@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/src/config/default-profile-catalog.ts

@@ -11,12 +11,8 @@ import {
   DEFAULT_PROFILE_PROVIDERS,
   type DefaultProfileKey,
   type DefaultProfileProvider,
-  INTERNAL_PROFILE_KEYS,
-  type InternalProfileKey,
   isDefaultProfileProvider,
   OS_BETA_PROFILE_KEY,
-  PROFILE_MATRIX_KEYS,
-  type ProfileMatrixKey,
 } from "./default-profile-names.js";
 import { resolveDefaultConnectionName } from "./default-provider-resolution.js";
 import {
@@ -28,7 +24,8 @@ import {
 
 /**
  * Code-defined catalog of the default inference profiles (`balanced`,
- * `quality-optimized`, `cost-optimized`, plus the flag-gated `os-beta`).
+ * `quality-optimized`, `cost-optimized`, `latency-optimized`, plus the
+ * flag-gated `os-beta`).
  *
  * The catalog is the single source of truth for default profile CONTENT,
  * structured as an intent × provider matrix: each default profile is an
@@ -60,6 +57,9 @@ export type DefaultProfileTemplate = Omit<
   provider: NonNullable<ProfileEntry["provider"]>;
 };
 
+/** One implementation of every default profile, keyed by profile key. */
+type ProfileImpls = Record<DefaultProfileKey, DefaultProfileTemplate>;
+
 /**
  * The `vellum` column: platform-managed implementations, stamped
  * `provider: "vellum"` — dispatch derives the upstream from the model.
@@ -68,7 +68,7 @@ export type DefaultProfileTemplate = Omit<
  * Overwritten in workspace config on every daemon boot so Vellum can push
  * model/config updates to customers in new releases.
  */
-const VELLUM_PROFILE_IMPLS: Record<ProfileMatrixKey, DefaultProfileTemplate> = {
+const VELLUM_PROFILE_IMPLS: ProfileImpls = {
   balanced: {
     model: "gpt-5.6-luna",
     provider: "vellum",
@@ -99,11 +99,11 @@ const VELLUM_PROFILE_IMPLS: Record<ProfileMatrixKey, DefaultProfileTemplate> = {
     model: "accounts/fireworks/models/deepseek-v4-flash",
     provider: "vellum",
     source: "managed",
-    label: "Speed",
+    label: "Cost",
     // Tier intent only - never name the concrete model here. Clients
     // surface the live model beside the description, so a model name in
     // this copy would go stale the moment the pin moves.
-    description: "Fastest responses at lower cost",
+    description: "Cheapest responses, for high-volume work",
     maxTokens: 8192,
     // Explicit reasoning opt-out. OpenAI-compat APIs default reasoning to
     // "medium" when the field is omitted, and effort-driven providers encode
@@ -116,22 +116,24 @@ const VELLUM_PROFILE_IMPLS: Record<ProfileMatrixKey, DefaultProfileTemplate> = {
     },
   },
   "latency-optimized": {
-    // The managed latency class. Its leading tokens are the live-voice
-    // turn-taking verdict, so what this profile optimizes is the tail of
-    // time-to-first-token rather than the median: a verdict slower than
-    // `liveVoice.frontModel.endpointDecisionTimeoutMs` trips the speculative
-    // fail-open commit in live-voice-session.ts, which is audible dead air.
+    // The managed latency class, also what the live-voice front model runs on.
+    // Its leading tokens are the turn-taking verdict, so what this profile
+    // optimizes is the tail of time-to-first-token rather than the median: a
+    // verdict slower than `liveVoice.frontModel.endpointDecisionTimeoutMs`
