@mycadet/gateway 0.12.11 → 0.13.0-dev.202610171626.d97b8b8

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -28,10 +28,10 @@ describe("tunnelHostForCloudHost", () => {
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
     expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+      "staging-tunnel.mycadet.ai",
     );
     expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+      "dev-tunnel.mycadet.ai",
     );
   });
 

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/channels.ts

@@ -39,7 +39,6 @@ export const CHANNEL_IDS = [
   "slack",
   "email",
   "platform",
-  "a2a",
   "discord",
   "plugin",
   // Internal id for conversations a guardian shares with a contact. It has no

package/node_modules/@mycadet/ces-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,7 +1,7 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
@@ -11,7 +11,7 @@ export function tunnelHostForCloudHost(host: string): string | null {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -28,10 +28,10 @@ describe("tunnelHostForCloudHost", () => {
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
     expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+      "staging-tunnel.mycadet.ai",
     );
     expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+      "dev-tunnel.mycadet.ai",
     );
   });
 

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/channels.ts

@@ -39,7 +39,6 @@ export const CHANNEL_IDS = [
   "slack",
   "email",
   "platform",
-  "a2a",
   "discord",
   "plugin",
   // Internal id for conversations a guardian shares with a contact. It has no

package/node_modules/@mycadet/gateway-client/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,7 +1,7 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
@@ -11,7 +11,7 @@ export function tunnelHostForCloudHost(host: string): string | null {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/node_modules/@mycadet/gateway-client/src/admission-policy-contract.ts

@@ -52,7 +52,7 @@ export const ADMISSION_FLOOR: Record<AdmissionPolicy, number> = {
  * Hard-exempt internal channels — never subject to PUT policy, omitted from
  * GET list, runtime admission stage short-circuits without floor check.
  *
- * `platform` / `a2a` are peer/internal channels with no human-trust model.
+ * `platform` is the peer/internal channel with no human-trust model.
  *
  * `phone` is NOT exempt — voice ingress enforces the admission floor.
  *
@@ -62,7 +62,6 @@ export const ADMISSION_FLOOR: Record<AdmissionPolicy, number> = {
  */
 export const ADMISSION_POLICY_EXEMPT_CHANNELS: ReadonlySet<string> = new Set([
   "platform",
-  "a2a",
 ]);
 
 export function isAdmissionPolicyExemptChannel(channelType: string): boolean {

package/node_modules/@mycadet/gateway-client/src/gateway-ipc-contracts.ts

@@ -68,26 +68,6 @@ export type GatewayLogsTailRouteParams = z.infer<
   typeof GatewayLogsTailRouteParamsSchema
 >;
 
-/**
- * `gateway_debug_export`: a consistent copy of the gateway database plus its
- * recent log files, as one gzipped tar, for a debug bundle. No params.
- */
-export const GatewayDebugExportIpcParamsSchema = z
-  .object({})
-  .strict()
-  .default({});
-
-export const GatewayDebugExportIpcResponseSchema = z.object({
-  ok: z.literal(true),
-  /** `tar.gz` bytes, base64. Contains gateway.sqlite and gateway-logs/. */
-  archive_base64: z.string(),
-  size_bytes: z.number().int().nonnegative(),
-});
-
-export type GatewayDebugExportIpcResponse = z.infer<
-  typeof GatewayDebugExportIpcResponseSchema
->;
-
 export const GatewayLogsTailIpcResponseSchema = z.object({
   lines: z.array(z.record(z.string(), z.unknown())),
   truncated: z.boolean(),

package/node_modules/@mycadet/service-contracts/src/__tests__/ingress.test.ts

@@ -28,10 +28,10 @@ describe("tunnelHostForCloudHost", () => {
 
   test("maps env-prefixed platform hosts to their env tunnel", () => {
     expect(tunnelHostForCloudHost("staging-cloud.mycadet.ai")).toBe(
-      "tunnel-staging.mycadet.ai",
+      "staging-tunnel.mycadet.ai",
     );
     expect(tunnelHostForCloudHost("dev-cloud.mycadet.ai")).toBe(
-      "tunnel-dev.mycadet.ai",
+      "dev-tunnel.mycadet.ai",
     );
   });
 

