@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/runtime/routes/gateway-status-routes.ts

@@ -0,0 +1,69 @@
+/**
+ * Gateway status route — public tunnel status via the gateway IPC proxy.
+ *
+ * The tunnel is the gateway's outbound public-ingress transport. It is only
+ * used to tunnel inbound Twilio webhooks and live voice/audio WebSockets to
+ * this assistant — it plays no part in platform credentials or the managed
+ * LLM proxy. The handler reads the live status from the gateway over the local
+ * IPC socket, so the assistant does not need gateway signing material.
+ *
+ * The response is deliberately tunnel-agnostic: a single `tunnel` field holding
+ * the active public URL, omitted entirely when a tunnel is up but has no URL.
+ * This keeps the contract stable if the underlying transport (currently Velay)
+ * is ever swapped for another tunnel. If the gateway is not running (no IPC
+ * answer), the handler errors instead of returning an empty result.
+ */
+import { z } from "zod";
+
+import { ipcGetVelayStatus } from "../../ipc/gateway-client.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { ServiceUnavailableError } from "./errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
+
+// ── Schemas ─────────────────────────────────────────────────────────────
+
+const GatewayStatusResponseSchema = z.object({
+  // Present with the public tunnel URL when a tunnel is connected; omitted
+  // (so the object is `{}`) when no tunnel is up or the gateway is not running.
+  tunnel: z.string().optional(),
+});
+type GatewayStatusResponse = z.infer<typeof GatewayStatusResponseSchema>;
+
+// ── Handlers ────────────────────────────────────────────────────────────
+
+async function handleGatewayStatus(
+  _args: RouteHandlerArgs,
+): Promise<GatewayStatusResponse> {
+  const status = await ipcGetVelayStatus().catch(() => null);
+  // A null status means the gateway did not answer over IPC — i.e. it is not
+  // running. That is a fatal condition for this command, not a "no tunnel"
+  // state, so surface it as an error rather than an empty result.
+  if (status === null) {
+    throw new ServiceUnavailableError(
+      "Gateway is not running or is unreachable over IPC.",
+    );
+  }
+  return status.connected && status.publicUrl
+    ? { tunnel: status.publicUrl }
+    : {};
+}
+
+// ── Route definitions ───────────────────────────────────────────────────
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "gateway_status",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    endpoint: "gateway/status",
+    handler: handleGatewayStatus,
+    summary: "Get gateway status",
+    description:
+      "Reports the gateway's public tunnel status. `tunnel` holds the active public URL when a tunnel is connected and is omitted otherwise. Errors with 503 when the gateway is not running. The tunnel only matters for routing inbound Twilio webhooks and live voice/audio WebSockets.",
+    tags: ["gateway"],
+    responseBody: GatewayStatusResponseSchema,
+  },
+];

package/src/runtime/routes/guardian-action-routes.ts

@@ -13,11 +13,11 @@
  */
 import { z } from "zod";
 
-import { isHttpAuthDisabled } from "../../config/env.js";
 import {
-  type CanonicalGuardianRequest,
-  listPendingRequestsByConversationScope,
-} from "../../contacts/canonical-guardian-store.js";
+  type GuardianRequestWire,
+  listPendingRequestsByScope,
+} from "../../channels/gateway-guardian-requests.js";
+import { isHttpAuthDisabled } from "../../config/env.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { processGuardianDecision } from "../guardian-action-service.js";
 import type { GuardianDecisionPrompt } from "../guardian-decision-types.js";
@@ -30,14 +30,16 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 // GET /v1/guardian-actions/pending?conversationId=...
 // ---------------------------------------------------------------------------
 
-function handleGuardianActionsPending({ queryParams = {} }: RouteHandlerArgs) {
+async function handleGuardianActionsPending({
+  queryParams = {},
+}: RouteHandlerArgs) {
   const conversationId = queryParams.conversationId;
 
   if (!conversationId) {
     throw new BadRequestError("conversationId query parameter is required");
   }
 