+    // trips the speculative fail-open commit in live-voice-session.ts, which
+    // is audible dead air.
     //
     // Two constraints bind the model id. Its managed credentials must be
     // provisioned in every environment, and it alone selects the upstream:
     // `provider` below is the provider-agnostic managed sentinel, so
     // `getManagedUpstream` resolves the real upstream from the model's catalog
-    // owner.
+    // owner. Sharing `balanced`'s model is deliberate: the split is effort
+    // and thinking, and this model is the one live-voice TTFT drives validated.
     model: "gpt-5.6-luna",
     provider: "vellum",
     source: "managed",
-    label: "Latency",
-    description: "Lowest time-to-first-token, for real-time call sites",
+    label: "Speed",
+    description: "Fastest responses, with reasoning turned off",
     maxTokens: 8192,
     effort: "low",
     thinking: { enabled: false, streamThinking: false },
@@ -150,7 +152,7 @@ const VELLUM_PROFILE_IMPLS: Record<ProfileMatrixKey, DefaultProfileTemplate> = {
  * per-request for any other default-capable provider.
  */
 const BYOK_PROFILE_IMPLS: Record<
-  ProfileMatrixKey,
+  DefaultProfileKey,
   Omit<DefaultProfileTemplate, "provider">
 > = {
   balanced: {
@@ -173,21 +175,24 @@ const BYOK_PROFILE_IMPLS: Record<
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
+  // On providers whose cheapest model is also their fastest (anthropic,
+  // ollama, fireworks) these two intents resolve the same model and the split
+  // is effort alone (see PROVIDER_MODEL_INTENTS).
   "cost-optimized": {
-    intent: "latency-optimized",
+    intent: "cost-optimized",
     source: "user",
-    label: "Speed",
-    description: "Fastest responses at lower cost",
+    label: "Cost",
+    description: "Cheapest responses, for high-volume work",
     maxTokens: 8192,
-    effort: "low",
+    effort: "none",
     thinking: { enabled: false, streamThinking: false },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
   "latency-optimized": {
     intent: "latency-optimized",
     source: "user",
-    label: "Latency",
-    description: "Lowest time-to-first-token, for real-time call sites",
+    label: "Speed",
+    description: "Fastest responses, with reasoning turned off",
     maxTokens: 8192,
     effort: "low",
     thinking: { enabled: false, streamThinking: false },
@@ -200,10 +205,10 @@ const BYOK_PROFILE_IMPLS: Record<
  * implementation of default profile `key` on `provider`.
  */
 export const PROFILE_IMPLS: Record<
-  ProfileMatrixKey,
+  DefaultProfileKey,
   Record<DefaultProfileProvider, DefaultProfileTemplate>
 > = Object.fromEntries(
-  PROFILE_MATRIX_KEYS.map((key) => [
+  DEFAULT_PROFILE_KEYS.map((key) => [
     key,
     Object.fromEntries(
       DEFAULT_PROFILE_PROVIDERS.map((provider) => [
@@ -215,7 +220,7 @@ export const PROFILE_IMPLS: Record<
     ) as Record<DefaultProfileProvider, DefaultProfileTemplate>,
   ]),
 ) as Record<
-  ProfileMatrixKey,
+  DefaultProfileKey,
   Record<DefaultProfileProvider, DefaultProfileTemplate>
 >;
 
@@ -229,18 +234,45 @@ export const MANAGED_PROFILE_TEMPLATES: Record<string, DefaultProfileTemplate> =
     DEFAULT_PROFILE_KEYS.map((key) => [key, PROFILE_IMPLS[key].vellum]),
   );
 
