@vellumai/assistant 0.10.2 → 0.10.3-dev.202606252046.9075fd5

package/src/__tests__/trusted-contact-verification.test.ts

@@ -22,21 +22,27 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-import {
-  findContactChannel,
-  findGuardianForChannel,
-} from "../contacts/contact-store.js";
+import { and, desc, eq } from "drizzle-orm";
+
+import type { ChannelId } from "../channels/types.js";
+import { findContactChannel } from "../contacts/contact-store.js";
 import {
   revokeMember,
   upsertContactChannel,
 } from "../contacts/contacts-write.js";
+import type { ChannelStatus } from "../contacts/types.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
+import { contactChannels, contacts } from "../memory/schema.js";
 import { resolveActorTrust } from "../runtime/actor-trust-resolver.js";
 import {
   createOutboundSession,
   validateAndConsumeVerification,
 } from "../runtime/channel-verification-service.js";
+import {
+  __resetMemberVerdictCacheForTest,
+  setMemberVerdict,
+} from "../runtime/member-verdict-cache.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 await initializeDb();
@@ -53,6 +59,48 @@ function resetTables(): void {
   db.run("DELETE FROM contacts");
 }
 
+// Mirror a warmed gateway verdict so the sync resolveActorTrust fallback
+// resolves the member with the given status; the local ACL columns are no
+// longer read.
+function warmMemberVerdict(
+  channelType: ChannelId,
+  address: string,
+  status: ChannelStatus = "unverified",
+): void {
+  const found = findContactChannel({ channelType, address });
+  if (!found) return;
+  setMemberVerdict(channelType, address, {
+    trustClass: "unknown",
+    canonicalSenderId: address,
+    contactId: found.contact.id,
+    channelId: found.channel.id,
+    status,
+    policy: "allow",
+  });
+}
+
+/**
+ * Read the local active guardian channel for a channel type, mirroring the
+ * gateway's role/status resolution. Used by assertions that confirm the local
+ * guardian binding state after verification flows.
+ */
+function localGuardianForChannel(channelType: string) {
+  const row = getDb()
+    .select({ contact: contacts, channel: contactChannels })
+    .from(contacts)
+    .innerJoin(contactChannels, eq(contacts.id, contactChannels.contactId))
+    .where(
+      and(
+        eq(contacts.role, "guardian"),
+        eq(contactChannels.type, channelType),
+        eq(contactChannels.status, "active"),
+      ),
+    )
+    .orderBy(desc(contactChannels.verifiedAt))
+    .get();
+  return row ? { contact: row.contact, channel: row.channel } : null;
+}
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -60,6 +108,7 @@ function resetTables(): void {
 describe("trusted contact verification → member activation", () => {
   beforeEach(() => {
     resetTables();
+    __resetMemberVerdictCacheForTest();
   });
 
   test("successful verification creates active member with allow policy", () => {
@@ -88,26 +137,24 @@ describe("trusted contact verification → member activation", () => {
       expect(result.verificationType).toBe("trusted_contact");
     }
 
-    // Simulate the member upsert that inbound-message-handler performs on success
+    // Simulate the member upsert that inbound-message-handler performs on
+    // success. The local mirror persists identity only; the gateway owns the
+    // ACL verdict, so the channel lands at the schema-default status.
     upsertContactChannel({
       sourceChannel: "telegram",
       externalUserId: "requester-user-123",
       externalChatId: "requester-chat-123",
-      status: "active",
-      policy: "allow",
       displayName: "Requester Name",
       username: "requester_username",
     });
 
-    // Verify: active member record exists
+    // Verify: member identity record exists
     const contactResult = findContactChannel({
       channelType: "telegram",
       address: "requester-user-123",
     });
 
     expect(contactResult).not.toBeNull();
-    expect(contactResult!.channel.status).toBe("active");
-    expect(contactResult!.channel.policy).toBe("allow");
     expect(contactResult!.channel.address).toBe("requester-user-123");
     expect(contactResult!.channel.externalChatId).toBe("requester-chat-123");
     expect(contactResult!.contact.displayName).toBe("Requester Name");
@@ -119,11 +166,10 @@ describe("trusted contact verification → member activation", () => {
       sourceChannel: "telegram",
       externalUserId: "requester-user-jeff",
       externalChatId: "requester-chat-jeff",
-      status: "active",
-      policy: "allow",
       displayName: "Jeff",
       username: "jeff_handle",
     });
+    warmMemberVerdict("telegram", "requester-user-jeff");
 
     const trust = resolveActorTrust({
       assistantId: "self",
@@ -132,7 +178,9 @@ describe("trusted contact verification → member activation", () => {
       actorExternalId: "requester-user-jeff",
     });
 
