@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/__tests__/tool-approval-handler.test.ts

@@ -1,5 +1,11 @@
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
+import {
+  installThresholdReaderMock,
+  resetThresholdReaderMock,
+  thresholdReaderMock,
+} from "./gateway-threshold-reader-mock.js";
+
 const testDir = process.env.VELLUM_WORKSPACE_DIR!;
 
 // Mock verification control-plane policy -- not targeting control-plane by default
@@ -22,22 +28,75 @@ const fakeTool = {
   execute: async () => ({ content: "ok", isError: false }),
 };
 
+/** Same tool class as `fakeTool`, but reaching the guardian's own machine. */
+const fakeHostTool = {
+  ...fakeTool,
+  name: "host_bash",
+  executionTarget: "host" as const,
+};
+
+/**
+ * A skill shadowing a core side-effect name. A novel third-party tool name is
+ * not a side-effect tool at all, so it never reaches the floor — shadowing is
+ * the case where an unvetted manifest lands on a liftable invocation.
+ */
+const fakeSkillTool = {
+  ...fakeTool,
+  name: "document_create",
+  category: "documents",
+};
+
+const fakeTools: Record<string, typeof fakeTool> = {
+  bash: fakeTool,
+  host_bash: fakeHostTool,
+  document_create: fakeSkillTool,
+  acme_send: { ...fakeTool, name: "acme_send", category: "messaging" },
+  ws_deploy: { ...fakeTool, name: "ws_deploy", category: "workspace" },
+  mcp_lookup: { ...fakeTool, name: "mcp_lookup", category: "mcp" },
+  file_write: { ...fakeTool, name: "file_write", category: "filesystem" },
+  web_fetch: { ...fakeTool, name: "web_fetch", category: "network" },
+};
+
+/** Registry ownership per tool — drives the extension-owned gate checks. */
+const toolOwners: Record<string, { kind: string; id: string }> = {
+  document_create: { kind: "skill", id: "some-skill" },
+  acme_send: { kind: "skill", id: "some-skill" },
+  ws_deploy: { kind: "workspace", id: "tools/ws-deploy.ts" },
+  mcp_lookup: { kind: "mcp", id: "some-server" },
+};
+
+/**
+ * Per-test owner override for `file_write`, for the workspace-override-of-a-
+ * core-name case. `undefined` = unowned built-in, the lift tests' baseline.
+ */
+let fileWriteOwner: { kind: string; id: string } | undefined;
+
 mock.module("../tools/registry.js", () => ({
-  getTool: (name: string) => (name === "bash" ? fakeTool : undefined),
-  resolveTool: (name: string) => (name === "bash" ? fakeTool : undefined),
-  getAllTools: () => [fakeTool],
+  getTool: (name: string) => fakeTools[name],
+  resolveTool: (name: string) => fakeTools[name],
+  getAllTools: () => Object.values(fakeTools),
+  getToolOwner: (name: string) =>
+    name === "file_write" && fileWriteOwner ? fileWriteOwner : toolOwners[name],
 }));
 
 // Mock the dynamic-skill predicate so isSensitiveTool's skill_load branch is
 // exercised without a real skill catalog: "dynamic-skill" is an inline-command
 // load, anything else is plain.
+/** Whether the owning skill of the tool under test reports as first-party. */
+let skillOwnerBundled = false;
+
 mock.module("../permissions/checker.js", () => ({
   isDynamicSkillLoadInvocation: (
     _name: string,
     input: Record<string, unknown>,
   ) => input?.skill === "dynamic-skill",
+  isToolOwnerSkillBundled: () => skillOwnerBundled,
 }));
 
+// The channel permission-matrix cell is a gateway IPC call; the shared mock
+// makes it per-test controllable and counts lookups.
+installThresholdReaderMock();
+
 // Capture tool-audit terminal calls so tests can assert on denied/error outcomes
 // the way they previously asserted on emitted lifecycle events.
 const auditCalls = {
@@ -60,6 +119,10 @@ function resetAuditCalls(): void {
   auditCalls.prompted.length = 0;
 }
 