+/**
+ * The values BYOK hatch seeding wrote onto each `custom-*` copy, for the keys
+ * whose live template carries something else. The conversion pass recognizes
+ * an unedited copy by comparing it field-by-field against the frozen body, so
+ * every field here must describe what sits on disk, not what the profile
+ * resolves to today. A field the live template alone supplies makes every
+ * unedited copy read as user-edited and stop converting.
+ *
+ * `intent` selects the copy's model through `materializeProfile`, so it is the
+ * load-bearing pin. `label` is compared nowhere in the body, but
+ * `userOverlayState` reads it to tell a user rename from the hatch's own
+ * label, and a mismatch there carries a phantom rename onto the bare key.
+ */
+const HATCH_ERA_TEMPLATE_FIELDS: Partial<
+  Record<DefaultProfileKey, Partial<DefaultProfileTemplate>>
+> = {
+  "cost-optimized": {
+    intent: "latency-optimized",
+    label: "Speed",
+    description: "Fastest responses at lower cost",
+    effort: "low",
+  },
+};
+
 /**
  * Frozen record of the `custom-*` profile bodies that pre-conversion BYOK
  * hatches wrote to workspace config (the anthropic column; provider and
  * connection were overridden per hatch). Consumed by the existing-install
  * conversion pass as the reference for recognizing unedited copies, which
  * are safe to remove in favor of the code-resolved defaults.
+ *
+ * The `latency-optimized` entry exists for shape only: hatch seeding writes no
+ * `custom-latency-optimized`, so no install holds one to recognize.
  */
 export const USER_PROFILE_TEMPLATES: Record<string, DefaultProfileTemplate> =
   Object.fromEntries(
     DEFAULT_PROFILE_KEYS.map((key) => [
       `custom-${key}`,
-      PROFILE_IMPLS[key].anthropic,
+      { ...PROFILE_IMPLS[key].anthropic, ...HATCH_ERA_TEMPLATE_FIELDS[key] },
     ]),
   );
 
@@ -263,6 +295,17 @@ export const OS_BETA_PROFILE_TEMPLATE: DefaultProfileTemplate = {
   topP: 0.95,
 };
 
+/**
+ * Profiles whose body is code-owned outright: no workspace overlay, and no
+ * user-owned shadow. The shadow rule below lets a user replace a default they
+ * can select, but `latency-optimized` fronts every live-voice turn through
+ * `voiceFrontDecision`/`voiceFrontDoor`, where a model outside the latency
+ * envelope is audible dead air rather than a slow reply. A same-named
+ * workspace entry stays on disk and stays listed; it just never governs what
+ * this name resolves to.
+ */
+export const CODE_OWNED_PROFILE_NAMES = new Set<string>(["latency-optimized"]);
+
 // All managed profiles, including the flag-gated os-beta, are invariant:
 // their MANAGED-SOURCE entries are read-only to user-facing writes except
 // re-enabling a disabled one (enforced at commitConfigWrite). A user-owned
@@ -270,7 +313,6 @@ export const OS_BETA_PROFILE_TEMPLATE: DefaultProfileTemplate = {
 // the on-disk entry's `source` being `managed`.
 export const INVARIANT_PROFILE_NAMES = new Set<string>([
   ...DEFAULT_PROFILE_KEYS,
-  ...INTERNAL_PROFILE_KEYS,
   OS_BETA_PROFILE_KEY,
 ]);
 
@@ -283,7 +325,6 @@ export const INVARIANT_PROFILE_NAMES = new Set<string>([
 // same-named user profile.
 export const MANAGED_PROFILE_NAMES = new Set<string>([
   ...DEFAULT_PROFILE_KEYS,
-  ...INTERNAL_PROFILE_KEYS,
   OS_BETA_PROFILE_KEY,
 ]);
 
@@ -319,7 +360,7 @@ export function materializeProfile(
 // `PROVIDER_MODEL_INTENTS`' own check): exactly one of `intent`/`model` is
 // set, and every pinned model id exists in PROVIDER_CATALOG for its
 // underlying provider — catching drift when a model is renamed or removed.
-for (const key of PROFILE_MATRIX_KEYS) {
+for (const key of DEFAULT_PROFILE_KEYS) {
   for (const provider of DEFAULT_PROFILE_PROVIDERS) {
     const impl = PROFILE_IMPLS[key][provider];
     if ((impl.model == null) === (impl.intent == null)) {
@@ -355,7 +396,7 @@ for (const provider of DEFAULT_PROVIDER_CHOICES) {
   if (isDefaultProfileProvider(provider)) {
     continue;
   }
-  for (const key of PROFILE_MATRIX_KEYS) {
+  for (const key of DEFAULT_PROFILE_KEYS) {
     const { model } = materializeProfile(
       { ...BYOK_PROFILE_IMPLS[key], provider },
       provider,
@@ -372,7 +413,7 @@ for (const provider of DEFAULT_PROVIDER_CHOICES) {
 