-    expect(trust.trustClass).toBe("trusted_contact");
+    // The local mirror persists identity only; the schema-default status places
+    // the contact in the unverified_contact tier (gateway owns elevation).
+    expect(trust.trustClass).toBe("unverified_contact");
     expect(trust.actorMetadata.displayName).toBe("Jeff");
     expect(trust.actorMetadata.senderDisplayName).toBeUndefined();
     expect(trust.actorMetadata.memberDisplayName).toBe("Jeff");
@@ -147,11 +195,10 @@ describe("trusted contact verification → member activation", () => {
       sourceChannel: "telegram",
       externalUserId: "requester-user-jeff-priority",
       externalChatId: "requester-chat-jeff-priority",
-      status: "active",
-      policy: "allow",
       displayName: "Jeff",
       username: "jeff_handle",
     });
+    warmMemberVerdict("telegram", "requester-user-jeff-priority");
 
     const trust = resolveActorTrust({
       assistantId: "self",
@@ -162,7 +209,7 @@ describe("trusted contact verification → member activation", () => {
       actorDisplayName: "Jeffrey",
     });
 
-    expect(trust.trustClass).toBe("trusted_contact");
+    expect(trust.trustClass).toBe("unverified_contact");
     expect(trust.actorMetadata.displayName).toBe("Jeff");
     expect(trust.actorMetadata.senderDisplayName).toBe("Jeffrey");
     expect(trust.actorMetadata.memberDisplayName).toBe("Jeff");
@@ -179,8 +226,6 @@ describe("trusted contact verification → member activation", () => {
       sourceChannel: "telegram",
       externalUserId: "other-user-in-group",
       externalChatId: "shared-group-chat",
-      status: "active",
-      policy: "allow",
       displayName: "Other User",
       username: "other_handle",
     });
@@ -229,20 +274,17 @@ describe("trusted contact verification → member activation", () => {
       sourceChannel: "telegram",
       externalUserId: "requester-user-456",
       externalChatId: "requester-chat-456",
-      status: "active",
-      policy: "allow",
     });
 
-    // Simulate the ACL check that inbound-message-handler performs
+    // The local mirror persists the member identity; the gateway owns the ACL
+    // verdict the inbound handler enforces.
     const contactResult = findContactChannel({
       channelType: "telegram",
       address: "requester-user-456",
     });
 
     expect(contactResult).not.toBeNull();
-    expect(contactResult!.channel.status).toBe("active");
-    expect(contactResult!.channel.policy).toBe("allow");
-    // ACL check passes: member exists, is active, and has allow policy
+    expect(contactResult!.channel.address).toBe("requester-user-456");
   });
 
   test("member lookup is scoped by channel type", () => {
@@ -267,8 +309,6 @@ describe("trusted contact verification → member activation", () => {
       sourceChannel: "telegram",
       externalUserId: "user-cross-test",
       externalChatId: "chat-cross-test",
-      status: "active",
-      policy: "allow",
     });
 
     // Member should be found via contacts
@@ -277,7 +317,7 @@ describe("trusted contact verification → member activation", () => {
       address: "user-cross-test",
     });
     expect(contactResult).not.toBeNull();
-    expect(contactResult!.channel.status).toBe("active");
+    expect(contactResult!.channel.address).toBe("user-cross-test");
 
     // Member should NOT be found for a different channel type
     const otherChannel = findContactChannel({
@@ -287,31 +327,22 @@ describe("trusted contact verification → member activation", () => {
     expect(otherChannel).toBeNull();
   });
 
-  test("re-verification of previously revoked member reactivates them", () => {
-    // Create and activate a member
+  test("revokeMember resolves the member identity without mutating local ACL", () => {
+    // Create a member identity row.
     const member = upsertContactChannel({
       sourceChannel: "telegram",
       externalUserId: "user-revoked",
       externalChatId: "chat-revoked",
-      status: "active",
-      policy: "allow",
       displayName: "Revoked User",
     });
 
