@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/live-voice/progress-phrases.ts

@@ -0,0 +1,17 @@
+// Static fallbacks for an idle-triggered progress narration whose LLM
+// phrasing failed — the one case where prolonged silence is actively harmful.
+// The idle trigger can fire on a slow turn with zero tool activity, so every
+// phrase stays strictly neutral: no claims about running tools or tasks.
+// Persona-neutral, no domain content, ≤ 8 words.
+// Exported so tests can assert the neutrality invariant against the list.
+export const PROGRESS_FALLBACK_PHRASES: readonly string[] = [
+  "Still on it — one moment.",
+  "Still thinking this through.",
+  "Almost there — thanks for waiting.",
+];
+
+// Deterministic rotation through the phrase list: callers hold a nonnegative
+// monotonic counter, so consecutive picks vary while tests stay reproducible.
+export function pickProgressPhrase(counter: number): string {
+  return PROGRESS_FALLBACK_PHRASES[counter % PROGRESS_FALLBACK_PHRASES.length];
+}

package/src/live-voice/protocol.ts

@@ -22,6 +22,7 @@ const _LIVE_VOICE_SERVER_FRAME_TYPES = [
   "tts_audio",
   "tts_done",
   "turn_cancelled",
+  "minimize_room",
   "metrics",
   "archived",
   "error",
@@ -242,6 +243,18 @@ export interface LiveVoiceTurnCancelledServerFrame extends LiveVoiceServerFrameB
   readonly turnId: string;
 }
 
+/**
+ * Assistant-requested room minimize: the just-completed turn asked (via the
+ * inline [-1] control marker) for the client to dismiss the full-screen
+ * voice room so the user can see the screen behind it. Sent only after the
+ * turn's TTS has fully drained, at most once per turn. Advisory — clients
+ * without a room (pop-outs, older clients) ignore it.
+ */
+export interface LiveVoiceMinimizeRoomServerFrame extends LiveVoiceServerFrameBase {
+  readonly type: "minimize_room";
+  readonly turnId: string;
+}
+
 export interface LiveVoiceMetricsServerFrame extends LiveVoiceServerFrameBase {
   readonly type: "metrics";
   readonly event?: string;
@@ -312,6 +325,7 @@ export type LiveVoiceServerFrame =
   | LiveVoiceTtsAudioServerFrame
   | LiveVoiceTtsDoneServerFrame
   | LiveVoiceTurnCancelledServerFrame
+  | LiveVoiceMinimizeRoomServerFrame
   | LiveVoiceMetricsServerFrame
   | LiveVoiceArchivedServerFrame
   | LiveVoiceErrorServerFrame;
@@ -331,6 +345,7 @@ export type LiveVoiceServerFramePayload =
   | WithoutSeq<LiveVoiceTtsAudioServerFrame>
   | WithoutSeq<LiveVoiceTtsDoneServerFrame>
   | WithoutSeq<LiveVoiceTurnCancelledServerFrame>
+  | WithoutSeq<LiveVoiceMinimizeRoomServerFrame>
   | WithoutSeq<LiveVoiceMetricsServerFrame>
   | WithoutSeq<LiveVoiceArchivedServerFrame>
   | WithoutSeq<LiveVoiceErrorServerFrame>;

package/src/media/app-icon-generator.ts

@@ -12,7 +12,10 @@ import { join } from "node:path";
 import { getAppDirPath } from "../apps/app-store.js";
 import { getConfig } from "../config/loader.js";
 import { getLogger } from "../util/logger.js";
-import { resolveImageGenCredentials } from "./image-credentials.js";
+import {
+  resolveImageGenCredentials,
+  resolveImageGenRouting,
+} from "./image-credentials.js";
 import { generateImage, mapImageGenError } from "./image-service.js";
 
