@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/config/feature-flag-registry.json

@@ -6,7 +6,7 @@
       "scope": "client",
       "key": "in-chat-onboarding-tour",
       "label": "In-Chat Onboarding Tour",
-      "description": "Multivariate experiment for the eyes-led in-chat onboarding tour. control = straight to chat after research onboarding (current behavior); tour = the extended tour auto-plays on first workspace entry, and the header replay button shows. Desktop-only: phone-width viewports and the native shell get neither the tour nor its telemetry (not even the exposure event), so the funnel measures desktop sessions exclusively. Targeted via LaunchDarkly (planned 70% tour / 30% control).",
+      "description": "Multivariate experiment for the eyes-led in-chat onboarding tour. control = straight to chat after research onboarding (current behavior); tour = the extended tour auto-plays on first workspace entry. Desktop-only: phone-width viewports and the native shell get neither the tour nor its telemetry (not even the exposure event), so the funnel measures desktop sessions exclusively. Targeted via LaunchDarkly (70% tour / 30% control).",
       "defaultEnabled": "control",
       "values": ["control", "tour"]
     },
@@ -117,22 +117,6 @@
       "description": "Show older versions in the version picker, allowing rollback to previous releases",
       "defaultEnabled": false
     },
-    {
-      "id": "voice-mode",
-      "scope": "assistant",
-      "key": "voice-mode",
-      "label": "Voice Mode",
-      "description": "Show the live voice conversation button in the composer",
-      "defaultEnabled": false
-    },
-    {
-      "id": "voice-duplex-handoff",
-      "scope": "assistant",
-      "key": "voice-duplex-handoff",
-      "label": "Voice Duplex Handoff",
-      "description": "When a user barges in during live voice, keep the interrupted turn running as a background subagent instead of discarding it (true-duplex handoff)",
-      "defaultEnabled": false
-    },
     {
       "id": "fast-mode",
       "scope": "assistant",
@@ -293,14 +277,6 @@
       "description": "Expose the developer-only Memory Router Playground tab in macOS Settings and the /assistant/memory-router-playground web page for dry-running v4 router config overrides against the live page index. Dev-only; default off.",
       "defaultEnabled": false
     },
-    {
-      "id": "memory-v3-injection-gate",
-      "scope": "assistant",
-      "key": "memory-v3-injection-gate",
-      "label": "Memory v3 injection gate",
-      "description": "Per-turn injection gate for memory v3: after the BM25F needle + dense cosine finder lanes run, skip the selectPool LLM call (inject nothing) when finder-lane scores fall below the configured thresholds (memory.v3.gate). Default on (flipped remotely July 2026); this registry value is the fallback when no platform snapshot is available.",
-      "defaultEnabled": true
-    },
     {
       "id": "self-intro-greeting",
       "scope": "both",
@@ -350,27 +326,27 @@
       "defaultEnabled": false
     },
     {
-      "id": "credentials-settings",
+      "id": "chat-credential-reveal",
       "scope": "assistant",
-      "key": "credentials-settings",
-      "label": "Credentials settings page",
-      "description": "Show the Credentials page in web settings for listing, adding, and deleting stored credentials.",
+      "key": "chat-credential-reveal",
+      "label": "Chat Credential Reveal",
+      "description": "Persist chat secret redactions as sentinel markers instead of the legacy HTML marker, enriched with the vault identity when the value byte-matches a credential revealed this turn. Also gates the `credentials reveal --for-chat` channel and the live-stream swap that replaces an echoed reveal plaintext with its sentinel before emission. Redaction itself is NOT gated: a route-proven reveal plaintext stays out of persisted rows in both modes. Client chip rendering is gated on daemon version, not on this flag.",
       "defaultEnabled": false
     },
     {
-      "id": "credential-requests",
+      "id": "composer-secret-guard",
       "scope": "assistant",
-      "key": "credential-requests",
-      "label": "One-time credential request links",
-      "description": "Enable one-time credential-request links: the generate-link action in settings, the public credential entry page, and assistant-initiated links on channels without secure input.",
+      "key": "composer-secret-guard",
+      "label": "Composer Secret Guard",
+      "description": "Detect API keys/secrets typed into the chat composer and offer secure credential storage before send",
       "defaultEnabled": false
     },
     {
-      "id": "chat-credential-reveal",
-      "scope": "assistant",
-      "key": "chat-credential-reveal",
-      "label": "Chat Credential Reveal",
-      "description": "Persist chat secret redactions as sentinel markers instead of the legacy HTML marker, enriched with the vault identity when the value byte-matches a credential revealed this turn. Also gates the `credentials reveal --for-chat` channel and the live-stream swap that replaces an echoed reveal plaintext with its sentinel before emission. Redaction itself is NOT gated: a route-proven reveal plaintext stays out of persisted rows in both modes. Client chip rendering is gated on daemon version, not on this flag.",
+      "id": "marketing-pricing-takeover",
+      "scope": "client",
+      "key": "marketing-pricing-takeover",
+      "label": "Marketing Pricing Takeover",
+      "description": "Gates the marketing pricing takeover page (www.vellum.ai/pricing) and the `/assistant/checkout?package=<slug>` deep link its package CTAs target. One flag covers both halves of the funnel so they can never be enabled independently and strand a CTA. When off, the checkout deep link redirects to the in-app plans takeover.",
       "defaultEnabled": false
     }
   ]

