Full audit of the proposed voice + reservations build, checked against our actual stack, credits, and vendors. Verdict first, then a ranked punch-list the eng team can work straight off.
This is a genuinely strong audit. The security gate, the "build on the two live repos, archive the dead three," and the pay-by-link / no-spoken-PAN payment design are all correct and I wouldn't touch them. But it has one headline blind spot that undercuts its own thesis, plus a few stack-alignment misses that cost us money and a vendor. Here's the punch-list, ranked.
The plan lovingly moves the whole datastore to Cloudflare for a "modern edge stack," but Knightsbrook is an Irish (EU) property, so every call recording, transcript, and guest PII is GDPR-regulated personal data. I verified it: Retell has no EU data residency â it stores everything in US AWS, GDPR-covered only via SCCs, not physical residency. So the voice brain leaks 100% of guest PII to the US while we congratulate ourselves on an edge datastore. The doc never mentions this.
Fix: sign Retell's DPA + SCCs, set the agent's storage mode to "Everything except PII" with PII scrubbing (or disable recording storage), set short retention, and put "EU-hosted voice (LiveKit/Pipecat on EU infra, or Vapi-EU)" in the risk register as a real phase-2 evaluation, not a footnote. This belongs in §3 as a compliance blocker, not §6 as an afterthought.
D1/R2/KV EU data residency is real but only settable at creation and irreversible after (wrangler d1 create --jurisdiction=eu, R2 .eu.r2.cloudflarestorage.com). The plan names Cloudflare but never the jurisdiction flag. Miss it on day one and you rebuild the whole data layer.
Fix: one line in §4.1, but a load-bearing one â set the --jurisdiction=eu flag on every store the moment it's created.
The plan names Twilio for both PSTN and the SMS pay-link. We have $20K in Telnyx credits, it's already our carrier, and Retell ships a first-class Telnyx SIP integration (dedicated setup guide, elastic trunk). Route (a) the PSTN trunk into Retell, (b) the mid-call SMS pay-link, and (c) an Irish +353 inbound number all through Telnyx. That deletes the Twilio line-item, spends credits instead of cash, consolidates to one vendor, and Telnyx's EU numbers/PoPs help the telephony-leg residency story too.
We hold $100K Deepgram credits. Note it as the STT path if/when we move off Retell-hosted (relevant to the EU-voice evaluation in #1 â Deepgram has EU endpoints). Minor, but it's free capacity the plan doesn't know we have.
The plan's AI Gateway + PostHog choices already match us. Add our gbrain / KB stack as the retrieval layer feeding the agent (ties to gap #7 below).
The doc says "build on AI-Voice-RTL-backend" and "target Cloudflare Workers." That's in tension. Don't drag a 4,099-line God-class server.ts with fake isAdmin, CORS: *, and plaintext passwords into the path that mints payment sessions. Build the tool/webhook/reservations layer clean on Workers + Hono from line one, leave the campaign backend archived read-only. That reframes half of §3's security gate from "remediate" to "don't inherit" â cheaper and safer.
Human parity at a 131-room spa/golf/wedding resort is as much prompt design and property knowledge (spa treatments, golf packages, dining, room categories, cancellation policy, directions) as it is Rezlynx write-access. Add a knowledge-base workstream. And route weddings/events/group bookings to a human â too complex and high-value to let the AI book in a pilot. Booking write-access is necessary, not sufficient, for parity.
The plan's bones are right. The one thing that would actually bite us in production is #1 â shipping an "EU-compliant edge stack" whose voice layer ships all guest PII to Virginia. Fix that framing and the tier-2 vendor swap and it's solid.