 const log = getLogger("app-icon-generator");
@@ -31,9 +34,10 @@ export async function generateAppIcon(
 ): Promise<void> {
   const config = getConfig();
   const svc = config.services["image-generation"];
+  const { backendProvider, managed } = resolveImageGenRouting(svc);
   const { credentials, errorHint } = await resolveImageGenCredentials({
-    provider: svc.provider,
-    mode: svc.mode,
+    provider: backendProvider,
+    managed,
   });
   if (!credentials) {
     log.debug(
@@ -64,9 +68,12 @@ export async function generateAppIcon(
     "- Modern aesthetic similar to Apple's design language";
 
   try {
-    log.info({ appId, appName, provider: svc.provider }, "Generating app icon");
+    log.info(
+      { appId, appName, provider: backendProvider },
+      "Generating app icon",
+    );
 
-    const result = await generateImage(svc.provider, credentials, {
+    const result = await generateImage(backendProvider, credentials, {
       prompt,
       mode: "generate",
       model: svc.model,
@@ -74,7 +81,7 @@ export async function generateAppIcon(
 
     if (result.images.length === 0) {
       log.warn(
-        { appId, provider: svc.provider },
+        { appId, provider: backendProvider },
         "Provider returned no image for app icon",
       );
       return;
@@ -88,9 +95,9 @@ export async function generateAppIcon(
 
     log.info({ appId, iconPath }, "App icon saved");
   } catch (error) {
-    const message = mapImageGenError(svc.provider, error);
+    const message = mapImageGenError(backendProvider, error);
     log.warn(
-      { appId, provider: svc.provider, error: message },
+      { appId, provider: backendProvider, error: message },
       "App icon generation failed — skipping",
     );
   }

package/src/media/avatar-router.ts

@@ -1,6 +1,9 @@
 import { getConfig } from "../config/loader.js";
 import { ConfigError, ProviderError } from "../util/errors.js";
-import { resolveImageGenCredentials } from "./image-credentials.js";
+import {
+  resolveImageGenCredentials,
+  resolveImageGenRouting,
+} from "./image-credentials.js";
 import { generateImage, mapImageGenError } from "./image-service.js";
 
 export async function generateAvatar(
@@ -9,9 +12,10 @@ export async function generateAvatar(
   const config = getConfig();
   const svc = config.services["image-generation"];
 
+  const { backendProvider, managed } = resolveImageGenRouting(svc);
   const { credentials, errorHint } = await resolveImageGenCredentials({
-    provider: svc.provider,
-    mode: svc.mode,
+    provider: backendProvider,
+    managed,
   });
 
   if (!credentials) {
@@ -20,7 +24,7 @@ export async function generateAvatar(
 
   let result;
   try {
-    result = await generateImage(svc.provider, credentials, {
+    result = await generateImage(backendProvider, credentials, {
       prompt,
       mode: "generate",
       model: svc.model,
@@ -30,7 +34,7 @@ export async function generateAvatar(
     // (e.g. avatar-generator) don't need provider context to surface a
     // useful error.
     throw new ProviderError(
-      mapImageGenError(svc.provider, error),
+      mapImageGenError(backendProvider, error),
       svc.provider,
     );
   }

