@vellumai/assistant 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/calls/media-stream-server.ts

@@ -41,14 +41,10 @@
 import type { ServerWebSocket } from "bun";
 
 import { revokeScopedApprovalGrantsForContext } from "../approvals/scoped-approval-grants.js";
-import {
-  getGuardianDelivery,
-  getGuardianDeliveryFresh,
-  voiceGuardianDisplayName,
-} from "../contacts/guardian-delivery-reader.js";
 import { getAssistantName } from "../daemon/identity-helpers.js";
 import { addMessage } from "../persistence/conversation-crud.js";
 import { resolveGuardianName } from "../prompts/user-reference.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getLogger } from "../util/logger.js";
 import { CallController } from "./call-controller.js";
 import {
@@ -57,7 +53,11 @@ import {
 } from "./call-pointer-messages.js";
 import { CallSetupFlow, type CallSetupFlowDeps } from "./call-setup-flow.js";
 import type { SetupFlowResult } from "./call-setup-flow-types.js";
-import { routeSetup } from "./call-setup-router.js";
+import {
+  routeSetup,
+  type SetupOutcome,
+  type SetupResolved,
+} from "./call-setup-router.js";
 import { speakSystemPrompt } from "./call-speech-output.js";
 import {
   fireCallTranscriptNotifier,
@@ -70,9 +70,8 @@ import {
   recordCallEvent,
   updateCallSession,
 } from "./call-store.js";
-import { getChannelAdmissionPolicy } from "./channel-admission-reader.js";
 import { finalizeCall } from "./finalize-call.js";
-import { getPhoneCallerVerdict } from "./inbound-trust-reader.js";
+import { readPhoneCallerTrust } from "./inbound-trust-reader.js";
 import { MediaStreamOutput } from "./media-stream-output.js";
 import { parseMediaStreamFrame } from "./media-stream-parser.js";
 import type { MediaStreamStartEvent } from "./media-stream-protocol.js";
@@ -81,6 +80,10 @@ import {
   type MediaStreamSttSessionCallbacks,
   type MediaStreamSttSessionConfig,
 } from "./media-stream-stt-session.js";
+import {
+  TRUST_UNAVAILABLE_DENY_MESSAGE,
+  unresolvedActorTrust,
+} from "./unresolved-caller-trust.js";
 
 const log = getLogger("media-stream-server");
 const UUID_SHAPED_NAME =
@@ -102,6 +105,32 @@ function resolveAssistantLabel(): string | null {
   }
 }
 
+/**
+ * Deny routing for an inbound call whose combined trust-verdict +
+ * admission-floor read failed (gateway unreachable / malformed answer).
+ * Mirrors the router's floor-deny outcome shape so the setup flow runs the
+ * standard deny teardown (denial copy + hangup). Trust is stamped `unknown`
+ * via the shared builder: with no gateway answer the caller cannot be vetted.
+ */
+function admissionUnavailableDeny(otherPartyNumber: string): {
+  outcome: SetupOutcome;
+  resolved: SetupResolved;
+} {
+  return {
+    outcome: {
+      action: "deny",
+      message: TRUST_UNAVAILABLE_DENY_MESSAGE,
+      logReason: "Inbound voice admission floor: gateway unreachable",
+    },
+    resolved: {
+      assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
+      isInbound: true,
+      otherPartyNumber,
+      actorTrust: unresolvedActorTrust(otherPartyNumber),
+    },
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Active sessions registry (keyed by callSessionId)
 // ---------------------------------------------------------------------------
@@ -133,22 +162,23 @@ export class MediaStreamCallSession {
    * instead of the controller while set.
    */
   private setupFlow: CallSetupFlow | null = null;
-  /** Guardian displayName primed from the gateway binding during setup. */
+  /** Guardian displayName primed from the setup trust verdict. */
   private primedGuardianDisplayName: string | undefined;
   private streamSid: string | null = null;
   private callSid: string | null = null;
   private disposed = false;
   // True from the synchronous start of handleStart until setup routing
-  // completes. Resolving the admission floor yields the event loop, so
-  // transcripts/barge-in arriving in this window are ignored — a denied or
-  // not-yet-authorized caller's speech is never persisted before the floor
-  // and trust ACL are applied. The controller-existence checks below also
-  // gate persistence, but this guard makes the intent explicit and covers
-  // the brief async window before the controller is created.
+  // completes. Resolving the trust verdict + admission floor yields the
+  // event loop, so transcripts/barge-in arriving in this window are ignored
+  // — a denied or not-yet-authorized caller's speech is never persisted
+  // before the floor and trust ACL are applied. The controller-existence
+  // checks below also gate persistence, but this guard makes the intent
+  // explicit and covers the brief async window before the controller is
+  // created.
   private setupRouting = false;
   // Resolves when the async setup routing kicked off by the `start` frame
   // settles. Exposed via whenSetupSettled() for deterministic test awaiting,
-  // since handleStart now yields on the admission-policy read.
+  // since handleStart yields on the gateway trust read.
   private setupSettled: Promise<void> = Promise.resolve();
 