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
 import {
   mintGrantFromDecision,
   type MintGrantParams,
@@ -71,8 +134,8 @@ import { scopedApprovalGrants } from "../persistence/schema/index.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 import {
   type ApprovalCellThreshold,
-  isSensitiveTool,
   resolveSensitiveToolDecision,
+  sensitiveToolReach,
   ToolApprovalHandler,
 } from "../tools/tool-approval-handler.js";
 import type { ToolContext } from "../tools/types.js";
@@ -528,36 +591,100 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
   });
 });
 
-describe("isSensitiveTool", () => {
-  test("sensitivity is a property of the tool and execution target", () => {
-    // Side-effect tools are sensitive wherever they run.
-    expect(isSensitiveTool("bash", "sandbox")).toBe(true);
-    expect(isSensitiveTool("file_write", "sandbox")).toBe(true);
-    // Read-only tools are sensitive only when they execute on the host.
-    expect(isSensitiveTool("web_search", "host")).toBe(true);
-    expect(isSensitiveTool("web_search", "sandbox")).toBe(false);
-    // UI surface tools are exempt even on the host target.
-    expect(isSensitiveTool("ui_show", "host")).toBe(false);
-    expect(isSensitiveTool("ui_update", "host")).toBe(false);
-    expect(isSensitiveTool("ui_dismiss", "host")).toBe(false);
-  });
-
-  test("an inline-command (dynamic) skill_load is sensitive; a plain one is not", () => {
+describe("sensitiveToolReach", () => {
+  test("reach is a property of the tool and execution target", () => {
+    // Side-effect tools reach the sandbox wherever they run…
+    expect(sensitiveToolReach("bash", "sandbox")).toBe("sandbox");
+    expect(sensitiveToolReach("file_write", "sandbox")).toBe("sandbox");
+    // …read-only tools reach only when they execute on the host…
+    expect(sensitiveToolReach("web_search", "host")).toBe("host");
+    expect(sensitiveToolReach("web_search", "sandbox")).toBe("none");
+    // …and UI surface tools are exempt even on the host target.
+    expect(sensitiveToolReach("ui_show", "host")).toBe("none");
+    expect(sensitiveToolReach("ui_update", "host")).toBe("none");
+    expect(sensitiveToolReach("ui_dismiss", "host")).toBe("none");
+  });
+
+  test("an inline-command (dynamic) skill_load reaches the host; a plain one is not sensitive", () => {
     // skill_load is not a side-effect tool, but a load that executes embedded
     // shell at load time must pass through the capability floor — so a
     // non-guardian's dynamic load escalates to the guardian, Full-access-proof.
     expect(
-      isSensitiveTool("skill_load", "sandbox", { skill: "dynamic-skill" }),
-    ).toBe(true);
+      sensitiveToolReach("skill_load", "sandbox", { skill: "dynamic-skill" }),
+    ).toBe("host");
     expect(
-      isSensitiveTool("skill_load", "sandbox", { skill: "plain-skill" }),
-    ).toBe(false);
+      sensitiveToolReach("skill_load", "sandbox", { skill: "plain-skill" }),
+    ).toBe("none");
     // Without input, skill_load falls back to the name/target rule.
-    expect(isSensitiveTool("skill_load", "sandbox")).toBe(false);
+    expect(sensitiveToolReach("skill_load", "sandbox")).toBe("none");
+  });
+
+  test("an out-of-workspace file_read reaches the host; an in-workspace one is not sensitive", () => {
+    const workingDir = mkdtempSync(join(tmpdir(), "sensitive-tool-test-"));
+    try {
+      // Out-of-workspace file access is host-equivalent: the host-fallback
+      // path policy executes the escape, so it carries the host capability
+      // floor even for the read-only sandbox tool.
+      expect(
+        sensitiveToolReach(
+          "file_read",
+          "sandbox",
+          { path: "/etc/hosts" },
+          workingDir,
+        ),
+      ).toBe("host");
+      expect(
+        sensitiveToolReach(
+          "file_read",
+          "sandbox",
+          { path: "notes.txt" },
+          workingDir,
+        ),
+      ).toBe("none");
+      // `path` is the executed field — a benign `file_path` must not mask it.
+      expect(
+        sensitiveToolReach(
+          "file_read",
+          "sandbox",
+          { path: "/etc/hosts", file_path: "notes.txt" },
+          workingDir,
+        ),
+      ).toBe("host");
+      // Container-style /workspace paths remap to the workspace.
+      expect(
+        sensitiveToolReach(
+          "file_read",
+          "sandbox",
+          { path: "/workspace/notes.txt" },
+          workingDir,
+        ),
+      ).toBe("none");
+      // Without a workingDir the boundary is unknown — name/target rule only.
+      expect(
+        sensitiveToolReach("file_read", "sandbox", { path: "/etc/hosts" }),
+      ).toBe("none");
+      // Containerized installs keep the hard execution boundary, so the
+      // escape never executes and does not need the floor.
+      process.env.IS_CONTAINERIZED = "true";
+      try {
+        expect(
+          sensitiveToolReach(
+            "file_read",
+            "sandbox",
+            { path: "/etc/hosts" },
+            workingDir,
+          ),
+        ).toBe("none");
+      } finally {
+        delete process.env.IS_CONTAINERIZED;
+      }
+    } finally {
+      rmSync(workingDir, { recursive: true, force: true });
+    }
   });
 });
 
