@vellumai/assistant 0.10.2-dev.202606251104.36cd100 → 0.10.2-dev.202606251348.a66ca6e

package/openapi.yaml

@@ -4915,20 +4915,13 @@ paths:
                             - address
                             - isPrimary
                             - externalUserId
-                            - status
-                            - policy
-                            - verifiedAt
-                            - verifiedVia
                             - lastSeenAt
                             - interactionCount
                             - lastInteraction
-                            - revokedReason
-                            - blockedReason
                           additionalProperties: false
                     required:
                       - id
                       - displayName
-                      - role
                       - interactionCount
                       - createdAt
                       - updatedAt
@@ -5076,20 +5069,13 @@ paths:
                               - address
                               - isPrimary
                               - externalUserId
-                              - status
-                              - policy
-                              - verifiedAt
-                              - verifiedVia
                               - lastSeenAt
                               - interactionCount
                               - lastInteraction
-                              - revokedReason
-                              - blockedReason
                             additionalProperties: false
                       required:
                         - id
                         - displayName
-                        - role
                         - interactionCount
                         - createdAt
                         - updatedAt
@@ -5206,20 +5192,13 @@ paths:
                             - address
                             - isPrimary
                             - externalUserId
-                            - status
-                            - policy
-                            - verifiedAt
-                            - verifiedVia
                             - lastSeenAt
                             - interactionCount
                             - lastInteraction
-                            - revokedReason
-                            - blockedReason
                           additionalProperties: false
                     required:
                       - id
                       - displayName
-                      - role
                       - interactionCount
                       - createdAt
                       - updatedAt
@@ -5581,20 +5560,13 @@ paths:
                             - address
                             - isPrimary
                             - externalUserId
-                            - status
-                            - policy
-                            - verifiedAt
-                            - verifiedVia
                             - lastSeenAt
                             - interactionCount
                             - lastInteraction
-                            - revokedReason
-                            - blockedReason
                           additionalProperties: false
                     required:
                       - id
                       - displayName
-                      - role
                       - interactionCount
                       - createdAt
                       - updatedAt
@@ -5776,20 +5748,13 @@ paths:
                           - address
                           - isPrimary
                           - externalUserId
-                          - status
-                          - policy
-                          - verifiedAt
-                          - verifiedVia
                           - lastSeenAt
                           - interactionCount
                           - lastInteraction
-                          - revokedReason
-                          - blockedReason
                         additionalProperties: false
                   required:
                     - id
                     - displayName
-                    - role
                     - interactionCount
                     - createdAt
                     - updatedAt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.2-dev.202606251104.36cd100",
+  "version": "0.10.2-dev.202606251348.a66ca6e",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/actor-trust-resolver-address-fallback.test.ts

@@ -7,12 +7,18 @@
  * and are discovered through the same path as every other channel.
  *
  * This suite verifies that address-based lookup returns the correct
- * `memberRecord` with the right channel/status so relay-setup-router
+ * `memberRecord` with the right ACL status so relay-setup-router
  * can emit the appropriate outcome (e.g. `unverified_caller`).
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import type {
+  ChannelPolicy,
+  ChannelStatus,
+  ContactRole,
+} from "../contacts/types.js";
+
 // ── Logger mock (suppress output) ───────────────────────────────────────────
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -23,13 +29,21 @@ mock.module("../util/logger.js", () => ({
 let _byAddress: ReturnType<
   (typeof import("../contacts/contact-store.js"))["findContactByAddress"]
 > = null;
-let _guardian: ReturnType<
-  (typeof import("../contacts/contact-store.js"))["findGuardianForChannel"]
-> = null;
+// ACL view is carried on memberRecord, sourced from the local ACL columns via
+// getLocalMemberAcl. Stub it per test instead of seeding the DB.
+let _acl: { status: ChannelStatus; policy: ChannelPolicy; role: ContactRole } =
+  { status: "unverified", policy: "allow", role: "contact" };
 
 mock.module("../contacts/contact-store.js", () => ({
   findContactByAddress: (_type: string, _addr: string) => _byAddress,
-  findGuardianForChannel: (_channel: string) => _guardian,
+  getLocalMemberAcl: (_channelId: string) => _acl,
+}));
+
+// Guardian resolution now reads the gateway delivery cache; these suites only
+// exercise the member/address path, so the cache peek stays empty.
+mock.module("../contacts/guardian-delivery-reader.js", () => ({
+  peekCachedGuardianDelivery: () => undefined,
+  guardianForChannel: () => undefined,
 }));
 