-    // Revoke the member
-    const revoked = revokeMember(member!.channel.id, "testing revocation");
+    // The local revoke is a pure resolver now — the gateway owns the ACL
+    // downgrade; revokeMember returns the resolved native contact/channel.
+    const revoked = revokeMember(member!.channel.id);
     expect(revoked).not.toBeNull();
-    expect(revoked!.channel.status).toBe("revoked");
-
-    // Verify the member is indeed revoked (ACL would reject)
-    const revokedResult = findContactChannel({
-      channelType: "telegram",
-      address: "user-revoked",
-    });
-    expect(revokedResult).not.toBeNull();
-    expect(revokedResult!.channel.status).toBe("revoked");
+    expect(revoked!.channel.id).toBe(member!.channel.id);
 
-    // Guardian re-approves, new outbound session created
+    // Re-upsert on the same identity is idempotent on the identity row.
     const session = createOutboundSession({
       channel: "telegram",
       expectedExternalUserId: "user-revoked",
@@ -321,7 +352,6 @@ describe("trusted contact verification → member activation", () => {
       verificationPurpose: "trusted_contact",
     });
 
-    // Requester enters the new code
     const result = validateAndConsumeVerification(
       "telegram",
       session.secret,
@@ -333,23 +363,18 @@ describe("trusted contact verification → member activation", () => {
       expect(result.verificationType).toBe("trusted_contact");
     }
 
-    // upsertContactChannel reactivates the existing record
     upsertContactChannel({
       sourceChannel: "telegram",
       externalUserId: "user-revoked",
       externalChatId: "chat-revoked",
-      status: "active",
-      policy: "allow",
     });
 
-    // Verify: member is now active again
-    const reactivatedResult = findContactChannel({
+    const reResolved = findContactChannel({
       channelType: "telegram",
       address: "user-revoked",
     });
-    expect(reactivatedResult).not.toBeNull();
-    expect(reactivatedResult!.channel.status).toBe("active");
-    expect(reactivatedResult!.channel.policy).toBe("allow");
+    expect(reResolved).not.toBeNull();
+    expect(reResolved!.channel.id).toBe(member!.channel.id);
   });
 
   test("trusted contact verification does NOT create a guardian binding", () => {
@@ -388,7 +413,7 @@ describe("trusted contact verification → member activation", () => {
     }
 
     // The original guardian binding should remain intact
-    const guardianResult = findGuardianForChannel("telegram");
+    const guardianResult = localGuardianForChannel("telegram");
     expect(guardianResult).not.toBeNull();
     expect(guardianResult!.channel.address).toBe("guardian-user-original");
   });
@@ -412,7 +437,7 @@ describe("trusted contact verification → member activation", () => {
       expect(result.verificationType).toBe("guardian");
     }
 
-    const guardianResult = findGuardianForChannel("telegram");
+    const guardianResult = localGuardianForChannel("telegram");
     expect(guardianResult).toBeNull();
   });
 });

package/src/__tests__/twilio-routes.test.ts

@@ -109,6 +109,25 @@ mock.module("../calls/channel-admission-reader.js", () => ({
   getChannelAdmissionPolicy: async () => mockAdmissionPolicy,
 }));
 
+// Mock the inbound trust reader used by the media-stream preflight. Captures
+// its args so tests can assert the inbound caller's verdict is fetched, and
+// returns mockInboundVerdict which is threaded into the preflight routeSetup.
+let mockInboundVerdict: unknown = null;
+let lastInboundVerdictArgs: Record<string, unknown> | null = null;
+mock.module("../calls/inbound-trust-reader.js", () => ({
+  getInboundTrustVerdict: async (args: Record<string, unknown>) => {
+    lastInboundVerdictArgs = args;
+    return mockInboundVerdict;
+  },
+  getPhoneCallerVerdict: async (otherPartyNumber: string | undefined) => {
+    lastInboundVerdictArgs = {
+      channelType: "phone",
+      actorExternalId: otherPartyNumber || undefined,
+    };
+    return mockInboundVerdict;
+  },
+}));
+
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
   getGatewayInternalBaseUrl: () => "http://gateway.internal:7830",
@@ -470,6 +489,8 @@ describe("twilio webhook routes", () => {
     // Reset admission policy + captured routeSetup context between tests
     mockAdmissionPolicy = null;
     lastRouteSetupCtx = null;
+    mockInboundVerdict = null;
+    lastInboundVerdictArgs = null;
     // Reset routeSetup mock to default normal_call
     mockRouteSetupResult = {
       outcome: { action: "normal_call", isInbound: true },
@@ -1269,6 +1290,81 @@ describe("twilio webhook routes", () => {
       expect(lastRouteSetupCtx?.admissionPolicy).toBe("guardian_only");
     });
 