-  const prompts = listGuardianDecisionPrompts({
+  const prompts = await listGuardianDecisionPrompts({
     conversationId,
     channel: "vellum",
   });
@@ -135,24 +137,24 @@ async function handleGuardianActionDecision({
  * The returned prompts normalize `conversationId` to the queried conversation ID
  * for client rendering stability.
  */
-export function listGuardianDecisionPrompts(params: {
+export async function listGuardianDecisionPrompts(params: {
   conversationId: string;
   channel?: string;
-}): GuardianDecisionPrompt[] {
+}): Promise<GuardianDecisionPrompt[]> {
   const { conversationId, channel } = params;
   const prompts: GuardianDecisionPrompt[] = [];
 
-  const canonicalRequests = listPendingRequestsByConversationScope(
+  const pendingRequests = await listPendingRequestsByScope(
     conversationId,
     channel,
   );
 
-  for (const req of canonicalRequests) {
-    // Skip expired canonical requests
+  for (const req of pendingRequests) {
+    // Skip expired requests
     if (req.expiresAt && new Date(req.expiresAt).getTime() < Date.now())
       continue;
 
-    const prompt = mapCanonicalRequestToPrompt(req, conversationId);
+    const prompt = mapRequestToPrompt(req, conversationId);
     prompts.push(prompt);
   }
 
@@ -160,11 +162,11 @@ export function listGuardianDecisionPrompts(params: {
 }
 
 // ---------------------------------------------------------------------------
-// Canonical request -> prompt mapping
+// Guardian request -> prompt mapping
 // ---------------------------------------------------------------------------
 
-function mapCanonicalRequestToPrompt(
-  req: CanonicalGuardianRequest,
+function mapRequestToPrompt(
+  req: GuardianRequestWire,
   conversationId: string,
 ): GuardianDecisionPrompt {
   const questionText = buildKindAwareQuestionText(req);
@@ -193,7 +195,7 @@ function mapCanonicalRequestToPrompt(
   };
 }
 
-function buildKindAwareQuestionText(req: CanonicalGuardianRequest): string {
+function buildKindAwareQuestionText(req: GuardianRequestWire): string {
   const baseText =
     req.questionText ??
     (req.toolName

package/src/runtime/routes/guardian-approval-interception.ts

@@ -92,14 +92,16 @@ export async function handleApprovalInterception(
     approvalMessageTs,
   } = params;
 
-  // Slack emoji reactions are handled by the canonical guardian decision
+  // Slack emoji reactions are handled by the guardian decision
   // pipeline (`routeGuardianReply`), invoked from the inbound reaction stage:
   // it resolves the target request from the reacted card's delivery record.
   // See `guardian-reply-router.ts`.
 
   // ── Standard approval interception (existing flow) ──
   const pendingPrompt = getChannelApprovalPrompt(conversationId);
-  if (!pendingPrompt) return { handled: false };
+  if (!pendingPrompt) {
+    return { handled: false };
+  }
 
   // Unverified sender: unknown trust where either the sender's identity
   // could not be established or no guardian binding exists for the channel.
@@ -139,7 +141,7 @@ export async function handleApprovalInterception(
     const pending = getApprovalInfoByConversation(conversationId);
     if (pending.length > 0) {
       // Guard: a non-guardian actor with a guardian binding must not
-      // self-approve, even in the window before the guardian's canonical
+      // self-approve, even in the window before the guardian's
       // request row is persisted. The pending confirmation (isInteractive=true)
       // can exist before the request is delivered to the guardian; without this
       // guard the actor could fall through to the conversational engine / NL
@@ -155,7 +157,7 @@ export async function handleApprovalInterception(
             conversationExternalId,
             guardianExternalUserId: trustCtx.guardianExternalUserId,
           },
-          "Blocking non-guardian self-approval: pending confirmation exists but canonical guardian request not yet created",
+          "Blocking non-guardian self-approval: pending confirmation exists but guardian request not yet created",
         );
         await deliverStaleApprovalReply({
           scenario: "request_pending_guardian",