package/node_modules/@mycadet/service-contracts/src/channels.ts

@@ -39,7 +39,6 @@ export const CHANNEL_IDS = [
   "slack",
   "email",
   "platform",
-  "a2a",
   "discord",
   "plugin",
   // Internal id for conversations a guardian shares with a contact. It has no

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -1,7 +1,7 @@
 /**
  * Map a Cadet Cloud host onto its environment's tunnel host, following the
  * deployment naming convention (`cloud.mycadet.ai` → `tunnel.mycadet.ai`,
- * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
+ * `{env}-cloud.mycadet.ai` → `{env}-tunnel.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
  * cloud-speech transport can't drift.
@@ -11,7 +11,7 @@ export function tunnelHostForCloudHost(host: string): string | null {
     return "tunnel.mycadet.ai";
   }
   const match = /^([a-z0-9-]+)-cloud\.mycadet\.ai$/.exec(host);
-  return match ? `tunnel-${match[1]}.mycadet.ai` : null;
+  return match ? `${match[1]}-tunnel.mycadet.ai` : null;
 }
 
 export function normalizePublicBaseUrl(value: unknown): string | undefined {

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Cadet Gateway API",
-    "version": "0.12.8",
+    "version": "0.12.9",
     "description": "Auto-generated OpenAPI specification for the Cadet Gateway HTTP endpoints."
   },
   "servers": [{ "url": "", "description": "Same-origin — the gateway" }],

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "@mycadet/gateway",
-  "version": "0.12.11",
+  "version": "0.13.0-dev.202610171626.d97b8b8",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vargasjr-dev/mycadet-temp.git"
+  },
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/actor-token-revocation.test.ts

@@ -30,10 +30,6 @@ const { createRuntimeProxyHandler } =
   await import("../http/routes/runtime-proxy.js");
 const { bustGuardianIntegrityCache } =
   await import("../auth/guardian-integrity.js");
-const {
-  resetGuardianIntegrityReporterForTesting,
-  setGuardianIntegrityReporterOverridesForTesting,
-} = await import("../guardian-integrity-reporter.js");
 
 const ACTOR_SUB = "actor:self:guardian-001";
 const actorClaims = { sub: ACTOR_SUB } as TokenClaims;
@@ -128,20 +124,12 @@ beforeEach(async () => {
   await initGatewayDb();
   __resetLastUsedDebounceForTests();
   // The integrity state is module-cached across tests; token rows seeded here
-  // are integrity evidence, so keep the reporter silenced and the cache cold.
+  // are integrity evidence, so keep the cache cold.
   bustGuardianIntegrityCache();
-  resetGuardianIntegrityReporterForTesting();
-  setGuardianIntegrityReporterOverridesForTesting({
-    fetchImpl: async () => new Response("{}"),
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: { error: () => {}, warn: () => {} },
-  });
 });
 
 afterEach(() => {
   resetGatewayDb();
-  resetGuardianIntegrityReporterForTesting();
   bustGuardianIntegrityCache();
   if (savedSecurityDir === undefined) {
     delete process.env.GATEWAY_SECURITY_DIR;
@@ -158,28 +146,41 @@ afterEach(() => {
 describe("admitActorToken: revocation verdict", () => {
   test("rejects an actor token whose record is revoked", () => {
     insertTokenRecord("token-revoked", "revoked");
-    expect(admitActorToken("token-revoked", actorClaims)).toBe(false);
+    expect(admitActorToken("token-revoked", actorClaims).admitted).toBe(false);
   });
 
