VoiceOps Gateway — talk to your infra, safely

During an incident your hands never leave the keyboard, so voice is the free channel. It is also the dangerous one: today's voice assistants for infrastructure go straight from transcript to shell, and "delete the worker" sounds a lot like "debug the worker". VoiceOps Gateway puts a safety layer between the mouth and the socket. Speech streams from the browser as 16 kHz PCM to the gateway, which owns a Speechmatics Realtime session (standard operating point, 1-second max delay, live partials, a custom ops dictionary with Korean phonetic hints such as "엔진엑스" → nginx). An LLM maps the utterance to one structured action, but it never decides what is safe. A fixed policy table assigns the lane: READ actions run immediately and are spoken back through Speechmatics TTS; MUTATE actions are read back and wait for "yes / 응" or a button; DESTRUCTIVE actions are refused with the reason spoken aloud. The gateway also investigates. "워커 컨테이너 왜 자꾸 죽어?" collects state, restart count, memory limit, restart policy, the last 15 minutes of OOM/die events from the Docker event stream and recent logs, then speaks a diagnosis and proposes one follow-up action that still needs confirmation. The sandbox worker really leaks memory and really gets OOM-killed, so the evidence is live, not scripted. Defence in depth: policy table, sandbox-label scope check, a ten-operation executor allowlist, and an haproxy socket proxy that only accepts GET on containers/events plus POST restart/stop/start. remove, kill, exec, prune, create and update return 403 at the socket even if the gateway itself were compromised. Every decision is appended to a SHA-256 hash-chained audit log that can be verified from the UI. One command, five containers, no GPU: `docker compose up -d --build`. Runs on an Intel N150 mini PC. MIT licensed.