+    test("media-stream inbound: fetches the caller's verdict (From) and threads it into the preflight routeSetup", async () => {
+      mockConfigObj.services.stt.provider = "openai-whisper" as any;
+      mockInboundVerdict = {
+        channelType: "phone",
+        actorExternalId: "+14155551234",
+        contactId: "contact-1",
+        channelId: "channel-1",
+        status: "verified",
+        policy: "allow",
+        resolutionFailed: false,
+      };
+
+      const req = makeInboundVoiceRequest({
+        CallSid: "CA_ms_verdict_inbound_1",
+        From: "+14155551234",
+        To: "+15550001111",
+      });
+
+      const res = await handleVoiceWebhook(req);
+      expect(res.status).toBe(200);
+
+      // Inbound: verdict fetched for the caller (From) on the phone channel.
+      expect(lastInboundVerdictArgs).toEqual({
+        channelType: "phone",
+        actorExternalId: "+14155551234",
+      });
+      // Verdict threaded into the preflight routeSetup.
+      expect(lastRouteSetupCtx?.verdict).toEqual(mockInboundVerdict);
+    });
+
+    test("media-stream inbound: a blocked/denied member verdict is classified deny in the preflight", async () => {
+      mockConfigObj.services.stt.provider = "openai-whisper" as any;
+      mockInboundVerdict = {
+        channelType: "phone",
+        actorExternalId: "+14155551234",
+        contactId: "contact-1",
+        channelId: "channel-1",
+        status: "blocked",
+        policy: "deny",
+        resolutionFailed: false,
+      };
+      // The real router returns `deny` for a blocked member verdict; the mock
+      // reflects that outcome. deny is supported on media-stream, so the
+      // preflight still emits Stream TwiML (denial spoken at stream start).
+      mockRouteSetupResult = {
+        outcome: {
+          action: "deny",
+          message:
+            "This number is not authorized to reach the assistant right now.",
+          logReason: "Inbound voice ACL: member blocked",
+        },
+        resolved: {
+          assistantId: "self",
+          isInbound: true,
+          otherPartyNumber: "+14155551234",
+          actorTrust: { trustClass: "unknown", memberRecord: null },
+        },
+      };
+
+      const req = makeInboundVoiceRequest({
+        CallSid: "CA_ms_verdict_deny_1",
+        From: "+14155551234",
+        To: "+15550001111",
+      });
+
+      const res = await handleVoiceWebhook(req);
+      expect(res.status).toBe(200);
+
+      // Verdict was threaded into routeSetup, which denied the caller.
+      expect(lastRouteSetupCtx?.verdict).toEqual(mockInboundVerdict);
+      const twiml = await res.text();
+      expect(twiml).toContain("<Stream");
+      expect(twiml).not.toContain("<ConversationRelay");
+    });
+
     test("media-stream: floor-denied caller classified deny still produces Stream TwiML (deny handled at stream level)", async () => {
       mockConfigObj.services.stt.provider = "openai-whisper" as any;
       mockAdmissionPolicy = "guardian_only";