package/src/config/loader.ts

@@ -156,7 +156,13 @@ export function getDeploymentContextDefaults(): Record<string, unknown> {
     // default (`gemini-embedding-2`).
     memory: { embeddings: { provider: "gemini" } },
     services: {
-      "image-generation": managed,
+      // Image-generation is provider-only for the managed axis: `vellum`
+      // generates through the platform runtime proxy (the backend derives
+      // from the selected model's prefix at request time). Hosted assistants
+      // default to it here; fill-only, so an explicit on-disk BYOK provider
+      // (gemini/openai) always wins. Filling a `mode` instead would
+      // re-manage BYOK configs on every load.
+      "image-generation": { provider: "vellum" },
       "google-oauth": managed,
       "outlook-oauth": managed,
       "linear-oauth": managed,

package/src/config/memory-tier.ts

@@ -1,30 +1,35 @@
-import { isMemoryV3Live } from "./memory-v3-gate.js";
+import {
+  isMemoryEnabled,
+  isMemoryV3Live,
+  isV2InjectionEngineActive,
+} from "./memory-v3-gate.js";
 import type { AssistantConfig } from "./schema.js";
 
 export type MemoryTier = "off" | "v1" | "v2" | "v3";
 
 /**
  * Derive the coarse memory tier for an assistant, as a single bucket for
- * telemetry. Precedence mirrors the runtime memory-source semantics:
+ * telemetry. Precedence is defined by the named gate predicates in
+ * `memory-v3-gate.ts` — this function is fully derived from them, so the tier
+ * buckets and the runtime gates can never disagree:
  *
- * - `"off"` wins over everything: an explicit `memory.enabled === false`
- *   disables the whole memory system regardless of v2/v3 settings.
+ * - `"off"` wins over everything: {@link isMemoryEnabled} is false when an
+ *   explicit `memory.enabled === false` disables the whole memory system,
+ *   regardless of v2/v3 settings.
  * - `"v3"` wins over `"v2"`: when memory-v3 is live it suppresses v2 injection
  *   (see {@link isMemoryV3Live}).
- * - `"v2"` when v2 is explicitly enabled and v3 is not live.
+ * - `"v2"` when the v2 injection engine performs turn-time selection
+ *   (see {@link isV2InjectionEngineActive}).
  * - `"v1"` otherwise (memory on, neither v2 nor v3 selected).
- *
- * Optional chaining is defensive — a partial config (e.g. a mocked config in
- * tests) resolves to the correct bucket rather than throwing.
  */
 export function memoryTier(config: AssistantConfig): MemoryTier {
-  if (config.memory?.enabled === false) {
+  if (!isMemoryEnabled(config)) {
     return "off";
   }
   if (isMemoryV3Live(config)) {
     return "v3";
   }
-  if (config.memory?.v2?.enabled === true) {
+  if (isV2InjectionEngineActive(config)) {
     return "v2";
   }
   return "v1";

package/src/config/memory-v3-gate.test.ts

@@ -1,6 +1,16 @@
 import { describe, expect, test } from "bun:test";
 
