Пути конференций · матрица · runbook 8 шагов · VNC-приёмка
Команды, подключающие OpenClaw к живым встречам, ломаются иначе, чем на чат-каналах: аудио должно оставаться duplex, PSTN-абонентам нужен стабильный номер, а ассистент должен слышать комнату без API-ключей во вкладке браузера. OpenClaw v2026.5.4 даёт согласованную тройку — ingress Google Meet (календарный вход и захват аудио комнаты), номер Twilio (PSTN-ноги с SecretRef), и голосовой мост Gemini realtime на Gateway, мультиплексирующий источники в ту же семью Live-транспорта, что browser Talk в v2026.4.26. В статье — шесть классов боли, матрица транспорта, runbook из восьми шагов, четыре факта для тикетов и 20-минутная VNC-сетка на арендованных Apple Silicon. См. также публичный доступ Gateway и HTTPS reverse proxy, порядок мультиканального rollout и после baselines — инкрементальное обновление v2026.5.7.
Интеграции встреч ломаются тихо. Логи Gateway могут показывать здоровый процесс, пока участники ничего не слышат, or PSTN callers hear the assistant but Meet attendees do not. The six items below are the recurring classes we see on rented macOS nodes where SSH-only operators never open Chromium site settings or macOS microphone privacy lists.
Meet OAuth and domain policy: Workspace admins restrict which OAuth clients may read calendar events or join as automated attendees. Symptoms look like “stuck on consent” with no Gateway error until you correlate Google Admin audit timestamps with your redirect URI list.
Browser capture vs headless fantasy: Meet audio ingest still depends on a supported Chromium profile and honest HTTPS origins. Headless Linux relays cannot close macOS TCC prompts; attempting to fake capture with loopback hacks creates comb filtering and unusable transcripts.
Twilio credential sprawl: Account SID, API keys, and per-number webhooks scattered across env files cause partial success—PSTN rings, but the voice bridge never receives media events because the callback URL still points at last week’s tunnel hostname.
Bridge session collisions: Two bridge owners on the same Meet room or conference name produce echo, duplicated tool calls, and transcripts that disagree with channel archives. This is especially common when multichannel fan-out is enabled before voice baselines are frozen.
Reverse-proxy WebSocket drift: Long-lived duplex audio needs correct Upgrade and idle timeouts on the path between browser, Gateway, and upstream Live endpoints. A TLS terminator tuned for REST will drop bridges that chat smoke tests never exercise.
Evidence gaps on shared leases: Compliance reviewers ask for “who clicked Allow on the microphone” aligned with Gateway session ids. SSH text alone cannot answer that; you need VNC eyewitness plus exported listener tables in the same macOS user that owns launchd.
Считайте эти боли архитектурными воротами, а не полировкой. If you skip them, the hidden cost is week-long tickets that oscillate between “Google quota” and “model too small” while the bridge never muxed PSTN and Meet on one session id.
Используйте таблицу на мосту инцидента, прежде чем менять SKU Gemini. Rows deliberately separate ingress (how audio enters OpenClaw) from reasoning (what the agent does with text).
| Потребность | Предпочтительно в 5.4 | Не смешивать без mux | Первая VNC-проверка |
|---|---|---|---|
| Scheduled Meet with screen share | Meet ingress + single bridge session | Parallel browser Talk tab on same room | Chromium mic/site permission for Meet origin |
| PSTN-only participant | Twilio dial-in leg into bridge | Separate Gateway process per caller | Twilio debugger shows in-progress with matching CallSid |
| Desk developer testing voice | Browser Talk (4.26 path) | Meet bot attendee on same machine | One microphone owner; Activity Monitor audio devices |
| Async recap after meeting | Channel transcript + TTS readout | Keeping bridge open indefinitely | Bridge teardown logs; cron job status |
| Public webhook callbacks | HTTPS reverse proxy in front of Gateway | Raw port 18789 on the internet | TLS cert hostname = Twilio webhook URL host |
| IM fan-out during live call | Multichannel after bridge baseline | Enabling all channels before Meet smoke | channels list vs active bridge owner |
The matrix pairs naturally with multichannel guidance: text channels are excellent for command-and-control, but they should not become a second audio owner while a bridge session is live. When you expose Gateway publicly for Twilio webhooks, reuse the same Host header and certificate discipline documented for operator consoles—do not invent a one-off HTTP endpoint on a different subdomain without updating Twilio voice URLs.
