@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/plugins/mtime-cache.ts

@@ -22,7 +22,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
-import { registerShutdownHook } from "../daemon/shutdown-registry.js";
 import {
   clearPluginHooks,
   collectUserHooks,
@@ -35,7 +34,7 @@ import {
   runShutdownHook,
   WORKSPACE_HOOKS_OWNER,
 } from "../hooks/hook-loader.js";
-import type { HookFunction, ShutdownContext } from "../plugin-api/types.js";
+import type { HookFunction, ShutdownReason } from "../plugin-api/types.js";
 import {
   registerPluginTools,
   unregisterPluginTools,
@@ -178,12 +177,21 @@ const disabledPluginDirs = new Set<string>();
  * workspace hooks. Refreshes plugin discovery first, then delegates the actual
  * hook resolution to the hook loader. Plugin hooks run in install-date order,
  * the workspace hook runs last.
+ *
+ * `effectiveEnabledPlugins` carries the per-chat plugin scope: when non-null,
+ * user plugins outside the set are skipped (standalone workspace hooks always
+ * run). `null`/omitted means no per-chat restriction.
  */
 export async function getUserHooksFor<TCtx = unknown>(
   hookName: string,
+  effectiveEnabledPlugins?: Set<string> | null,
 ): Promise<HookFunction<TCtx>[]> {
   await scanPlugins();
-  return collectUserHooks<TCtx>(hookName, discoveredPluginDirs);
+  return collectUserHooks<TCtx>(
+    hookName,
+    discoveredPluginDirs,
+    effectiveEnabledPlugins,
+  );
 }
 
 // ─── Tool cache ──────────────────────────────────────────────────────────────
@@ -320,7 +328,7 @@ async function scanPlugins(): Promise<void> {
       const manifest = await parsePluginManifest(pluginDir);
       const pluginName = manifest?.name ?? entry;
       if (discoveredPluginDirs.has(pluginDir)) {
-        await deactivatePlugin(pluginName);
+        await deactivatePlugin(pluginName, "disable");
         await evictPlugin(pluginDir, pluginName);
       }
       if (!disabledPluginDirs.has(pluginDir)) {
@@ -351,7 +359,7 @@ async function scanPlugins(): Promise<void> {
   // Deactivate and evict cache entries for deleted plugins.
   for (const [pluginDir, pluginName] of discoveredPluginDirs) {
     if (!currentDirs.has(pluginDir)) {
-      await deactivatePlugin(pluginName);
+      await deactivatePlugin(pluginName, "uninstall");
       await evictPlugin(pluginDir, pluginName);
     }
   }
@@ -422,8 +430,10 @@ async function evictAll(): Promise<void> {
 
 /**
  * Plugins (and the workspace-hooks pseudo-owner) fully activated (tools
- * registered + `init` hook run) within this process, in activation order. The
- * process shutdown hook walks this list in reverse to tear everything down.
+ * registered + `init` hook run) within this process, in activation order. A
+ * runtime uninstall/disable tears a single entry down via
+ * {@link deactivatePlugin}; at daemon shutdown the owners' `shutdown` hooks
+ * fire through the unified `runHook(HOOKS.SHUTDOWN)` pipeline.
  */
 const activatedPlugins: Array<{ name: string }> = [];
 
@@ -436,16 +446,12 @@ const activatedPlugins: Array<{ name: string }> = [];
  */
 const activatedNames = new Set<string>();
 
-const shutdownContext: ShutdownContext = {
-  assistantVersion: APP_VERSION,
-};
-
 /**
  * Activate a single discovered plugin: pre-import its hooks, register its tools
  * into the global tool registry, and run its `init` hook. Idempotent — a plugin
  * already activated (or mid-activation) is skipped. Never throws; per-surface
  * failures are logged and the plugin still counts as activated so the shutdown
- * hook tears down whatever came up (mirrors boot semantics).
+ * teardown handles whatever came up (mirrors boot semantics).
  *
  * Called from `scanPlugins`, which runs both at boot and on every subsequent
  * scan — so a plugin whose files appear at runtime (installed via the CLI or
@@ -491,12 +497,16 @@ async function activatePlugin(
 }
 
