Read the flow.
The gateway reads inline call-control objects or pre-fetches the configured origin before forwarding a passing request. Signed answer and branch callbacks check the flow after placement.
Pre-dial compliance interlock for the Vonage Voice API
Inspect a failing call flow before the carrier is asked to dial.
Route outbound creation requests through Preflight to check the flow your server is about to serve. A block or hold stops forwarding to the carrier; the verdict and action path explain why. The checks cite selected federal and Georgia provisions. They do not decide whether a call is lawful.
No language model decides: encoded structural monitors report true, false or inconclusive.
The reference application's flow, evaluated by the engine in this browser
The problem, on a real object
A deliberate timeout defect.
A call flow is a JSON object your server returns when the platform asks what to do. This reference application has a deliberate defect: its timeout branch ends without reaching the declared opt-out handler. It is a demonstration flow, not a real clinic or customer call.
The platform can ask your server for another object after a keypress or timeout. Preflight compares observed paths with the developer's declaration, so missing and undeclared branches can be inspected.
The check is narrower than its cited source. Matching a phrase does not prove identification is truthful; reaching a declared handler does not prove an opt-out was saved. Consent, exemptions and legal applicability require separate assessment.
The highlighted path fails the P3 structural check, which cites 47 CFR 64.1200(b)(3).
The block, live
Recomputed on every load.
These are decision counts from the deployed host, not counts of unique calls or confirmed placements. One call can produce several decisions. Reload and they recompute. Seals record dated commitments to a chain head, not a guarantee that every scheduled run succeeded.
...
block decisions
...
hold decisions
...
pass decisions
evidence log head …
reading the host…
reading the host…
How it works
From flow to decision record.
Run structural monitors.
The encoded properties check calling-hour facts, identification ordering, declared opt-out reachability and caller ID. Citations document their sources; a monitor result is not a complete legal determination.
Decide before the dial.
On the gateway, a false verdict blocks forwarding; an inconclusive result holds under strict policy. A pass allows forwarding, not guaranteed placement. An approved release can permit inconclusive monitors and requires a separate resubmission.
Measured, not assumed: pre-dial checks require the gateway. The answer webhook checks an already answered call; changing webhooks alone cannot stop dialing.
Write the receipt.
Decision records carry hashes and placement results. Scheduled jobs can seal a head to Sigstore Rekor and reconcile carrier records. Inspect each report's time window and outcome; a schedule is not proof that no call bypassed the gateway.
Dial it yourself
+1 943 244 5023
That number runs the deliberate reference flow. The builder confirmed speech through the iPhone Client SDK softphone; its matching ledger record showed answer-time intervention on an already placed call. Exact audio wording was not verified.
The optional Verify voice-code form is built but not verified on the builder's personal number. It requests consent to a demonstration call, not campaign consent. The private consent store retains the number; the public consent entry uses a keyed hash.
The browser softphone uses the Client SDK. Separate evidence: an iPhone screenshot confirms a test push, not a new held-call alert or closed-app delivery. The owned-number gateway check is a different test, not proof that this iPhone rang or stayed silent.
Sandbox
Paste an object. No account.
The engine runs locally in your browser. Paste a call-control object to inspect monitor verdicts and citations, with a witness path when a property fails. The result checks the encoded structure, not legal compliance.
A single object, not your whole flow. Discovery of the branches your server serves at runtime happens on the host, from traffic.
The tower says
…
The evidence
Inspect the recorded chain.
Each entry hashes its canonical form together with the previous entry's hash. A verifier checks internal consistency; comparison with a verified external seal can reveal changes to sealed history. It does not prove complete event capture or prevent a database owner from changing storage. Published CLI 0.2.0 predates the current source hardening; check the repository's release disclosure before using it:
npx preflight-interlock@0.2.0 verify-ledger https://preflight-api-rc34.onrender.comLast carrier reconciliation: reading the host…
Verify a recorded seal against the public log:
rekor-cli verify --uuid <the last seal's uuid, read from the log>Rate properties, from the platform's own event webhooks: reading the host…
Honest limits
What this is not.
Preflight verifies the structure of your call flow against a published set of rules. It does not verify consent, business relationships, or the content of what is spoken.
Coverage is reported as endpoints observed over endpoints declared. A branch never exercised has never been checked, and the header says so.
A rate center is a proxy for where the called party is. Mobile numbers travel.
The implemented gate records consent to a demonstration call. Personal-number Verify was not part of the verified demo. This is not campaign-level consent or durable opt-out record-keeping.
Compliance tool, not legal advice.