package/src/runtime/routes/guardian-approval-prompt.ts

@@ -2,7 +2,7 @@
  * Approval prompt delivery: rich UI (buttons) with plain-text fallback.
  */
 import type { ChannelId } from "../../channels/types.js";
-import { recordApprovalCardDelivery } from "../../notifications/canonical-delivery-recorder.js";
+import { recordApprovalCardDelivery } from "../../notifications/guardian-delivery-recorder.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import type { ApprovalMessageContext } from "../approval-message-composer.js";
@@ -75,7 +75,9 @@ function formatToolInputPreview(
 }
 
 function truncatePreview(text: string): string {
-  if (text.length <= INPUT_PREVIEW_MAX_LENGTH) return text;
+  if (text.length <= INPUT_PREVIEW_MAX_LENGTH) {
+    return text;
+  }
   const truncated = text.slice(0, INPUT_PREVIEW_MAX_LENGTH - 1) + "…";
   // Preserve backtick pairing so markdown renders correctly.
   const openBackticks = (truncated.match(/`/g) || []).length;
@@ -148,7 +150,7 @@ export async function deliverGeneratedApprovalPrompt(
         assistantId,
       );
       if (deliveryResult.ts) {
-        recordApprovalCardDelivery({
+        await recordApprovalCardDelivery({
           requestId: uiMetadata.requestId,
           channel: sourceChannel,
           chatId,
@@ -181,7 +183,7 @@ export async function deliverGeneratedApprovalPrompt(
         assistantId,
       });
       if (fallbackResult.ts) {
-        recordApprovalCardDelivery({
+        await recordApprovalCardDelivery({
           requestId: uiMetadata.requestId,
           channel: sourceChannel,
           chatId,
@@ -215,7 +217,7 @@ export async function deliverGeneratedApprovalPrompt(
       assistantId,
     });
     if (plainResult.ts) {
-      recordApprovalCardDelivery({
+      await recordApprovalCardDelivery({
         requestId: uiMetadata.requestId,
         channel: sourceChannel,
         chatId,