   test("admits an actor token whose record is active", () => {
     insertTokenRecord("token-active", "active");
-    expect(admitActorToken("token-active", actorClaims)).toBe(true);
+    expect(admitActorToken("token-active", actorClaims).admitted).toBe(true);
+  });
+
+  test("hands the loaded record back for route reuse", () => {
+    insertTokenRecord("token-recorded", "active");
+    const { record } = admitActorToken("token-recorded", actorClaims);
+    expect(record).toMatchObject({
+      status: "active",
+      guardianPrincipalId: "guardian-001",
+      hashedDeviceId: hashToken("device-A"),
+      platform: "web",
+    });
+    expect(record?.issuedAt).toBeNumber();
+    expect(record?.expiresAt).toBeNumber();
   });
 
   test("admits (fail-open) an actor token with no record", () => {
-    expect(admitActorToken("token-unknown", actorClaims)).toBe(true);
+    expect(admitActorToken("token-unknown", actorClaims).admitted).toBe(true);
   });
 
   test("never checks non-actor tokens (svc)", () => {
     // Even if a row with this hash were revoked, a svc sub must be ignored.
     insertTokenRecord("svc-token", "revoked");
     const svcClaims = { sub: "svc:gateway:self" } as TokenClaims;
-    expect(admitActorToken("svc-token", svcClaims)).toBe(true);
+    expect(admitActorToken("svc-token", svcClaims).admitted).toBe(true);
   });
 
   test("admits (fail-open) when the gateway DB is unavailable", () => {
     resetGatewayDb();
-    expect(admitActorToken("token-anything", actorClaims)).toBe(true);
+    expect(admitActorToken("token-anything", actorClaims).admitted).toBe(true);
   });
 
   test("still detects revocation when the token has surrounding whitespace", () => {
@@ -187,8 +188,10 @@ describe("admitActorToken: revocation verdict", () => {
     // supplied with trailing whitespace (e.g. a `?token=<jwt>%20` WS param)
     // must still resolve to the revoked record.
     insertTokenRecord("token-revoked", "revoked");
-    expect(admitActorToken("token-revoked ", actorClaims)).toBe(false);
-    expect(admitActorToken(" token-revoked\n", actorClaims)).toBe(false);
+    expect(admitActorToken("token-revoked ", actorClaims).admitted).toBe(false);
+    expect(admitActorToken(" token-revoked\n", actorClaims).admitted).toBe(
+      false,
+    );
   });
 
   test("a revoked token is rejected without stamping any row", () => {
@@ -197,7 +200,7 @@ describe("admitActorToken: revocation verdict", () => {
     insertTokenRecord("token-stale", "revoked");
     insertTokenRecord("token-fresh", "active");
 
-    expect(admitActorToken("token-stale", actorClaims)).toBe(false);
+    expect(admitActorToken("token-stale", actorClaims).admitted).toBe(false);
 
     expect(readRow("token-stale")?.lastUsedAt).toBeNull();
     expect(readRow("token-fresh")?.lastUsedAt).toBeNull();
@@ -228,19 +231,19 @@ describe("signature-encoding canonicalization (revocation bypass)", () => {
     insertTokenRecord(jwt, "revoked"); // stored under the canonical token hash
 
     // Baseline: the canonical token is detected as revoked.
-    expect(admitActorToken(jwt, actorClaims)).toBe(false);
+    expect(admitActorToken(jwt, actorClaims).admitted).toBe(false);
 
     // Bypass attempt: same token, signature re-encoded (different string, same
     // bytes). Must still resolve to the revoked record.
     const padded = padSignature(jwt);
     expect(padded).not.toBe(jwt);
-    expect(admitActorToken(padded, actorClaims)).toBe(false);
+    expect(admitActorToken(padded, actorClaims).admitted).toBe(false);
   });
 
   test("does not falsely revoke an active token re-encoded with padding", () => {
     const jwt = mintActorJwt();
     insertTokenRecord(jwt, "active");
-    expect(admitActorToken(padSignature(jwt), actorClaims)).toBe(true);
+    expect(admitActorToken(padSignature(jwt), actorClaims).admitted).toBe(true);
   });
 });
 
