go-sip/docs/evidence/20260918-ai-sdk-poc.md

AI SDK PoC evidence — 2026-09-18

Scope

This record covers an isolated compile/protocol-mock PoC only. It does not provide supplier credentials, call a paid endpoint, or unlock W10/W14.

OpenAI-compatible streaming LLM

A temporary module outside sip-go-agent was built with Go 1.27.1:

• module: github.com/openai/openai-go/v3
• version: v3.62.0
• module sum: h1:P3G1Ip9eOwCJxg2q1lPBFg7iuyDEJDuoqQinzZDaxJM=
• LICENSE SHA-256: 636eb7d79da9bb6d515a4b3fd417aa26679eb3cf16396ddab4bc55fa74e616e4
• compile surface: Chat Completions streaming, context cancellation surface, configured base URL, and option.WithMaxRetries(0)
• protocol mock: local httptest server verified the authorized model, stream, explicit temperature: 0, and explicit max_tokens: 37; exactly one request was observed
• go test ./...: passed
• govulncheck ./...: no vulnerabilities found

The SDK is not added to the production module. The PoC does not prove that a supplier's endpoint, model capability matrix, billing behavior, or streaming error semantics match the approved SaaS configuration.

DashScope Paraformer ASR

A temporary module outside sip-go-agent compiled github.com/devinyf/dashscopego v0.1.2:

• module sum: h1:pBqXY4+9LnCE2886hX9bRXw4WjxRpJ6Rl6Kb5XiYbcQ=
• LICENSE SHA-256: 0ac223aad8ac9f5331b7a6c7161b7011fd42907940964489985274ecda0e5dcf
• compile surface: Paraformer run-task request, PCM/16 kHz parameters, language hints, binary audio send, result callback, and close
• go test ./...: passed
• govulncheck ./...: no reachable vulnerabilities; one unused required-module finding was reported as unreachable

This candidate hard-codes the service WebSocket endpoint in its public connection helper, so the PoC did not make a local protocol mock request. It is not added to the production module until endpoint injection, cancellation, backpressure, and selected-model parameter behavior are accepted.

Volcengine ASR/TTS

A temporary module compiled github.com/GizClaw/doubao-speech-go v0.0.0-20260915022405-e38c14802696:

• module sum: h1:FL/2Z4hIT4gaVWz0kCVFSZP1O4RrvpWTZWwLnuVmNO0=
• LICENSE SHA-256: 04df76b166686a49f7f51f129aeab846b1b65dfa2de29bd38c2a39e433dd0fe5
• compile surface: ASR V2 session/open, typed model/audio parameters, SendAudio, Recv, TTS V2 session/open, SendText, and CancelSession
• go test ./...: passed
• govulncheck ./...: no vulnerabilities found

The source is a pseudo-version with no release tag in the local module query. More importantly, TTSV2WSConfig exposes speaker/resource/format/sample-rate but not the required speed/volume/pitch controls. This is a parameter reachability failure for the approved snapshot and keeps the Volcengine SDK unlocked; no real endpoint was called.

The existing local AI pipeline remains a bounded mock and must not be reported as real ASR/LLM/TTS. Supplier authorization is still required for final protocol, cancellation, backpressure, billing, and capability acceptance.