One bridge session id per live room—Meet legs, PSTN legs, and Gemini upstream must share it or you are debugging echo, not intelligence.
Думайте тремя плоскостями. Плоскость ingress: Meet connector subscribes to calendar events (or explicit meet URLs), launches a controlled browser context, and forwards room audio frames into Gateway. Twilio connector accepts inbound PSTN or SIP, normalizes codecs, and attaches as another leg on the same bridge. Плоскость моста: Gateway owns session lifecycle, trace ids, SecretRef resolution for Google and Twilio credentials, and back-pressure when upstream Live endpoints throttle. Плоскость агента: tools, skills, and channel transcripts remain orthogonal—you still want structured commands in Slack or Telegram while voice stays duplex.
Compared with v2026.4.26 browser Talk, Meet ingress adds scheduling and attendee policy: the bot is a participant with organizational consent, not a local tab experiment. Compared with multichannel messaging, voice bridge sessions are time-bounded and sensitive to jitter; do not reuse IM retry policies for audio frames. Gemini realtime voice bridge here means the same Live family transport used for Talk, but fed by muxed PCM or Opus legs rather than a single tab capture—Gateway negotiates upstream tokens so secrets never land in Local Storage.
On a leased remote Mac, the practical anchor is still one interactive macOS user that owns launchd, Chromium profiles, and microphone TCC entries. Splitting “Gateway on user A, browser on user B” recreates the classic split-brain cache where Meet shows connected while the bridge reads silence.
Выполняйте по порядку. Early steps pin versions and URLs; middle steps validate ingress; final steps attach observability before you enable multichannel fan-out.
Freeze and backup: Record openclaw --version, node absolute path, OPENCLAW_HOME, Gateway listener matrix, lease id, and launchd label. Export current Meet and Twilio config stanzas (redact secrets) into the change ticket.
Upgrade to v2026.5.4 and doctor: Run openclaw doctor; resolve deprecated relay keys from 4.26-era snippets before touching Meet. Keep a rollback tarball of the prior config tree.
Workspace OAuth (VNC mandatory): Complete Google Workspace consent in Chromium as the Gateway user; capture Admin console client id allowlisting if your domain restricts apps.
Twilio SecretRef and webhooks: Store Account SID and auth tokens via SecretRef; point voice status callbacks at your HTTPS reverse-proxy hostname, not an ephemeral tunnel. Validate TLS chain from outside your VPC.
Declare one bridge profile: Configure Meet ingress and Twilio dial-in to share a bridgeSessionId template per calendar series or conference name. Document teardown idle timeout (for example 120 seconds after last PSTN hangup).
Lab Meet smoke: Join a test Meet with two human headsets plus one dial-in number. Confirm Gateway logs show a single bridge owner and matching trace ids on Meet and Twilio legs.
Gemini upstream probe: Run a short duplex prompt through the bridge; capture first-byte latency and end-to-end round-trip in Gateway metrics. Compare against browser Talk baselines from 4.26 on the same host.
Enable multichannel fan-out: Only after voice baselines pass, follow multichannel rollout order so Telegram or Slack commands cannot spawn a second bridge on the same room.
voiceBridge:
owner: gateway
geminiLive:
region: us-central1
traceHeader: X-OpenClaw-Bridge-Trace
meet:
calendarId: primary
joinWindowMinutes: 15
twilio:
dialInNumber: "+1XXXXXXXXXX"
statusCallback: "https://gateway.example.com/twilio/voice/status"
mux:
bridgeSessionTemplate: "meet-${eventId}"
maxPstnLegs: 4
idleTeardownSeconds: 120
Примечание: Keys are illustrative; your build may expose equivalent settings via openclaw configure sections. Treat YAML as documentation for reviewers, not as copy-paste without checking release notes.
openclaw --version openclaw doctor openclaw gateway status openclaw secrets audit lsof -nP -iTCP -sTCP:LISTEN | rg -i "openclaw|18789" || true openclaw channels list
Предупреждение: Do not file “Gemini quota” as root cause until bridge mux and proxy WebSocket upgrades are ruled out—quota dashboards are polite liars on duplex paths.