package/src/media/image-credentials.ts

@@ -12,24 +12,57 @@ import { PLATFORM_PROVIDER_META } from "../providers/platform-proxy/constants.js
 import { resolveManagedProxyContext } from "../providers/platform-proxy/context.js";
 import { getProviderKeyAsync } from "../security/secure-keys.js";
 import type { ImageGenCredentials, ImageGenProvider } from "./types.js";
+import { providerForImageModelPrefix, providerForModel } from "./types.js";
+
+/**
+ * Resolve which backend serves an image request and whether it runs managed.
+ *
+ * `vellum` is unconditionally managed and carries no backend of its own: the
+ * backend derives from the model prefix (`gpt-*`/`dall-e-*` proxy OpenAI,
+ * anything else proxies Gemini), so one managed provider spans both runtime
+ * proxies. Managed routing never falls back to a stored BYOK key, and a BYOK
+ * provider never falls back to the proxy — billing follows the explicit
+ * provider choice. Other providers use the caller's key, with an explicit
+ * model override re-routing to the model's backend.
+ */
+export function resolveImageGenRouting(
+  svc: { provider: string; model: string },
+  modelOverride?: unknown,
+): { backendProvider: ImageGenProvider; managed: boolean } {
+  const managed = svc.provider === "vellum";
+  if (svc.provider === "vellum") {
+    const model =
+      typeof modelOverride === "string" && modelOverride
+        ? modelOverride
+        : svc.model;
+    return { backendProvider: providerForImageModelPrefix(model), managed };
+  }
+  return {
+    backendProvider: providerForModel(
+      modelOverride,
+      svc.provider as ImageGenProvider,
+    ),
+    managed,
+  };
+}
 
 /**
  * Resolve credentials for an image-generation request.
  *
- * - `mode === "managed"`: returns managed-proxy credentials when the
- *   platform URL and assistant API key are both configured, otherwise
- *   returns a hint telling the user to log in or switch modes.
- * - `mode === "your-own"`: returns direct credentials when the provider
- *   API key is present in secure storage (or the env-var fallback),
- *   otherwise returns a provider-aware hint pointing at Settings.
+ * - `managed`: returns managed-proxy credentials when the platform URL and
+ *   assistant API key are both configured, otherwise a hint telling the
+ *   user to log in.
+ * - otherwise: returns direct credentials when the provider API key is
+ *   present in secure storage (or the env-var fallback), otherwise a
+ *   provider-aware hint pointing at Settings.
  */
 export async function resolveImageGenCredentials(opts: {
   provider: ImageGenProvider;
-  mode: "managed" | "your-own";
+  managed: boolean;
 }): Promise<{ credentials?: ImageGenCredentials; errorHint?: string }> {
-  const { provider, mode } = opts;
+  const { provider, managed } = opts;
 
-  if (mode === "managed") {
+  if (managed) {
     // Resolve platform URL + assistant API key from a single snapshot so
     // baseUrl and assistantApiKey can't diverge if the credential is cleared
     // between lookups.
@@ -55,7 +88,6 @@ export async function resolveImageGenCredentials(opts: {
     };
   }
 
-  // mode === "your-own"
   const apiKey = await getProviderKeyAsync(provider);
   if (apiKey) {
     return { credentials: { type: "direct", apiKey } };

package/src/media/image-service.ts

@@ -63,17 +63,5 @@ export function mapImageGenError(
  *   - `gemini-*`            → `gemini`
  *   - anything else (or `undefined`) → the provided `fallback`
  */
-export function providerForModel(
-  model: unknown,
-  fallback: ImageGenProvider,
-): ImageGenProvider {
-  // `model` originates from an LLM tool call's `input.model`, which is a
-  // `Record<string, unknown>` without runtime validation — so a non-string
-  // value (e.g. `{"model": 123}`) must not crash `.startsWith`.
-  if (typeof model !== "string" || !model) return fallback;
-  if (model.startsWith("gpt-") || model.startsWith("dall-e-")) return "openai";
-  if (model.startsWith("gemini-")) return "gemini";
-  return fallback;
-}
-
 export type { ImageGenCredentials } from "./types.js";
+export { providerForModel } from "./types.js";

package/src/media/types.ts

@@ -34,8 +34,7 @@ export const MAX_VARIANTS = 4;
 
 /**
  * Derive the image-generation provider from a model identifier by prefix.
- * Shared with the runtime dispatcher `providerForModel` in
- * `image-service.ts`; prefixes must stay in sync with that function.
+ * Sibling of {@link providerForModel} below; prefixes must stay in sync.
  * Unknown models fall through to "gemini".
  */
 export function providerForImageModelPrefix(model: string): ImageGenProvider {
@@ -45,6 +44,28 @@ export function providerForImageModelPrefix(model: string): ImageGenProvider {
   return "gemini";
 }
 
