Skip to content

SMS Journey

The SMS journey is the path from a Twilio inbound message to a committed turn outcome and any outbound text. Every durable concern in the runtime is a revisioned state machine advanced by a pure transition policy1.

Live Message Flow

flowchart TD
    A["Signed Twilio webhook"] --> B["Record durable inbound state"]
    B --> C{"Gate"}
    C -->|Boundary| D["Commit boundary outcome"]
    C -->|Allow| E["Enqueue Mira turn"]
    E --> F["Safety reading + turn reading"]
    F --> G["Decide"]
    G --> H["Look up"]
    H --> I["Write: one Luna request"]
    I --> J["Check: Jev judges the words"]
    J --> K["Commit"]
  1. The signed Twilio webhook passes its posted message fields to the inbound receiver, which records durable inbound state1.
  2. The gate handles hard boundaries before model reasoning, and boundary outcomes commit immediately1.
  3. Allowed turns enqueue the Mira turn action, which makes two Jev calls in parallel: a safety reading and a turn reading1.
  4. The safety reading is saved before anything else is written, so a crash cannot lose the safety floor1.
  5. The decide step is a pure function that applies the safety floor, decides the actions, and reads no generated text1.
  6. One Luna request writes the reply from the decision and the passages, and each sentence that states a passage fact ends with its passage tag1.
  7. After Luna writes, Jev judges Mira's words once, and an unsupported sentence rejects the complete draft through the existing recovery path1.
  8. Commit re-reads consent, safety hold, attempt ownership, and the revision of the touched loop and memories, applies the actions, then writes the reply and its code-written receipts1.
  9. A failed reply check, a writer failure, an unreadable Jev answer, or an expired lease recovers with a fixed template and opens a durable review1.

What Happens Before The Model

Boundary decisions are deterministic for exact STOP/HELP responses, pause and restart language, safety-hold blocking, obvious emergency, self-harm, poison, and abuse signals, and identity-sensitive account requests when identity is unverified1.

A paused or held caregiver's text, and a text from an unknown sender, gets the safety reading alone, with no turn reading, lookup, or Luna request1.

The safety reading is frozen for the turn, and a later check cannot lower a floor the message already set1. Safety is enforced at increasing-cost boundaries: deterministic gate decisions, the isolated safety reading and code's floor, the code-written route line, reply and action verification, and effect-preflighted commit1. The safety route line is written by code, never by Luna1.

Who Decides What

Code, not Luna, makes every choice about what to do: which actions, which items, which fact to ask, and what a reply kind is1. The knowledge catalog has four sources: benefits, resources, strategies, and guidance1.

Commit And Delivery

Commit re-checks channel state before creating an outbound outbox row, which protects against a caregiver opting out while the turn is running1. Transport owns delivery state, and later Twilio callbacks reconcile delivered, undelivered, and failed status1.

Consent is send-class based, so enrollment or a same-turn reply does not become blanket follow-up permission1.

The caregiver loop is deliberately small: one active loop stores the larger objective, one current action, the expected observation, and a stop condition1. Code opens a loop only from a step the caregiver stated in their own words1.

The caregiver starts an assessment, by a command or by assent to the delivered offer, and Convex rejects any other start1.

Signup

Web enrollment is a separate adapter, not an inbound turn or onboarding workflow1. Transport re-checks consent and safety before delivery and blocks stale welcome work after 15 minutes1.

  1. GiveCare. "GC-SMS Runtime Contract." Exact verified owner projection. Source -> ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