 function buildDefaultProfileEntries(): Record<string, ProfileEntry> {
   const entries: Record<string, ProfileEntry> = {};
-  for (const key of PROFILE_MATRIX_KEYS) {
+  for (const key of DEFAULT_PROFILE_KEYS) {
     const impl = PROFILE_IMPLS[key].vellum;
     entries[key] = materializeProfile(impl, impl.provider);
   }
@@ -445,15 +486,7 @@ function resolveAgainstBody(
   if (body == null) {
     return workspace;
   }
-  // An internal profile's body is code-owned outright — no workspace overlay,
-  // not even a user-owned shadow. The shadow rule below exists so a user can
-  // deliberately replace a default they can see and select; an internal name
-  // was never selectable, so a same-named workspace entry (legal before the
-  // name was reserved) is unrelated state, not an override. Honoring it would
-  // silently hand a latency-class call site an arbitrary user model. The
-  // entry itself is untouched: it stays in `llm.profiles`, stays listed, and
-  // stays valid as an `activeProfile` reference.
-  if (isInternalProfileKey(name)) {
+  if (CODE_OWNED_PROFILE_NAMES.has(name)) {
     return { ...body };
   }
   if (workspace == null) {
@@ -506,27 +539,11 @@ export function isDefaultProfileKey(name: string): name is DefaultProfileKey {
   return (DEFAULT_PROFILE_KEYS as readonly string[]).includes(name);
 }
 
-/**
- * Whether a name is implemented by the intent × provider matrix — the
- * user-facing defaults plus the internal call-site-only profiles. This is the
- * predicate resolution uses: an internal profile must resolve through the
- * default provider's column exactly like a default, even though it is never
- * listed or seeded.
- */
-export function isMatrixProfileKey(name: string): name is ProfileMatrixKey {
-  return (PROFILE_MATRIX_KEYS as readonly string[]).includes(name);
-}
-
-/** Whether a name is a code-owned profile that must never be listed to users. */
-export function isInternalProfileKey(name: string): name is InternalProfileKey {
-  return (INTERNAL_PROFILE_KEYS as readonly string[]).includes(name);
-}
-
 function defaultProfileBodyForProvider(
   name: string,
   defaultProvider: DefaultProviderConfig | null,
 ): ProfileEntry | undefined {
-  if (defaultProvider == null || !isMatrixProfileKey(name)) {
+  if (defaultProvider == null || !isDefaultProfileKey(name)) {
     return CODE_DEFAULT_PROFILE_ENTRIES[name];
   }
   const { provider } = defaultProvider;
@@ -569,12 +586,6 @@ function clampMaxTokensToModelCap(body: ProfileEntry): ProfileEntry {
  * available code default, merged per `getEffectiveProfile`. This is the
  * record all runtime readers of `llm.profiles` should consume; the raw
  * workspace record is a write-path concern.
- *
- * Internal profiles are omitted: they exist only to be named by a call-site
- * default, so listing them would offer them as selectable models and let
- * `activeProfile`/`overrideProfile` validation accept them. Resolution
- * reaches them by name through `resolveDefaultProfileForProvider`, which
- * does not go through this record.
  */
 export function getEffectiveProfiles(
   workspaceProfiles: Record<string, ProfileEntry> | undefined,
@@ -586,9 +597,6 @@ export function getEffectiveProfiles(
     ...(workspaceProfiles ?? {}),
   };
   for (const name of Object.keys(catalogEntries)) {
-    if (isInternalProfileKey(name)) {
-      continue;
-    }
     const entry = getEffectiveProfile(workspaceProfiles, name, catalogEntries);
     if (entry != null) {
       effective[name] = entry;
@@ -613,9 +621,6 @@ export function getEffectiveProfilesForProvider(
     ...(workspaceProfiles ?? {}),
   };
   for (const name of Object.keys(CODE_DEFAULT_PROFILE_ENTRIES)) {
-    if (isInternalProfileKey(name)) {
-      continue;
-    }
     const entry = resolveDefaultProfileForProvider(
       workspaceProfiles,
       name,

