@vellumai/assistant 0.10.12 → 0.11.0-staging.1

package/src/notifications/guardian-question-mode.ts

@@ -75,9 +75,19 @@ const GuardianQuestionPayloadBaseSchema = z.object({
 export const PendingQuestionPayloadSchema =
   GuardianQuestionPayloadBaseSchema.extend({
     requestKind: z.literal("pending_question"),
-    callSessionId: z.string().min(1),
-    activeGuardianRequestCount: z.number(),
+    /** Present only for voice-call questions; absent for ask_question prompts. */
+    callSessionId: z.string().min(1).optional(),
+    activeGuardianRequestCount: z.number().optional(),
     toolName: z.string().optional(),
+    /**
+     * Structured answer options for an ask_question prompt (2–4 entries).
+     * When present, the broadcaster renders them as tappable option actions
+     * (see {@link buildQuestionOptionActionId}); absent payloads render as
+     * plain text with request-code reply instructions.
+     */
+    options: z
+      .array(z.object({ id: z.string().min(1), label: z.string().min(1) }))
+      .optional(),
   });
 
 /**
@@ -221,6 +231,51 @@ export function buildToolApprovalSourceView(
   };
 }
 
+// ── Answer-option action tokens ─────────────────────────────────────────
+
+/**
+ * Action-id scheme for answer-mode option buttons on a `pending_question`
+ * card. The broadcaster builds card actions with these ids (so every channel
+ * adapter renders them without knowing they're question options), the reply
+ * router recognizes a tapped id as an answer selection rather than an
+ * approval action, and the question resolver maps the index back to the
+ * pending interaction's option. Index-based (not the raw option id) so the
+ * channel callback stays small and the LLM-supplied option id never rides
+ * the wire.
+ */
+export const QUESTION_SKIP_ACTION_ID = "answer_skip";
+
+/** Action id for the option at `index` on a question card. */
+export function buildQuestionOptionActionId(index: number): string {
+  return `answer_${index}`;
+}
+
+export type QuestionAnswerSelection =
+  | { kind: "option"; index: number }
+  | { kind: "skip" };
+
+/**
+ * Parse an action token from a question card. Returns `null` for anything
+ * that is not an answer-option token (including ordinary approval actions),
+ * so callers can fall through to approval handling.
+ */
+export function parseQuestionAnswerActionId(
+  token: string,
+): QuestionAnswerSelection | null {
+  if (token === QUESTION_SKIP_ACTION_ID) {
+    return { kind: "skip" };
+  }
+  const match = /^answer_(\d+)$/.exec(token);
+  if (!match) {
+    return null;
+  }
+  const index = Number(match[1]);
+  if (!Number.isInteger(index) || index < 0) {
+    return null;
+  }
+  return { kind: "option", index };
+}
+
 interface GuardianRequestModeInput {
   kind: unknown;
   toolName?: unknown;

package/src/notifications/home-feed-side-effect.ts

@@ -159,6 +159,7 @@ const EVENT_CATEGORY_MAP: Record<string, FeedItemCategory> = {
   "guardian.question": "security",
   "guardian.channel_activation": "security",
   "ingress.access_request": "security",
+  "telegram.webhook_health_alert": "system",
 };
 
 function deriveCategory(signal: NotificationSignal): FeedItemCategory {
@@ -269,6 +270,9 @@ const NOTEWORTHY_EVENT_NAMES: ReadonlySet<string> = new Set([
   "guardian.channel_activation",
   "ingress.access_request",
   "credential.health_alert",
+  // A dark messaging channel is inbox-worthy: the guardian may be waiting on
+  // replies that are silently queueing at Telegram.
+  "telegram.webhook_health_alert",
 ]);
 
 function deriveNoteworthy(signal: NotificationSignal): boolean {

package/src/notifications/signal.ts

@@ -25,6 +25,7 @@ export const NOTIFICATION_SOURCE_CHANNELS = [
   { id: "email", description: "Email channel" },
   { id: "platform", description: "Platform-managed channel" },
   { id: "a2a", description: "Agent-to-agent protocol channel" },
+  { id: "discord", description: "Discord channel" },
   { id: "scheduler", description: "Scheduled task runner (reminders, cron)" },
   { id: "watcher", description: "File/event watcher subsystem" },
 ] as const;
@@ -82,10 +83,6 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     id: "ingress.trusted_contact.guardian_decision",
     description: "Guardian decided on trusted contact request",
   },
-  {
-    id: "ingress.trusted_contact.denied",
-    description: "Trusted contact request denied",
-  },
   {
     id: "ingress.trusted_contact.verification_sent",
     description: "Verification sent to trusted contact",
@@ -125,6 +122,11 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     description:
       "OAuth credential health issue detected (expired, revoked, missing scopes)",
   },
+  {
+    id: "telegram.webhook_health_alert",
+    description:
+      "Telegram webhook is not delivering (unregistered, or failing per getWebhookInfo)",
+  },
 ] as const;
 