   // ── Operational diagnostics counters ──────────────────────────────
@@ -229,16 +259,13 @@ export class MediaStreamCallSession {
     // Intercept `start` to bootstrap the session before forwarding.
     const parseResult = parseMediaStreamFrame(raw);
     if (parseResult.ok && parseResult.event.event === "start") {
-      // handleStart resolves the admission floor asynchronously; the
-      // setupRouting guard set synchronously at its top ensures inbound
-      // frames forwarded below are ignored until routing completes.
-      this.setupSettled = this.handleStart(parseResult.event).catch((err) => {
-        log.error(
-          { err, callSessionId: this.callSessionId },
-          "Media-stream setup routing failed",
-        );
-        this.setupRouting = false;
-      });
+      // handleStart resolves the trust verdict + admission floor
+      // asynchronously; the setupRouting guard set synchronously at its top
+      // ensures inbound frames forwarded below are ignored until routing
+      // completes.
+      this.setupSettled = this.handleStart(parseResult.event).catch((err) =>
+        this.handleSetupFailure(err),
+      );
     }
 
     // Always forward to the STT session (it handles all event types).
@@ -378,7 +405,7 @@ export class MediaStreamCallSession {
 
   private async handleStart(event: MediaStreamStartEvent): Promise<void> {
     // Enter the setup-pending window synchronously, before any await. The
-    // admission-policy read below yields the event loop, so frames forwarded
+    // gateway trust read below yields the event loop, so frames forwarded
     // to the STT session can produce transcripts/barge-in before routing
     // completes — those are dropped while setupRouting is true.
     this.setupRouting = true;
@@ -421,60 +448,61 @@ export class MediaStreamCallSession {
     // transport.
     const from = session?.fromNumber ?? "";
     const to = session?.toNumber ?? "";
-
-    // Resolve the phone channel's inbound admission floor so the trust floor
-    // (e.g. guardian_only) is enforced on this transport too — not just the
-    // gateway webhook's no_one kill switch. The reader fails open to `null`
-    // by contract, so a transport hiccup admits the caller.
-    //
-    // Concurrently, prime the guardian displayName used by setup-flow copy
-    // and warm the phone-channel guardian-delivery cache for routeSetup's
-    // SYNC resolveActorTrust fallback (gateway-side binding writes don't
-    // invalidate the daemon cache, so read fresh). All three are independent
-    // IPC reads on different cache keys.
-    const [admissionPolicy] = await Promise.all([
-      getChannelAdmissionPolicy("phone"),
-      this.primeGuardianDisplayName(),
-      getGuardianDeliveryFresh({ channelTypes: ["phone"] }),
-    ]);
-
-    // The admission-policy read above yields the event loop; if Twilio closed
-    // the WebSocket meanwhile, the close handler will have called destroy().
-    // Abort setup so we don't create a controller or speak on a disposed
-    // session.
-    if (this.abortIfDisposed("admission read")) {
-      return;
-    }
-
-    // Verdict-first caller trust so this transport enforces the gateway
-    // ACL. routeSetup uses it when present and not resolutionFailed, else
-    // falls back to local resolution. The reader returns null on failure,
-    // keeping the local path on a gateway blip.
     const isInbound = session?.initiatedFromConversationId == null;
     const otherPartyNumber = isInbound ? from : to;
-    const verdict = await getPhoneCallerVerdict(otherPartyNumber);
 
-    // The verdict read above yields the event loop; abort if the session was
-    // disposed meanwhile, matching the admission-read guard above.
-    if (this.abortIfDisposed("verdict read")) {
+    // Single gateway round-trip for caller trust: the verdict (this
+    // transport's sole caller-trust source) rides with the phone channel's
+    // inbound admission floor, so the trust floor (e.g. guardian_only) is
+    // enforced here too — not just the gateway webhook's no_one kill switch.
+    // The read fails closed: an unreachable gateway denies inbound setup
+    // below rather than admitting unvetted callers past the floor.
+    const trustRead = await readPhoneCallerTrust(otherPartyNumber);
+
+    // The trust read above yields the event loop; if Twilio closed the
+    // WebSocket meanwhile, the close handler will have called destroy().
+    // Abort setup so we don't create a controller or speak on a disposed
+    // session.
+    if (this.abortIfDisposed("trust read")) {
       return;
     }
 