package/src/config/default-profile-names.ts

@@ -6,41 +6,26 @@
  * import cycles.
  */
 
-/** Stable keys of the always-available default profiles. */
+/**
+ * Stable keys of the always-available default profiles, in picker order.
+ *
+ * A key is an on-disk contract: `llm.callSites.*.profile`, `activeProfile`,
+ * mix arms and schedule pins all reference it, so a key is fixed regardless of
+ * the label its profile carries. `cost-optimized` is labelled "Cost" and
+ * `latency-optimized` is labelled "Speed" (see `default-profile-catalog.ts`).
+ *
+ * `latency-optimized` also backs the live-voice front model, which is why it
+ * exists as a profile rather than a raw model pin on the call site: a pin
+ * resolves to a provider BYOK installs may hold no credential for.
+ */
 export const DEFAULT_PROFILE_KEYS = [
   "balanced",
   "quality-optimized",
   "cost-optimized",
+  "latency-optimized",
 ] as const;
 export type DefaultProfileKey = (typeof DEFAULT_PROFILE_KEYS)[number];
 
-/**
- * Code-owned profiles that exist only to be named by a call-site default —
- * never offered as a user-selectable model. They resolve through the same
- * intent × provider matrix as the defaults, but are deliberately excluded
- * from the workspace seed and from every profile listing, so the picker
- * still shows exactly Balanced / Speed / Quality.
- *
- * `latency-optimized` is the latency-class profile the live-voice front
- * model runs on: `cost-optimized`'s upstream cannot meet the turn-taking
- * latency envelope, and the alternative — a raw model pin on the call site —
- * resolves to a provider BYOK installs may hold no credential for.
- */
-export const INTERNAL_PROFILE_KEYS = ["latency-optimized"] as const;
-export type InternalProfileKey = (typeof INTERNAL_PROFILE_KEYS)[number];
-
-/**
- * Every key implemented by the intent × provider matrix: the user-selectable
- * defaults plus the internal call-site-only profiles. This is the set the
- * resolver dereferences against; `DEFAULT_PROFILE_KEYS` alone is the
- * user-facing subset.
- */
-export const PROFILE_MATRIX_KEYS = [
-  ...DEFAULT_PROFILE_KEYS,
-  ...INTERNAL_PROFILE_KEYS,
-] as const;
-export type ProfileMatrixKey = DefaultProfileKey | InternalProfileKey;
-
 /**
  * Flag-gated default profile: only available while the `os-beta` feature
  * flag has reconciled it into the workspace (see `sync-gated-profiles.ts`).

package/src/config/env-registry.ts

@@ -237,6 +237,7 @@ const KNOWN_VELLUM_VARS = new Set([
   "VELLUM_CPU_LIMIT",
   "VELLUM_MEMORY_LIMIT",
   "VELLUM_MINIKUBE_STORAGE_SIZE",
+  "VELLUM_ONNX_INTRA_OP_THREADS",
 ]);
 