-describe("resolveSensitiveToolDecision / CapabilitySet floor invariant", () => {
+describe("resolveSensitiveToolDecision / CapabilitySet floor × approval cell", () => {
   const cellThresholds: Array<ApprovalCellThreshold | undefined> = [
     undefined,
     "none",
@@ -565,24 +692,58 @@ describe("resolveSensitiveToolDecision / CapabilitySet floor invariant", () => {
     "medium",
     "high",
   ];
-  const riskLevels = ["low", "medium", "high"];
+  /** The cells that authorize something, and so can lift the floor. */
+  const liftingThresholds: ApprovalCellThreshold[] = ["low", "medium", "high"];
+
+  test("no cell and a none cell both leave the escalate floor standing", () => {
+    for (const cellThreshold of [undefined, "none"] as const) {
+      expect(
+        resolveSensitiveToolDecision({
+          reach: "sandbox",
+          cellThreshold,
+          sensitiveToolApproval: "escalate-and-wait",
+        }),
+      ).toBe("escalate-and-wait");
+    }
+  });
 
-  test("no cell threshold or risk level lifts the floor for non-self actors", () => {
+  test("a cell that authorizes something lifts the escalate floor", () => {
+    for (const cellThreshold of liftingThresholds) {
+      expect(
+        resolveSensitiveToolDecision({
+          reach: "sandbox",
+          cellThreshold,
+          sensitiveToolApproval: "escalate-and-wait",
+        }),
+      ).toBe("proceed");
+    }
+  });
+
+  // A room-level posture says what the assistant may do in that room. It is
+  // never a grant of the owner's own machine or accounts, so no cell at any
+  // cascade level reaches past the sandbox.
+  test("host reach is never lifted, at any cell threshold", () => {
     for (const cellThreshold of cellThresholds) {
-      for (const riskLevel of riskLevels) {
-        expect(
-          resolveSensitiveToolDecision({
-            sensitive: true,
-            cellThreshold,
-            riskLevel,
-            sensitiveToolApproval: "escalate-and-wait",
-          }),
-        ).toBe("escalate-and-wait");
+      expect(
+        resolveSensitiveToolDecision({
+          reach: "host",
+          cellThreshold,
+          sensitiveToolApproval: "escalate-and-wait",
+        }),
+      ).toBe("escalate-and-wait");
+    }
+  });
+
+  // An actor with no established identity has no cell to stand on: the matrix
+  // is keyed by contact type, and "unknown" is the absence of one. No cell at
+  // any cascade level may turn that into permission to act.
+  test("deny is absolute — no cell threshold lifts it", () => {
+    for (const cellThreshold of cellThresholds) {
+      for (const reach of ["sandbox", "host"] as const) {
         expect(
           resolveSensitiveToolDecision({
-            sensitive: true,
+            reach,
             cellThreshold,
-            riskLevel,
             sensitiveToolApproval: "deny",
           }),
         ).toBe("deny");
@@ -592,12 +753,11 @@ describe("resolveSensitiveToolDecision / CapabilitySet floor invariant", () => {
 