package/src/runtime/routes/guardian-expiry-sweep.ts

@@ -0,0 +1,130 @@
+/**
+ * Guardian request expiry sweep.
+ *
+ * Periodically asks the gateway to CAS-expire pending guardian requests
+ * whose `expiresAt` timestamp has passed (`guardian_requests_sweep_expired`),
+ * so stale requests are cleaned up even when no follow-up traffic arrives
+ * from either the guardian or the requester.
+ *
+ * The gateway owns the status transition (the single source of truth); the
+ * daemon fans out the side effects for each expired row it returns:
+ * withdrawing the approval cards on every surface, notifying the requester
+ * that their request expired, and releasing any in-memory pending
+ * interaction. Requester notices are delivered straight to the requester's
+ * channel — not the guardian-facing notification pipeline — and the guardian
+ * stays passive, since the withdrawn card already reflects expiry.
+ *
+ * Unreachable-gateway posture: log and skip the round — the next tick
+ * retries, and expiry only ever moves forward.
+ */
+
+import { withdrawGuardianRequestCards } from "../../approvals/guardian-card-withdrawal.js";
+import { notifyExpiredGuardianRequest } from "../../approvals/guardian-expiry-notifier.js";
+import {
+  type GuardianRequestWire,
+  sweepExpiredGuardianRequests,
+} from "../../channels/gateway-guardian-requests.js";
+import { getLogger } from "../../util/logger.js";
+
+const log = getLogger("guardian-expiry-sweep");
+
+/** Interval at which the expiry sweep runs (60 seconds). */
+const SWEEP_INTERVAL_MS = 60_000;
+
+/** Timer handle for the sweep so it can be stopped in tests and shutdown. */
+let sweepTimer: ReturnType<typeof setInterval> | null = null;
+
+/** Guard against overlapping sweeps. */
+let sweepInProgress = false;
+
+/**
+ * Run one expiry sweep round: the gateway CAS-expires every pending request
+ * past its `expiresAt` (a concurrent decision that wins the race is never
+ * overwritten), then the daemon runs the per-request side effects. Returns
+ * the count of requests transitioned to expired.
+ */
+export async function runGuardianExpirySweep(): Promise<number> {
+  let expired: GuardianRequestWire[];
+  try {
+    expired = await sweepExpiredGuardianRequests();
+  } catch (err) {
+    log.warn(
+      { err },
+      "Guardian expiry sweep skipped — gateway unreachable; next round retries",
+    );
+    return 0;
+  }
+
+  // The sweep returns the full rows, so the side-effect fan-out can never be
+  // stranded by a failed follow-up read after the status flip.
+  for (const request of expired) {
+    log.info(
+      {
+        event: "guardian_request_expired",
+        requestId: request.id,
+        kind: request.kind,
+        expiresAt: request.expiresAt,
+      },
+      "Expired guardian request via sweep",
+    );
+
+    // Withdraw the now-stale approval cards on every surface. No origin
+    // channel — the expiry is system-driven, so all surfaces (including
+    // in-app) are withdrawn. Best-effort and non-throwing.
+    await withdrawGuardianRequestCards({
+      request,
+      status: "expired",
+    });
+
+    // Notify the requester their request expired and release any in-memory
+    // pending interaction. Best-effort and non-throwing, like the card
+    // withdrawal above.
+    await notifyExpiredGuardianRequest(request);
+  }
+
+  if (expired.length > 0) {
+    log.info(
+      {
+        event: "guardian_expiry_sweep_complete",
+        expiredCount: expired.length,
+      },
+      `Guardian expiry sweep: expired ${expired.length} request(s)`,
+    );
+  }
+
+  return expired.length;
+}
+
+/**
+ * Start the periodic guardian expiry sweep. Idempotent — calling it
+ * multiple times reuses the same timer.
+ */
+export function startGuardianExpirySweep(): void {
+  if (sweepTimer) {
+    return;
+  }
+  sweepTimer = setInterval(() => {
+    if (sweepInProgress) {
+      return;
+    }
+    sweepInProgress = true;
+    void runGuardianExpirySweep()
+      .catch((err) => {
+        log.error({ err }, "Guardian expiry sweep failed");
+      })
+      .finally(() => {
+        sweepInProgress = false;
+      });
+  }, SWEEP_INTERVAL_MS);
+}
+
+/**
+ * Stop the periodic guardian expiry sweep. Used in tests and shutdown.
+ */
+export function stopGuardianExpirySweep(): void {
+  if (sweepTimer) {
+    clearInterval(sweepTimer);
+    sweepTimer = null;
+  }
+  sweepInProgress = false;
+}

package/src/runtime/routes/inbound-message-handler.ts

@@ -111,7 +111,6 @@ import { enforceAdmissionPolicy } from "./inbound-stages/admission-policy.js";
 import { processChannelMessageInBackground } from "./inbound-stages/background-dispatch.js";
 import { handleBootstrapIntercept } from "./inbound-stages/bootstrap-intercept.js";
 import { handleEditIntercept } from "./inbound-stages/edit-intercept.js";
-import { handleEscalationIntercept } from "./inbound-stages/escalation-intercept.js";
 import { handleGuardianActivationIntercept } from "./inbound-stages/guardian-activation-intercept.js";
 import { handleGuardianReplyIntercept } from "./inbound-stages/guardian-reply-intercept.js";
 import {
@@ -420,7 +419,7 @@ export async function handleChannelInbound({
   // notification, and a stranger's reaction creates no conversation/binding.
   // The interceptor drops strangers, records known contacts' reactions as
   // transcript signals, and routes a guardian's reaction on an approval card
-  // through the canonical guardian decision pipeline. Reactions never drive an
+  // through the guardian decision pipeline. Reactions never drive an
   // agent turn.
   if (isSlackReactionEvent(body)) {
     return handleSlackReactionIntercept({
@@ -823,7 +822,7 @@ export async function handleChannelInbound({
     const floorSenderId = canonicalSenderId ?? rawSenderId;
     if (isCallbackInteraction) {
       if (floorSenderId) {
-        handshakeInProgress = isApprovalHandshakeInProgress({
+        handshakeInProgress = await isApprovalHandshakeInProgress({
           canonicalAssistantId,
           sourceChannel,
           actorExternalId: floorSenderId,
@@ -973,28 +972,6 @@ export async function handleChannelInbound({
     };
   }
 