-    const { outcome, resolved } = await routeSetup({
-      callSessionId: this.callSessionId,
-      session: session ?? null,
-      from,
-      to,
-      customParameters: event.start.customParameters,
-      admissionPolicy,
-      verdict,
-    });
+    let routed: { outcome: SetupOutcome; resolved: SetupResolved };
+    if (isInbound && !trustRead.ok) {
+      // Fail closed: with no gateway answer neither the floor nor the caller
+      // trust can be resolved, so the caller cannot be vetted.
+      log.warn(
+        { callSessionId: this.callSessionId, from },
+        "Inbound voice trust/admission read unavailable — denying call setup",
+      );
+      routed = admissionUnavailableDeny(otherPartyNumber);
+    } else {
+      // Guardian displayName for setup-flow copy comes off the verdict (the
+      // gateway stamps the channel's guardian binding label independent of
+      // who is calling); absent → the default guardian reference.
+      const verdict = trustRead.ok ? trustRead.verdict : null;
+      this.primedGuardianDisplayName = verdict?.guardianDisplayName;
+
+      // routeSetup fails closed on a missing/failed verdict (inbound deny,
+      // outbound setup-failure teardown). Outbound calls never consult
+      // admission, so a failed read degrades to a null policy here.
+      routed = await routeSetup({
+        callSessionId: this.callSessionId,
+        session: session ?? null,
+        from,
+        to,
+        customParameters: event.start.customParameters,
+        admissionPolicy: trustRead.ok ? trustRead.admissionPolicy : null,
+        verdict,
+      });
 
-    // routeSetup can yield the event loop (gateway voice-invite read); abort
-    // if the session was disposed meanwhile, matching the guards above.
-    if (this.abortIfDisposed("setup routing")) {
-      return;
+      // routeSetup can yield the event loop (gateway voice-invite read); abort
+      // if the session was disposed meanwhile, matching the guard above.
+      if (this.abortIfDisposed("setup routing")) {
+        return;
+      }
     }
+    const { outcome, resolved } = routed;
 
     log.info(
       {
@@ -517,6 +545,61 @@ export class MediaStreamCallSession {
     return true;
   }
 
+  /**
+   * Fail-loud teardown when setup routing rejects (outbound unusable-verdict
+   * abort, gateway pending-session/invite read throw). Without this the call
+   * stays connected with no flow or controller — a live silent line whose
+   * transcripts are dropped. Mirrors the abnormal-close teardown: mark the
+   * session failed, notify the initiating conversation, end the stream, and
+   * finalize.
+   */
+  private handleSetupFailure(err: unknown): void {
+    log.error(
+      { err, callSessionId: this.callSessionId },
+      "Media-stream setup routing failed — ending call",
+    );
+    this.setupRouting = false;
+
+    // Transport already closed mid-setup: handleTransportClosed ran teardown.
+    if (this.disposed) {
+      return;
+    }
+
+    const flow = this.setupFlow;
+    this.setupFlow = null;
+    flow?.dispose("teardown");
+
+    const session = getCallSession(this.callSessionId);
+    if (session && !isTerminalState(session.status)) {
+      const detail = err instanceof Error ? err.message : String(err);
+      updateCallSession(this.callSessionId, {
+        status: "failed",
+        endedAt: Date.now(),
+        lastError: `Call setup failed: ${detail}`,
+      });
+      recordCallEvent(this.callSessionId, "call_failed", {
+        reason: "setup_routing_failed",
+        transport: "media-stream",
+      });
+      if (session.initiatedFromConversationId) {
+        postPointerMessageSafe(
+          session.initiatedFromConversationId,
+          "failed",
+          session.toNumber,
+          { reason: "call setup failed" },
+        );
+      }
+    }
+
+    // The terminal status set above makes handleTransportClosed exit early
+    // on the socket close, so finalize + revoke grants inline (exactly-once
+    // guarded by the flow's own finalization).
+    this.output.endSession("setup-failed");
+    if (!flow?.hasFinalized()) {
+      this.runFinalizationAndGrantCleanup(session);
+    }
+  }
+
   /**
    * Real side-effect surface for the {@link CallSetupFlow}. Pure-logic
    * deps (code validation, invite redemption, guardian notification,
@@ -609,16 +692,6 @@ export class MediaStreamCallSession {
       });
   }
 