 /**

package/src/config/feature-flag-registry.json

@@ -341,6 +341,14 @@
       "description": "Persist chat secret redactions as sentinel markers instead of the legacy HTML marker, enriched with the vault identity when the value byte-matches a credential revealed this turn. Also gates the `credentials reveal --for-chat` channel and the live-stream swap that replaces an echoed reveal plaintext with its sentinel before emission. Redaction itself is NOT gated: a route-proven reveal plaintext stays out of persisted rows in both modes. Client chip rendering is gated on daemon version, not on this flag.",
       "defaultEnabled": false
     },
+    {
+      "id": "assistant-switcher",
+      "scope": "client",
+      "key": "assistant-switcher",
+      "label": "Assistant Switcher",
+      "description": "Show the Switch Assistant section in General settings (local mode only), linking to the assistant chooser.",
+      "defaultEnabled": false
+    },
     {
       "id": "marketing-pricing-takeover",
       "scope": "client",
@@ -348,6 +356,14 @@
       "label": "Marketing Pricing Takeover",
       "description": "Gates the marketing pricing takeover page (www.vellum.ai/pricing) and the `/assistant/checkout?package=<slug>` deep link its package CTAs target. One flag covers both halves of the funnel so they can never be enabled independently and strand a CTA. When off, the checkout deep link redirects to the in-app plans takeover.",
       "defaultEnabled": false
+    },
+    {
+      "id": "assistant-reply-push",
+      "scope": "assistant",
+      "key": "assistant-reply-push",
+      "label": "Assistant Reply Push",
+      "description": "Gates the `chat.assistant_reply` push notification the assistant sends at the end of a user-initiated turn whose reply the user has not seen. On by default; turn it off to silence the push without disabling the rest of the notification pipeline.",
+      "defaultEnabled": true
     }
   ]
 }

package/src/config/llm-resolver.ts

@@ -11,7 +11,7 @@ import {
 } from "../providers/vellum-model-routing.js";
 import { CALL_SITE_DEFAULTS } from "./call-site-defaults.js";
 import {
-  isMatrixProfileKey,
+  isDefaultProfileKey,
   resolveDefaultProfileForProvider,
 } from "./default-profile-catalog.js";
 import {
@@ -114,12 +114,29 @@ export interface ResolveCallSiteOpts {
 
 export type ResolutionFallbackReason = "missing" | "disabled" | "incomplete";
 
+export interface ResolvedCallSiteConfig {
+  config: z.infer<typeof LLMConfigBase>;
+  profileName?: string;
+}
+
+export function resolveCallSiteConfigWithProfile(
+  callSite: LLMCallSite,
+  llm: z.infer<typeof LLMSchema>,
+  opts: ResolveCallSiteOpts = {},
+): ResolvedCallSiteConfig {
+  const selection = selectWinningProfile(callSite, llm, opts);
+  return {
+    config: resolveOverrideOrDefault(callSite, llm, selection),
+    ...(selection.profileName ? { profileName: selection.profileName } : {}),
+  };
+}
+
 export function resolveCallSiteConfig(
   callSite: LLMCallSite,
   llm: z.infer<typeof LLMSchema>,
   opts: ResolveCallSiteOpts = {},
 ): z.infer<typeof LLMConfigBase> {
-  return resolveOverrideOrDefault(callSite, llm, opts);
+  return resolveCallSiteConfigWithProfile(callSite, llm, opts).config;
 }
 
 // ─── Single-winner profile resolution ───────────────────────────────────────
@@ -234,7 +251,7 @@ function providerAwareEntry(
     name,
     defaultProvider,
   );
-  if (!isMatrixProfileKey(name) || entry?.mix != null) {
+  if (!isDefaultProfileKey(name) || entry?.mix != null) {
     return entry;
   }
   if (
@@ -358,9 +375,8 @@ const CODE_DEFAULT_BASE: z.infer<typeof LLMConfigBase> = LLMConfigBase.parse(
 function resolveOverrideOrDefault(
   callSite: LLMCallSite,
   llm: z.infer<typeof LLMSchema>,
-  opts: ResolveCallSiteOpts,
+  selection: ProfileWinnerSelection,
 ): z.infer<typeof LLMConfigBase> {
-  const selection = selectWinningProfile(callSite, llm, opts);
   const winnerFragment: Mergeable =
     selection.entry == null ? {} : winnerConfigFragment(selection.entry);
 