Запускайте SSH-автоматизацию и VNC-свидетель в одном проходе. The grid below is sized for a single operator on a leased Mac; attach screenshots to the change record.
| Проверка | VNC (same user as Gateway) | SSH | OK |
|---|---|---|---|
| Version footer | Gateway UI build matches CLI | openclaw --version | 5.4.x consistent |
| Meet mic consent | Chromium + System Settings microphone | Not substitutable | Paths match binaries |
| Twilio webhook reachability | Optional browser to status URL | curl -I via public hostname | TLS valid; 2xx |
| Bridge trace alignment | Network filter on trace header | Gateway log grep | Single session id |
| Duplex smoke | Hear round-trip within SLA | Metrics snapshot | No one-way audio |
| Teardown | Meet tab closed cleanly | Idle timer fired | No orphan PSTN |
If you plan a subsequent jump to v2026.5.7, archive this grid’s JSON and log excerpts as the voice baseline bundle. Publish-chain fixes in 5.7 do not replace bridge acceptance—they sit on top.
For organizations that also run outbound-only agents on Linux, keep Meet and Twilio ingress on the macOS anchor host. Linux remains excellent for webhooks and batch jobs, but it cannot close the microphone and OAuth evidence chain this workflow requires.
Two drills catch production issues that happy-path smokes miss. Drill A—proxy failover: reload Nginx or Caddy during an active bridge and confirm Twilio retries status callbacks without spawning a second bridge session. Drill B—partial PSTN loss: drop one caller leg while Meet stays up; verify mux policy either removes the leg gracefully or marks the session degraded in logs operators actually read.
Document expected agent behavior when Meet screen-share starts: some teams mute bridge capture to avoid narrating slide text; others want vision tools on shared content. The 5.4 bridge does not remove product policy—you still declare whether screen content becomes model input or stays out of band.
Finally, align retention: voice transcripts may be more sensitive than IM archives. Pair bridge configuration with your existing SecretRef audit cadence and legal hold rules before you invite external dial-in numbers.
HTTPS, ports, and Twilio callback parity on a leased Mac.
Читать →Enable IM fan-out after voice baselines, not before.
Читать →Incremental checklist after bridge acceptance passes.
Читать →Yes—that is the 5.4 design point. Declare one bridge owner per live room and mux PSTN legs before the Gemini upstream. Two owners on the same Meet create echo and diverging transcripts.
No. Workspace OAuth, Chromium permissions, and macOS microphone TCC require the same interactive user you get over VNC. SSH remains essential for listener tables and log archives.
4.26 optimizes a local browser tab on Google Live transport. 5.4 adds calendar Meet ingress and Twilio PSTN with explicit bridge session semantics in Gateway.
Validate 5.4 bridge acceptance first if Meet or Twilio is in scope. Apply 5.7 incrementally for publish-chain and channels CLI improvements without skipping voice baselines.
OpenClaw v2026.5.4 turns meeting audio into a first-class Gateway concern: Meet and Twilio are ingress planes, Gemini Live is the duplex reasoning transport, and your change process still owns secrets, proxy timeouts, and session teardown. Teams that try to run this only over SSH routinely lose weeks to permission drift and false-green Meet UI states that logs never explain.
Owning a physical Mac adds sleep policy, update windows, and hardware depreciation; undersized laptops choke when Meet capture, PSTN mux, and transcript archives coincide. A leased remote Mac with a reviewable GUI session keeps imaging and uptime with the provider while you keep bridge policy and SecretRef inventory—usually with a shorter mean time to recover when a bridge drops mid-call.
Меньше CapEx, но по-прежнему приёмка из раздела 6 под одним пользователем macOS: VNCMac сдаёт облачные Mac — основная кнопка ведёт на страницу покупки Mac в облаке; сравните тарифы на главной перед следующим окном изменения моста.