 // ── Real import after mocks ───────────────────────────────────────────────────
@@ -45,11 +59,12 @@ function makeContact(
   status: "unverified" | "active" = "unverified",
 ): ContactWithChannels {
   const channelId = "ch-test";
+  // ACL lives on memberRecord (carrier), sourced from getLocalMemberAcl — set
+  // the stub here so the resolver classifies trust off this status/role.
+  _acl = { status, policy: "allow", role };
   return {
     id: "contact-test",
     displayName: "Patrick Test",
-    role,
-    principalId: null,
     notes: null,
     lastInteraction: null,
     interactionCount: 0,
@@ -65,16 +80,10 @@ function makeContact(
         address: PHONE,
         externalChatId: null,
         isPrimary: true,
-        status,
-        policy: "allow",
-        verifiedAt: null,
-        verifiedVia: null,
-        revokedReason: null,
-        blockedReason: null,
+        inviteId: null,
+        lastSeenAt: null,
         interactionCount: 0,
         lastInteraction: null,
-        lastSeenAt: null,
-        inviteId: null,
         createdAt: 0,
         updatedAt: 0,
       },
@@ -87,7 +96,7 @@ function makeContact(
 describe("resolveActorTrust — address fallback", () => {
   beforeEach(() => {
     _byAddress = null;
-    _guardian = null;
+    _acl = { status: "unverified", policy: "allow", role: "contact" };
   });
 
   test("finds unverified channel via address when externalUserId is null", () => {
@@ -103,7 +112,7 @@ describe("resolveActorTrust — address fallback", () => {
 
     expect(result.memberRecord).not.toBeNull();
     expect(result.memberRecord?.contact.displayName).toBe("Patrick Test");
-    expect(result.memberRecord?.channel.status).toBe("unverified");
+    expect(result.memberRecord?.status).toBe("unverified");
     // trustClass is 'unverified_contact' for a member whose channel is
     // pending or unverified — known to the guardian but not yet verified.
     expect(result.trustClass).toBe("unverified_contact");
@@ -119,7 +128,7 @@ describe("resolveActorTrust — address fallback", () => {
       actorExternalId: PHONE,
     });
 
-    expect(result.memberRecord?.channel.status).toBe("active");
+    expect(result.memberRecord?.status).toBe("active");
     expect(result.memberRecord?.channel.address).toBe(PHONE);
   });
 
@@ -150,7 +159,7 @@ describe("resolveActorTrust — address fallback", () => {
     });
 
     expect(result.memberRecord).not.toBeNull();
-    expect(result.memberRecord?.channel.status).toBe("active");
+    expect(result.memberRecord?.status).toBe("active");
     expect(result.trustClass).toBe("trusted_contact");
   });
 
@@ -158,8 +167,8 @@ describe("resolveActorTrust — address fallback", () => {
     // Mirrors the unverified branch but for `pending` status (e.g. a phone
     // contact registered by name-capture awaiting the DTMF challenge).
     const contact = makeContact("contact", "unverified");
-    // Override status to "pending" — makeContact only accepts unverified/active
-    contact.channels[0]!.status = "pending";
+    // Override ACL status to "pending" — makeContact only accepts unverified/active.
+    _acl = { ..._acl, status: "pending" };
     _byAddress = contact;
 
     const result = resolveActorTrust({
@@ -169,15 +178,15 @@ describe("resolveActorTrust — address fallback", () => {
       actorExternalId: PHONE,
     });
 
-    expect(result.memberRecord?.channel.status).toBe("pending");
+    expect(result.memberRecord?.status).toBe("pending");
     expect(result.trustClass).toBe("unverified_contact");
   });
 
   test("blocked-status member is classified as unknown (not unverified_contact)", () => {
     // Hard-deny statuses (blocked, revoked) stay `unknown` — admission-layer
-    // re-checks channel.status and emits the hard-deny reasons.
+    // re-checks channel status and emits the hard-deny reasons.
     const contact = makeContact("contact", "unverified");
-    contact.channels[0]!.status = "blocked";
+    _acl = { ..._acl, status: "blocked" };
     _byAddress = contact;
 
     const result = resolveActorTrust({
@@ -187,13 +196,13 @@ describe("resolveActorTrust — address fallback", () => {
       actorExternalId: PHONE,
     });
 