 export type NotificationSourceEventName =

package/src/notifications/trusted-contact-payloads.ts

@@ -31,10 +31,9 @@ const TrustedContactIdentitySchema = z.object({
 });
 
 /**
- * Payload for `ingress.trusted_contact.guardian_decision` and
- * `ingress.trusted_contact.denied` — the guardian's verdict on an access
- * request. The deny path emits both events from one object; the approve path
- * emits `guardian_decision` with `decision: "approved"` (identical shape).
+ * Payload for `ingress.trusted_contact.guardian_decision` — the guardian's
+ * verdict on an access request. `decision` distinguishes the deny path from
+ * an approve (identical shape).
  */
 export const TrustedContactDecisionPayloadSchema =
   TrustedContactIdentitySchema.extend({

package/src/notifications/vellum-card-affinity.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared vellum-card conversation pin for guardian-request producers.
+ *
+ * Guardian cards (access requests, tool grants, tool approvals, questions)
+ * that know their originating conversation pass this affinity fragment to
+ * `emitNotificationSignal` so the in-app (vellum) card lands inside that
+ * conversation instead of one the decision engine picks. The metadata mirrors
+ * the target's `source` because `pairDeliveryWithConversation` reuses a
+ * conversation only when its source matches the signal's (inbound
+ * conversations default to "user"); a stale/missing target falls back to a
+ * fresh conversation via the same pairing path.
+ */
+
+import { getConversation } from "../persistence/conversation-crud.js";
+
+export interface VellumCardAffinity {
+  conversationAffinityHint: { vellum: string };
+  conversationMetadata: { source: string };
+}
+
+/**
+ * Build the emit-signal affinity fragment pinning the vellum card to
+ * `destinationConversationId`, or `undefined` when the producer has no
+ * originating conversation (callers spread the result:
+ * `...(buildVellumCardAffinity(id) ?? {})`).
+ */
+export function buildVellumCardAffinity(
+  destinationConversationId: string | undefined,
+): VellumCardAffinity | undefined {
+  if (!destinationConversationId) {
+    return undefined;
+  }
+  return {
+    conversationAffinityHint: { vellum: destinationConversationId },
+    conversationMetadata: {
+      source: getConversation(destinationConversationId)?.source ?? "user",
+    },
+  };
+}

package/src/oauth/AGENTS.md

@@ -39,7 +39,7 @@ The `logoUrl` field in `seed-providers.ts` is the source of truth for a provider
 
 For brands Simple Icons doesn't host (e.g. Salesforce, which Simple Icons removed for trademark reasons), use the `glincker/thesvg` source via jsDelivr — `https://cdn.jsdelivr.net/gh/glincker/thesvg@main/public/icons/<key>/default.svg`. The recognised `logoUrl` prefixes are enforced by `oauth-provider-seed-logos.test.ts`; if you need a third source, extend that allowlist.
 
-### 5. Secret patterns (if applicable) — `../security/secret-patterns.ts`
+### 5. Secret patterns (if applicable) — `packages/service-contracts/src/secret-detection.ts`
 
 If the provider issues API keys with a recognizable prefix (e.g. `acme_sk_`), add a `PREFIX_PATTERNS` entry. OAuth-only services with opaque access tokens do not need one. See `../security/AGENTS.md` for details.
 