-import { usesConceptPageMemory } from "./memory-v3-gate.js";
+import { memoryTier } from "./memory-tier.js";
+import {
+  isMemoryEnabled,
+  isMemoryV1Active,
+  isMemoryV2ExplicitlyDisabled,
+  isMemoryV3Live,
+  isV2InjectionEngineActive,
+  isV3TierActive,
+  usesConceptPageMemory,
+} from "./memory-v3-gate.js";
+import type { AssistantConfig } from "./schema.js";
 
 describe("usesConceptPageMemory", () => {
   test("false when memory is explicitly disabled, even with v3 live", () => {
@@ -38,3 +48,270 @@ describe("usesConceptPageMemory", () => {
     expect(usesConceptPageMemory({})).toBe(false);
   });
 });
+
+type TriState = boolean | undefined;
+
+function makeConfig(
+  enabled: TriState,
+  v2Enabled: TriState,
+  v3Live: TriState,
+): AssistantConfig {
+  return {
+    memory: {
+      ...(enabled === undefined ? {} : { enabled }),
+      ...(v2Enabled === undefined ? {} : { v2: { enabled: v2Enabled } }),
+      ...(v3Live === undefined ? {} : { v3: { live: v3Live } }),
+    },
+  } as AssistantConfig;
+}
+
+describe("tier predicate truth table", () => {
+  // Rows: [enabled, v2.enabled, v3.live] → expected
+  // [isMemoryEnabled, isMemoryV1Active, isV2InjectionEngineActive,
+  //  isMemoryV2ExplicitlyDisabled, isV3TierActive].
+  // undefined = key unset. Covers all 27 {enabled, v2.enabled, v3.live}
+  // tri-state combinations.
+  //
+  // The nine `enabled: false` rows are the decided memory-off semantics, and
+  // they are what makes the predicates non-interchangeable with the raw
+  // substrate/live reads: with memory off NO tier is active — not v1
+  // (`isMemoryV1Active` false even though `usesConceptPageMemory` is also
+  // false) and not v3 (`isV3TierActive` false even with `memory.v3.live`
+  // set). Every tier-scoped code path asks these predicates for that reason.
+  const rows: Array<{
+    inputs: [TriState, TriState, TriState];
+    expected: [boolean, boolean, boolean, boolean, boolean];
+  }> = [
+    // memory on by default (enabled unset)
+    {
+      inputs: [undefined, undefined, undefined],
+      expected: [true, true, false, false, false],
+    },
+    {
+      inputs: [undefined, undefined, true],
+      expected: [true, false, false, false, true],
+    },
+    {
+      inputs: [undefined, undefined, false],
+      expected: [true, true, false, false, false],
+    },
+    {
+      inputs: [undefined, true, undefined],
+      expected: [true, false, true, false, false],
+    },
+    {
+      inputs: [undefined, true, true],
+      expected: [true, false, false, false, true],
+    },
+    {
+      inputs: [undefined, true, false],
+      expected: [true, false, true, false, false],
+    },
+    {
+      inputs: [undefined, false, undefined],
+      expected: [true, true, false, true, false],
+    },
+    {
+      inputs: [undefined, false, true],
+      expected: [true, false, false, true, true],
+    },
+    {
+      inputs: [undefined, false, false],
+      expected: [true, true, false, true, false],
+    },
+    // memory explicitly on
+    {
+      inputs: [true, undefined, undefined],
+      expected: [true, true, false, false, false],
+    },
+    {
+      inputs: [true, undefined, true],
+      expected: [true, false, false, false, true],
+    },
+    {
+      inputs: [true, undefined, false],
+      expected: [true, true, false, false, false],
+    },
+    {
+      inputs: [true, true, undefined],
+      expected: [true, false, true, false, false],
+    },
+    {
+      inputs: [true, true, true],
+      expected: [true, false, false, false, true],
+    },
+    {
+      inputs: [true, true, false],