   test("self capability proceeds for sensitive tools (lane-B policy governs downstream)", () => {
     for (const cellThreshold of cellThresholds) {
-      for (const riskLevel of riskLevels) {
+      for (const reach of ["sandbox", "host"] as const) {
         expect(
           resolveSensitiveToolDecision({
-            sensitive: true,
+            reach,
             cellThreshold,
-            riskLevel,
             sensitiveToolApproval: "self",
           }),
         ).toBe("proceed");
@@ -613,9 +773,8 @@ describe("resolveSensitiveToolDecision / CapabilitySet floor invariant", () => {
     ] as const) {
       expect(
         resolveSensitiveToolDecision({
-          sensitive: false,
+          reach: "none",
           cellThreshold: undefined,
-          riskLevel: "high",
           sensitiveToolApproval,
         }),
       ).toBe("proceed");
@@ -623,6 +782,391 @@ describe("resolveSensitiveToolDecision / CapabilitySet floor invariant", () => {
   });
 });
 
+describe("ToolApprovalHandler / approval cell lifts the sensitive-tool floor", () => {
+  const handler = new ToolApprovalHandler();
+  /** An ordinary workspace write: sandbox reach, and nothing excludes it. */
+  const toolName = "file_write";
+  const input = { path: "notes/todo.md", content: "x" };
+
+  /**
+   * A contact in a room, with no `requesterExternalUserId` — escalation needs
+   * one, so when the floor stands the gate takes the generic denial path
+   * instead of reaching for the guardian-request machinery. That keeps these
+   * tests on the gate's own decision.
+   */
+  function channelContext(overrides: Partial<ToolContext> = {}): ToolContext {
+    return makeContext({
+      trustClass: "trusted_contact",
+      executionChannel: "telegram",
+      channelPermissionChannelId: "C-room",
+      ...overrides,
+    });
+  }
+
+  function cell(threshold: string) {
+    return { ok: true, resolved: { threshold, scope: "channel" } } as const;
+  }
+
+  beforeEach(() => {
+    clearTables();
+    resetAuditCalls();
+    resetThresholdReaderMock();
+    skillOwnerBundled = false;
+    fileWriteOwner = undefined;
+  });
+
+  test.each(["low", "medium", "high"])(
+    "a %s cell lifts the floor — no scoped grant required",
+    async (threshold) => {
+      thresholdReaderMock.cell = cell(threshold);
+
+      const result = await handler.checkPreExecutionGates(
+        toolName,
+        input,
+        channelContext(),
+        "low",
+        Date.now(),
+      );
+
+      expect(result.allowed).toBe(true);
+      if (!result.allowed) {
+        return;
+      }
+      // Not "approved via a grant" — the gate stepped out of the grant
+      // mechanism entirely and handed off to the risk/threshold policy.
+      expect(result.grantConsumed).toBeFalsy();
+      expect(auditCalls.denied.length).toBe(0);
+    },
+  );
+
+  test("a none cell authorizes nothing — the floor stands", async () => {
+    thresholdReaderMock.cell = cell("none");
+
+    const result = await handler.checkPreExecutionGates(
+      toolName,
+      input,
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+    if (result.allowed) {
+      return;
+    }
+    expect(result.result.content).toContain("requires guardian approval");
+  });
+
+  // Fail closed: an unreadable cell is indistinguishable from a strict one, so
+  // a gateway outage must never widen what a channel actor may do.
+  test("a failed cell lookup does not lift the floor", async () => {
+    thresholdReaderMock.cell = { ok: false };
+
+    const result = await handler.checkPreExecutionGates(
+      toolName,
+      input,
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+  });
+
+  // The matrix is keyed by contact type, and "unknown" is the absence of one.
+  test("an unknown actor stays fail-closed even under a full-access cell", async () => {
+    thresholdReaderMock.cell = cell("high");
+
+    const result = await handler.checkPreExecutionGates(
+      toolName,
+      input,
+      channelContext({ trustClass: "unknown" }),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+    if (result.allowed) {
+      return;
+    }
+    expect(result.result.content).toContain("verified channel identity");
+    // Nothing to resolve: no cell can lift an absolute deny.
+    expect(thresholdReaderMock.cellLookups).toBe(0);
+  });
+
+  // The cell says what the assistant may do in a room, not what a contact may
+  // do to the owner's machine. `host_bash` is the same tool class as `bash`