package/src/permissions/channel-permission-query.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  collapseChannelThresholdForContact,
+  effectiveChannelCellThreshold,
+} from "./channel-permission-query.js";
+
+describe("collapseChannelThresholdForContact", () => {
+  test.each([
+    ["none", "none"],
+    ["low", "low"],
+    ["medium", "low"],
+    ["high", "low"],
+  ] as const)("%s collapses to %s", (input, expected) => {
+    expect(collapseChannelThresholdForContact(input)).toBe(expected);
+  });
+});
+
+describe("effectiveChannelCellThreshold", () => {
+  const resolved = (threshold: "none" | "low" | "medium" | "high") => ({
+    ok: true as const,
+    resolved: { threshold },
+  });
+  const noCell = { ok: true as const, resolved: null };
+  const failed = { ok: false as const };
+
+  test("a transport failure authorizes nothing, for every contact type", () => {
+    for (const contactType of [
+      "guardian",
+      "trusted_contact",
+      "unverified_contact",
+      "unknown",
+    ] as const) {
+      expect(
+        effectiveChannelCellThreshold(failed, contactType, "low"),
+      ).toBeUndefined();
+    }
+  });
+
+  test("a contact's resolved cell is collapsed", () => {
+    expect(
+      effectiveChannelCellThreshold(resolved("high"), "trusted_contact", "low"),
+    ).toBe("low");
+    expect(
+      effectiveChannelCellThreshold(resolved("none"), "trusted_contact", "low"),
+    ).toBe("none");
+  });
+
+  test("a contact with no cell gets the caller-derived room default", () => {
+    expect(
+      effectiveChannelCellThreshold(noCell, "trusted_contact", "low"),
+    ).toBe("low");
+    expect(
+      effectiveChannelCellThreshold(noCell, "trusted_contact", "none"),
+    ).toBe("none");
+    expect(
+      effectiveChannelCellThreshold(noCell, "trusted_contact", undefined),
+    ).toBeUndefined();
+  });
+
+  test("guardian queries pass through raw and ignore the room default", () => {
+    expect(
+      effectiveChannelCellThreshold(resolved("high"), "guardian", "low"),
+    ).toBe("high");
+    expect(
+      effectiveChannelCellThreshold(noCell, "guardian", "low"),
+    ).toBeUndefined();
+  });
+});

package/src/permissions/channel-permission-query.ts

@@ -13,10 +13,25 @@ import {
   isChannelConversationType,
   isTrustClass,
   type ResolveChannelPermissionRequest,
+  type ResolvedChannelPermission,
+  type RiskThreshold,
 } from "@vellumai/gateway-client";
 
 import type { PolicyContext } from "./types.js";
 
+/**
+ * The fields a cell query is derived from — a subset of {@link PolicyContext}
+ * so a caller holding only a turn's channel coordinates (the sensitive-tool
+ * gate, which runs before a policy context exists) can build the same query.
+ */
+export type ChannelPermissionCoordinates = Pick<
+  PolicyContext,
+  | "sourceChannel"
+  | "trustClass"
+  | "channelConversationType"
+  | "channelExternalId"
+>;
+
 /**
  * Build the permission-matrix cell query for a permission decision: the
  * channel coordinates of the turn plus the actor's contact-type. Returns
@@ -26,7 +41,7 @@ import type { PolicyContext } from "./types.js";
  * from the conversation override / global defaults as before.
  */
 export function buildChannelPermissionCellQuery(
-  policyContext?: PolicyContext,
+  policyContext?: ChannelPermissionCoordinates,
 ): ResolveChannelPermissionRequest | undefined {
   const adapter = policyContext?.sourceChannel;
   const trustClass = policyContext?.trustClass;
@@ -44,3 +59,60 @@ export function buildChannelPermissionCellQuery(
     contactType: trustClass,
   };
 }
+
+/**
+ * Collapse a threshold to the two levels a channel distinguishes for
+ * non-guardian contact types: `none` is itself, everything else is `low`.
+ * Applied to stored cells and to the global default a cell-less room
+ * inherits alike; the picker applies the same collapse for display (web
+ * `channelTierBehavesAs`), so a room can never behave wider than the level
+ * displayed for it.
+ */
+export function collapseChannelThresholdForContact(
+  threshold: RiskThreshold,
+): RiskThreshold {
+  return threshold === "none" ? "none" : "low";
+}
+
+/**
+ * The threshold a cell resolution actually authorizes for a contact type.
+ * The single rule every cell consumer applies — the sensitive-tool gate,
+ * the threshold cascade, and the pre-prompt refresh — kept in this leaf
+ * module so tests that stub the IPC lookup still exercise it.
+ *
+ * For non-guardian contact types, a resolved cell authorizes its collapsed
+ * threshold ({@link collapseChannelThresholdForContact}), and a successful
+ * walk with no cell at any level authorizes `noCellDefault` — the room
+ * default the caller derives from the owner's global setting, already
+ * collapsed. Callers that cannot derive one pass `undefined`, which keeps
+ * the caller's fail-safe path in charge.
+ *
+ * Guardian queries pass through untouched — a resolved cell keeps its raw
+ * threshold and no-cell returns `undefined` (fall through to the global
+ * thresholds): the channel setting governs other people in the room, never
+ * the guardian's own lane.
+ *
+ * A transport failure (`ok: false`) is `undefined`: an unreachable gateway
+ * must never widen what a channel actor may do.
+ */
+export function effectiveChannelCellThreshold(
+  cell:
+    | {
+        ok: true;
+        resolved: Pick<ResolvedChannelPermission, "threshold"> | null;
+      }
+    | { ok: false },
+  contactType: ResolveChannelPermissionRequest["contactType"],
+  noCellDefault: RiskThreshold | undefined,
+): RiskThreshold | undefined {
+  if (!cell.ok) {
+    return undefined;
+  }
+  if (contactType === "guardian") {
+    return cell.resolved?.threshold;
+  }
+  if (!cell.resolved) {
+    return noCellDefault;
+  }
+  return collapseChannelThresholdForContact(cell.resolved.threshold);
+}