 /**
- * Deactivate a plugin whose directory was removed or disabled at runtime:
- * unregister its tools and run its `shutdown` hook. Must run *before*
- * `evictPlugin` clears the hook cache, since the shutdown hook is read from it.
- * Idempotent — a plugin that was never activated is a no-op.
+ * Deactivate a plugin whose directory was removed (`uninstall`) or disabled
+ * (`disable`) at runtime: unregister its tools and run its `shutdown` hook with
+ * the matching {@link ShutdownReason}. Must run *before* `evictPlugin` clears
+ * the hook cache, since the shutdown hook is read from it. Idempotent — a plugin
+ * that was never activated is a no-op.
  */
-async function deactivatePlugin(pluginName: string): Promise<void> {
+async function deactivatePlugin(
+  pluginName: string,
+  reason: ShutdownReason,
+): Promise<void> {
   if (!activatedNames.has(pluginName)) return;
   activatedNames.delete(pluginName);
   const idx = activatedPlugins.findIndex((p) => p.name === pluginName);
@@ -513,7 +523,11 @@ async function deactivatePlugin(pluginName: string): Promise<void> {
     );
   }
 
-  await runShutdownHook(pluginName, shutdownContext, "plugin-removed");
+  await runShutdownHook(
+    pluginName,
+    { assistantVersion: APP_VERSION, reason },
+    reason,
+  );
 }
 
 // ─── Boot population ─────────────────────────────────────────────────────────
@@ -521,8 +535,10 @@ async function deactivatePlugin(pluginName: string): Promise<void> {
 /**
  * Populate the caches at boot by scanning the plugins directory once (which
  * imports surfaces, registers tools, and runs `init` hooks via `activatePlugin`
- * inside `scanPlugins`), activating standalone workspace hooks, and installing
- * the process shutdown hook.
+ * inside `scanPlugins`) and activating standalone workspace hooks. At daemon
+ * shutdown these owners' `shutdown` hooks fire through the unified
+ * `runHook(HOOKS.SHUTDOWN)` pipeline; a runtime uninstall/disable tears a single
+ * owner down via {@link deactivatePlugin}.
  *
  * This replaces the old `loadExternalPlugin` → `registerPlugin` →
  * `bootstrapPlugins` path for user plugins. Instead of registering whole
@@ -555,33 +571,6 @@ export async function populateCacheAtBoot(
     await runInitHook(WORKSPACE_HOOKS_OWNER);
     activatedPlugins.push({ name: WORKSPACE_HOOKS_OWNER });
   }
-
-  // Register a single shutdown hook that walks all activated owners in reverse
-  // order, unregistering tools and running shutdown hooks. It reads the live
-  // `activatedPlugins` array at teardown time, so plugins activated after boot
-  // (runtime installs) are torn down too.
-  registerShutdownHook("user-plugins", async (reason) => {
-    for (let i = activatedPlugins.length - 1; i >= 0; i--) {
-      const entry = activatedPlugins[i];
-      if (entry === undefined) continue;
-      const { name } = entry;
-
-      // Unregister tools before running shutdown so onShutdown sees a
-      // clean model-visible surface. (No-op for the workspace-hooks owner,
-      // which registers no tools.)
-      try {
-        unregisterPluginTools(name);
-      } catch (err) {
-        log.warn(
-          { err, plugin: name, reason },
-          "user plugin tool unregister failed (continuing)",
-        );
-      }
-
-      // Run the `shutdown` hook if present.
-      await runShutdownHook(name, shutdownContext, reason);
-    }
-  });
 }
 
