@vellumai/assistant 0.10.4-dev.202607012234.a9be056 → 0.10.4-dev.202607020106.aa66e63

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -77,6 +77,7 @@ export type { AdmissionPolicy } from "./admission-policy-contract.js";
 
 // Trust verdict contract (gateway → daemon) — Zod schemas + derived types
 export {
+  isTrustClass,
   makeResolutionFailedVerdict,
   ResolveInboundTrustRequestSchema,
   TRUST_CLASS_VALUES,

package/node_modules/@vellumai/gateway-client/src/trust-verdict-contract.ts

@@ -32,6 +32,18 @@ export const TrustClassSchema = z.enum(TRUST_CLASS_VALUES);
 
 export type TrustClass = (typeof TRUST_CLASS_VALUES)[number];
 
+const TRUST_CLASS_SET: ReadonlySet<string> = new Set(TRUST_CLASS_VALUES);
+
+/**
+ * Type guard for wire-sourced trust classes. Consumers receive verdicts over
+ * IPC/HTTP, so a field statically typed {@link TrustClass} can still carry an
+ * out-of-contract value (version skew, malformed payload); this narrows it
+ * safely without casting.
+ */
+export function isTrustClass(value: string): value is TrustClass {
+  return TRUST_CLASS_SET.has(value);
+}
+
 /**
  * Per-actor trust verdict resolved by the gateway from its ACL DB. ACL +
  * identity keys + minimal labels only. Guardian binding and member
@@ -42,9 +54,10 @@ export const TrustVerdictSchema = z.object({
   trustClass: TrustClassSchema,
   canonicalSenderId: z.string().nullable(),
 
-  // Present+true ⇒ gateway attempted resolution but failed (DB error);
-  // consumer treats it as "could not vouch", distinct from a real `unknown`
-  // stranger.
+  // Present+true ⇒ gateway attempted resolution but could not produce a
+  // usable verdict (DB error, or a sender who maps to the guardian contact
+  // whose principal is unresolved); consumer treats it as "could not vouch",
+  // distinct from a real `unknown` stranger.
   resolutionFailed: z.boolean().optional(),
 
   // Guardian binding — present only when a guardian binding matches.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.10.4-dev.202607012234.a9be056",
+  "version": "0.10.4-dev.202607020106.aa66e63",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/approval-interception-trust-gates.test.ts

@@ -24,8 +24,14 @@ mock.module("../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => _conversationMocks.get(id),
 }));
 
+// Anchored guardian principal, driven per-test to exercise the guardian
+// principal gate (undefined = anchor unresolvable).
+let _anchorPrincipalId: string | undefined;
+mock.module("../runtime/local-actor-identity.js", () => ({
+  findLocalGuardianPrincipalId: async () => _anchorPrincipalId,
+}));
+
 import type { Conversation } from "../daemon/conversation.js";
-import type { TrustContext } from "../daemon/trust-context.js";
 import { initializeDb } from "../persistence/db-init.js";
 import * as approvalMessageComposer from "../runtime/approval-message-composer.js";
 import * as gatewayClient from "../runtime/gateway-client.js";
@@ -76,6 +82,7 @@ describe("approval interception trust-class gates", () => {
 
   beforeEach(() => {
     pendingInteractions.clear();
+    _anchorPrincipalId = undefined;
     deliverSpy = spyOn(gatewayClient, "deliverChannelReply").mockResolvedValue({
       ok: true,
     });
@@ -105,7 +112,7 @@ describe("approval interception trust-class gates", () => {
         trustClass: "unknown",
         requesterExternalUserId: "intruder-user-1",
         guardianExternalUserId: "guardian-1",
-      } as TrustContext,
+      },
       assistantId: ASSISTANT_ID,
     });
 
@@ -117,6 +124,144 @@ describe("approval interception trust-class gates", () => {
     composeSpy.mockRestore();
   });
 
