HappyRobot — Carrier Sales Operations

A carrier calls in through a browser web-call, gets verified and OTP-checked, is matched to a load, negotiates a rate the broker's ceiling is never disclosed and is handed to a senior rep. The HappyRobot voice agent orchestrates the conversation; a containerized bridge connects the systems HappyRobot can't reach natively (the legacy TMS, FMCSA, OTP); every call is logged to Twin and surfaced on this dashboard.

Components

Inbound Voice Agent (HappyRobot workflow): a Web-Call trigger + voice agent that runs the conversation and calls tools mid-call. Conditionals enforce the negotiation flow; a Twin run-audit captures each call; the senior-rep handoff is mocked via a Transfer-Popup node (web calls have no PSTN leg).
Carrier Sales Bridge (FastAPI, Dockerized on Railway): the integration layer for everything HappyRobot can't do natively — FMCSA verification, the OTP flow, and the legacy-TMS protocol. Exposes authenticated REST endpoints the agent's Webhook tools call.
Legacy TMS: a line-oriented, fixed-width TCP protocol (search / get / book) that injects faults. The bridge speaks it with a resilient client (per-request connect, retries/backoff, fault detection, booking reconciliation).
FMCSA: carrier operating-authority lookup by MC number (QCMobile REST), normalized to an eligible/not-eligible decision.
Twin (data layer): HappyRobot-native Postgres. The bridge upserts one carrier_call_audit row per call (MC, load, agreed rate, OTP status, rounds, outcome) keyed by run id.
Ops Dashboard (this app): Next.js (App Router) deployed natively as a HappyRobot App, reading carrier_call_audit + carrier_call_offers via the v2 API. Tabs for Operations (KPIs, recent calls, per-call negotiation timeline), Test Call (the carrier agent embedded inline + a live one-time-code panel), and Architecture. The same code also runs on Railway as a portable mirror.

How a call flows

Carrier opens the web-call link and talks to the agent.
Agent collects the MC → verify_carrier → FMCSA. If not eligible, the call ends.
Agent sends a one-time code → send_otp / verify_otp. No matching until verified — no bypass.
Agent gathers lane/equipment → search_loads (or browses by equipment) and pitches a load.
On each carrier offer → evaluate_offer returns accept / counter / reject (≤3 rounds). The ceiling is never revealed.
On agreement → book_load (TMS) → handoff_to_rep (mock transfer).
Throughout, the bridge upserts the call's audit row to Twin → visible here within seconds.

Key design decisions

The rate ceiling never leaves the bridge. MAX_BUY is read server-side; the agent only ever receives accept/counter/reject. (The live TMS will book above the ceiling — proven — so margin protection is entirely the bridge's job.)
OTP is enforced server-side (CSPRNG, salted-hash, TTL, attempt/resend caps, single-use, no skip path) so it resists social engineering regardless of what the agent is told.
Resilience over the flaky TMS: connect-per-request, retry/backoff, and booking reconciliation after a fault.
Quality is continuous: 5 northstar KPIs + scripted & adversarial tests; audits run on 100% of live calls.