@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/__tests__/guardian-decision-primitive-canonical.test.ts

@@ -1,38 +1,29 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
-  truncateForLog: (value: string) => value,
-}));
+import { createGuardianGatewaySim } from "./guardian-gateway-sim.js";
+
+const sim = createGuardianGatewaySim();
+mock.module("../channels/gateway-guardian-requests.js", () => sim.module);
 
 import {
-  applyCanonicalGuardianDecision,
+  applyGuardianDecision,
   GRANT_TTL_MS,
-  mintCanonicalRequestGrant,
+  mintGuardianRequestGrant,
 } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
 import {
   getRegisteredKinds,
   getResolver,
 } from "../approvals/guardian-request-resolvers.js";
-import {
-  createCanonicalGuardianRequest,
-  getCanonicalGuardianRequest,
-} from "../contacts/canonical-guardian-store.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { scopedApprovalGrants } from "../persistence/schema/index.js";
 
 await initializeDb();
 
-function resetTables(): void {
-  const db = getDb();
-  db.run("DELETE FROM scoped_approval_grants");
-  db.run("DELETE FROM canonical_guardian_deliveries");
-  db.run("DELETE FROM canonical_guardian_requests");
+function resetState(): void {
+  sim.reset();
+  getDb().run("DELETE FROM scoped_approval_grants");
 }
 
 // ---------------------------------------------------------------------------
@@ -85,20 +76,19 @@ describe("guardian-request-resolvers / registry", () => {
 });
 
 // ---------------------------------------------------------------------------
-// applyCanonicalGuardianDecision tests
+// applyGuardianDecision tests
 // ---------------------------------------------------------------------------
 
-describe("applyCanonicalGuardianDecision", () => {
-  beforeEach(() => resetTables());
+describe("applyGuardianDecision", () => {
+  beforeEach(() => resetState());
 
   // ── Successful approval ─────────────────────────────────────────────
 
   test("approves a pending tool_approval request", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
@@ -106,7 +96,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -121,18 +111,17 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(result.grantMinted).toBe(false);
     expect(result.resolverFailed).toBe(true);
 
-    // Verify canonical request state
-    const resolved = getCanonicalGuardianRequest(req.id);
+    // Verify gateway-side request state
+    const resolved = sim.getRequest(req.id);
     expect(resolved!.status).toBe("approved");
     expect(resolved!.decidedByExternalUserId).toBe("guardian-1");
   });
 
   test("denies a pending tool_approval request", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
@@ -140,7 +129,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "reject",
       actorContext: guardianActor(),
@@ -150,14 +139,12 @@ describe("applyCanonicalGuardianDecision", () => {
     if (!result.applied) return;
     expect(result.grantMinted).toBe(false);
 
-    const resolved = getCanonicalGuardianRequest(req.id);
-    expect(resolved!.status).toBe("denied");
+    expect(sim.getRequest(req.id)!.status).toBe("denied");
   });
 
   test("approves a pending_question request with answer text", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "pending_question",
-      sourceType: "voice",
       sourceChannel: "twilio",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
@@ -167,7 +154,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -177,24 +164,70 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(result.applied).toBe(true);
     if (!result.applied) return;
 
-    const resolved = getCanonicalGuardianRequest(req.id);
+    const resolved = sim.getRequest(req.id);
     expect(resolved!.status).toBe("approved");
     expect(resolved!.answerText).toBe("1234");
   });
 