package/src/config/loader.ts

@@ -1119,17 +1119,24 @@ export function loadConfig(): AssistantConfig {
         // Drop the deployment-context embedding provider so it is never
         // persisted (see above); the schema default re-applies in memory.
         delete (seed.memory.embeddings as { provider?: unknown }).provider;
-        // Memory-v3 tuning knobs are globally-shipped defaults, not per-assistant
-        // config: persist only `live` (genuine per-assistant state — some
-        // workspaces predate the v3 migration and must not be flipped on) and let
-        // every tuning knob resolve from the schema on load. This way a shipped
-        // schema-default change reaches all assistants (mirrors the
-        // embedding-provider strip above); migration
-        // 119-strip-persisted-memory-v3-tuning-defaults handles already-seeded
-        // configs.
-        seed.memory.v3 = {
-          live: seed.memory.v3.live,
-        } as (typeof seed.memory)["v3"];
+        // Nothing under memory.v3 is persisted at seed time.
+        //
+        // The tuning knobs are globally-shipped defaults: freezing them to
+        // disk would stop a shipped default change from reaching this
+        // assistant (mirrors the embedding-provider strip above; migration 119
+        // strips them from configs that already carry them).
+        //
+        // `live` stays absent because an absent leaf is the only way to
+        // express "no decision recorded". This seed runs before workspace
+        // migrations, and migration 105 defers to any value already present
+        // (`if ("live" in v3Config) return`), unable to tell a deliberate
+        // choice from a schema default. Writing the leaf here would pin a
+        // brand-new workspace to the schema default; leaving it absent lets
+        // 105 decide regardless of boot ordering. The schema default still
+        // applies in memory on every load, and a hatch-time
+        // `memory.v3.live=false` override still wins by merging after
+        // migrations.
+        seed.memory.v3 = {} as (typeof seed.memory)["v3"];
         // Strip dataDir (runtime-derived) from the persisted config
         const { dataDir: _, ...persistable } = seed;
         writeFileSync(configPath, JSON.stringify(persistable, null, 2) + "\n");

package/src/config/schemas/llm.ts

@@ -10,7 +10,6 @@ import {
 import {
   DEFAULT_PROFILE_KEYS,
   DEFAULT_PROFILE_PROVIDERS,
-  INTERNAL_PROFILE_KEYS,
 } from "../default-profile-names.js";
 
 /**
@@ -714,18 +713,11 @@ export const LLMSchema = z
       ...Object.keys(config.profiles ?? {}),
       ...DEFAULT_PROFILE_KEYS,
     ]);
-    // Internal profiles exist only to be named by a call site, so they are
-    // valid reference targets there and nowhere else — never for
-    // `activeProfile`/`advisorProfile`, which are user-facing selections.
-    const callSiteProfileNames = new Set([
-      ...profileNames,
-      ...INTERNAL_PROFILE_KEYS,
-    ]);
     for (const [siteId, siteConfig] of Object.entries(config.callSites ?? {})) {
       if (siteConfig?.profile == null) {
         continue;
       }
-      if (!callSiteProfileNames.has(siteConfig.profile)) {
+      if (!profileNames.has(siteConfig.profile)) {
         ctx.addIssue({
           code: "custom",
           path: ["callSites", siteId, "profile"],

package/src/config/schemas/memory-retrospective.ts

@@ -39,6 +39,15 @@ export const MemoryRetrospectiveConfigSchema = z
         "Minimum milliseconds between attempts (success or failure). Prevents tight retry loops across trigger types. Pre-compaction bypasses this gate.",
       ),
 