+/**
+ * Like {@link providerForImageModelPrefix}, but for untrusted caller input:
+ * a non-string or empty `model` (e.g. an LLM tool call's raw `input.model`)
+ * and unknown prefixes fall back to the provided provider instead of gemini.
+ * Prefixes must stay in sync with providerForImageModelPrefix.
+ */
+export function providerForModel(
+  model: unknown,
+  fallback: ImageGenProvider,
+): ImageGenProvider {
+  if (typeof model !== "string" || !model) {
+    return fallback;
+  }
+  if (model.startsWith("gpt-") || model.startsWith("dall-e-")) {
+    return "openai";
+  }
+  if (model.startsWith("gemini-")) {
+    return "gemini";
+  }
+  return fallback;
+}
+
 /**
  * Message fragments that indicate a provider billing / insufficient-credits
  * failure. Used by the per-provider error mappers to detect a non-retryable
@@ -74,7 +95,9 @@ export function isImageProviderBillingError(args: {
   status?: number;
   message?: string;
 }): boolean {
-  if (args.status === 402) return true;
+  if (args.status === 402) {
+    return true;
+  }
   const message = args.message ?? "";
   return BILLING_MESSAGE_PATTERNS.some((pattern) => pattern.test(message));
 }

package/src/notifications/AGENTS.md

@@ -2,6 +2,8 @@
 
 All notification producers **MUST** go through `emitNotificationSignal()` in `notifications/emit-signal.ts`. Do not bypass the pipeline by broadcasting events directly -- the pipeline handles event persistence, deduplication, decision routing, and delivery audit.
 
+Guardian-request cards (approvals, questions) ride this pipeline end to end -- the full lifecycle map is [docs/guardian-request-flow.md](../../docs/guardian-request-flow.md). Card actions (`actions[]`) are built **once, centrally** in the broadcaster's context resolvers (`resolveApprovalContext` / `resolveQuestionOptionsContext`); channel adapters render only. Adding buttons for a new request kind = a broadcaster context branch, never adapter parsing.
+
 When a notification flow creates a server-side conversation (e.g. guardian question conversations, task run conversations), the conversation and initial message **MUST** be persisted before the conversation-created event is emitted. This ensures the macOS/iOS client can immediately fetch the conversation contents when it receives the event.
 
 Guardian-request producers (access requests, tool approvals, tool-grant escalations, voice questions, trusted-contact confirmations) **MUST** record approval-card deliveries through `recordApprovalCardDelivery` / `recordGuardianRequestDeliveries` in `guardian-delivery-recorder.ts` -- never by calling the gateway client's `createGuardianRequestDelivery` directly. That sink is the single place the card-to-request addressing convention lives (conversation id for the in-app card; chat + channel-native `ts` for channel cards), so the path that writes a delivery row cannot drift from the paths that read it back to withdraw a card or resolve an emoji reaction -- the drift that previously fanned this logic into four divergent copies. (Tests may seed delivery rows directly for fixtures.)