+  // ── Daemon-domain kinds decide as a plain CAS ───────────────────────
+
+  test("tool_approval decide carries no aclOutcome", async () => {
+    const req = sim.seedRequest({
+      kind: "tool_approval",
+      sourceChannel: "telegram",
+      sourceConversationId: "conv-1",
+      guardianExternalUserId: "guardian-1",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      expiresAt: Date.now() + 60_000,
+    });
+
+    await applyGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor(),
+    });
+
+    expect(sim.state.decideCalls).toHaveLength(1);
+    expect(sim.state.decideCalls[0].aclOutcome).toBeUndefined();
+  });
+
+  test("a failed plain-CAS decide leaves the request pending and surfaces resolverFailed", async () => {
+    sim.state.decideError = new Error("gateway unreachable");
+    const req = sim.seedRequest({
+      kind: "tool_approval",
+      sourceChannel: "telegram",
+      sourceConversationId: "conv-1",
+      guardianExternalUserId: "guardian-1",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      expiresAt: Date.now() + 60_000,
+    });
+
+    const result = await applyGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor(),
+    });
+
+    expect(result.applied).toBe(true);
+    if (!result.applied) return;
+    expect(result.resolverFailed).toBe(true);
+    expect(result.resolverFailureReason).toBe("decision_persist_failed");
+    expect(result.grantMinted).toBe(false);
+    expect(sim.getRequest(req.id)!.status).toBe("pending");
+  });
+
   // ── Principal mismatch ──────────────────────────────────────────────
 
   test("rejects decision when actor principal does not match request principal", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor({ guardianPrincipalId: "wrong-principal" }),
@@ -204,16 +237,16 @@ describe("applyCanonicalGuardianDecision", () => {
     if (result.applied) return;
     expect(result.reason).toBe("identity_mismatch");
 
-    // Request remains pending
-    const unchanged = getCanonicalGuardianRequest(req.id);
-    expect(unchanged!.status).toBe("pending");
+    // Request remains pending; no decide was attempted
+    expect(sim.getRequest(req.id)!.status).toBe("pending");
+    expect(sim.state.decideCalls).toHaveLength(0);
   });
 
   test("matching principal authorizes decision (cross-channel same principal)", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "desktop",
-      conversationId: "conv-1",
+      sourceChannel: "vellum",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
@@ -221,7 +254,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: trustedActor(),
@@ -234,20 +267,18 @@ describe("applyCanonicalGuardianDecision", () => {
   });
 
   test("rejects decision when request has no guardianPrincipalId", async () => {
-    // unknown_kind is not in DECISIONABLE_KINDS so it can be created without
-    // guardianPrincipalId. A request with no bound principal can never be
-    // authorized by anyone — this is a data-integrity fault
-    // (request_misconfigured), not an authorization denial against the actor,
-    // so it must not be reported as identity_mismatch / "no permission".
-    const req = createCanonicalGuardianRequest({
+    // A request with no bound principal can never be authorized by anyone —
+    // this is a data-integrity fault (request_misconfigured), not an
+    // authorization denial against the actor, so it must not be reported as
+    // identity_mismatch / "no permission".
+    const req = sim.seedRequest({
       kind: "unknown_kind",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor({ guardianPrincipalId: "some-principal" }),
@@ -259,16 +290,15 @@ describe("applyCanonicalGuardianDecision", () => {
   });
 
   test("rejects decision when actor has no guardianPrincipalId", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor({ guardianPrincipalId: undefined }),
@@ -282,17 +312,16 @@ describe("applyCanonicalGuardianDecision", () => {
   // ── Stale / already-resolved (race condition) ──────────────────────
 
   test("second concurrent decision fails (first-writer-wins)", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       expiresAt: Date.now() + 60_000,
     });
 
     // First decision succeeds
-    const first = await applyCanonicalGuardianDecision({
+    const first = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -300,7 +329,7 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(first.applied).toBe(true);
 
     // Second decision fails — request is no longer pending
-    const second = await applyCanonicalGuardianDecision({
+    const second = await applyGuardianDecision({
       requestId: req.id,
       action: "reject",
       actorContext: guardianActor(),
@@ -310,14 +339,39 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(second.reason).toBe("already_resolved");
 