-  // ── Ingress escalation ──
-  const escalationResponse = await handleEscalationIntercept({
-    resolvedMember,
-    canonicalAssistantId,
-    sourceChannel,
-    sourceInterface,
-    conversationExternalId,
-    externalMessageId,
-    conversationId: result.conversationId,
-    eventId: result.eventId,
-    content: trimmedContent,
-    attachmentIds,
-    sourceMetadata: body.sourceMetadata,
-    actorDisplayName: body.actorDisplayName,
-    actorExternalId: body.actorExternalId,
-    actorUsername: body.actorUsername,
-    replyCallbackUrl: body.replyCallbackUrl,
-    canonicalSenderId,
-    rawSenderId,
-  });
-  if (escalationResponse) return escalationResponse;
-
   const metadataHintsRaw = sourceMetadata?.hints;
   const metadataHints = Array.isArray(metadataHintsRaw)
     ? metadataHintsRaw.filter(
@@ -1046,12 +1023,11 @@ export async function handleChannelInbound({
   });
   if (bootstrapResponse) return bootstrapResponse;
 
-  // Legacy voice guardian action interception removed — all guardian reply
-  // routing now flows through the canonical router below (routeGuardianReply),
-  // which handles request code matching, callback parsing, and NL classification
-  // against canonical_guardian_requests.
+  // All guardian reply routing flows through the guardian reply router below
+  // (routeGuardianReply), which handles request code matching, callback
+  // parsing, and NL classification against the gateway's guardian_requests.
 
-  // ── Canonical guardian reply router ──
+  // ── Guardian reply router ──
   const guardianReplyResult = await handleGuardianReplyIntercept({
     isDuplicate: result.duplicate,
     trimmedContent,
@@ -1826,12 +1802,12 @@ function isBackfilledSlackGuardianMessage(
 ): boolean {
   const rawSenderId = message.sender?.id?.trim();
   if (!rawSenderId || !guardianExternalUserId) return false;
-  const canonicalSender =
+  const normalizedSender =
     canonicalizeInboundIdentity("slack", rawSenderId) ?? rawSenderId;
-  const canonicalGuardian =
+  const normalizedGuardian =
     canonicalizeInboundIdentity("slack", guardianExternalUserId) ??
     guardianExternalUserId.trim();
-  return canonicalSender === canonicalGuardian;
+  return normalizedSender === normalizedGuardian;
 }
 
 const SLACK_ASSISTANT_THREAD_PLACEHOLDER_TEXT = "New Assistant Thread";

package/src/runtime/routes/inbound-stages/acl-enforcement.test.ts

@@ -15,11 +15,6 @@ import type { SourceMetadata, TrustVerdict } from "@vellumai/gateway-client";
 
 import { createGatewayVerificationSessionsStub } from "../../../__tests__/helpers/gateway-verification-sessions-stub.js";
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
-}));
-
 // Track contact-store reads to prove findContactChannel is NOT used on the
 // verdict path.
 const findContactChannelCalls: unknown[] = [];

package/src/runtime/routes/inbound-stages/acl-enforcement.ts

@@ -1,6 +1,6 @@
 /**
  * Ingress ACL enforcement stage: resolves the inbound actor to a member
- * record, enforces allow/deny/escalate policies, and notifies the guardian
+ * record, enforces allow/deny policies, and notifies the guardian
  * of denied access requests.
  *
  * Invite code/token redemption is intercepted at gateway ingress; redeemed
@@ -175,7 +175,7 @@ export interface AclResult {
 