package/src/notifications/__tests__/broadcaster.test.ts

@@ -292,3 +292,98 @@ describe("NotificationBroadcaster platform deep-link from contextPayload", () =>
     expect(sends[0]?.payload.deepLinkTarget).toBeUndefined();
   });
 });
+
+// The card context is built once per broadcast (adapters render only); an
+// answer-mode pending_question with structured options renders them as
+// tappable card actions in the answer-token scheme the reply router
+// recognizes.
+describe("NotificationBroadcaster question option actions", () => {
+  function questionSignal(payload: Record<string, unknown>) {
+    return makeSignal({
+      sourceEventName: "guardian.question",
+      contextPayload: payload,
+    });
+  }
+
+  const decisionForPlatform = () =>
+    makeDecision({
+      selectedChannels: ["platform"],
+      renderedCopy: { platform: { title: "Question", body: "Which fruit?" } },
+    });
+
+  test("renders pending_question options as answer-token actions plus Skip", async () => {
+    const { adapter, sends } = makeCapturingAdapter("platform");
+    const broadcaster = new NotificationBroadcaster([adapter]);
+
+    await broadcaster.broadcastDecision(
+      questionSignal({
+        requestKind: "pending_question",
+        requestId: "req-q1",
+        requestCode: "abc123",
+        questionText: "Which fruit?",
+        options: [
+          { id: "apple", label: "Apple" },
+          { id: "banana", label: "Banana" },
+        ],
+      }),
+      decisionForPlatform(),
+    );
+
+    expect(sends.length).toBe(1);
+    const approval = sends[0]?.payload.approvalContext;
+    expect(approval?.requestId).toBe("req-q1");
+    expect(approval?.actions).toEqual([
+      { id: "answer_0", label: "Apple" },
+      { id: "answer_1", label: "Banana" },
+      { id: "answer_skip", label: "Skip" },
+    ]);
+    // The plain-text fallback keeps the answer-mode request-code instruction.
+    expect(approval?.plainTextFallback).toContain("ABC123");
+    expect(approval?.plainTextFallback).toContain("your answer");
+  });
+
+  test("an option-less pending_question (voice) carries no card actions", async () => {
+    const { adapter, sends } = makeCapturingAdapter("platform");
+    const broadcaster = new NotificationBroadcaster([adapter]);
+
+    await broadcaster.broadcastDecision(
+      questionSignal({
+        requestKind: "pending_question",
+        requestId: "req-v1",
+        requestCode: "def456",
+        questionText: "What time works?",
+        callSessionId: "call-1",
+        activeGuardianRequestCount: 1,
+      }),
+      decisionForPlatform(),
+    );
+
+    expect(sends.length).toBe(1);
+    // Answer-mode without options renders as plain text with request-code
+    // instructions — no approve/reject pair is ever attached to a question.
+    expect(sends[0]?.payload.approvalContext).toBeUndefined();
+  });
+
+  test("tool_approval payloads keep the approve/reject action pair", async () => {
+    const { adapter, sends } = makeCapturingAdapter("platform");
+    const broadcaster = new NotificationBroadcaster([adapter]);
+
+    await broadcaster.broadcastDecision(
+      questionSignal({
+        requestKind: "tool_approval",
+        requestId: "req-t1",
+        requestCode: "ghi789",
+        questionText: "Approve tool: bash",
+        toolName: "bash",
+      }),
+      decisionForPlatform(),
+    );
+
+    expect(sends.length).toBe(1);
+    const approval = sends[0]?.payload.approvalContext;
+    expect(approval?.actions?.map((a) => a.id)).toEqual([
+      "approve_once",
+      "reject",
+    ]);
+  });
+});

package/src/notifications/adapters/macos.ts

@@ -18,8 +18,8 @@
  * does not match their own identity.
  */
 
+import type { AssistantEvent } from "../../api/index.js";
 import type { InterfaceId } from "../../channels/types.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
 import { getLogger } from "../../util/logger.js";
 import type {
   ChannelAdapter,
@@ -44,7 +44,7 @@ export interface BroadcastFnOptions {
 }
 
 export type BroadcastFn = (
-  msg: ServerMessage,
+  msg: AssistantEvent,
   conversationId?: string,
   options?: BroadcastFnOptions,
 ) => void;
@@ -107,7 +107,7 @@ export class VellumAdapter implements ChannelAdapter {
         deepLinkMetadata: payload.deepLinkTarget,
         targetGuardianPrincipalId,
         silent,
-      } as ServerMessage);
+      } as AssistantEvent);
 
