For the build team

Production architecture panel

None of this exists in the prototype. It describes what a real deployment would need before any pilot with residents.

Flow overview

press-to-talk  ->  consent check  ->  speech-to-text (session indicator on)
      |                                          |
      v                                          v
 policy / rules engine  ->  approved knowledge base  ->  spoken + captioned reply
      |                                          |
      v                                          v
 reminder workflow                        human escalation queue
      \__________  audit log + encryption + retention  __________/

Consent manager

Records purpose-specific consent, versioned notices, representative arrangements and withdrawal. Nothing processes without a valid consent record.

On-device wake action / push-to-talk

Default is press-to-speak. Any wake action runs on-device and never streams audio before activation.

Speech-to-text with session indicator

Explicit visual and audible session indicator, one-touch stop, audio discarded immediately after transcription.

Policy / rules engine

Deterministic guardrails: refuse medical, legal, financial and eligibility questions; block sensitive-data capture; force human escalation paths.

Approved knowledge base

Curated, reviewed answers from official and programme-approved sources, versioned with an owner and review date.

Reminder workflow

Consent-checked scheduling in Asia/Singapore, read-back confirmation, quiet hours, repeat caps, and a one-step off switch.

Human escalation

Queue to trained officers with service-hour transparency, fallback messaging, and clear emergency-service redirection.

Encryption

TLS in transit, encryption at rest, managed keys with rotation, and no plaintext transcripts in logs.

Access control

Role-based, least-privilege access for family and staff; time-bound grants; person-initiated revocation.

Audit logs

Tamper-evident records of access, escalation, consent change, export and deletion — readable by the person themselves.

Configurable retention

Short default retention with automatic deletion jobs, per-purpose overrides, and documented residency choices.

Prototype boundary

This site has no database, no authentication, no connectors, no analytics, no microphone, no telephony, no uploads and no external API calls. Every interaction is local scripted state in the browser.