     // First decision stuck
-    const final = getCanonicalGuardianRequest(req.id);
-    expect(final!.status).toBe("approved");
+    expect(sim.getRequest(req.id)!.status).toBe("approved");
+  });
+
+  test("a decide CAS miss maps to already_resolved", async () => {
+    const req = sim.seedRequest({
+      kind: "tool_approval",
+      sourceConversationId: "conv-1",
+      guardianExternalUserId: "guardian-1",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      expiresAt: Date.now() + 60_000,
+    });
+
+    // Race a concurrent writer between the primitive's pending read and its
+    // decide call: the row flips terminal right before the CAS runs.
+    sim.state.beforeDecide = () => {
+      sim.requests.get(req.id)!.status = "approved";
+    };
+
+    const result = await applyGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor(),
+    });
+
+    expect(result.applied).toBe(false);
+    if (result.applied) return;
+    expect(result.reason).toBe("already_resolved");
   });
 
   // ── Not found ──────────────────────────────────────────────────────
 
   test("returns not_found for nonexistent request", async () => {
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: "nonexistent-id",
       action: "approve_once",
       actorContext: guardianActor(),
@@ -331,16 +385,15 @@ describe("applyCanonicalGuardianDecision", () => {
   // ── Invalid action ─────────────────────────────────────────────────
 
   test("rejects invalid action", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "bogus_action" as any,
       actorContext: guardianActor(),
@@ -351,18 +404,16 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(result.reason).toBe("invalid_action");
 
     // Request remains pending
-    const unchanged = getCanonicalGuardianRequest(req.id);
-    expect(unchanged!.status).toBe("pending");
+    expect(sim.getRequest(req.id)!.status).toBe("pending");
   });
 
   // ── approve_always / temporal actions are no longer valid ──────────
 
   test("rejects approve_always as invalid_action", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
@@ -370,7 +421,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       // @ts-expect-error - approve_always is no longer a valid action
       action: "approve_always",
@@ -384,11 +435,10 @@ describe("applyCanonicalGuardianDecision", () => {
   });
 
   test("rejects approve_10m as invalid_action", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "unknown_kind",
-      sourceType: "voice",
       sourceChannel: "phone",
-      conversationId: "conv-10m-1",
+      sourceConversationId: "conv-10m-1",
       callSessionId: "call-10m-1",
       toolName: "host_bash",
       inputDigest: "sha256:10m-digest",
@@ -396,7 +446,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       // @ts-expect-error - approve_10m is no longer a valid action
       action: "approve_10m",
@@ -410,11 +460,10 @@ describe("applyCanonicalGuardianDecision", () => {
   });
 
   test("rejects approve_conversation as invalid_action", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "unknown_kind",
-      sourceType: "voice",
       sourceChannel: "phone",
-      conversationId: "conv-session-1",
+      sourceConversationId: "conv-session-1",
       callSessionId: "call-session-1",
       toolName: "file_write",
       inputDigest: "sha256:session-digest",
@@ -422,7 +471,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       // @ts-expect-error - approve_conversation is no longer a valid action
       action: "approve_conversation",
@@ -438,16 +487,15 @@ describe("applyCanonicalGuardianDecision", () => {
   // ── Expired request ────────────────────────────────────────────────
 
   test("rejects decision on expired request", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       expiresAt: Date.now() - 10_000, // already expired
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -459,16 +507,15 @@ describe("applyCanonicalGuardianDecision", () => {
   });
 
   test("allows decision on request with no expiresAt", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       // No expiresAt
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -480,11 +527,10 @@ describe("applyCanonicalGuardianDecision", () => {
   // ── Resolver dispatch ──────────────────────────────────────────────
 
   test("dispatches to tool_approval resolver", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "file_read",
@@ -492,7 +538,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -502,9 +548,8 @@ describe("applyCanonicalGuardianDecision", () => {
   });
 
   test("dispatches to pending_question resolver", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "pending_question",
-      sourceType: "voice",
       sourceChannel: "twilio",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
@@ -514,7 +559,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
@@ -522,38 +567,35 @@ describe("applyCanonicalGuardianDecision", () => {
     });
 
     expect(result.applied).toBe(true);
-    const resolved = getCanonicalGuardianRequest(req.id);
+    const resolved = sim.getRequest(req.id);
     expect(resolved!.answerText).toBe("secret123");
   });
 
   test("succeeds for non-decisionable kind with matching principal", async () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "unknown_kind",
-      sourceType: "channel",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianExternalUserId: "guardian-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       expiresAt: Date.now() + 60_000,
     });
 