-    expect(result.memberRecord?.channel.status).toBe("blocked");
+    expect(result.memberRecord?.status).toBe("blocked");
     expect(result.trustClass).toBe("unknown");
   });
 
   test("revoked-status member is classified as unknown", () => {
     const contact = makeContact("contact", "unverified");
-    contact.channels[0]!.status = "revoked";
+    _acl = { ..._acl, status: "revoked" };
     _byAddress = contact;
 
     const result = resolveActorTrust({
@@ -203,7 +212,7 @@ describe("resolveActorTrust — address fallback", () => {
       actorExternalId: PHONE,
     });
 
-    expect(result.memberRecord?.channel.status).toBe("revoked");
+    expect(result.memberRecord?.status).toBe("revoked");
     expect(result.trustClass).toBe("unknown");
   });
 });

package/src/__tests__/channel-approval-routes.test.ts

@@ -69,7 +69,6 @@ mock.module("../daemon/approval-generators.js", () => ({
   createApprovalConversationGenerator: () => _testApprovalConversationGenerator,
 }));
 
-import { upsertContact } from "../contacts/contact-store.js";
 import type { Conversation } from "../daemon/conversation.js";
 import {
   createCanonicalGuardianDelivery,
@@ -86,7 +85,10 @@ import * as gatewayClient from "../runtime/gateway-client.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { _setTestPollMaxWait } from "../runtime/routes/channel-route-shared.js";
 import { resetDbForTesting } from "./db-test-helpers.js";
-import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
+import {
+  handleChannelInbound,
+  seedContactChannel,
+} from "./helpers/channel-test-adapter.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 await initializeDb();
@@ -212,22 +214,19 @@ function makeInboundRequest(overrides: Record<string, unknown> = {}): Request {
 const noopProcessMessage = mock(async () => ({ messageId: "msg-1" }));
 
 function ensureTestContact(): void {
-  upsertContact({
+  seedContactChannel({
+    sourceChannel: "telegram",
+    externalUserId: "telegram-user-default",
     displayName: "Test User",
-    channels: [
-      {
-        type: "telegram",
-        address: "telegram-user-default",
-        status: "active",
-        policy: "allow",
-      },
-      {
-        type: "slack",
-        address: "slack-user-default",
-        status: "active",
-        policy: "allow",
-      },
-    ],
+    status: "active",
+    policy: "allow",
+  });
+  seedContactChannel({
+    sourceChannel: "slack",
+    externalUserId: "slack-user-default",
+    displayName: "Test User",
+    status: "active",
+    policy: "allow",
   });
 }
 
@@ -1926,16 +1925,12 @@ describe("trusted-contact self-approval blocked before guardian approval row exi
       guardianDeliveryChatId: "guardian-tc-selfapproval-chat",
       guardianPrincipalId: "guardian-tc-selfapproval",
     });
-    upsertContact({
+    seedContactChannel({
+      sourceChannel: "telegram",
+      externalUserId: "tc-selfapproval-user",
       displayName: "TC Self-Approval User",
-      channels: [
-        {
-          type: "telegram",
-          address: "tc-selfapproval-user",
-          status: "active",
-          policy: "allow",
-        },
-      ],
+      status: "active",
+      policy: "allow",
     });
   });
 