@@ -365,12 +368,12 @@ describe("/auth/token revocation", () => {
       .get();
 
     expect(derivedRecord?.status).toBe("derived");
-    expect(admitActorToken(derivedJwt, actorClaims)).toBe(true);
+    expect(admitActorToken(derivedJwt, actorClaims).admitted).toBe(true);
 
     revokeActorTokensByDevice("guardian-001", hashToken("device-A"));
 
-    expect(admitActorToken(sourceJwt, actorClaims)).toBe(false);
-    expect(admitActorToken(derivedJwt, actorClaims)).toBe(false);
+    expect(admitActorToken(sourceJwt, actorClaims).admitted).toBe(false);
+    expect(admitActorToken(derivedJwt, actorClaims).admitted).toBe(false);
   });
 
   test("fails closed with a repairable 401 when guardian rows are lost over evidence (no divergent mint)", async () => {
@@ -528,7 +531,7 @@ describe("admitActorToken: device last-used stamping", () => {
     const before = readRow("token-used");
     expect(before?.lastUsedAt).toBeNull();
 
-    expect(admitActorToken("token-used", actorClaims)).toBe(true);
+    expect(admitActorToken("token-used", actorClaims).admitted).toBe(true);
 
     const after = readRow("token-used");
     expect(after?.lastUsedAt).toBeGreaterThan(0);
@@ -540,7 +543,7 @@ describe("admitActorToken: device last-used stamping", () => {
     insertTokenRecord("token-counted", "active");
 
     const sql = captureSql(() => {
-      expect(admitActorToken("token-counted", actorClaims)).toBe(true);
+      expect(admitActorToken("token-counted", actorClaims).admitted).toBe(true);
     });
 
     // The verdict and the stamp share one SELECT; the stamp adds the UPDATE.
@@ -560,7 +563,9 @@ describe("admitActorToken: device last-used stamping", () => {
       .run();
 
     const sql = captureSql(() => {
-      expect(admitActorToken("token-debounced", actorClaims)).toBe(true);
+      expect(admitActorToken("token-debounced", actorClaims).admitted).toBe(
+        true,
+      );
     });
 
     expect(readRow("token-debounced")?.lastUsedAt).toBe(sentinel);
@@ -593,7 +598,7 @@ describe("admitActorToken: device last-used stamping", () => {
     const svcClaims = { sub: "svc:gateway:self" } as TokenClaims;
 
     const sql = captureSql(() => {
-      expect(admitActorToken("svc-token", svcClaims)).toBe(true);
+      expect(admitActorToken("svc-token", svcClaims).admitted).toBe(true);
     });
 
     expect(readRow("svc-token")?.lastUsedAt).toBeNull();
@@ -604,7 +609,9 @@ describe("admitActorToken: device last-used stamping", () => {
   test("is a no-op for an unrecorded token hash", () => {
     insertTokenRecord("token-recorded", "active");
 
-    expect(admitActorToken("token-unrecorded", actorClaims)).toBe(true);
+    expect(admitActorToken("token-unrecorded", actorClaims).admitted).toBe(
+      true,
+    );
     expect(readRow("token-recorded")?.lastUsedAt).toBeNull();
   });
 
@@ -623,7 +630,7 @@ describe("admitActorToken: device last-used stamping", () => {
       "CREATE TRIGGER fail_last_used BEFORE UPDATE ON actor_token_records BEGIN SELECT RAISE(ABORT, 'stamp failed'); END",
     );
 