-  /**
-   * Prime the guardian displayName from the gateway binding so the
-   * synchronous setup-flow label path can read it without an IPC
-   * round-trip.
-   */
-  private async primeGuardianDisplayName(): Promise<void> {
-    const list = await getGuardianDelivery();
-    this.primedGuardianDisplayName = voiceGuardianDisplayName(list);
-  }
-
   // ── Finalization helpers for early-teardown paths ─────────────────
 
   /**

package/src/calls/media-stream-stt-session.ts

@@ -400,6 +400,7 @@ export class MediaStreamSttSession {
       transcriber = await resolveStreamingTranscriber({
         sampleRate: STREAMING_SAMPLE_RATE,
         utteranceBoundaryFinals: true,
+        utteranceEndMs: getConfig().calls.voice.utteranceEndMs,
       });
     } catch (err) {
       log.warn(

package/src/calls/resolve-call-tts-provider.ts

@@ -16,6 +16,7 @@ import {
 import { resolveTtsConfig } from "../tts/tts-config-resolver.js";
 import type { TtsProvider, TtsProviderId } from "../tts/types.js";
 import { getLogger } from "../util/logger.js";
+import type { CallAudioFormat } from "./audio-store.js";
 import {
   evaluateTelephonyTtsPlayability,
   fishAudioReferenceIdConfigured,
@@ -43,7 +44,7 @@ export interface ResolvedCallTts {
   useSynthesizedPath: boolean;
 
   /** Audio format to use for synthesized audio. */
-  audioFormat: "mp3" | "wav" | "opus";
+  audioFormat: CallAudioFormat;
 }
 
 // ---------------------------------------------------------------------------
@@ -52,18 +53,17 @@ export interface ResolvedCallTts {
 
 export interface ResolveCallTtsOptions {
   /**
-   * When true, force `audioFormat` to `"wav"` regardless of the
+   * When true, resolve `audioFormat` to `"pcm"` regardless of the
    * provider's configured format. The media-stream transport sets this
-   * because its {@link audioBufferToFrames} can only correctly
-   * transcode WAV (PCM) to mu-law -- compressed formats (mp3, opus)
-   * are sent as raw bytes and produce garbled audio.
+   * because it transcodes raw PCM to mu-law -- compressed formats
+   * (mp3, opus) are sent as raw bytes and produce garbled audio.
    *
    * Also gates the media-stream playability guard: a configured provider
-   * that cannot produce playable PCM/WAV audio (or lacks credentials) is
+   * that cannot produce playable PCM audio (or lacks credentials) is
    * swapped for a playable fallback provider instead of resolving into a
    * provider whose only possible media-stream outcome is silence.
    */
-  preferWav?: boolean;
+  requiresPcmAudio?: boolean;
 }
 
 // ---------------------------------------------------------------------------
@@ -80,8 +80,8 @@ export interface ResolveCallTtsOptions {
  * `callMode: "native-twilio"` send text via `sendTextToken`, which the
  * media-stream transport re-synthesizes through daemon TTS.
  *
- * For WAV-requiring transports (`preferWav`, i.e. media-stream), the
- * resolved provider is validated against the media-stream playability
+ * For PCM-requiring transports (`requiresPcmAudio`, i.e. media-stream),
+ * the resolved provider is validated against the media-stream playability
  * capability (format + credentials); a not-playable provider is replaced
  * by {@link findPlayableTelephonyTtsFallback}.
  *
@@ -108,9 +108,9 @@ export async function resolveCallTtsProvider(
     const fishAudioUnusable =
       providerId === "fish-audio" && !fishAudioReferenceIdConfigured();
 