       log.info(
         {

package/src/notifications/broadcaster.ts

@@ -30,8 +30,12 @@ import {
 } from "./deliveries-store.js";
 import { resolveDestinations } from "./destination-resolver.js";
 import {
+  buildQuestionOptionActionId,
   buildToolApprovalSourceView,
+  parseGuardianQuestionPayload,
   parseInteractiveApprovalPayload,
+  QUESTION_SKIP_ACTION_ID,
+  resolveGuardianInstructionModeFromPayload,
   type ToolApprovalSourceView,
 } from "./guardian-question-mode.js";
 import { nonEmpty } from "./notification-utils.js";
@@ -94,6 +98,16 @@ function resolveApprovalContext(
   }
 
   if (signal.sourceEventName === "guardian.question") {
+    // Answer-mode question with structured options (an ask_question prompt):
+    // render the options as card actions so every channel adapter shows
+    // tappable choices. Built here — once per broadcast — so adapters stay
+    // rendering-only; the reply router recognizes the action ids as answer
+    // selections (see parseQuestionAnswerActionId).
+    const questionContext = resolveQuestionOptionsContext(payload);
+    if (questionContext) {
+      return questionContext;
+    }
+
     const parsed = parseInteractiveApprovalPayload(payload);
     if (!parsed) {
       return undefined;
@@ -137,6 +151,49 @@ function resolveApprovalContext(
   return undefined;
 }
 
+/**
+ * Card actions for an answer-mode `pending_question` payload carrying
+ * structured options: one action per option plus Skip, ids in the
+ * answer-selection scheme. Returns `undefined` for approval-mode payloads,
+ * option-less questions (voice questions answer by free text), and anything
+ * that fails strict parsing — those fall through to the approval/plain-text
+ * paths.
+ */
+function resolveQuestionOptionsContext(
+  payload: Record<string, unknown>,
+): ResolvedApprovalContext | undefined {
+  const parsed = parseGuardianQuestionPayload(payload);
+  if (!parsed || parsed.requestKind !== "pending_question") {
+    return undefined;
+  }
+  if (resolveGuardianInstructionModeFromPayload(parsed).mode !== "answer") {
+    return undefined;
+  }
+  const options = parsed.options;
+  if (!options || options.length === 0) {
+    return undefined;
+  }
+  const requestId = nonEmpty(parsed.requestId);
+  if (!requestId) {
+    return undefined;
+  }
+
+  const code = parsed.requestCode?.toUpperCase() ?? requestId;
+  return {
+    approval: {
+      requestId,
+      actions: [
+        ...options.map((option, index) => ({
+          id: buildQuestionOptionActionId(index),
+          label: option.label,
+        })),
+        { id: QUESTION_SKIP_ACTION_ID, label: "Skip" },
+      ],
+      plainTextFallback: `Reply "${code} <your answer>".`,
+    },
+  };
+}
+
 /** Callback invoked immediately when a vellum notification conversation is created. */
 export interface ConversationCreatedInfo {
   conversationId: string;

package/src/notifications/copy-composer.ts

@@ -222,21 +222,6 @@ const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
     };
   },
 
-  "ingress.trusted_contact.denied": (payload) => {
-    const parsed = parseTrustedContactDecisionPayload(payload);
-    const requesterLabel = formatTrustedContactActor(
-      parsed?.requesterDisplayName,
-      parsed?.requesterExternalUserId,
-      parsed?.sourceChannel,
-      "Someone",
-    );
-
-    return {
-      title: "Trusted Contact Denied",
-      body: `A trusted contact request from ${requesterLabel} has been denied.`,
-    };
-  },
-
   "watcher.notification": (payload) => ({
     title: str(payload.title, "Watcher Notification"),
     body: str(payload.body, "A watcher event occurred"),