 // ─── Test hooks ──────────────────────────────────────────────────────────────

package/src/plugins/pipeline.ts

@@ -107,6 +107,12 @@ function cloneHookValue<T>(value: T, seen = new WeakMap<object, unknown>()): T {
  * successfully committed context. The final context after the chain settles is
  * returned.
  *
+ * When `initialCtx` carries a `conversationId`, it is passed to
+ * {@link getHooksFor}, which resolves the conversation's per-chat plugin scope
+ * (memory, then DB) and skips a hook whose contributing plugin is outside the
+ * effective set. Contexts without a `conversationId` impose no restriction —
+ * every globally-enabled plugin's hook runs.
+ *
  * @param name        The hook identifier — pick one from {@link HOOKS}.
  * @param initialCtx  Context the first hook receives.
  * @returns The final context after the chain settles. Same reference as
@@ -116,9 +122,10 @@ export async function runHook<TCtx>(
   name: HookName,
   initialCtx: TCtx,
 ): Promise<TCtx> {
+  const conversationId = extractConversationId(initialCtx);
   let hooks: HookFunction<TCtx>[];
   try {
-    hooks = await getHooksFor<TCtx>(name);
+    hooks = await getHooksFor<TCtx>(name, { conversationId });
   } catch (err) {
     log.error(
       { err, hookName: name },
@@ -146,3 +153,10 @@ export async function runHook<TCtx>(
   }
   return active;
 }
+
+/** The `conversationId` off a hook context, when it carries one as a string. */
+function extractConversationId(ctx: unknown): string | undefined {
+  const conversationId = (ctx as { conversationId?: unknown } | null)
+    ?.conversationId;
+  return typeof conversationId === "string" ? conversationId : undefined;
+}

package/src/plugins/types.ts

@@ -48,13 +48,6 @@ export interface PluginManifest {
    * own version at load time.
    */
   version: string;
-  /**
-   * Assistant feature-flag keys that must all be enabled for this plugin to
-   * activate. Checked by `bootstrapPlugins` via `isAssistantFeatureFlagEnabled`
-   * — if any listed flag is disabled, the plugin is skipped entirely for the
-   * boot (no `init()`, no tool/route/skill contributions, no shutdown hook).
-   */
-  requiresFlag?: string[];
   /**
    * Zod-compatible validator (or any parser-like object) for the plugin's
    * config block under `plugins.<name>`. Typed as `unknown` here — concrete
@@ -71,6 +64,7 @@ export type {
   HookFunction,
   InitContext,
   ShutdownContext,
+  ShutdownReason,
 } from "../plugin-api/types.js";
 
 // ─── Memory-graph result ─────────────────────────────────────────────────────
@@ -143,6 +137,13 @@ export interface TurnContext {
   readonly timestamp?: string;
   /** Human-readable interface label (e.g. "vellum", "telegram"). */
   readonly interfaceName?: string;
+  /**
+   * Client OS surface ("web" | "ios" | "macos"), reported independently of
+   * the transport interface. Rendered as the `client_os:` line so the model
+   * knows the platform even though the web/iOS/macOS apps share one `"web"`
+   * transport interface.
+   */
+  readonly clientOs?: string;
   /** Channel label gating response-discretion guidance in `<turn_context>`. */
   readonly channelName?: string;
   /**
@@ -335,13 +336,12 @@ export interface Injector {
 export type PluginRouteRegistration = SkillRoute;
 
 /**
- * A single background-job-handler contribution: a job `type` string paired with
- * the {@link JobHandler} that processes it. Plugins contribute these via the
- * `jobHandlers` field; bootstrap registers them into the global job-handler
- * registry, and the general job worker's registration entry
- * (`jobs/register-job-handlers.ts`) forwards the union into the worker dispatch
- * table. `type` must be globally unique across every plugin — dispatch is a
- * keyed lookup. See `plugins/job-handler-registry.ts`.
+ * A single background-job-handler entry: a job `type` string paired with the
+ * {@link JobHandler} that processes it. The memory plugin's handler list
+ * (`plugins/defaults/memory/job-handlers.ts`) is an array of these, registered
+ * directly into the worker's dispatch table from the plugin's `init` hook.
+ * `type` must be globally unique across every registered handler — dispatch is a
+ * keyed lookup.
  */
 export interface JobHandlerEntry {
   /** The job-queue type string this handler processes (globally unique). */
@@ -400,15 +400,6 @@ export interface Plugin {
    * injectors sharing an `order`. See `plugins/injector-registry.ts`.
    */
   injectors?: readonly Injector[];
-  /**
-   * Background-job handlers contributed to the general job worker. Bootstrap
-   * registers these into the global job-handler registry before `init()` runs,
-   * symmetric with `tools`/`routes`/`injectors`; the general worker's
-   * registration entry (`jobs/register-job-handlers.ts`) forwards the union into
-   * the worker dispatch table. Each `type` must be globally unique across every
-   * plugin. See `plugins/job-handler-registry.ts`.
-   */
-  jobHandlers?: readonly JobHandlerEntry[];
 }
 
