Guest-facing Lucia can convert public guest conversation into structured operational_signal v0 payloads that the operator system can review without pretending unverified guests are linked to bookings.
Current Implemented Signal Path
Current guest operational signal bridge:
guest-facing Lucia conversationoperational_signal v0server-side signed POST from guest agentEngine /v1/guest/signalssafe Engine persistenceAdmin /admin/dashboard sections.guest_signalsAdmin Signal Stream guest signal rendering
Guest signals are operational clarity, not automatic booking truth.
Signing Boundary
Guest agent signs and POSTs guest signals server-side.
Core boundary:
public browser does not own signal authenticity
guest-agent server function owns signed delivery
Engine verifies signed guest signal intake
Identity Normalization
Engine normalizes guest signals into explicit identity/linkage contract fields.
Anonymous/unlinked defaults:
unknown_or_anonymous
not_applicable
unlinked
public_only
review_only
no mutations
claimed_booked_guest
guest_claimed
candidate_booking
operator_link_required
no mutations
verified_booked_guest
verified_booking
booking_action_allowed
still no unrestricted Full Booking mutation
Admin Display Contract
Current Admin behavior:
guest signals render in Admin Signal Stream
actionable guest signals are visible before collapsed rows
unlinked guest signals show honest review/link language
candidate/unlinked guest signals do not fake DAW routing
linked/verified signals may eventually route to DAW when safe
guest signals can seed Focus Ops context
review this guest signal
candidate booking claim
operator link required
unlinked public guest signal
booking verified
guest attached
DAW ready
record updated
Focus Ops Boundary
Guest signals may seed Focus Ops context.
Focus Ops must not let candidate or unlinked guest signals drift into similar existing bookings.
In particular:
service overlap is not identity evidence
airport pickup overlap must not attach an unlinked guest to Luca/Nora
See Also