package/src/permissions/checker.test.ts

@@ -15,12 +15,14 @@ mock.module("../config/assistant-feature-flags.js", () => ({
 }));
 
 // `buildPolicyContext` (used by the integration tests below) precomputes the
-// proc-to-skills gate via `isProcToSkillsActive`. Drive it through this slot so
-// a test can put the production threading path in the active / inactive state.
-let mockProcToSkillsActive = true;
+// proc-to-skills gate via `isV3TierActive`. Drive it through this slot so a
+// test can put the production threading path in the active / inactive state.
+let mockV3TierActive = true;
 mock.module("../config/memory-v3-gate.js", () => ({
-  isProcToSkillsActive: () => mockProcToSkillsActive,
-  isMemoryV3Live: () => mockProcToSkillsActive,
+  isMemoryEnabled: (config?: { memory?: { enabled?: boolean } }) =>
+    config?.memory?.enabled !== false,
+  isV3TierActive: () => mockV3TierActive,
+  isMemoryV3Live: () => mockV3TierActive,
   usesConceptPageMemory: (memory?: {
     enabled?: boolean;
     v2?: { enabled?: boolean };
@@ -115,10 +117,14 @@ mock.module("./trust-store.js", () => ({
   onRulesChanged: () => {},
 }));
 
-// Mock workspace policy.
+// Mock workspace policy. Spread the real module so pure path helpers
+// (resolveSandboxBase) keep their real behavior for param building.
+const realWorkspacePolicy = await import("./workspace-policy.js");
 let mockIsPathWithinWorkspaceRoot = true;
 mock.module("./workspace-policy.js", () => ({
+  ...realWorkspacePolicy,
   isWorkspaceScopedInvocation: () => false,
+  isOutOfWorkspaceFileInvocation: () => false,
   isPathWithinWorkspaceRoot: () => mockIsPathWithinWorkspaceRoot,
 }));
 
@@ -143,9 +149,13 @@ mock.module("../tools/network/url-safety.js", () => ({
 import type { ClassificationResult } from "./ipc-risk-types.js";
 
 let mockIpcClassifyRiskResult: ClassificationResult | undefined;
+let lastClassifyRiskParams: Record<string, unknown> | undefined;
 
 mock.module("../ipc/gateway-client.js", () => ({
-  ipcClassifyRisk: async () => mockIpcClassifyRiskResult,
+  ipcClassifyRisk: async (params: Record<string, unknown>) => {
+    lastClassifyRiskParams = params;
+    return mockIpcClassifyRiskResult;
+  },
   ipcCall: async () => undefined,
   ipcCallPersistent: async () => undefined,
   resetPersistentClient: () => {},
@@ -155,6 +165,7 @@ mock.module("../ipc/gateway-client.js", () => ({
 
 import {
   mkdtempSync,
+  realpathSync,
   rmSync,
   symlinkSync,
   unlinkSync,
@@ -180,9 +191,10 @@ describe("Permission Checker (gateway IPC)", () => {
   beforeEach(() => {
     mockIsContainerized = false;
     mockIpcClassifyRiskResult = undefined;
+    lastClassifyRiskParams = undefined;
     mockCachedThreshold = "low";
     mockRefreshedThreshold = null;
-    mockProcToSkillsActive = true;
+    mockV3TierActive = true;
     thresholdCallLog.length = 0;
   });
 
