I Hijacked My ESP32 Voice Device to Run Claude Without Touching the Firmware

I did not buy this device to use it the way the manufacturer intended. The AIPI-Lite is a small ESP32-S3 voice gadget from XOrigin. It ships configured to talk to XOrigin's cloud. You speak, it sends your audio to xdc-chat.xorigin.ai, their servers process it, and a response comes back. Fine product. Not what I wanted. I wanted it talking to Claude, running locally, without touching the firmware. No soldering. No flashing. No firmware source code. Just network interception. Here is what I actually built. Reading the Boot Sequence First step was figuring out what the device actually does when it powers on. I connected it to COM7 and opened a serial monitor at 115200 baud. The boot log told me everything I needed. The device has a two-phase startup. Phase one: it connects to an MQTT broker at a hardcoded IP address, 152.32.151.73:1883, over TLS. That IP is baked into NVS (non-volatile storage) on the chip. It does not resolve a hostname. DNS is useless here. Phase two: that MQTT connecti