-    if (options?.preferWav) {
+    if (options?.requiresPcmAudio) {
       // Media-stream transport: every spoken turn is synthesized, so the
-      // provider must produce playable PCM/WAV with resolvable credentials
+      // provider must produce playable PCM with resolvable credentials
       // and satisfied config invariants (the capability check covers the
       // fish-audio referenceId rule). Swap in a playable fallback rather
       // than resolving into a provider that can only be silent.
@@ -134,7 +134,7 @@ export async function resolveCallTtsProvider(
         }
       }
     } else if (useSynthesizedPath && fishAudioUnusable) {
-      // Non-WAV transport: degrade to the native token path rather than
+      // Non-PCM transport: degrade to the native token path rather than
       // letting the call stay silent.
       log.warn(
         { provider: providerId },
@@ -149,10 +149,11 @@ export async function resolveCallTtsProvider(
     // config so the streaming store entry's content-type matches the
     // actual audio bytes the provider produces.
     //
-    // When preferWav is set (media-stream transport), force WAV so
-    // audioBufferToFrames receives PCM it can transcode to mu-law.
-    const audioFormat: "mp3" | "wav" | "opus" = options?.preferWav
-      ? "wav"
+    // When requiresPcmAudio is set (media-stream transport), resolve to
+    // PCM so audioBufferToFrames receives raw PCM it can transcode to
+    // mu-law.
+    const audioFormat: CallAudioFormat = options?.requiresPcmAudio
+      ? "pcm"
       : (() => {
           const configuredFormat = (
             resolved.providerConfig as { format?: string }
@@ -162,7 +163,7 @@ export async function resolveCallTtsProvider(
             ["mp3", "wav", "opus"].includes(configuredFormat)
               ? configuredFormat
               : "mp3"
-          ) as "mp3" | "wav" | "opus";
+          ) as Exclude<CallAudioFormat, "pcm">;
         })();
 
     return { provider, useSynthesizedPath, audioFormat };
@@ -174,6 +175,28 @@ export async function resolveCallTtsProvider(
   }
 }
 
+/**
+ * Decode a resolved call audio format into the provider request format
+ * and the audio-store format.
+ *
+ * Transport-forced PCM and user-configured WAV both request raw PCM from
+ * the provider so the audio bytes match the store's content-type —
+ * without this, providers like Fish Audio still return mp3 and the
+ * downstream mu-law transcoder fails on the format mismatch. The store
+ * format follows the request: when raw PCM is requested the entry's
+ * content-type must be audio/pcm, otherwise the store would say
+ * "audio/wav" while the bytes have no RIFF header and
+ * audioBufferToFrames falls through to the wrong decode path.
+ */
+export function resolveSynthesisFormats(format: CallAudioFormat): {
+  outputFormat: "pcm" | undefined;
+  storeFormat: CallAudioFormat;
+} {
+  const outputFormat =
+    format === "pcm" || format === "wav" ? ("pcm" as const) : undefined;
+  return { outputFormat, storeFormat: outputFormat ?? format };
+}
+
 /**
  * Find a catalog provider that can produce playable media-stream audio
  * with resolvable credentials.
@@ -199,3 +222,23 @@ export async function findPlayableTelephonyTtsFallback(
   }
   return null;
 }
+
+/**
+ * Resolve {@link findPlayableTelephonyTtsFallback} to a registered
+ * provider instance. Returns `null` when no playable fallback exists or
+ * the winning candidate is not registered in the provider registry.
+ * Callers own retry semantics and logging.
+ */
+export async function findPlayableTelephonyTtsFallbackProvider(
+  excludeProviderId?: string,
+): Promise<TtsProvider | null> {
+  const fallbackId = await findPlayableTelephonyTtsFallback(excludeProviderId);
+  if (!fallbackId) {
+    return null;
+  }
+  try {
+    return getTtsProvider(fallbackId);
+  } catch {
+    return null;
+  }
+}

package/src/calls/telephony-tts-capability.ts

@@ -4,9 +4,9 @@
  * Validates whether a TTS provider can produce audio that is actually
  * playable over the media-stream call transport. Playability requires:
  *
- * 1. The catalog entry's `mediaStreamPlayback.outputFormat` is `"pcm"` or
- *    `"wav"` — the media-stream mu-law transcoder cannot decode compressed
- *    formats (mp3, opus).
+ * 1. The catalog entry's `mediaStreamPlayback.outputFormat` is `"pcm"` —
+ *    the media-stream mu-law transcoder cannot decode compressed formats
+ *    (mp3, opus).
  * 2. Every secret the catalog entry requires resolves to a value.
  * 3. Provider-specific config invariants hold — Fish Audio requires a
  *    configured `referenceId` (no per-request voiceId is supplied on the
@@ -65,7 +65,7 @@ export type TelephonyTtsCapability =
  * the media-stream call transport.
  *
  * Callers can branch on the discriminated `status` field:
- * - `"playable"` — the provider produces PCM/WAV and credentials resolve.
+ * - `"playable"` — the provider produces PCM and credentials resolve.
  * - `"not-playable"` — see `reason` (`"unsupported-format"` when the
  *   provider is unknown or only produces compressed audio,
  *   `"missing-credentials"` when a required secret does not resolve,
@@ -103,7 +103,7 @@ export async function evaluateTelephonyTtsPlayability(
   }
 