+      expected: [true, false, true, false, false],
+    },
+    {
+      inputs: [true, false, undefined],
+      expected: [true, true, false, true, false],
+    },
+    {
+      inputs: [true, false, true],
+      expected: [true, false, false, true, true],
+    },
+    {
+      inputs: [true, false, false],
+      expected: [true, true, false, true, false],
+    },
+    // memory explicitly off — no tier is active (v3-live included:
+    // `isV3TierActive` is false), but the explicit v2 opt-out is still visible
+    {
+      inputs: [false, undefined, undefined],
+      expected: [false, false, false, false, false],
+    },
+    {
+      inputs: [false, undefined, true],
+      expected: [false, false, false, false, false],
+    },
+    {
+      inputs: [false, undefined, false],
+      expected: [false, false, false, false, false],
+    },
+    {
+      inputs: [false, true, undefined],
+      expected: [false, false, false, false, false],
+    },
+    {
+      inputs: [false, true, true],
+      expected: [false, false, false, false, false],
+    },
+    {
+      inputs: [false, true, false],
+      expected: [false, false, false, false, false],
+    },
+    {
+      inputs: [false, false, undefined],
+      expected: [false, false, false, true, false],
+    },
+    {
+      inputs: [false, false, true],
+      expected: [false, false, false, true, false],
+    },
+    {
+      inputs: [false, false, false],
+      expected: [false, false, false, true, false],
+    },
+  ];
+
+  const show = (v: TriState) => (v === undefined ? "unset" : String(v));
+
+  for (const { inputs, expected } of rows) {
+    const [enabled, v2Enabled, v3Live] = inputs;
+    const [expEnabled, expV1, expV2Engine, expV2Disabled, expV3Tier] = expected;
+    test(`enabled=${show(enabled)} v2.enabled=${show(v2Enabled)} v3.live=${show(v3Live)}`, () => {
+      const config = makeConfig(enabled, v2Enabled, v3Live);
+      expect(isMemoryEnabled(config)).toBe(expEnabled);
+      expect(isMemoryV1Active(config)).toBe(expV1);
+      expect(isV2InjectionEngineActive(config)).toBe(expV2Engine);
+      expect(isMemoryV2ExplicitlyDisabled(config)).toBe(expV2Disabled);
+      expect(isV3TierActive(config)).toBe(expV3Tier);
+      // The predicates and memoryTier() share one implementation; assert every
+      // tier bucket agrees with the predicates on every combination. This is
+      // memoryTier()'s coverage — all four buckets are pinned here, so it needs
+      // no separate test file.
+      expect(isMemoryEnabled(config)).toBe(memoryTier(config) !== "off");
+      expect(isMemoryV1Active(config)).toBe(memoryTier(config) === "v1");
+      expect(isV2InjectionEngineActive(config)).toBe(
+        memoryTier(config) === "v2",
+      );
+      // `"off"` outranks `"v3"`, so the v3 bucket is the live-AND-enabled
+      // conjunction rather than `isMemoryV3Live` alone — which is exactly what
+      // `isV3TierActive` names.
+      expect(isV3TierActive(config)).toBe(memoryTier(config) === "v3");
+      expect(isV3TierActive(config)).toBe(
+        isMemoryV3Live(config) && isMemoryEnabled(config),
+      );
+    });
+  }
+
+  test("empty config: memory on, v1 is the live tier", () => {
+    const config = {} as AssistantConfig;
+    expect(isMemoryEnabled(config)).toBe(true);
+    expect(isMemoryV1Active(config)).toBe(true);
+    expect(isV2InjectionEngineActive(config)).toBe(false);
+    expect(isMemoryV2ExplicitlyDisabled(config)).toBe(false);
+  });
+
+  test("v2.enabled stays true on v3-live assistants; the engine predicate still reports inactive", () => {
+    // v2.enabled and v3.live may both be true; only the v3 injection engine