package/src/__tests__/channel-guardian.test.ts

@@ -65,45 +65,77 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
 
 // Gateway relay mock — the revoke path relays the ACL downgrade over IPC and
 // validates the response; return a well-formed mark_channel_revoked result.
+// The gateway owns the revoke and dual-writes the local assistant row to
+// "revoked"; mirror that dual-write here so guardian-resolution reads under
+// test observe the downgrade (the assistant-side teardown is now a no-op shim).
 mock.module("../ipc/gateway-client.js", () => ({
   ipcCallPersistent: async (
-    _method: string,
+    method: string,
     params?: Record<string, unknown>,
-  ) => ({
-    ok: true,
-    didWrite: true,
-    channel: {
-      id: (params?.contactChannelId as string) ?? "ch1",
-      contactId: "c1",
-      type: "phone",
-      address: "addr",
-      status: "revoked",
-      revokedReason: (params?.reason as string) ?? null,
-    },
-  }),
+  ) => {
+    if (method === "mark_channel_revoked") {
+      const { getDb } = await import("../memory/db-connection.js");
+      const { contactChannels } = await import("../memory/schema.js");
+      const { eq } = await import("drizzle-orm");
+      const channelId = params?.contactChannelId as string | undefined;
+      if (channelId) {
+        getDb()
+          .update(contactChannels)
+          .set({ status: "revoked" })
+          .where(eq(contactChannels.id, channelId))
+          .run();
+      }
+    }
+    return {
+      ok: true,
+      didWrite: true,
+      channel: {
+        id: (params?.contactChannelId as string) ?? "ch1",
+        contactId: "c1",
+        type: "phone",
+        address: "addr",
+        status: "revoked",
+        revokedReason: (params?.reason as string) ?? null,
+      },
+    };
+  },
 }));
 
 // Guardian-delivery reader mock — the inbound challenge guard reads guardian
 // existence from the gateway. Derive the list from the local binding state so
 // the gateway-backed presence guard mirrors the DB the rest of the test sets up.
 const resolveGuardianList = async (input?: { channelTypes?: string[] }) => {
-  const { findGuardianForChannel } = await import(
-    "../contacts/contact-store.js"
-  );
+  const { getDb } = await import("../memory/db-connection.js");
+  const { contacts, contactChannels } = await import("../memory/schema.js");
+  const { and, eq } = await import("drizzle-orm");
   const channels = input?.channelTypes ?? [];
   return channels
     .map((channelType) => {
-      const found = findGuardianForChannel(channelType);
-      if (!found) return null;
+      const row = getDb()
+        .select({ contact: contacts, channel: contactChannels })
+        .from(contacts)
+        .innerJoin(
+          contactChannels,
+          eq(contacts.id, contactChannels.contactId),
+        )
+        .where(
+          and(
+            eq(contacts.role, "guardian"),
+            eq(contactChannels.type, channelType),
+            eq(contactChannels.status, "active"),
+          ),
+        )
+        .get();
+      if (!row) return null;
       return {
         channelType,
-        contactId: found.contact.id,
-        principalId: found.contact.principalId ?? null,
-        displayName: found.contact.displayName ?? null,
-        address: found.channel.address,
-        externalChatId: found.channel.externalChatId ?? null,
+        contactId: row.contact.id,
+        principalId: row.contact.principalId ?? null,
+        displayName: row.contact.displayName ?? null,
+        address: row.channel.address,
+        externalChatId: row.channel.externalChatId ?? null,
         status: "active",
-        verifiedAt: found.channel.verifiedAt ?? null,
+        verifiedAt: row.channel.verifiedAt ?? null,
       };
     })
     .filter((g) => g !== null);
@@ -147,6 +179,7 @@ import {
 } from "../memory/guardian-rate-limits.js";
 import {
   channelVerificationSessions,
+  contactChannels,
   conversations,
 } from "../memory/schema.js";
 import {
@@ -192,6 +225,19 @@ function resetTables(): void {
   mockBotUsername = "test_bot";
 }
 
+/**
+ * Revoke a guardian channel's local ACL state directly. The production revoke
+ * is gateway-owned (relayed via mark_channel_revoked); this stamps the local
+ * mirror so the guardian-resolution reads still under test see the downgrade.
+ */
+function revokeGuardianChannelLocally(channelType: string): void {
+  getDb()
+    .update(contactChannels)
+    .set({ status: "revoked" })
+    .where(eq(contactChannels.type, channelType))
+    .run();
+}
+
 // ═══════════════════════════════════════════════════════════════════════════
 // 2. Verification Challenge Lifecycle (Store)
 // ═══════════════════════════════════════════════════════════════════════════
@@ -558,7 +604,7 @@ describe("guardian identity check", () => {
       guardianDeliveryChatId: "chat-42",
     });
 
-    serviceRevokeBinding("asst-1", "telegram");
+    revokeGuardianChannelLocally("telegram");
 
     expect(await isGuardian("asst-1", "telegram", "user-42")).toBe(false);
   });
@@ -595,7 +641,7 @@ describe("guardian identity check", () => {
     expect(await isGuardian("asst-1", "telegram", "phone-user-1")).toBe(false);
   });
 