     // Should still succeed — CAS resolution happens regardless of resolver
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: guardianActor(),
     });
 
     expect(result.applied).toBe(true);
-    const resolved = getCanonicalGuardianRequest(req.id);
-    expect(resolved!.status).toBe("approved");
+    expect(sim.getRequest(req.id)!.status).toBe("approved");
   });
 
-  test("desktop actor with matching principal mints scoped grant for approved canonical request", async () => {
-    const req = createCanonicalGuardianRequest({
+  test("desktop actor with matching principal mints scoped grant for approved request", async () => {
+    const req = sim.seedRequest({
       kind: "unknown_kind",
-      sourceType: "voice",
       sourceChannel: "phone",
-      conversationId: "conv-voice-1",
+      sourceConversationId: "conv-voice-1",
       callSessionId: "call-voice-1",
       toolName: "host_bash",
       inputDigest: "sha256:voice-digest-1",
@@ -561,7 +603,7 @@ describe("applyCanonicalGuardianDecision", () => {
       expiresAt: Date.now() + 60_000,
     });
 
-    const result = await applyCanonicalGuardianDecision({
+    const result = await applyGuardianDecision({
       requestId: req.id,
       action: "approve_once",
       actorContext: trustedActor(),
@@ -582,24 +624,23 @@ describe("applyCanonicalGuardianDecision", () => {
 });
 
 // ---------------------------------------------------------------------------
-// mintCanonicalRequestGrant tests
+// mintGuardianRequestGrant tests
 // ---------------------------------------------------------------------------
 
-describe("mintCanonicalRequestGrant", () => {
-  beforeEach(() => resetTables());
+describe("mintGuardianRequestGrant", () => {
+  beforeEach(() => resetState());
 
   test("mints grant for request with tool metadata", () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-1",
+      sourceConversationId: "conv-1",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
       inputDigest: "sha256:abc",
     });
 
-    const result = mintCanonicalRequestGrant({
+    const result = mintGuardianRequestGrant({
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",
@@ -610,17 +651,16 @@ describe("mintCanonicalRequestGrant", () => {
   });
 
   test("mints grant when guardianExternalUserId is omitted", () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-2",
+      sourceConversationId: "conv-2",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
       inputDigest: "sha256:xyz",
     });
 
-    const result = mintCanonicalRequestGrant({
+    const result = mintGuardianRequestGrant({
       request: req,
       actorChannel: "vellum",
       effectiveAction: "approve_once",
@@ -635,14 +675,13 @@ describe("mintCanonicalRequestGrant", () => {
   });
 
   test("skips grant for request without tool metadata", () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "pending_question",
-      sourceType: "voice",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       // No toolName or inputDigest
     });
 
-    const result = mintCanonicalRequestGrant({
+    const result = mintGuardianRequestGrant({
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",
@@ -653,15 +692,14 @@ describe("mintCanonicalRequestGrant", () => {
   });
 
   test("skips grant when toolName present but inputDigest missing", () => {
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
       // No inputDigest
     });
 
-    const result = mintCanonicalRequestGrant({
+    const result = mintGuardianRequestGrant({
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",
@@ -673,17 +711,16 @@ describe("mintCanonicalRequestGrant", () => {
 
   test("mints grant with default 5m TTL for approve_once", () => {
     const before = Date.now();
-    const req = createCanonicalGuardianRequest({
+    const req = sim.seedRequest({
       kind: "tool_approval",
-      sourceType: "channel",
       sourceChannel: "telegram",
-      conversationId: "conv-ttl-once",
+      sourceConversationId: "conv-ttl-once",
       guardianPrincipalId: TEST_PRINCIPAL_ID,
       toolName: "shell",
       inputDigest: "sha256:ttl-once",
     });
 
-    const result = mintCanonicalRequestGrant({
+    const result = mintGuardianRequestGrant({
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",