+    // is active then. A direct `memory.v2.enabled` read says "on"; the
+    // predicate must say "off".
+    const config = makeConfig(undefined, true, true);
+    expect(config.memory?.v2?.enabled).toBe(true);
+    expect(isV2InjectionEngineActive(config)).toBe(false);
+    // The substrate is still active — v3 is a concept-page consumer.
+    expect(usesConceptPageMemory(config.memory)).toBe(true);
+  });
+});
+
+/**
+ * The v1-staleness guard used to have three spellings that disagreed when
+ * memory is off: `usesConceptPageMemory(config.memory)` at job dispatch,
+ * `!isMemoryV1Active(config)` in the graph handlers, and a re-inlined
+ * `usesConceptPageMemory` on the `graph_extract` handler. All three now read
+ * `isMemoryV1Active`, and these tests pin both halves of that: the two
+ * spellings agree everywhere EXCEPT memory-off, and memory-off skips v1 work.
+ */
+describe("v1-staleness guard is one condition", () => {
+  const memoryOff = makeConfig(false, undefined, undefined);
+  const v1Tier = makeConfig(undefined, false, false);
+  const v2Tier = makeConfig(undefined, true, false);
+  const v3Tier = makeConfig(undefined, true, true);
+
+  test("v1 work runs on the v1 tier and nowhere else", () => {
+    expect(isMemoryV1Active(v1Tier)).toBe(true);
+    expect(isMemoryV1Active(v2Tier)).toBe(false);
+    expect(isMemoryV1Active(v3Tier)).toBe(false);
+    expect(isMemoryV1Active(memoryOff)).toBe(false);
+  });
+
+  test("memory-off is the one state where the old spellings disagreed", () => {
+    // The former dispatch-level spelling. Identical on every tier…
+    for (const config of [v1Tier, v2Tier, v3Tier]) {
+      expect(isMemoryV1Active(config)).toBe(
+        !usesConceptPageMemory(config.memory),
+      );
+    }
+    // …and wrong with memory off: the substrate check reports "not concept
+    // pages", which the old guard read as "v1 is live" and kept v1 work
+    // running. The named predicate says v1 is not the tier.
+    expect(usesConceptPageMemory(memoryOff.memory)).toBe(false);
+    expect(isMemoryV1Active(memoryOff)).toBe(false);
+  });
+
+  test("an explicit v2 opt-out with memory off still is not the v1 tier", () => {
+    // `memory.v2.enabled: false` puts a memory-ON assistant on v1; memory off
+    // outranks that.
+    expect(isMemoryV1Active(makeConfig(true, false, false))).toBe(true);
+    expect(isMemoryV1Active(makeConfig(false, false, false))).toBe(false);
+  });
+});
+
+/**
+ * `isV3TierActive` replaced two predicates that disagreed on memory-off: the
+ * memory-graph capability check (which honored the opt-out) and a
+ * proc-to-skills alias of `isMemoryV3Live` (which did not). One predicate now
+ * answers for both features.
+ */
+describe("v3 tier is one condition", () => {
+  test("memory off suppresses the v3 tier even with memory.v3.live set", () => {
+    const config = makeConfig(false, undefined, true);
+    // The raw key is still set — only the tier predicate accounts for the
+    // opt-out, which is why feature gates must not read `isMemoryV3Live`.
+    expect(isMemoryV3Live(config)).toBe(true);
+    expect(isV3TierActive(config)).toBe(false);
+  });
+
+  test("v3 live with memory on is the v3 tier", () => {
+    expect(isV3TierActive(makeConfig(true, undefined, true))).toBe(true);
+    expect(isV3TierActive(makeConfig(undefined, undefined, true))).toBe(true);
+  });
+
+  test("false when v3 is not live, and on an empty config", () => {
+    expect(isV3TierActive(makeConfig(undefined, undefined, false))).toBe(false);
+    expect(isV3TierActive({} as AssistantConfig)).toBe(false);
+  });
+});