-    expect(admitActorToken("token-retry", actorClaims)).toBe(true);
+    expect(admitActorToken("token-retry", actorClaims).admitted).toBe(true);
     expect(readRow("token-retry")?.lastUsedAt).toBeNull();
 
     rawDb.exec("DROP TRIGGER fail_last_used");
@@ -657,7 +664,7 @@ describe("admitActorToken: device last-used stamping", () => {
     ).$client;
     rawDb.exec("ALTER TABLE actor_token_records RENAME TO actor_token_stash");
 
-    expect(admitActorToken("token-transient", actorClaims)).toBe(true);
+    expect(admitActorToken("token-transient", actorClaims).admitted).toBe(true);
 
     rawDb.exec("ALTER TABLE actor_token_stash RENAME TO actor_token_records");
     insertTokenRecord("token-transient", "active");

package/src/__tests__/channel-admission-policy-routes.test.ts

@@ -125,12 +125,10 @@ describe("GET /v1/channel-admission-policy", () => {
     expect(phone?.policy).toBe(ADMISSION_POLICY_DEFAULT);
   });
 
-  test("omits exempt `a2a` and hidden `cadet`/`whatsapp` but includes enforced `phone`", async () => {
-    // a2a stays exempt (no runtime admission model). cadet/whatsapp are still
-    // enforced at runtime but hidden from the Channel Trust Floors UI, so they
-    // must not surface even when a row is persisted. phone is now enforced and
-    // visible, so it must surface.
-    store.set("a2a", "guardian_only");
+  test("omits hidden `cadet`/`whatsapp` but includes enforced `phone`", async () => {
+    // cadet/whatsapp are still enforced at runtime but hidden from the
+    // Channel Trust Floors UI, so they must not surface even when a row is
+    // persisted. phone is now enforced and visible, so it must surface.
     store.set("cadet", "guardian_only");
     store.set("whatsapp", "guardian_only");
     store.set("cadet-shared", "guardian_only");
@@ -263,17 +261,6 @@ describe("PUT /v1/channel-admission-policy/:channelType", () => {
     }
   });
 
-  test("§8.1: rejects PUT for exempt channel `a2a` with 403", async () => {
-    const handler = createChannelAdmissionPolicySetHandler();
-    const res = await handler(
-      jsonRequest("http://localhost/v1/channel-admission-policy/a2a", "PUT", {
-        policy: "guardian_only",
-      }),
-      "a2a",
-    );
-    expect(res.status).toBe(403);
-    expect(store.get("a2a")).toBe(ADMISSION_POLICY_DEFAULT);
-  });
 
   test("upserts `phone` like any enforced channel (voice ingress wired)", async () => {
     const handler = createChannelAdmissionPolicySetHandler();

package/src/__tests__/contact-store-mirror-op-missing.test.ts

@@ -17,7 +17,6 @@ import {
   beforeAll,
   beforeEach,
   afterAll,
-  afterEach,
   mock,
 } from "bun:test";
 
@@ -48,25 +47,33 @@ mock.module("../ipc/assistant-client.js", () => ({
 
 // ── Imports ──────────────────────────────────────────────────────────────────
 
-import { ContactStore } from "../db/contact-store.js";
 import {
   initGatewayDb,
   getGatewayDb,
   resetGatewayDb,
 } from "../db/connection.js";
 import { contacts, contactChannels } from "../db/schema.js";
-import {
-  MIRROR_OP_MISSING_CHECK_NAME,
-  flushMirrorOpReporterForTesting,
-  resetMirrorOpReporterForTesting,
-  setMirrorOpReporterOverridesForTesting,
-} from "../contacts-mirror-op-reporter.js";
+import * as mirrorOpReporter from "../contacts-mirror-op-reporter.js";
 
