CounterCall

Architecture

Four refusals guard one phone call.

The happy path is four CALL-E Goals API calls. Everything else on this page is the machinery that stops a wrong checklist from reaching someone who is about to cross a city on the strength of it. Two refusals fire before the phone rings; two more fire after it is answered.

step before anyone has answered refusal — renders no checklist a clerk said this out loud
You name the office and procedure no personal data is ever sent preflight.mjs validate · diff contract · mint key Is the number in the seed file, with a published source? no REFUSE — exit 3 never infer a phone number goals.get read the LIVE published contract Does it still match the contract we pinned? drifted REFUSE — re-pin first a stale schema dials a real person goals.run + Idempotency-Key ☎ the phone rings here · once per day goals.waitForResult poll to a terminal outcome A result, or a terminal GoalRunError? error renderFailure 8 of 8 codes · never a partial card Valid against the pinned schema, every field? invalid REFUSE — result_invalid additionalProperties: false valid renderCard 6 typed fields + the verbatim clerk quote a row nobody answered stays empty Every red path renders NO checklist — a half-parsed list is worse than none, because it gets acted on. goals.list runs separately, discovering the published procedure catalogue.

Every surface, and where it lives

Seven measured CALL-E surfaces. Line numbers re-measured against v1.0.0; scripts/verify_live.mjs holds the same table and checks it against the live service.

Discover the catalogue

goals.list

Lists the published Goals. This is the reuse mechanism itself — the thing that makes a procedure library possible rather than a single hard-coded script.

scripts/verify_calle.mjs:49

Read the live contract

goals.get

Fetches the published input_schema and result_schema before every dial, not once at deploy time. Costs one API call and converts a silent wrong answer into a loud refusal.

skills/countercall/scripts/preflight.mjs:45

Place the call

goals.run

The only method that makes a phone ring. Carries a business-stable idempotency key, so a retry after a crash can never double-dial a public line with a queue in front of it.

skills/countercall/scripts/call.mjs:70

Wait for a terminal outcome

goals.waitForResult

Polls until either a result or an error exists — never both, never neither. There is no timeout that quietly returns a partial answer.

skills/countercall/scripts/call.mjs:74

One call per day

Idempotency-Key

countercall:{office}:{procedure}:{date}:v1 — business-stable, not a random UUID. A key that changes on retry is a bug, not a workaround.

skills/countercall/scripts/_lib.mjs:62

Refuse on contract drift

diffContract

Compares the pinned contract against the live one and refuses the dial on any mismatch. Dialling a real person with a stale schema returns a result that looks fine and is quietly wrong.

skills/countercall/scripts/_lib.mjs:39

Route every failure

GoalRunError.code

All eight published codes map to distinct, honest outcomes. Not one of them renders a partial checklist.

skills/countercall/scripts/render.mjs:102

Render the evidence

renderCard

Six typed fields plus the verbatim line the clerk said. A field nobody answered renders empty and grey — never a typical value, never quietly dropped so the gap disappears.

skills/countercall/scripts/render.mjs:57
no_answerdeclinedresult_invalidresult_unavailable result_failedtimed_outcall_failedcanceled

Why the schema is the product. The phone call is the part CALL-E handles. The hard part is the contract around it — pinning it, diffing it before every run, refusing gracefully when it moves. validateResult and renderCard are the decision function that must never be wrong, so they are verified across the entire input space the contract permits: 1,296 valid results, 1,296 rendered cards checked for invented values, 8,208 single-field corruptions rejected and 720 unexpected-key injections rejected — 11,520 cases. The sweep found a real defect while it was being written: an empty clerk_quote validated clean, which would have rendered a card that looks sourced and is not.