+    requireUserActivity: z
+      .boolean({
+        error: "memory.retrospective.requireUserActivity must be a boolean",
+      })
+      .default(true)
+      .describe(
+        "When true (default), a retrospective fires only when the unprocessed tail contains at least one user message carrying non-tool_result content. Tool results ride on user-role rows, so bare tool-result carriers do not count as user activity. Assistant-only stretches (proactive sends, broadcast recaps) are skipped with the cursor left in place, so the first retrospective after real user activity reviews the whole deferred stretch. Set false to run retrospectives over assistant-only activity as well.",
+      ),
+
     sweepIntervalMs: z
       .number({
         error: "memory.retrospective.sweepIntervalMs must be a number",

package/src/config/schemas/monitoring.ts

@@ -6,8 +6,9 @@ import { z } from "zod";
  * The resource monitor runs as a separate OS process (a child of the assistant)
  * that samples the container's own cgroup memory + workspace disk off the main
  * event loop, so it keeps recording during a main-thread freeze and its samples
- * survive an OOM SIGKILL. The assistant spawns it at every startup — it is
- * platform infrastructure, not an opt-in feature, and there is deliberately no
+ * survive an OOM SIGKILL. On a slower timer it also compares each process's
+ * open file-descriptor count against its limit. The assistant spawns it at every
+ * startup: it is platform infrastructure, not an opt-in feature, and there is no
  * config switch to turn it off. `assistant monitoring start`/`stop` control the
  * process at runtime only; a stopped monitor respawns on the next boot.
  */
@@ -49,6 +50,31 @@ export const MonitoringConfigSchema = z
       .describe(
         "Minimum interval between high-memory snapshots, in milliseconds, so a sustained spike does not write a snapshot on every sample.",
       ),
+    fdPollIntervalMs: z
+      .number({ error: "monitoring.fdPollIntervalMs must be a number" })
+      .int("monitoring.fdPollIntervalMs must be an integer")
+      .min(1_000, "monitoring.fdPollIntervalMs must be at least 1000ms")
+      .max(1_800_000, "monitoring.fdPollIntervalMs must be <= 1800000ms")
+      .default(300_000)
+      .describe(
+        "How often the monitor walks the container's processes to compare their open file-descriptor counts against their limits, in milliseconds. Far slower than the memory sampler (default 5 minutes) because the walk costs a readdir per process and descriptor counts climb over minutes, not milliseconds.",
+      ),
+    highFdThresholdRatio: z
+      .number({ error: "monitoring.highFdThresholdRatio must be a number" })
+      .min(0.1, "monitoring.highFdThresholdRatio must be >= 0.1")
+      .max(1, "monitoring.highFdThresholdRatio must be <= 1")
+      .default(0.8)
+      .describe(
+        "Fraction of a process's open-file soft limit (RLIMIT_NOFILE) at which the monitor logs a warning identifying the PIDs involved. Default 0.8, leaving headroom before open() starts failing with EMFILE.",
+      ),
+    fdWarnCooldownMs: z
+      .number({ error: "monitoring.fdWarnCooldownMs must be a number" })
+      .int("monitoring.fdWarnCooldownMs must be an integer")
+      .min(0, "monitoring.fdWarnCooldownMs must be non-negative")
+      .default(60_000)
+      .describe(
+        "Minimum interval between file-descriptor warnings while usage stays over the threshold, in milliseconds. Crossing the threshold always warns immediately; this only throttles the repeats.",
+      ),
     pluginSourceScanIntervalMs: z
       .number({
         error: "monitoring.pluginSourceScanIntervalMs must be a number",

package/src/config/schemas/workspace-git.ts

@@ -34,6 +34,21 @@ export const WorkspaceGitConfigSchema = z
       .describe(
         "Files larger than this (bytes) are excluded from workspace auto-commits",
       ),
+    historyCompaction: z
+      .object({
+        enabled: z
+          .boolean({
+            error: "workspaceGit.historyCompaction.enabled must be a boolean",
+          })
+          .default(true)
+          .describe(
+            "Whether background history compaction runs automatically. Manual compaction via the admin route is unaffected.",
+          ),
+      })
+      .default({ enabled: true })
+      .describe(
+        "Background compaction of workspace git history (squashes commits older than the retention window to reclaim oversized blobs from .git)",
+      ),
     interactiveGitTimeoutMs: z
       .number({
         error: "workspaceGit.interactiveGitTimeoutMs must be a number",