 // ─── Errors ──────────────────────────────────────────────────────────────────

package/src/prompts/__tests__/system-prompt.test.ts

@@ -8,7 +8,7 @@
 
 import { copyFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 const TEST_DIR = process.env.VELLUM_WORKSPACE_DIR!;
 
@@ -125,50 +125,188 @@ describe("buildSystemPrompt — persona override", () => {
   });
 });
 
-describe("buildSystemPrompt — hasNoClient pin", () => {
-  // Marker unique to the `{{^hasNoClient}}` branch of 05-access-preference:
-  // host fallbacks only render when a client is connected.
-  const WITH_CLIENT_MARKER = "`host_bash` with CLIs";
+describe("buildSystemPrompt — default persona trust-class guardrail", () => {
+  // Marker strings from the bundled users/default.md template.
+  const GUARDRAIL = "Protect your guardian's privacy";
+  const TRUSTED_GREETING = "You're talking with a trusted contact";
+  const STRANGER_GREETING = "You're talking with someone you don't recognize";
+
+  const templatesDir = join(import.meta.dirname!, "..", "templates");
+  let priorAuthEnv: string | undefined;
 
   beforeEach(() => {
-    mkdirSync(TEST_DIR, { recursive: true });
+    // Captured so the DISABLE_HTTP_AUTH regression test below can restore it.
+    priorAuthEnv = process.env.DISABLE_HTTP_AUTH;
+
+    mkdirSync(join(TEST_DIR, "users"), { recursive: true });
+    // Render the real shipped template, not a sentinel.
+    copyFileSync(
+      join(templatesDir, "users", "default.md"),
+      join(TEST_DIR, "users", "default.md"),
+    );
+  });
+
+  afterEach(() => {
+    if (priorAuthEnv === undefined) delete process.env.DISABLE_HTTP_AUTH;
+    else process.env.DISABLE_HTTP_AUTH = priorAuthEnv;
   });
 