   for (const secret of entry.secretRequirements) {
-    if (!(await secretResolves(secret.credentialStoreKey))) {
+    if (!(await ttsSecretResolves(secret.credentialStoreKey))) {
       return {
         status: "not-playable",
         providerId: entry.id,
@@ -129,7 +129,7 @@ export async function evaluateTelephonyTtsPlayability(
  * Single source of truth for the fish-audio usability invariant: the
  * telephony path supplies no per-request voiceId, so synthesis requires a
  * configured reference ID. Shared by {@link evaluateTelephonyTtsPlayability}
- * and the call TTS resolver's non-WAV degrade path.
+ * and the call TTS resolver's non-PCM (native token) degrade path.
  *
  * When fish-audio is the active `services.tts.provider`, its config is
  * read through the {@link resolveTtsConfig} provider-options layer — the
@@ -159,18 +159,18 @@ export function fishAudioReferenceIdConfigured(): boolean {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
-
 /**
- * Check whether a catalog `credentialStoreKey` resolves to a value.
+ * Check whether a TTS catalog `credentialStoreKey` resolves to a value.
  *
  * API keys (`credential/{service}/api_key` or a bare service name) go
  * through `getProviderKeyAsync` so env-var-only setups are honoured;
- * other namespaced fields are looked up verbatim.
+ * other namespaced fields are looked up verbatim. Shared by
+ * {@link evaluateTelephonyTtsPlayability} and the live-voice credential
+ * preflight.
  */
-async function secretResolves(credentialStoreKey: string): Promise<boolean> {
+export async function ttsSecretResolves(
+  credentialStoreKey: string,
+): Promise<boolean> {
   const parts = credentialStoreKey.split("/");
   if (parts.length === 1) {
     return Boolean(await getProviderKeyAsync(credentialStoreKey));

package/src/calls/tts-text-sanitizer.ts

@@ -55,9 +55,11 @@ export function sanitizeForTts(text: string): string {
   result = result.replace(/^[-*]\s+/gm, "");
 
   // 7. Italic: *text* or _text_ → text
-  //    Word-boundary-aware to preserve arithmetic like `5 * 3` and identifiers like `my_var`.
-  result = result.replace(/(?<!\w)\*([^*]+)\*(?!\w)/g, "$1");
-  result = result.replace(/(?<!\w)_([^_]+)_(?!\w)/g, "$1");
+  //    Word-boundary-aware with non-whitespace content edges, so arithmetic
+  //    like `5 * 3 and 4 * 2` and identifiers like `my_var` survive. Mirrors
+  //    the open-span rule in tts/speakable-segments.ts.
+  result = result.replace(/(?<!\w)\*([^\s*](?:[^*]*[^\s*])?)\*(?!\w)/g, "$1");
+  result = result.replace(/(?<!\w)_([^\s_](?:[^_]*[^\s_])?)_(?!\w)/g, "$1");
 
   // 8. Emojis: strip extended pictographic characters, variation selectors,
   //    zero-width joiners, skin tone modifiers, and regional indicator symbols (flags).

package/src/calls/unresolved-caller-trust.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared fail-closed deny pieces for an inbound caller the gateway could not
+ * vouch for — an unreachable gateway (media-stream server) or an unusable
+ * trust verdict (setup router). Both deny lanes speak the same copy and stamp
+ * the same unknown-trust context.
+ */
+
+import type { ActorTrustContext } from "../runtime/actor-trust-resolver.js";
+
+/** Single user-facing copy for the gateway-unavailable inbound deny. */
+export const TRUST_UNAVAILABLE_DENY_MESSAGE =
+  "The assistant is unable to take this call right now. Please try again later.";
+
+/**
+ * Minimal unknown-trust context for the fail-closed deny, where no verdict
+ * is available to build real trust from.
+ */
+export function unresolvedActorTrust(
+  otherPartyNumber: string,
+): ActorTrustContext {
+  return {
+    canonicalSenderId: otherPartyNumber || null,
+    guardianBindingMatch: null,
+    memberRecord: null,
+    trustClass: "unknown",
+    actorMetadata: {
+      identifier: otherPartyNumber || undefined,
+      displayName: undefined,
+      senderDisplayName: undefined,
+      memberDisplayName: undefined,
+      username: undefined,
+      channel: "phone",
+      trustStatus: "unknown",
+    },
+  };
+}