 // ── Setup ────────────────────────────────────────────────────────────────────
 
-const errorLogs: [Record<string, unknown>, string][] = [];
-const warnLogs: unknown[] = [];
-let telemetryBodies: unknown[] = [];
+// The reporter's report fns carry the detail payload; capture them by
+// re-registering the reporter module with a recorder (its real sibling
+// exports — the unknown-method classifier — stay live for the store).
+const reportCalls: { op: string; detail: Record<string, unknown> }[] = [];
+
+mock.module("../contacts-mirror-op-reporter.js", () => ({
+  ...mirrorOpReporter,
+  reportMirrorOpMissing: (op: string, detail: Record<string, unknown>) => {
+    reportCalls.push({ op, detail });
+  },
+}));
+
+// The SUT must load AFTER the mock registrations above — a static import
+// would bind contact-store to the REAL ipc client + reporter before either
+// mock.module runs (bun mock.module is not retroactive for modules already
+// imported), and the escalations would never reach the recorder.
+const { ContactStore } = await import("../db/contact-store.js");
 
 beforeAll(async () => {
   await initGatewayDb();
@@ -88,30 +95,7 @@ beforeEach(() => {
     return {};
   });
 
-  errorLogs.length = 0;
-  warnLogs.length = 0;
-  telemetryBodies = [];
-  resetMirrorOpReporterForTesting();
-  setMirrorOpReporterOverridesForTesting({
-    fetchImpl: async (_url, init) => {
-      telemetryBodies.push(JSON.parse(String(init?.body)));
-      return new Response("{}");
-    },
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail, msg) => {
-        errorLogs.push([detail, msg]);
-      },
-      warn: (detail, msg) => {
-        warnLogs.push([detail, msg]);
-      },
-    },
-  });
-});
-
-afterEach(() => {
-  resetMirrorOpReporterForTesting();
+  reportCalls.length = 0;
 });
 
 afterAll(() => {
@@ -161,7 +145,7 @@ function unknownMethodError(method: string): Error {
 // ── Tests ────────────────────────────────────────────────────────────────────
 
 describe("mergeContacts — unknown mirror op escalation", () => {
-  test("unknown method → error log + telemetry; gateway merge still applied", async () => {
+  test("unknown method → fail-loud report; gateway merge still applied", async () => {
     seedContact("ct_keep");
     seedContact("ct_merge");
     seedChannel("ch_1", "ct_merge");
@@ -175,7 +159,6 @@ describe("mergeContacts — unknown mirror op escalation", () => {
       "ct_keep",
       "ct_merge",
     );
-    await flushMirrorOpReporterForTesting();
 
     // Gateway (source of truth) merge stands: donor gone, channel moved.
     expect(contact!.id).toBe("ct_keep");
@@ -196,26 +179,16 @@ describe("mergeContacts — unknown mirror op escalation", () => {
         .find((c) => c.id === "ch_1")?.contactId,
     ).toBe("ct_keep");
 
-    // Escalated: one error log + one watchdog telemetry event.
-    expect(errorLogs.length).toBe(1);
-    expect(errorLogs[0][0]).toMatchObject({
-      op: "contacts_mirror_merge_contact",
-      keepId: "ct_keep",
-      mergeId: "ct_merge",
-    });
-    expect(telemetryBodies).toEqual([
+    // Escalated: exactly one fail-loud report with the op + detail.
+    expect(reportCalls).toEqual([
       {
-        check_name: MIRROR_OP_MISSING_CHECK_NAME,
-        detail: {
-          op: "contacts_mirror_merge_contact",
-          keepId: "ct_keep",
-          mergeId: "ct_merge",
-        },
+        op: "contacts_mirror_merge_contact",
+        detail: { keepId: "ct_keep", mergeId: "ct_merge" },
       },
     ]);
   });
 
-  test("other IPC failure → best-effort warn only, same gateway state", async () => {
+  test("other IPC failure → no report, same gateway state", async () => {
     seedContact("ct_keep");
     seedContact("ct_merge");
     seedChannel("ch_1", "ct_merge");
@@ -229,7 +202,6 @@ describe("mergeContacts — unknown mirror op escalation", () => {
       "ct_keep",
       "ct_merge",
     );
-    await flushMirrorOpReporterForTesting();
 
     expect(contact!.id).toBe("ct_keep");
     expect(mirrored).toBe(false);
@@ -241,14 +213,13 @@ describe("mergeContacts — unknown mirror op escalation", () => {
         .find((c) => c.id === "ct_merge"),
     ).toBeUndefined();
 
