Streaming Intent Transactions for Safe Asynchronous Tool Use in Full-Duplex Voice Agents

Full-duplex voice agents can dispatch tools before a user finishes speaking, reducing latency but creating a temporal authorization problem: a callback may return after the user has revised or revoked the intent that authorized it. Existing evaluations primarily measure routing and tool correctness rather than whether a delayed result remains authorized to change external state. We formalize this failure mode as streaming intent transactions and propose DuplexTxn. A causal policy over a frozen Omni backbone compares dispatch- and commit-time representations, while a deterministic gate verifies version, binding, dependency, confirmation, and idempotency constraints. We also introduce DuplexTxn-Bench, a paired-timing evaluation that holds speech, tool output, and initial state fixed while moving callback arrival across a spoken revision boundary. Across 516 synthetic out-of-distribution families and four independently trained seeds, DuplexTxn reduces unsafe-effect episodes from 17.05% to 0.024%, eliminates observed stale-result effects, and raises safe task completion from 8.58% to 82.63% relative to our execution of released DuplexOmni. On a post-freeze natural-speech transfer panel, the same frozen policies reach 100% safe completion under controlled callback replay. These results support temporal authorization as a distinct requirement for safe full-duplex tool use.