package/src/config/memory-v3-gate.ts

@@ -1,5 +1,67 @@
 import type { AssistantConfig } from "./schema.js";
 
+/**
+ * Whether memory as a whole is on — the user-facing master switch. Memory is
+ * on unless `memory.enabled` is explicitly set to `false`. Canonical home for
+ * the check; the config-singleton `isMemoryEnabled()` in
+ * `persistence/jobs-store.ts` delegates here. Accepts any object carrying the
+ * `memory` slice, so callers holding only the plugin-resolved slice (e.g. the
+ * memory plugin's `getMemoryConfig()`) can gate without the full config.
+ */
+export function isMemoryEnabled(
+  config: Pick<AssistantConfig, "memory">,
+): boolean {
+  return config.memory?.enabled !== false;
+}
+
+/**
+ * Whether the legacy graph/PKB memory engine (tier v1) is the live tier:
+ * memory is on and no concept-page consumer (v3 live or the v2 injection
+ * engine) is. Like {@link isMemoryEnabled}, accepts a `memory`-slice view.
+ *
+ * THE memory-off semantics for v1, stated once and shared by every v1 path
+ * (job dispatch, the job handlers, maintenance scheduling, startup seeding,
+ * the filing routes): `memory.enabled === false` means v1 is NOT the live
+ * tier, so v1 work is skipped exactly as it is under the concept-page
+ * substrate. Turning memory off is a user-facing opt-out — it must never be
+ * the one state in which the daemon still LLM-extracts, embeds, or files into
+ * the legacy graph. Ask this predicate, never `usesConceptPageMemory` alone:
+ * the two agree on every tier EXCEPT memory-off, where the bare substrate
+ * check reports "v1" and would keep v1 running.
+ */
+export function isMemoryV1Active(
+  config: Pick<AssistantConfig, "memory">,
+): boolean {
+  return isMemoryEnabled(config) && !usesConceptPageMemory(config.memory);
+}
+
+/**
+ * Whether the v2 activation/router engine performs turn-time selection:
+ * memory is on, `memory.v2.enabled` is set, and v3 is NOT the live injected
+ * source. Distinct from `usesConceptPageMemory`: `memory.v2.enabled` defaults
+ * true and typically stays set on v3-live assistants, so this predicate is the
+ * ONLY correct way to ask "should v2 select this turn" — a direct
+ * `memory.v2.enabled` read misbehaves under v3.
+ */
+export function isV2InjectionEngineActive(config: AssistantConfig): boolean {
+  return (
+    isMemoryEnabled(config) &&
+    config.memory?.v2?.enabled === true &&
+    !isMemoryV3Live(config)
+  );
+}
+
+/**
+ * Whether `memory.v2.enabled` is explicitly `false` — deliberately NOT the
+ * negation of `isV2InjectionEngineActive`, since the key defaults true. Names
+ * the explicit-false semantics `daemon/embedding-reconcile.ts` relies on: an
+ * explicit opt-out suppresses concept-page reconcile work even where the
+ * default would allow it.
+ */
+export function isMemoryV2ExplicitlyDisabled(config: AssistantConfig): boolean {
+  return config.memory?.v2?.enabled === false;
+}
+
 /**
  * Whether memory-v3 is the live injected memory source for this assistant,
  * suppressing v2 injection. Gated by workspace config (`memory.v3.live`): new
@@ -11,34 +73,34 @@ export function isMemoryV3Live(config: AssistantConfig): boolean {
 }
 