@@ -246,6 +258,70 @@ describe("Permission Checker (gateway IPC)", () => {
       );
     });
 
+    test("sends canonicalized boundary params for sandbox file tools", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "File write outside the workspace",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      const workingDir = mkdtempSync(join(tmpdir(), "checker-boundary-"));
+      try {
+        await classifyRisk(
+          "file_write",
+          { path: "/tmp/checker-boundary-outside.txt" },
+          workingDir,
+        );
+        expect(lastClassifyRiskParams?.isContainerized).toBe(false);
+        // The boundary is canonicalized so the gateway compares canonical
+        // against canonical (macOS tmpdir lives behind a /var symlink).
+        expect(lastClassifyRiskParams?.resolvedWorkingDir).toBe(
+          realpathSync(workingDir),
+        );
+      } finally {
+        rmSync(workingDir, { recursive: true, force: true });
+      }
+    });
+
+    test("classifies a dangling symlink by its destination", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "File write outside the workspace",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      const workingDir = realpathSync(
+        mkdtempSync(join(tmpdir(), "checker-dangling-")),
+      );
+      const outside = realpathSync(
+        mkdtempSync(join(tmpdir(), "checker-dangling-out-")),
+      );
+      try {
+        const destination = join(outside, "not-yet.txt");
+        symlinkSync(destination, join(workingDir, "dangle"));
+        await classifyRisk("file_write", { path: "dangle" }, workingDir);
+        // The destination does not exist, but a write through the link
+        // creates it — classification must see the destination.
+        expect(lastClassifyRiskParams?.resolvedPath).toBe(destination);
+      } finally {
+        rmSync(workingDir, { recursive: true, force: true });
+        rmSync(outside, { recursive: true, force: true });
+      }
+    });
+
+    test("omits the canonicalized boundary for host file tools", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "Host file write (default)",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      await classifyRisk("host_file_write", {
+        path: "/tmp/checker-boundary-host.txt",
+      });
+      expect(lastClassifyRiskParams?.resolvedWorkingDir).toBeUndefined();
+    });
+
     test("caches results for identical inputs", async () => {
       mockIpcClassifyRiskResult = {
         risk: "low",
@@ -1085,7 +1161,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // Same retrospective ToolContext, but the feature is inactive (flag off
       // or v3 not live). buildPolicyContext stamps `procToSkillsActive: false`,
       // so the grant is dead and the high-risk scaffold prompts.
-      mockProcToSkillsActive = false;
+      mockV3TierActive = false;
       mockIpcClassifyRiskResult = {
         risk: "high",
         reason: "Skill scaffold",

package/src/permissions/checker.ts

@@ -53,6 +53,7 @@ import {
 import {
   isPathWithinWorkspaceRoot,
   isWorkspaceScopedInvocation,
+  resolveSandboxBase,
 } from "./workspace-policy.js";
 
 // ── Risk classification cache ────────────────────────────────────────────────
@@ -155,7 +156,7 @@ function fileToolFsStateKey(
     return undefined;
   }
   const resolved = resolveFileToolPaths(toolName, input, workingDir);
-  return `${resolved.resolvedPath ?? ""}\0${resolved.resolvedTransferDestPath ?? ""}`;
+  return `${resolved.resolvedPath ?? ""}\0${resolved.resolvedTransferDestPath ?? ""}\0${resolved.resolvedWorkingDir ?? ""}`;
 }
 