package/src/notifications/decision-engine.ts

@@ -974,7 +974,7 @@ export async function evaluateSignal(
     decision = enforceGuardianRequestCode(decision, signal);
     decision = enforceToolApprovalSeedBlocks(decision, signal);
     decision = enforceAccessRequestInstructions(decision, signal);
-    decision = enforceGuardianCallConversationAffinity(decision, signal);
+    decision = enforceGuardianRequestConversationAffinity(decision, signal);
     decision = enforceConversationAffinity(
       decision,
       signal.conversationAffinityHint,
@@ -992,7 +992,7 @@ export async function evaluateSignal(
     decision = enforceGuardianRequestCode(decision, signal);
     decision = enforceToolApprovalSeedBlocks(decision, signal);
     decision = enforceAccessRequestInstructions(decision, signal);
-    decision = enforceGuardianCallConversationAffinity(decision, signal);
+    decision = enforceGuardianRequestConversationAffinity(decision, signal);
     decision = enforceConversationAffinity(
       decision,
       signal.conversationAffinityHint,
@@ -1022,7 +1022,7 @@ export async function evaluateSignal(
   decision = enforceGuardianRequestCode(decision, signal);
   decision = enforceToolApprovalSeedBlocks(decision, signal);
   decision = enforceAccessRequestInstructions(decision, signal);
-  decision = enforceGuardianCallConversationAffinity(decision, signal);
+  decision = enforceGuardianRequestConversationAffinity(decision, signal);
   decision = enforceConversationAffinity(
     decision,
     signal.conversationAffinityHint,
@@ -1258,33 +1258,32 @@ export function enforceRoutingIntent(
   return decision;
 }
 
-// ── Guardian call conversation affinity ──────────────────────────────────
+// ── Guardian request conversation affinity ───────────────────────────────
 
 /**
- * Force a new vellum conversation for the first guardian question in a phone call.
+ * Force a new vellum conversation for guardian-request signals that carry no
+ * vellum affinity hint.
  *
- * When a guardian.question signal carries a callSessionId but has no
- * conversationAffinityHint, this is the first dispatch in a new call and
- * should get its own conversation. Without this guard the LLM might reuse a
- * conversation from a previous call. For subsequent dispatches within the same
- * call, the affinity hint already exists and enforceConversationAffinity
- * handles routing — so this guard is a no-op.
+ * Guardian cards (tool approvals, tool grants, access requests, voice and
+ * ask_question prompts) are pinned to their originating conversation by the
+ * producer via `conversationAffinityHint`. When no pin exists — e.g. an
+ * access request from a sender with no prior conversation, or the first
+ * question in a phone call — the card must open its own conversation:
+ * leaving the choice to the LLM lets unrelated requests accumulate in
+ * whichever guardian conversation is most recent. For hinted signals,
+ * enforceConversationAffinity applies the pin — this guard is a no-op.
  */
-export function enforceGuardianCallConversationAffinity(
+export function enforceGuardianRequestConversationAffinity(
   decision: NotificationDecision,
   signal: NotificationSignal,
 ): NotificationDecision {
-  if (signal.sourceEventName !== "guardian.question") {
-    return decision;
-  }
-
-  const callSessionId = signal.contextPayload?.callSessionId;
-  if (typeof callSessionId !== "string" || callSessionId.trim().length === 0) {
+  if (
+    signal.sourceEventName !== "guardian.question" &&
+    signal.sourceEventName !== "ingress.access_request"
+  ) {
     return decision;
   }
 
-  // If an affinity hint already exists for vellum, the second+ dispatch
-  // will be handled by enforceConversationAffinity — nothing to do here.
   if (signal.conversationAffinityHint?.vellum) {
     return decision;
   }
@@ -1299,8 +1298,8 @@ export function enforceGuardianCallConversationAffinity(
   enforced.conversationActions = conversationActions;
 
   log.info(
-    { callSessionId },
-    "Guardian call conversation affinity: first question in call — forcing start_new for vellum",
+    { sourceEventName: signal.sourceEventName },
+    "Guardian request conversation affinity: no vellum pin — forcing start_new",
   );
 
   return enforced;