 /**
- * Whether the memory concept graph is available for this assistant — the single
- * source of truth for both `GET /memory-graph` (`supported`) and the cheap
- * `graph_supported` bit on `GET /memory/stats`, so the advertised capability
- * and the actual build can never drift.
+ * Whether memory-v3 is the live TIER: v3 is the live injected source AND
+ * memory as a whole is on. Exactly `memoryTier(config) === "v3"` (see
+ * `memory-tier.ts`), and the difference from {@link isMemoryV3Live} is the
+ * memory-off case — `"off"` outranks `"v3"`, so a `memory.v3.live` assistant
+ * whose owner switched Memory off is NOT on the v3 tier. Every v3-tier-scoped
+ * FEATURE asks this predicate; only the injection-suppression checks that must
+ * mirror the raw `memory.v3.live` key ask {@link isMemoryV3Live} directly.
  *
- * The graph builds off the v3 concept-page substrate, so it requires v3 live.
- * It also honors the user-facing Memory opt-out: `memory.enabled === false`
- * turns memory off wholesale, so the graph must not be offered even when
- * `memory.v3.live` is still set.
- */
-export function isMemoryGraphSupported(config: AssistantConfig): boolean {
-  return config.memory?.enabled !== false && isMemoryV3Live(config);
-}
-
-/**
- * Whether procedural-memory-as-skills is ACTIVE: it is active whenever
- * memory-v3 is the live injected source. The feature is scoped to v3-live
- * assistants because skill retrieval rides the v3 lanes and the usage-prune
- * stage lives in the v3 maintain job. That prune ships observe-first: with
- * `memory.maintenance.skillPruneDays` at its default (`null`) it reports stale
- * assistant-authored skills (`prunableSkills`) but deletes none — so a v3-live
- * assistant authors skills without an automatic retirement bound until a
- * positive `skillPruneDays` is configured. Gating the whole feature (the
- * retrospective skill-authoring step and its permission grant) on this named
- * predicate keeps it coherently inert on non-v3 assistants.
+ * The two features gated on it, and why they must agree:
+ *
+ * - The memory concept graph — the single source of truth for both
+ *   `GET /memory-graph` (`supported`) and the cheap `graph_supported` bit on
+ *   `GET /memory/stats`, so the advertised capability and the actual build can
+ *   never drift. The graph builds off the v3 concept-page substrate.
+ * - Procedural-memory-as-skills — the retrospective's skill-authoring step and
+ *   its permission grant. Scoped to the v3 tier because skill retrieval rides
+ *   the v3 lanes and the usage-prune stage lives in the v3 maintain job. That
+ *   prune ships observe-first: with `memory.maintenance.skillPruneDays` at its
+ *   default (`null`) it reports stale assistant-authored skills
+ *   (`prunableSkills`) but deletes none — so a v3-tier assistant authors skills
+ *   without an automatic retirement bound until a positive `skillPruneDays` is
+ *   configured.
+ *
+ * Both write into memory on the user's behalf, so both honor the Memory
+ * opt-out identically: one predicate, one answer.
  */
-export function isProcToSkillsActive(config: AssistantConfig): boolean {
-  return isMemoryV3Live(config);
+export function isV3TierActive(config: AssistantConfig): boolean {
+  return isMemoryEnabled(config) && isMemoryV3Live(config);
 }
 
 /**

package/src/config/raw-config-utils.ts

@@ -4,7 +4,7 @@
  * Ensures the `services` and service-level objects exist before writing,
  * so callers don't need to guard against undefined intermediate keys.
  *
- * Example: `setServiceField(raw, "image-generation", "mode", "managed")`
+ * Example: `setServiceField(raw, "image-generation", "provider", "vellum")`
  * produces `raw.services["image-generation"].mode = "managed"`.
  */
 export function setServiceField(