-  test("hasNoClient renders divergent access-preference text", () => {
-    expect(buildSystemPrompt({ hasNoClient: false })).toContain(
-      WITH_CLIENT_MARKER,
+  test("stranger (unknown) sees the guardrail and the stranger greeting", () => {
+    const result = buildSystemPrompt({
+      trustContext: { sourceChannel: "slack", trustClass: "unknown" },
+    });
+
+    expect(result).toContain(GUARDRAIL);
+    expect(result).toContain(STRANGER_GREETING);
+    expect(result).not.toContain(TRUSTED_GREETING);
+  });
+
+  test("trusted contact sees the guardrail and the trusted greeting", () => {
+    const result = buildSystemPrompt({
+      trustContext: { sourceChannel: "slack", trustClass: "trusted_contact" },
+    });
+
+    expect(result).toContain(GUARDRAIL);
+    expect(result).toContain(TRUSTED_GREETING);
+    expect(result).not.toContain(STRANGER_GREETING);
+  });
+
+  test("unverified contact is framed like a trusted contact", () => {
+    const result = buildSystemPrompt({
+      trustContext: {
+        sourceChannel: "slack",
+        trustClass: "unverified_contact",
+      },
+    });
+
+    expect(result).toContain(GUARDRAIL);
+    expect(result).toContain(TRUSTED_GREETING);
+    expect(result).not.toContain(STRANGER_GREETING);
+  });
+
+  test("guardian trust class gates the whole default persona off", () => {
+    // A guardian normally renders their own users/<slug>.md; if they ever fall
+    // back to default.md, every section is gated off and nothing leaks.
+    const result = buildSystemPrompt({
+      trustContext: { sourceChannel: "vellum", trustClass: "guardian" },
+    });
+
+    expect(result).not.toContain(GUARDRAIL);
+    expect(result).not.toContain(TRUSTED_GREETING);
+    expect(result).not.toContain(STRANGER_GREETING);
+  });
+
+  test("renders for a non-guardian even when HTTP auth is disabled", () => {
+    // Platform-managed deployments run with DISABLE_HTTP_AUTH=true. A *present*
+    // trustContext must keep the actor's real class under that posture
+    // (resolveTrustClass only fail-safes *unresolved* actors), or the guardrail
+    // would silently switch off for the non-guardian channel actors it exists
+    // to protect.
+    process.env.DISABLE_HTTP_AUTH = "true";
+    const result = buildSystemPrompt({
+      trustContext: { sourceChannel: "slack", trustClass: "unknown" },
+    });
+
+    expect(result).toContain(GUARDRAIL);
+    expect(result).toContain(STRANGER_GREETING);
+  });
+
+  test("gates off for an unresolved local build when HTTP auth is disabled", () => {
+    // Initial-prompt warming, home generation, and btw sidechains build
+    // prompts with NO trustContext on behalf of the owner. In an auth-disabled
+    // (local / platform-managed) deployment that unresolved actor is the
+    // guardian, so the guardrail must not render into those guardian-facing
+    // prompts (fail-stranger would stonewall the owner about their own data).
+    process.env.DISABLE_HTTP_AUTH = "true";
+    const result = buildSystemPrompt({});
+
+    expect(result).not.toContain(GUARDRAIL);
+    expect(result).not.toContain(TRUSTED_GREETING);
+    expect(result).not.toContain(STRANGER_GREETING);
+  });
+
+  test("fails closed to the guardrail for an unresolved build when auth is enabled", () => {
+    // With auth enabled there is no basis to assume the unresolved actor is
+    // the guardian, so an unclassifiable build keeps the boundary.
+    delete process.env.DISABLE_HTTP_AUTH;
+    const result = buildSystemPrompt({});
+
+    expect(result).toContain(GUARDRAIL);
+    expect(result).toContain(STRANGER_GREETING);
+  });
+
+  test("boundary survives a per-contact persona file replacing default.md", () => {
+    // Every contact already has a `users/<slug>.md` filename reserved on
+    // their contact record; the moment that file exists with content it
+    // replaces `default.md` in the `10-user-persona` section. The privacy
+    // boundary must render regardless — it lives in the always-on
+    // `10a-non-guardian-boundary` section, not in the fallback file.
+    writeFileSync(
+      join(TEST_DIR, "users", "jane.md"),
+      "# Jane\n\nJane likes concise answers.\n",
+      "utf-8",
     );
-    expect(buildSystemPrompt({ hasNoClient: true })).not.toContain(
-      WITH_CLIENT_MARKER,
+    const result = buildSystemPrompt({
+      trustContext: { sourceChannel: "slack", trustClass: "trusted_contact" },
+      personaOverride: { userSlug: "jane" },
+    });
+
+    // The contact's own persona replaced the default greetings...
+    expect(result).toContain("Jane likes concise answers.");
+    expect(result).not.toContain(TRUSTED_GREETING);
+    // ...but the boundary still renders.
+    expect(result).toContain(GUARDRAIL);
+  });
+
+  test("boundary is omitted for a guardian rendering their own persona file", () => {
+    writeFileSync(
+      join(TEST_DIR, "users", "owner.md"),
+      "# Owner\n\nThe guardian's own profile.\n",
+      "utf-8",
     );
+    const result = buildSystemPrompt({
+      trustContext: { sourceChannel: "vellum", trustClass: "guardian" },
+      personaOverride: { userSlug: "owner" },
+    });
+
+    expect(result).toContain("The guardian's own profile.");
+    expect(result).not.toContain(GUARDRAIL);
+  });
+
+  test("never leaks literal mustache tags or comment lines", () => {
+    for (const trustClass of [
+      "unknown",
+      "trusted_contact",
+      "unverified_contact",
+      "guardian",
+    ] as const) {
+      const result = buildSystemPrompt({
+        trustContext: { sourceChannel: "slack", trustClass },
+      });
+      expect(result).not.toContain("{{");
+      expect(result).not.toContain("}}");
+      expect(result).not.toContain("Lines starting with");
+    }
+  });
+});
+
+describe("buildSystemPrompt — hasNoClient no longer affects the prompt", () => {
+  beforeEach(() => {
+    mkdirSync(TEST_DIR, { recursive: true });
   });
 