-    // No escalation: no reporter error log, no telemetry.
-    expect(errorLogs.length).toBe(0);
-    expect(telemetryBodies).toEqual([]);
+    // No escalation: the report never fires.
+    expect(reportCalls).toEqual([]);
   });
 });
 
 describe("upsertContact — unknown mirror op escalation", () => {
-  test("unknown method → error log + telemetry; gateway upsert still applied", async () => {
+  test("unknown method → fail-loud report; gateway upsert still applied", async () => {
     ipcThrowOn.set(
       "contacts_mirror_upsert_full",
       unknownMethodError("contacts_mirror_upsert_full"),
@@ -259,7 +230,6 @@ describe("upsertContact — unknown mirror op escalation", () => {
       displayName: "Alice",
       channels: [{ type: "slack", address: "U12345" }],
     });
-    await flushMirrorOpReporterForTesting();
 
     // Gateway write stands.
     expect(created).toBe(true);
@@ -272,20 +242,15 @@ describe("upsertContact — unknown mirror op escalation", () => {
     ).toBeDefined();
     expect(store.getChannelsForContact(contact.id)).toHaveLength(1);
 
-    expect(errorLogs.length).toBe(1);
-    expect(errorLogs[0][0]).toMatchObject({
-      op: "contacts_mirror_upsert_full",
-      contactId: contact.id,
-    });
-    expect(telemetryBodies).toEqual([
+    expect(reportCalls).toEqual([
       {
-        check_name: MIRROR_OP_MISSING_CHECK_NAME,
-        detail: { op: "contacts_mirror_upsert_full", contactId: contact.id },
+        op: "contacts_mirror_upsert_full",
+        detail: { contactId: contact.id },
       },
     ]);
   });
 
-  test("other IPC failure → best-effort warn only, same gateway state", async () => {
+  test("other IPC failure → no report, same gateway state", async () => {
     ipcThrowOn.set("contacts_mirror_upsert_full", new Error("socket closed"));
 
     const store = new ContactStore();
@@ -293,11 +258,9 @@ describe("upsertContact — unknown mirror op escalation", () => {
       displayName: "Bob",
       channels: [{ type: "slack", address: "U67890" }],
     });
-    await flushMirrorOpReporterForTesting();
 
     expect(created).toBe(true);
     expect(store.getChannelsForContact(contact.id)).toHaveLength(1);
-    expect(errorLogs.length).toBe(0);
-    expect(telemetryBodies).toEqual([]);
+    expect(reportCalls).toEqual([]);
   });
 });

package/src/__tests__/contacts-control-plane-proxy.test.ts

@@ -2507,24 +2507,6 @@ describe("handleDeleteContact (gateway-native)", () => {
 });
 
 describe("handleCreateInvite (gateway-native mint)", () => {
-  test("rejects sourceChannel 'a2a' (A2A invites are daemon-managed)", async () => {
-    contactStoreCreateInviteMock = makeEchoCreateInviteMock();
-
-    const handler = createContactsControlPlaneProxyHandler(makeConfig());
-    const res = await handler.handleCreateInvite(
-      new Request("http://localhost:7830/v1/contacts/invites", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ contactId: "ct_1", sourceChannel: "a2a" }),
-      }),
-    );
-
-    expect(res.status).toBe(400);
-    const body = await res.json();
-    expect(body.error.code).toBe("BAD_REQUEST");
-    expect(contactStoreCreateInviteMock).toHaveBeenCalledTimes(0);
-  });
-
   test("mints token + 6-digit code natively for non-voice invites; only hashes reach the store", async () => {
     contactStoreCreateInviteMock = makeEchoCreateInviteMock();