+  test("guardian apr: callback with a principal matching the anchor applies the decision", async () => {
+    _anchorPrincipalId = "guardian-principal-1";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-apply-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-apply-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+        guardianPrincipalId: "guardian-principal-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+  });
+
+  test("guardian apr: callback with a principal NOT matching the anchor is rejected before any decision", async () => {
+    _anchorPrincipalId = "the-real-guardian-principal";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-mismatch-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-mismatch-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "stale-guardian-user",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "stale-guardian-user",
+        guardianExternalUserId: "stale-guardian-user",
+        guardianPrincipalId: "some-other-principal",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("stale_ignored");
+    expect(sessionMock).not.toHaveBeenCalled();
+    // Generic failure copy — no oracle about pending requests or permission.
+    expect(deliverSpy).toHaveBeenCalledWith(
+      "https://gateway.test/deliver",
+      expect.objectContaining({
+        text: "Sorry, I couldn't process that. Please try again.",
+      }),
+    );
+  });
+
+  test("guardian without a resolved acting principal is rejected before any decision", async () => {
+    // Address-only guardian classification (e.g. a binding row with a null
+    // principal) must not authorize decisions.
+    _anchorPrincipalId = "the-real-guardian-principal";
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-no-principal-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-no-principal-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("stale_ignored");
+    expect(sessionMock).not.toHaveBeenCalled();
+  });
+
+  test("guardian decision defers to the verdict when the anchor read is unresolvable", async () => {
+    // Transient gateway miss on the anchor read: the gateway-stamped verdict
+    // (which already classified the actor guardian by principal) wins.
+    _anchorPrincipalId = undefined;
+    const sessionMock = registerPendingInteraction(
+      "req-guardian-anchor-miss-1",
+      CONVERSATION_ID,
+      TOOL_NAME,
+      TOOL_INPUT,
+    );
+
+    const result = await handleApprovalInterception({
+      conversationId: CONVERSATION_ID,
+      callbackData: "apr:req-guardian-anchor-miss-1:approve_once",
+      content: "",
+      conversationExternalId: REQUESTER_CHAT,
+      sourceChannel: "telegram",
+      actorExternalId: "guardian-user-1",
+      replyCallbackUrl: "https://gateway.test/deliver",
+      trustCtx: {
+        sourceChannel: "telegram",
+        trustClass: "guardian",
+        requesterExternalUserId: "guardian-user-1",
+        guardianExternalUserId: "guardian-user-1",
+        guardianPrincipalId: "guardian-principal-1",
+      },
+      assistantId: ASSISTANT_ID,
+    });
+
+    expect(result.handled).toBe(true);
+    expect(result.type).toBe("decision_applied");
+    expect(sessionMock).toHaveBeenCalled();
+  });
+
   test("unverified sender (no identity) auto-denies pending approval", async () => {
     const sessionMock = registerPendingInteraction(
       "req-unknown-auto-deny-1",
@@ -135,7 +280,7 @@ describe("approval interception trust-class gates", () => {
       trustCtx: {
         sourceChannel: "telegram",
         trustClass: "unknown",
-      } as TrustContext,
+      },
       assistantId: ASSISTANT_ID,
     });
 

package/src/__tests__/config-loader-backfill.test.ts

@@ -856,9 +856,9 @@ describe("loadConfig startup behavior", () => {
     );
     expect(raw.llm.profiles.balanced.effort).toBe("high");
     expect(raw.llm.profiles.balanced.source).toBe("managed");
-    // Quality serves Anthropic Opus, the most capable managed profile.
+    // Quality serves Anthropic Fable, the most capable managed profile.
     expect(raw.llm.profiles["quality-optimized"].provider).toBe("anthropic");
-    expect(raw.llm.profiles["quality-optimized"].model).toBe("claude-opus-4-8");
+    expect(raw.llm.profiles["quality-optimized"].model).toBe("claude-fable-5");
     // Speed is served by DeepSeek V4 Flash on Fireworks.
     expect(raw.llm.profiles["cost-optimized"].provider).toBe("fireworks");
     expect(raw.llm.profiles["cost-optimized"].model).toBe(
@@ -899,7 +899,7 @@ describe("loadConfig startup behavior", () => {
   test("reseed updates a source-less legacy canonical managed profile", () => {
     // Migration 052 seeded canonical profiles without a `source`. Such a
     // source-less `quality-optimized` is legacy managed, not user-owned, so it
-    // must still reseed to the latest template (Opus) and be tagged managed.
+    // must still reseed to the latest template (Fable) and be tagged managed.
     writeConfig({
       llm: {
         profiles: {
@@ -915,7 +915,7 @@ describe("loadConfig startup behavior", () => {
     mergeDefaultConfigAndSeedInferenceProfiles();
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
 
-    expect(raw.llm.profiles["quality-optimized"].model).toBe("claude-opus-4-8");
+    expect(raw.llm.profiles["quality-optimized"].model).toBe("claude-fable-5");
     expect(raw.llm.profiles["quality-optimized"].source).toBe("managed");
   });
 
@@ -1574,7 +1574,7 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
 
     expect(raw.llm.activeProfile).toBe("balanced");
-    // Balanced lives on `fireworks-managed`; `quality-optimized` (Opus on
+    // Balanced lives on `fireworks-managed`; `quality-optimized` (Fable on
     // `anthropic-managed`) is on a different connection, so selecting balanced at
     // hatch disables it. The default advisor falls to the only active managed
     // profile, `balanced`.