-  test("personaOverride.hasNoClient pins the flag over the conversation-derived option", () => {
-    // Fork-retrospective case: the fork is hydrated clientless
-    // (hasNoClient: true) but pins the source's live-turn value (false) so
-    // the prompt byte-matches the source's cached prefix.
+  // No system-prompt section branches on hasNoClient, so neither the flag nor
+  // the SystemPromptPersonaOverride.hasNoClient pin changes prompt output.
+  // Guards against a future section re-coupling to the flag.
+  test("output is identical regardless of the flag or its pin", () => {
+    const base = buildSystemPrompt({ hasNoClient: false });
+    expect(buildSystemPrompt({ hasNoClient: true })).toBe(base);
     expect(
       buildSystemPrompt({
         hasNoClient: true,
         personaOverride: { hasNoClient: false },
       }),
-    ).toContain(WITH_CLIENT_MARKER);
-    // And the pin wins in the other direction too.
-    expect(
-      buildSystemPrompt({
-        hasNoClient: false,
-        personaOverride: { hasNoClient: true },
-      }),
-    ).not.toContain(WITH_CLIENT_MARKER);
-  });
-
-  test("a personaOverride without the pin leaves the conversation-derived flag untouched", () => {
-    expect(
-      buildSystemPrompt({ hasNoClient: true, personaOverride: {} }),
-    ).not.toContain(WITH_CLIENT_MARKER);
-    expect(
-      buildSystemPrompt({ hasNoClient: false, personaOverride: {} }),
-    ).toContain(WITH_CLIENT_MARKER);
+    ).toBe(base);
   });
 });
 

package/src/prompts/persona-resolver.ts

@@ -91,7 +91,9 @@ function resolveGuardianUserFile(trustContext: TrustContext): string | null {
     }
   }
   const guardian = peekGuardianForChannel(trustContext.sourceChannel);
-  return guardian ? (guardianDeliveryUserFile(guardian) ?? "guardian.md") : null;
+  return guardian
+    ? (guardianDeliveryUserFile(guardian) ?? "guardian.md")
+    : null;
 }
 
 /**
@@ -103,10 +105,7 @@ function resolveGuardianUserFile(trustContext: TrustContext): string | null {
 function guardianDeliveryUserFile(
   guardian: GuardianDelivery,
 ): string | undefined {
-  const contact = findContactByAddress(
-    guardian.channelType,
-    guardian.address,
-  );
+  const contact = findContactByAddress(guardian.channelType, guardian.address);
   return contact?.userFile ?? undefined;
 }
 
@@ -147,13 +146,18 @@ function resolveUserFilename(
         trustContext.sourceChannel,
         trustContext.requesterExternalUserId,
       );
-      if (contactWithChannels) {
-        filename = contactWithChannels.userFile ?? null;
+      if (contactWithChannels?.userFile) {
+        filename = contactWithChannels.userFile;
       } else if (trustContext.trustClass === "guardian") {
         // Managed desktop: the JWT principal ID used as requesterExternalUserId
         // may differ from the contact channel's address (they are separate
-        // identity concepts). Read the guardian's user file keyed by the
-        // verdict-bound guardian identity.
+        // identity concepts) — OR the guardian's contact row exists but carries
+        // no explicit userFile yet (the normal post-hatch state, since the
+        // guardian contact is created with a null userFile and onboarding
+        // writes the file on disk, not the column). Either way, read the
+        // guardian's user file keyed by the verdict-bound guardian identity so
+        // the onboarding profile (written to guardian.md) loads instead of
+        // falling through to users/default.md.
         filename = resolveGuardianUserFile(trustContext);
       }
     } else if (trustContext.trustClass === "guardian") {