-  test("serviceRevokeBinding revokes the active binding", async () => {
+  test("guardian binding read reflects a gateway-owned revoke", async () => {
     createGuardianBinding({
       channel: "telegram",
       guardianExternalUserId: "user-42",
@@ -603,8 +649,10 @@ describe("guardian identity check", () => {
       guardianDeliveryChatId: "chat-42",
     });
 
-    const result = serviceRevokeBinding("asst-1", "telegram");
-    expect(result).toBe(true);
+    // The revoke is gateway-owned; serviceRevokeBinding's local teardown is a
+    // no-op shim. Stamp the local downgrade and assert the read reflects it.
+    serviceRevokeBinding("asst-1", "telegram");
+    revokeGuardianChannelLocally("telegram");
     expect(await getGuardianBinding("asst-1", "telegram")).toBeNull();
   });
 });
@@ -958,7 +1006,7 @@ describe("channel-scoped guardian resolution", () => {
       guardianDeliveryChatId: "chat-beta",
     });
 
-    serviceRevokeBinding("self", "telegram");
+    revokeGuardianChannelLocally("telegram");
 
     expect(await getGuardianBinding("self", "telegram")).toBeNull();
     expect(await getGuardianBinding("self", "phone")).not.toBeNull();
@@ -1472,8 +1520,10 @@ describe("voice guardian identity and revocation", () => {
       guardianDeliveryChatId: "voice-chat-1",
     });
 
-    const result = serviceRevokeBinding("asst-1", "phone");
-    expect(result).toBe(true);
+    // The revoke is gateway-owned; serviceRevokeBinding's local teardown is a
+    // no-op shim. Stamp the local downgrade and assert the read reflects it.
+    serviceRevokeBinding("asst-1", "phone");
+    revokeGuardianChannelLocally("phone");
     expect(await getGuardianBinding("asst-1", "phone")).toBeNull();
   });
 
@@ -1491,7 +1541,7 @@ describe("voice guardian identity and revocation", () => {
       guardianDeliveryChatId: "tg-chat-1",
     });
 
-    serviceRevokeBinding("asst-1", "phone");
+    revokeGuardianChannelLocally("phone");
 
     expect(await getGuardianBinding("asst-1", "phone")).toBeNull();
     expect(await getGuardianBinding("asst-1", "telegram")).not.toBeNull();

package/src/__tests__/channel-inbound-disk-pressure.test.ts

@@ -59,7 +59,6 @@ mock.module("../daemon/disk-pressure-guard.js", () => ({
     diskPressureStatusSequence?.shift() ?? diskPressureStatus,
 }));
 
-import { upsertContact } from "../contacts/contact-store.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import * as deliveryCrud from "../memory/delivery-crud.js";
@@ -71,6 +70,7 @@ import {
 import { sweepFailedEvents } from "../runtime/channel-retry-sweep.js";
 import {
   handleChannelInbound,
+  seedContactChannel,
   setAdapterProcessMessage,
 } from "./helpers/channel-test-adapter.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
@@ -90,16 +90,12 @@ function resetTables(): void {
 }
 
 function seedTrustedContact(policy: "allow" | "escalate" = "allow"): void {
-  upsertContact({
+  seedContactChannel({
+    sourceChannel: "telegram",
+    externalUserId: "telegram-user-1",
     displayName: "Example User",
-    channels: [
-      {
-        type: "telegram",
-        address: "telegram-user-1",
-        status: "active",
-        policy,
-      },
-    ],
+    status: "active",
+    policy,
   });
 }
 
@@ -236,16 +232,12 @@ describe("channel inbound disk pressure gate", () => {
   });
 
   test("blocks non-guardian Slack reactions silently (no reply) before persistence while locked", async () => {
-    upsertContact({
+    seedContactChannel({
+      sourceChannel: "slack",
+      externalUserId: "slack-user-1",
       displayName: "Example Slack User",
-      channels: [
-        {
-          type: "slack",
-          address: "slack-user-1",
-          status: "active",
-          policy: "allow",
-        },
-      ],
+      status: "active",
+      policy: "allow",
     });
     const processMessage = mock(async () => {
       throw new Error("processMessage should not run");