+  // and the same Full-access cell — only the reach differs.
+  test("a full-access cell does not lift a host-reach tool", async () => {
+    thresholdReaderMock.cell = cell("high");
+
+    const result = await handler.checkPreExecutionGates(
+      "host_bash",
+      { command: "ls" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+    if (result.allowed) {
+      return;
+    }
+    expect(result.result.content).toContain("requires guardian approval");
+    // Host reach is decided before the cell matters, so nothing is looked up.
+    expect(thresholdReaderMock.cellLookups).toBe(0);
+  });
+
+  // Each of these is a way back out of the sandbox, so a cell that lifted any
+  // one of them would lift the others by the back door. Excluding only some
+  // would read as safe while leaving the path open.
+  describe("what no cell lifts, even at Full access", () => {
+    beforeEach(() => {
+      thresholdReaderMock.cell = cell("high");
+    });
+
+    async function expectFloored(
+      toolName: string,
+      toolInput: Record<string, unknown>,
+    ) {
+      const result = await handler.checkPreExecutionGates(
+        toolName,
+        toolInput,
+        channelContext(),
+        "low",
+        Date.now(),
+      );
+      expect(result.allowed).toBe(false);
+      if (result.allowed) {
+        return;
+      }
+      expect(result.result.content).toContain("requires guardian approval");
+      // Excluded before the cell matters, so nothing is looked up.
+      expect(thresholdReaderMock.cellLookups).toBe(0);
+    }
+
+    // Running code in the workspace is how you write everything else in it.
+    test("sandbox bash", async () => {
+      await expectFloored("bash", { command: "ls" });
+    });
+
+    test.each([
+      ["hooks", "hooks/on-message.ts"],
+      ["plugins", "plugins/acme/register.ts"],
+      ["skills", "skills/acme/SKILL.md"],
+      ["tools", "tools/acme.ts"],
+      ["routes", "routes/acme.ts"],
+      ["workflows", "workflows/acme.ts"],
+    ])("a write into %s/ — code the daemon runs later", async (_dir, path) => {
+      await expectFloored("file_write", { path, content: "x" });
+    });
+
+    // Prompt surfaces are instructions the daemon obeys — rewriting them is
+    // the same delegation as planting code, one layer up.
+    test.each([
+      ["the assistant's own instructions", "SOUL.md"],
+      ["its identity", "IDENTITY.md"],
+      ["a per-user context file", "users/someone.md"],
+      ["a per-channel context file", "channels/general.md"],
+      [
+        "a system-section override",
+        "prompts/system/10a-non-guardian-boundary.md",
+      ],
+    ])("a write to %s — %s", async (_label, path) => {
+      await expectFloored("file_write", { path, content: "x" });
+    });
+
+    // Nothing reviewed an unvetted manifest, so the risk it claims about
+    // itself must not be what decides whether a room may run it unattended.
+    test("an unvetted skill shadowing a core side-effect tool", async () => {
+      skillOwnerBundled = false;
+      await expectFloored("document_create", { title: "x" });
+    });
+
+    // A novel name is in no side-effect list, so without the unvetted check it
+    // would not be gated at all — the case the shadowing guard alone misses.
+    test("an unvetted skill tool with a name of its own", async () => {
+      skillOwnerBundled = false;
+      await expectFloored("acme_send", { to: "someone" });
+    });
+
+    // Workspace-owned tools are dynamic-imported on-disk code with no
+    // bundled tier — unvetted by definition, whatever the bundled flag says.
+    test("a workspace-owned tool with a name of its own", async () => {
+      skillOwnerBundled = true;
+      await expectFloored("ws_deploy", { target: "prod" });
+    });
+
+    // A workspace tool registered over a delegable core name must not
+    // inherit that name's liftability — the owner decides, not the name.
+    test("a workspace override of a delegable core tool", async () => {
+      fileWriteOwner = { kind: "workspace", id: "tools/file-write.ts" };
+      await expectFloored("file_write", {
+        path: "notes/todo.md",
+        content: "x",
+      });
+    });
+
+    // MCP tools are floored as host reach; this pins that the unvetted
+    // allowlist catches them independently, so the floor does not hinge on
+    // the host stamp alone.
+    test("an MCP-owned tool, even without the host target", async () => {
