intake, sales, or the structured information gathering you would otherwise schedule an interview for, and we compile a purpose-built agent for it and deploy it into your workforce, on the fly, through the same signed pipeline that runs our own front door.
