A Czech phone agent that books jobs for tradespeople

# 4 tools. None can change a price.
read_price_list()  # only price source
free_slots()       # returns ids
save_request(
  name, phone, description,
  slot_id: integer  # id, not text
)
hand_to_human(reason)

# 25-turn cap, every call logged

• No price tool. The price list is a constant the model can only read. An injected discount has nowhere to land.
• Caller speech is data. The transcript goes into the prompt inside delimiters, never as instructions. A prompt-injection classifier screens it too, but only as an extra layer (see below).
• Numbers are parsed by code. Phone, price, date and time come from a deterministic Czech parser and override the model.
• No closing. It collects a request and offers a site visit, so no distance contract is created by phone.
• Fixed phrases are pre-recorded. Greeting and AI disclosure sound the same every call and cost nothing.

• It returns a score, not a label. My first version looked for the string "JAILBREAK", so the guard never fired once. Fixed to a 0.5 threshold.
• The small model can't read Czech. Same attack: 0.9988 in English, 0.0012 in Czech.
• It misses fake authority completely, and that is the expensive attack. So the real defence stays in the design: no tool can change a price. The guard is an extra layer, not the lock.