package/src/__tests__/ui-file-upload-surface.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
+import { FileUploadSurfaceDataSchema } from "../api/surfaces.js";
 import type {
   FileUploadSurfaceData,
   UiSurfaceShowFileUpload,
@@ -103,3 +104,88 @@ describe("UI surface tool registration", () => {
     ]);
   });
 });
+
+// ---------------------------------------------------------------------------
+// FileUploadSurfaceDataSchema coercion
+// ---------------------------------------------------------------------------
+//
+// `acceptedTypes` is contractually a string[], but the model frequently emits a
+// comma-joined string or a bare string. The renderer calls `.join`/`.some` on
+// it, so the schema coerces every shape to the array contract.
+
+describe("FileUploadSurfaceDataSchema coercion", () => {
+  test("passes a well-formed payload through unchanged", () => {
+    expect(
+      FileUploadSurfaceDataSchema.parse({
+        prompt: "Share the receipt PDF",
+        acceptedTypes: ["image/*", "application/pdf"],
+        maxFiles: 3,
+      }),
+    ).toEqual({
+      prompt: "Share the receipt PDF",
+      acceptedTypes: ["image/*", "application/pdf"],
+      maxFiles: 3,
+    });
+  });
+
+  test("coerces a comma-joined acceptedTypes string into an array", () => {
+    expect(
+      FileUploadSurfaceDataSchema.parse({
+        prompt: "p",
+        acceptedTypes: "image/*, application/pdf",
+      }).acceptedTypes,
+    ).toEqual(["image/*", "application/pdf"]);
+  });
+
+  test("wraps a single acceptedTypes string into a one-element array", () => {
+    expect(
+      FileUploadSurfaceDataSchema.parse({ acceptedTypes: "application/pdf" })
+        .acceptedTypes,
+    ).toEqual(["application/pdf"]);
+  });
+
+  test("the parsed acceptedTypes always supports .join", () => {
+    const parsed = FileUploadSurfaceDataSchema.parse({
+      acceptedTypes: "image/*,application/pdf",
+    });
+    // `.join` is the call the renderer makes on `acceptedTypes`.
+    expect(parsed.acceptedTypes?.join(",")).toBe("image/*,application/pdf");
+  });
+
+  test("drops blanks and non-string entries from an array", () => {
+    expect(
+      FileUploadSurfaceDataSchema.parse({
+        acceptedTypes: [" application/pdf ", "", null, 42, {}],
+      }).acceptedTypes,
+    ).toEqual(["application/pdf", "42"]);
+  });
+
+  test("treats a non-string, non-array acceptedTypes as absent", () => {
+    expect(
+      FileUploadSurfaceDataSchema.parse({ acceptedTypes: { pdf: true } })
+        .acceptedTypes,
+    ).toBeUndefined();
+    expect(
+      FileUploadSurfaceDataSchema.parse({ acceptedTypes: null }).acceptedTypes,
+    ).toBeUndefined();
+  });
+
+  test("coerces numeric-string maxFiles and drops invalid numbers", () => {
+    const parsed = FileUploadSurfaceDataSchema.parse({
+      maxFiles: "2",
+      maxSizeBytes: "not-a-number",
+    });
+    expect(parsed.maxFiles).toBe(2);
+    expect(parsed.maxSizeBytes).toBeUndefined();
+  });
+
+  test("never rejects a fully malformed payload", () => {
+    expect(
+      FileUploadSurfaceDataSchema.safeParse({
+        prompt: 5,
+        acceptedTypes: 99,
+        maxFiles: -1,
+      }).success,
+    ).toBe(true);
+  });
+});

package/src/__tests__/verification-control-plane-policy.test.ts

@@ -72,6 +72,8 @@ mock.module("../permissions/checker.js", () => ({
 }));
 
 mock.module("../memory/conversation-crud.js", () => ({
+    setConversationProcessingStartedAt: () => {},
+    isConversationProcessing: () => false,
   createConversation: (title: string) => ({ id: "conversation-1", title }),
   reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));