 /**
  * Enforce ingress ACL rules: member lookup, non-member/inactive denial,
- * policy enforcement (allow/deny/escalate bypass), and guardian
+ * policy enforcement (allow/deny), and guardian
  * notification for denied access.
  */
 export async function enforceIngressAcl(
@@ -389,11 +389,11 @@ export async function enforceIngressAcl(
         const nonMemberSenderId = canonicalSenderId ?? rawSenderId;
         const terminallyDenied =
           !!nonMemberSenderId &&
-          isAccessRequestDenied({
+          (await isAccessRequestDenied({
             canonicalAssistantId,
             sourceChannel,
             actorExternalId: nonMemberSenderId,
-          });
+          }));
 
         // Slack-specific: send a verification challenge directly to the
         // user's DM instead of requiring guardian-mediated approval. The
@@ -537,14 +537,14 @@ export async function enforceIngressAcl(
 
         // Notify the guardian about the access request so they can approve/deny.
         // Uses the shared helper which handles guardian binding lookup,
-        // deduplication, canonical request creation, and notification emission.
+        // deduplication, guardian request creation, and notification emission.
         // Skipped for callback interactions — a button press must not create
         // an access request — but the handshake window is still probed so the
         // reply doesn't tell a just-approved sender they lack access.
         let guardianNotified = false;
         let handshakeInProgress = false;
         if (isCallbackInteraction) {
-          handshakeInProgress = isApprovalHandshakeInProgress({
+          handshakeInProgress = await isApprovalHandshakeInProgress({
             canonicalAssistantId,
             sourceChannel,
             actorExternalId: (canonicalSenderId ?? rawSenderId)!,
@@ -700,11 +700,11 @@ export async function enforceIngressAcl(
           const terminallyDenied =
             !isBlockedMember &&
             !!inactiveSenderId &&
-            isAccessRequestDenied({
+            (await isAccessRequestDenied({
               canonicalAssistantId,
               sourceChannel,
               actorExternalId: inactiveSenderId,
-            });
+            }));
 
           // Slack-specific: re-verify inactive members via DM challenge
           // (same as non-member path). Blocked members are excluded —
@@ -799,7 +799,7 @@ export async function enforceIngressAcl(
           let handshakeInProgress = false;
           if (resolvedMember.status !== "blocked") {
             if (isCallbackInteraction) {
-              handshakeInProgress = isApprovalHandshakeInProgress({
+              handshakeInProgress = await isApprovalHandshakeInProgress({
                 canonicalAssistantId,
                 sourceChannel,
                 actorExternalId: (canonicalSenderId ?? rawSenderId)!,

package/src/runtime/routes/inbound-stages/admission-policy.test.ts

@@ -6,12 +6,14 @@
  * `handle-inbound-admission.test.ts` and in the full inbound-message
  * handler integration tests.
  */
-import { describe, expect,test } from "bun:test";
+import { describe, expect, test } from "bun:test";
 
 import type { AdmissionPolicyInput } from "./admission-policy.js";
 import { enforceAdmissionPolicy } from "./admission-policy.js";
 