package/src/prompts/system-prompt.ts

@@ -10,8 +10,12 @@ import { join } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
 import type { ChannelCapabilities } from "../daemon/conversation-runtime-assembly.js";
-import type { TrustContext } from "../daemon/trust-context.js";
+import {
+  resolveTrustClass,
+  type TrustContext,
+} from "../daemon/trust-context.js";
 import { markActivationSession } from "../plugins/defaults/memory/activation-session-store.js";
+import { derivePersonaTrustFlags } from "../runtime/trust-class.js";
 import { ACTIVATION_RAIL_BOOTSTRAP_TEMPLATE } from "../telemetry/activation-funnel.js";
 import type { OnboardingContext } from "../types/onboarding-context.js";
 import { resolveBundledDir } from "../util/bundled-asset.js";
@@ -319,14 +323,12 @@ export interface SystemPromptPersonaOverride {
   /**
    * Pins the `hasNoClient` flag for the prompt build, taking precedence over
    * the top-level `BuildSystemPromptOptions.hasNoClient` (which mirrors the
-   * conversation's live client state). The `05-access-preference` section
-   * renders different text under the flag — early in the prompt, so a
-   * mismatch breaks byte-parity with a cached prefix even when persona and
-   * profile match. Used by fork-based memory retrospectives: the fork is
-   * hydrated clientless (`hasNoClient = true`) while the source's live turns
-   * ran under the source's own client state (`false` for interactive
-   * interfaces, `true` for channel-routed sources) — the pin carries that
-   * live-turn value.
+   * conversation's live client state). No system-prompt section branches on
+   * `hasNoClient`, so this pin does not affect prompt output; it is retained
+   * so fork-based memory retrospectives can thread the source conversation's
+   * live-turn value (`false` for interactive interfaces, `true` for
+   * channel-routed sources) through the build without depending on the fork's
+   * clientless hydration default.
    */
   hasNoClient?: boolean;
 }
@@ -395,6 +397,21 @@ export function buildSystemPrompt(options?: BuildSystemPromptOptions): string {
   const hasNoClient =
     options?.personaOverride?.hasNoClient ?? options?.hasNoClient;
 
+  // Trust flags for the current actor, lifted onto the render context so
+  // persona sections — notably `users/default.md`, the persona rendered for
+  // non-guardian actors — can gate privacy guardrails on who is being spoken
+  // to. The class is resolved through `resolveTrustClass` first: a *present*
+  // trustContext always keeps the actor's real class (a resolved non-guardian
+  // channel actor is never elevated, even under DISABLE_HTTP_AUTH), while an
+  // *absent* one follows the actor-resolution contract — guardian for
+  // local/native builds in an auth-disabled deployment (initial-prompt
+  // warming, home generation, and btw sidechains build prompts with no
+  // trustContext for the owner), unknown otherwise so an unclassifiable turn
+  // still fails closed to the guardrail. The flag grouping itself lives on
+  // {@link derivePersonaTrustFlags}.
+  const { trustClass, isGuardian, isTrustedContact, isStranger } =
+    derivePersonaTrustFlags(resolveTrustClass(options?.trustContext));
+
   // Section render context.  Workspace section frontmatter `enabled:`
   // predicates, `{{key}}` / `{{#flag}}...{{/flag}}` body interpolation,
   // and `{{key}}` paths inside `workspacePath` all resolve against this
@@ -411,6 +428,10 @@ export function buildSystemPrompt(options?: BuildSystemPromptOptions): string {
     workspaceDir: getWorkspaceDir(),
     userSlug,
     channelSlug,
+    trustClass,
+    isGuardian,
+    isTrustedContact,
+    isStranger,
   };
 
   // Every system-prompt block flows through the bundled section