package/src/__tests__/voice-guardian-cold-cache-warm.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Cold-cache guardian voice/phone regression.
+ *
+ * The sync trust resolver (`resolveActorTrust`) reads the IO-free guardian-
+ * delivery cache snapshot (`peekCachedGuardianDelivery`) keyed per channel
+ * filter. On a cold process only `vellum` is warmed at daemon startup, so for
+ * `phone` the snapshot is empty until some read warms that exact channel key.
+ * The voice setup path therefore awaits
+ * `getGuardianDeliveryFresh({ channelTypes: ["phone"] })` BEFORE the sync
+ * resolve so an inbound guardian call classifies as `guardian` rather than
+ * misclassifying during a gateway verdict blip. It reads FRESH because gateway-
+ * side binding writes don't invalidate the daemon cache: a stale empty snapshot
+ * from an earlier setup would otherwise survive the TTL.
+ *
+ * This test drives the REAL guardian-delivery reader cache (mocking only the
+ * gateway `ipcCall`) so the cold→warm transition is exercised end to end.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const GUARDIAN_PHONE = "+15550100";
+
+// Gateway IPC stub: returns the phone guardian delivery. The real reader caches
+// the result under the `phone` key, so a subsequent sync `peek` finds it. When
+// `guardianBound` is false the gateway reports no guardian — simulating the
+// pre-binding state whose empty result the cache would otherwise pin.
+let guardianBound = true;
+let ipcCalls: Array<{ route: string; input: unknown }> = [];
+mock.module("../ipc/gateway-client.js", () => ({
+  ipcCall: async (route: string, input: unknown) => {
+    ipcCalls.push({ route, input });
+    return {
+      guardians: guardianBound
+        ? [
+            {
+              channelType: "phone",
+              contactId: "guardian-contact",
+              principalId: "P_GUARDIAN_COLD",
+              address: GUARDIAN_PHONE,
+              externalChatId: null,
+              status: "active",
+            },
+          ]
+        : [],
+    };
+  },
+}));
+
+// Member lookup is irrelevant to guardian classification (address match on the
+// cached delivery decides it); return null so the member path is a no-op.
+mock.module("../contacts/contact-store.js", () => ({
+  findContactByAddress: () => null,
+}));
+
+import {
+  __resetGuardianDeliveryCacheForTest,
+  getGuardianDelivery,
+  getGuardianDeliveryFresh,
+  peekCachedGuardianDelivery,
+} from "../contacts/guardian-delivery-reader.js";
+import { resolveActorTrust } from "../runtime/actor-trust-resolver.js";
+
+describe("voice path warms the phone guardian cache before sync trust", () => {
+  beforeEach(() => {
+    __resetGuardianDeliveryCacheForTest();
+    ipcCalls = [];
+    guardianBound = true;
+  });
+
+  test("cold phone cache: guardian call misclassifies until upstream warm", async () => {
+    // Precondition: cold cache for phone — the sync peek would miss.
+    expect(
+      peekCachedGuardianDelivery({ channelTypes: ["phone"] }),
+    ).toBeUndefined();
+
+    // Sync resolve on a cold cache: no guardian snapshot → classified unknown.
+    const cold = resolveActorTrust({
+      assistantId: "asst-1",
+      sourceChannel: "phone",
+      conversationExternalId: GUARDIAN_PHONE,
+      actorExternalId: GUARDIAN_PHONE,
+    });
+    expect(cold.trustClass).toBe("unknown");
+
+    // The voice setup path warms the phone-specific key via the fresh reader.
+    await getGuardianDeliveryFresh({ channelTypes: ["phone"] });
+    expect(
+      ipcCalls.some(
+        (c) =>
+          c.route === "resolve_guardian_delivery" &&
+          JSON.stringify(c.input) ===
+            JSON.stringify({ channelTypes: ["phone"] }),
+      ),
+    ).toBe(true);
+
+    // The sync resolve, reading the now-warm snapshot, classifies the caller as
+    // the guardian — not misclassified as `unknown`.
+    const warm = resolveActorTrust({
+      assistantId: "asst-1",
+      sourceChannel: "phone",
+      conversationExternalId: GUARDIAN_PHONE,
+      actorExternalId: GUARDIAN_PHONE,
+    });
+    expect(warm.trustClass).toBe("guardian");
+  });
+
+  test("fresh warm bypasses a stale empty phone snapshot after a gateway-side binding", async () => {
+    // An earlier setup cached an empty phone snapshot (no guardian yet). Gateway-
+    // side binding writes don't invalidate the daemon cache, so the entry stays
+    // warm-but-stale until the TTL.
+    guardianBound = false;
+    await getGuardianDelivery({ channelTypes: ["phone"] });
+    expect(peekCachedGuardianDelivery({ channelTypes: ["phone"] })).toEqual([]);
+
+    // Guardian binding now exists gateway-side. A non-force read would still
+    // return the pinned empty snapshot; the fresh read bypasses it.
+    guardianBound = true;
+    expect(await getGuardianDelivery({ channelTypes: ["phone"] })).toEqual([]);
+    await getGuardianDeliveryFresh({ channelTypes: ["phone"] });
+
+    // The sync resolve now reads the refreshed snapshot and classifies guardian.
+    const warm = resolveActorTrust({
+      assistantId: "asst-1",
+      sourceChannel: "phone",
+      conversationExternalId: GUARDIAN_PHONE,
+      actorExternalId: GUARDIAN_PHONE,
+    });
+    expect(warm.trustClass).toBe("guardian");
+  });
+
+  test("startup vellum-only warm leaves the phone key cold", async () => {
+    // Daemon startup warms only `vellum`; that must not populate the `phone` key.
+    await getGuardianDelivery({ channelTypes: ["vellum"] });
+    expect(
+      peekCachedGuardianDelivery({ channelTypes: ["phone"] }),
+    ).toBeUndefined();
+  });
+});