 /** Clear the risk classification cache. Called when trust rules change. Exported for test setup. */
@@ -210,7 +211,7 @@ function resolveSkillIdAndHash(
  * registry (`getToolOwner(name)`) rather than read from the `Tool` object,
  * since ownership lives on the registry, not on the tool itself.
  */
-function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
+export function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
   if (!tool) {
     return false;
   }
@@ -389,25 +390,6 @@ function buildFileContext(): FileContext {
  * filesystem this process cannot see (e.g. host_file paths proxied to a remote
  * client), so this never regresses below today's lexical behavior.
  */
-// The Docker sandbox mounts the workspace at /workspace, and the model emits
-// container-scoped paths (e.g. "/workspace/tools/evil.ts") even on local turns.
-// Mirror the gateway's resolveSandboxPath remap so the symlink-resolved path we
-// forward lines up with the gateway's lexical fallback and the protected dirs.
-const CONTAINER_WORKSPACE_PREFIX = "/workspace/";
-const CONTAINER_WORKSPACE_EXACT = "/workspace";
-
-function resolveSandboxBase(rawPath: string, workingDir: string): string {
-  let effectivePath = rawPath;
-  if (!rawPath.startsWith(workingDir + "/") && rawPath !== workingDir) {
-    if (rawPath.startsWith(CONTAINER_WORKSPACE_PREFIX)) {
-      effectivePath = rawPath.slice(CONTAINER_WORKSPACE_PREFIX.length);
-    } else if (rawPath === CONTAINER_WORKSPACE_EXACT) {
-      effectivePath = ".";
-    }
-  }
-  return resolve(workingDir, effectivePath);
-}
-
 function resolveClassificationPath(
   filePath: string,
   workingDir: string,
@@ -441,6 +423,13 @@ interface FileToolResolution {
   effectiveWorkingDir: string;
   isHostTool: boolean;
   resolvedPath?: string;
+  /**
+   * Symlink-canonicalized working dir for sandbox file tools, paired with
+   * `resolvedPath` so the gateway's workspace-boundary check compares
+   * canonical against canonical (a symlinked workspace prefix, e.g. macOS
+   * /var → /private/var, must not read as an escape). Unset for host tools.
+   */
+  resolvedWorkingDir?: string;
   transferSandboxDestPath?: string;
   transferSandboxWorkingDir?: string;
   resolvedTransferDestPath?: string;
@@ -490,6 +479,9 @@ function resolveFileToolPaths(
       effectiveWorkingDir,
       isHostTool,
     ),
+    resolvedWorkingDir: isHostTool
+      ? undefined
+      : resolveRealPath(effectiveWorkingDir),
     transferSandboxDestPath,
     transferSandboxWorkingDir,
     // The to_sandbox destination is a workspace write — symlink-resolve it too
@@ -573,7 +565,9 @@ function buildClassifyRiskParams(
       tool: toolName,
       path: resolved.filePath,
       resolvedPath: resolved.resolvedPath,
+      resolvedWorkingDir: resolved.resolvedWorkingDir,
       workingDir: resolved.effectiveWorkingDir,
+      isContainerized: getIsContainerized(),
       fileContext: buildFileContext(),
       transferSandboxDestPath: resolved.transferSandboxDestPath,
       transferSandboxWorkingDir: resolved.transferSandboxWorkingDir,
@@ -797,7 +791,8 @@ export async function classifyRisk(
 // prompt. The grant resolves these tools to ALLOW non-interactively, and ONLY
 // when all of these hold:
 //   - procedural-memory-as-skills is active (`policyContext.procToSkillsActive`,
-//     precomputed by buildPolicyContext: memory-v3 is live),
+//     precomputed by buildPolicyContext: the v3 tier is active — memory is on
+//     and memory-v3 is live),
 //   - the turn is the retrospective background source — guardian trust, `vellum`
 //     source channel, `memory_retrospective` origin (set in
 //     memory-retrospective-job.ts).

package/src/permissions/confirmation-guardian-request.test.ts

@@ -50,7 +50,7 @@ mock.module("../runtime/confirmation-request-guardian-bridge.js", () => ({
   },
 }));
 
-import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { AssistantEvent } from "../api/index.js";
 import { createGuardianRequestForConfirmation } from "./confirmation-guardian-request.js";
 
 const MSG = {
@@ -59,7 +59,7 @@ const MSG = {
   toolName: "Bash",
   input: { command: "ls" },
   riskLevel: "medium",
-} as unknown as ServerMessage & { type: "confirmation_request" };
+} as unknown as AssistantEvent & { type: "confirmation_request" };
 
 describe("createGuardianRequestForConfirmation", () => {
   beforeEach(() => {

package/src/permissions/confirmation-guardian-request.ts

@@ -17,7 +17,7 @@
  * therefore the emitters — stays cheap and free of import-time side effects.
  */
 
-import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { ConfirmationRequestEvent } from "../api/index.js";
 import { IntegrityError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 
@@ -30,7 +30,7 @@ const log = getLogger("confirmation-guardian-request");
  * never thrown.
  */
 export async function createGuardianRequestForConfirmation(
-  msg: ServerMessage & { type: "confirmation_request" },
+  msg: ConfirmationRequestEvent,
   conversationId: string,
   opts?: {
     /**