-function makeInput(overrides: Partial<AdmissionPolicyInput>): AdmissionPolicyInput {
+function makeInput(
+  overrides: Partial<AdmissionPolicyInput>,
+): AdmissionPolicyInput {
   return {
     sourceChannel: "telegram",
     trustClass: "unknown",
@@ -28,7 +30,11 @@ function makeInput(overrides: Partial<AdmissionPolicyInput>): AdmissionPolicyInp
 describe("enforceAdmissionPolicy — exempt channels", () => {
   test("a2a short-circuits to admitted regardless of policy", () => {
     const result = enforceAdmissionPolicy(
-      makeInput({ sourceChannel: "a2a", trustClass: "unknown", policy: "no_one" }),
+      makeInput({
+        sourceChannel: "a2a",
+        trustClass: "unknown",
+        policy: "no_one",
+      }),
     );
     expect(result.admitted).toBe(true);
   });
@@ -37,7 +43,11 @@ describe("enforceAdmissionPolicy — exempt channels", () => {
     // Voice ingress is wired, so `phone` is no longer exempt — an `unknown`
     // caller is denied under `no_one`.
     const result = enforceAdmissionPolicy(
-      makeInput({ sourceChannel: "phone", trustClass: "unknown", policy: "no_one" }),
+      makeInput({
+        sourceChannel: "phone",
+        trustClass: "unknown",
+        policy: "no_one",
+      }),
     );
     expect(result.admitted).toBe(false);
   });
@@ -133,7 +143,11 @@ describe("enforceAdmissionPolicy — rank vs floor", () => {
 
   test("unknown (non-member) admitted under strangers floor", () => {
     const result = enforceAdmissionPolicy(
-      makeInput({ trustClass: "unknown", memberStatus: undefined, policy: "strangers" }),
+      makeInput({
+        trustClass: "unknown",
+        memberStatus: undefined,
+        policy: "strangers",
+      }),
     );
     expect(result.admitted).toBe(true);
   });
@@ -147,7 +161,11 @@ describe("enforceAdmissionPolicy — rank vs floor", () => {
 
   test("pending member (unverified_contact) admitted under strangers floor", () => {
     const result = enforceAdmissionPolicy(
-      makeInput({ trustClass: "unverified_contact", memberStatus: "pending", policy: "strangers" }),
+      makeInput({
+        trustClass: "unverified_contact",
+        memberStatus: "pending",
+        policy: "strangers",
+      }),
     );
     expect(result.admitted).toBe(true);
   });

package/src/runtime/routes/inbound-stages/background-dispatch.test.ts

@@ -31,13 +31,6 @@ let deliverReplyViaCallbackImpl: (
   ...args: unknown[]
 ) => Promise<void> = async () => {};
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-}));
-
 mock.module("../../../persistence/delivery-channels.js", () => ({
   updateDeliveredSegmentCount: (eventId: string, count: number) => {
     deliveredSegmentCounts.push({ eventId, count });

package/src/runtime/routes/inbound-stages/bootstrap-intercept.test.ts

@@ -16,11 +16,6 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { createGatewayVerificationSessionsStub } from "../../../__tests__/helpers/gateway-verification-sessions-stub.js";
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
-}));
-
 // Gateway-backed session client (async IPC); throw toggles simulate an
 // unreachable gateway per lifecycle call.
 const gatewaySessions = createGatewayVerificationSessionsStub({

package/src/runtime/routes/inbound-stages/bootstrap-intercept.ts

@@ -65,7 +65,10 @@ async function respondBootstrapUnavailable(
   eventId: string,
 ): Promise<Record<string, unknown>> {
   try {
-    await sendTelegramReply(conversationExternalId, BOOTSTRAP_UNAVAILABLE_REPLY);
+    await sendTelegramReply(
+      conversationExternalId,
+      BOOTSTRAP_UNAVAILABLE_REPLY,
+    );
   } catch (err) {
     log.error(
       { err, chatId: conversationExternalId },
@@ -224,12 +227,12 @@ export async function handleBootstrapIntercept(
     );
   }
 
-  return ({
+  return {
     accepted: true,
     duplicate: false,
     eventId,
     verificationOutcome: "bootstrap_bound",
-  });
+  };
 }
 
 // ---------------------------------------------------------------------------