A WhatsApp assistant that runs the studio’s front desk: one number serving a lead and the founders, that briefs them the moment a booking lands

Orfloat’s own front desk is a WhatsApp assistant. It answers a prospect’s questions, runs the booking conversation, and writes to the founders’ real calendar, all through one business number. The recording below is one continuous take of two phones at once: a lead on the left, the studio on the right.

One number, two roles

The number is one WhatsApp business line, and it answers to two people at once: the lead who messages in, and the studio (the two founders) on the other side of the same number. The agent never sees a phone number. A thin channel server resolves every inbound message to a role and a number-free alias before the model reads a word, and the real numbers never leave the server’s environment.

The two roles are not the same conversation. The studio sees its own calendar, titles and all. The lead, when a proposed time turns out to be taken, is told only that there is a conflict, never whose. The boundary is not a request in the prompt; it is where the channel sits, between the people and the model.

The moment the studio runs itself

This is the whole point, and the demo shows it in one beat. The instant the lead says yes, three things land together. The booking becomes a real calendar event, prefixed [ORF] and carrying a Google Meet link. A brief arrives on the studio’s phone: who booked, for what, when, and a calendar link the founders can tap. And a welcome email sits written and waiting in the studio’s Gmail drafts, composed but never sent.

The founders did nothing, and the studio briefed itself. That is the feeling the preview is built to produce, and it is why the demo is two screens rather than one: the left phone is the work, the right phone is the result arriving on its own. The calendar event is the source of truth, so a brief that fails to send or a draft that fails to write can never unwind a booking that already happened.

The brain is a markdown program

There is almost no application code. The brain is a local Claude Code session, and no Anthropic API is called: the session is the agent. A single CLAUDE.md conducts it, routing on the role and the intent to the files it needs and reading them only when it needs them: seven flows, five context files, and five files of voice. The program is the markdown.

The code is the channel. Two small servers run beside the session: one speaks WhatsApp’s Cloud API and resolves identity, and one holds the calendar and the inbox. Everything a visitor would call the product’s behaviour (the answers, the judgement, the booking conversation) lives in prose the founders wrote and can read, not in a codebase they would have to trust on faith.

The boring parts, enforced in code

The safety here is not asked for in the prompt, where a model can forget it. It is built into the tools, where it cannot. Every event the agent creates must start with [ORF], enforced in the server and backed by a hook; an event that is not [ORF], one of the founders’ own, the agent cannot move or delete. Before it writes a booking, it re-reads the calendar and re-checks the slot. And the Gmail tools are create-draft and delete-draft and nothing else. There is no send. Of the eight Google tools the model can reach, not one can put a message into the world.

Above all of it sits the oldest gate of all: a read-back and an explicit yes before any write. You can watch the agent hold a softer line too, in the moment the lead asks for a price: it declines to invent a number, says so plainly, and routes to the discovery conversation instead. The booking is gated by code; the restraint is gated by character. The preview leans on both.

Drawn as one picture, the whole preview is a short pipeline: a number, a channel that turns identity into a role, one shared session that does the thinking, and one server where every write is gated.

Talking to the proof

This assistant did not appear from nothing. It is the successor of an earlier WhatsApp demo built for a marketing principal, the same architecture with the context and the character swapped out. And it is the working proof of the appointment-agent case study: the shape that piece describes (a Claude Code session serving a principal and their leads through one number, every calendar write behind a hard gate and a read-back) is exactly this.

It is a sibling, too, of the voice agent. Different channel, a phone call rather than a chat thread, but the same conviction underneath: the consequential actions belong behind code, and the model is trusted with the conversation, not the keys.

Where this honestly stands

What this is not, yet. It serves one shared founders’ number, not a fleet of them. It answers an allowlist, not open intake, so a stranger does not reach the founders by guessing the line. WhatsApp’s 24-hour session window bounds how the agent can reach back out on its own. The deployment is private.

And the lead in the recording is a fictional persona, booked into a real calendar with a burner address: the flow is real, the prospect is not. None of this is hidden. It is the honest edge of an internal preview, shown so the working part can be believed.

The smallest unit that works

The preview is exactly that, a preview, and it is also something more precise: the smallest unit of the thing we are really building. One number, one session, two roles, every consequential write held in code. It settles the first question end to end, on real infrastructure, against a real calendar. A demo that books a real meeting outweighs a paragraph claiming one could.

But a unit is not a system, and the very shape that makes the preview legible is the shape that does not scale. One shared session is one context window and one transcript. It holds a single conversation beautifully. Ask it to hold a hundred leads at once and the seams open: the conversations crowd the same context, the transcript that is its only memory grows until it has to be compacted, two leads who arrive in the same second contend for one brain, and a single crash takes every conversation with it.

None of that is a fault in the preview. It is the definition of a unit. The preview answers “does the conviction hold?” The production question is different: what carries that conviction to many businesses and many thousands of leads without the founders touching it? That is not a longer prompt. It is a different harness.

The production shape: sessions, memory, dreaming

We argued the general case already, in the harness is the half you own: an agent is a model plus a harness, and the harness is the only half you build. A production harness needs three things the unit fakes with a single session: isolation between conversations, memory that persists outside any one of them, and a way to get sharper between conversations rather than only within them.

• Sessions become a managed primitive. The Claude Agent SDK is the same agent loop as a library, where one session maps to one isolated process with its own resumable transcript; Managed Agents hosts the loop so each lead gets a session of their own instead of sharing one brain.
• Memory becomes a store, not a transcript. A shared memory store sits beside the sessions: plain files with read and write scopes, optimistic concurrency, and every change versioned and attributed to the session that made it.
• Dreaming closes the loop. Between sessions, an out-of-band batch process reads the day’s transcripts together with the store and produces a new, curated one: duplicates merged, stale entries replaced, fresh patterns surfaced.

The shape is the same conviction wearing different primitives. Identity still belongs to the channel. Consequential writes still sit behind code, and the platform agrees: its own guidance is to denylist destructive tools and keep a human confirmation step before any state change, the gated calendar write and the read-back restated as a platform default.

This is not a single-vendor story. The same shape is forming on the other side of the frontier: OpenAI’s Agents SDK gives agents, handoffs between specialists, guardrails, and sessions that manage history with compaction for long runs. Two labs, one direction. The model is the bought half, and the harness is the half a builder owns.

What transfers

The lesson is portable, and it is not about WhatsApp. An agent can be handed consequential writes (a real calendar, a real inbox) the moment its guardrails live in code rather than in a prompt it might forget. Identity belongs to the channel, not the model, so the agent works in roles and never holds a number. And what earns trust is not a claim of capability but a felt result: the studio briefing itself the instant a booking lands. Build that, and the demo does the arguing.