package/src/config/schemas/__tests__/live-voice.test.ts

@@ -11,6 +11,8 @@ const PROGRESS_DEFAULTS = {
   enabled: true,
   opsThreshold: 3,
   idleIntervalMs: 5_000,
+  maxSilenceMs: 35_000,
+  longOpMs: 15_000,
   minGapMs: 6_000,
   generationTimeoutMs: 1_500,
 };
@@ -21,7 +23,6 @@ const FRONT_MODEL_DEFAULTS = {
   endpointMaxExtensions: 2,
   ackFirstDeltaTimeoutMs: 2500,
   ackGenerationTimeoutMs: 600,
-  llmAckText: false,
   progress: PROGRESS_DEFAULTS,
 };
 
@@ -86,11 +87,9 @@ describe("LiveVoiceFrontModelConfigSchema", () => {
     const parsed = LiveVoiceFrontModelConfigSchema.parse({
       endpointDecisionTimeoutMs: 400,
       endpointMaxExtensions: 0,
-      llmAckText: true,
     });
     expect(parsed.endpointDecisionTimeoutMs).toBe(400);
     expect(parsed.endpointMaxExtensions).toBe(0);
-    expect(parsed.llmAckText).toBe(true);
     // Unspecified fields still get defaults
     expect(parsed.endpointExtensionMs).toBe(1500);
     expect(parsed.ackFirstDeltaTimeoutMs).toBe(2500);
@@ -111,19 +110,6 @@ describe("LiveVoiceFrontModelConfigSchema", () => {
     expect(result.success).toBe(false);
   });
 
-  test("rejects a non-boolean llmAckText", () => {
-    const result = LiveVoiceFrontModelConfigSchema.safeParse({
-      llmAckText: "yes",
-    });
-    expect(result.success).toBe(false);
-    if (!result.success) {
-      const msgs = result.error.issues.map((i) => i.message);
-      expect(
-        msgs.some((m) => m.includes("liveVoice.frontModel.llmAckText")),
-      ).toBe(true);
-    }
-  });
-
   test("absent progress namespace parses to full progress defaults", () => {
     const parsed = LiveVoiceFrontModelConfigSchema.parse({});
     expect(parsed.progress).toEqual(PROGRESS_DEFAULTS);
@@ -137,6 +123,8 @@ describe("LiveVoiceFrontModelConfigSchema", () => {
     expect(parsed.progress.opsThreshold).toBe(5);
     // Unspecified progress fields still get defaults
     expect(parsed.progress.idleIntervalMs).toBe(5_000);
+    expect(parsed.progress.maxSilenceMs).toBe(35_000);
+    expect(parsed.progress.longOpMs).toBe(15_000);
     expect(parsed.progress.minGapMs).toBe(6_000);
     expect(parsed.progress.generationTimeoutMs).toBe(1_500);
   });
@@ -156,6 +144,29 @@ describe("LiveVoiceFrontModelConfigSchema", () => {
     expect(result.success).toBe(false);
   });
 
+  test("rejects a heartbeat ceiling shorter than the idle tick interval", () => {
+    // The heartbeat is only checked on the idle tick, so a shorter ceiling
+    // could be overshot by a full interval.
+    const result = LiveVoiceFrontModelConfigSchema.safeParse({
+      progress: { idleIntervalMs: 60_000, maxSilenceMs: 10_000 },
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const msgs = result.error.issues.map((issue) => issue.message);
+      expect(
+        msgs.some((msg) =>
+          msg.includes("liveVoice.frontModel.progress.maxSilenceMs"),
+        ),
+      ).toBe(true);
+    }
+    // The floor itself is allowed: the tick is exactly on the ceiling.
+    expect(
+      LiveVoiceFrontModelConfigSchema.safeParse({
+        progress: { idleIntervalMs: 60_000, maxSilenceMs: 60_000 },
+      }).success,
+    ).toBe(true);
+  });
+
   test("rejects a non-boolean progress.enabled", () => {
     const result = LiveVoiceFrontModelConfigSchema.safeParse({
       progress: { enabled: "yes" },