+      await expectFloored("mcp_lookup", { query: "q" });
+    });
+
+    // The private network is the guardian's machine: the daemon's own HTTP
+    // surface, the gateway, whatever else is listening there.
+    test("web_fetch reaching the private network", async () => {
+      await expectFloored("web_fetch", {
+        url: "http://localhost:7821/",
+        allow_private_network: true,
+      });
+    });
+  });
+
+  test("a public web_fetch is still lifted", async () => {
+    thresholdReaderMock.cell = cell("low");
+
+    const result = await handler.checkPreExecutionGates(
+      "web_fetch",
+      { url: "https://example.com/" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+
+  // A successful cascade walk that finds no cell resolves the room's
+  // default — Conservative — so an unconfigured room behaves exactly as the
+  // picker and legend present it. (The mock's reset state IS the successful
+  // no-cell resolution.)
+  test("an unconfigured room lifts at the Conservative default", async () => {
+    const result = await handler.checkPreExecutionGates(
+      "file_write",
+      { path: "notes/todo.md", content: "x" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(true);
+    expect(thresholdReaderMock.cellLookups).toBe(1);
+  });
+
+  // The room default is the owner's global setting collapsed — a Strict
+  // global yields Strict rooms, so nothing lifts.
+  test("a Strict global keeps unconfigured rooms on the floor", async () => {
+    thresholdReaderMock.roomDefault = "none";
+
+    const result = await handler.checkPreExecutionGates(
+      "file_write",
+      { path: "notes/todo.md", content: "x" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+  });
+
+  // An unreadable global lifts nothing — the default derives from it, so
+  // without it the floor stands.
+  test("an unreadable global keeps unconfigured rooms on the floor", async () => {
+    thresholdReaderMock.roomDefault = undefined;
+
+    const result = await handler.checkPreExecutionGates(
+      "file_write",
+      { path: "notes/todo.md", content: "x" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+  });
+
+  // A write whose target cannot be resolved is never liftable — without a
+  // workingDir the sink check cannot see where the write lands, and it must
+  // fail closed rather than be skipped.
+  test("a write with no workingDir stays floored at any cell", async () => {
+    thresholdReaderMock.cell = cell("high");
+
+    const result = await handler.checkPreExecutionGates(
+      "file_write",
+      { path: "hooks/evil.ts", content: "x" },
+      channelContext({ workingDir: undefined }),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+    expect(thresholdReaderMock.cellLookups).toBe(0);
+  });
+
+  // The exclusions are about provenance and reach, not about naming: an
+  // ordinary workspace write is still delegable.
+  test("an ordinary workspace file write is still lifted", async () => {
+    thresholdReaderMock.cell = cell("high");
+
+    const result = await handler.checkPreExecutionGates(
+      "file_write",
+      { path: "notes/todo.md", content: "x" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(true);
+    if (!result.allowed) {
+      return;
+    }
+    expect(result.grantConsumed).toBeFalsy();
+  });
+
+  test("a bundled skill's side-effect tool is still lifted", async () => {
+    thresholdReaderMock.cell = cell("high");
+    skillOwnerBundled = true;
+
+    const result = await handler.checkPreExecutionGates(
+      "document_create",
+      { title: "x" },
+      channelContext(),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+
+  test("a guardian never pays for the cell lookup", async () => {
+    const result = await handler.checkPreExecutionGates(
+      toolName,
+      input,
+      channelContext({ trustClass: "guardian" }),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(true);
+    expect(thresholdReaderMock.cellLookups).toBe(0);
+  });
+
+  test("a turn with no channel coordinates skips the lookup", async () => {
+    const result = await handler.checkPreExecutionGates(
+      toolName,
+      input,
+      makeContext({ trustClass: "trusted_contact" }),
+      "low",
+      Date.now(),
+    );
+
+    expect(result.allowed).toBe(false);
+    expect(thresholdReaderMock.cellLookups).toBe(0);
+  });
+});
+
 describe("ToolApprovalHandler / unparseable tool args gate", () => {
   const handler = new ToolApprovalHandler();