@vellumai/assistant 0.11.2-dev.202608071521.2d2f93e → 0.11.2-dev.202608071719.8f7a9f1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608071521.2d2f93e",
+  "version": "0.11.2-dev.202608071719.8f7a9f1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/conversation-process-app-control-preactivation.test.ts

@@ -86,6 +86,7 @@ import {
   MessageQueue,
   type QueuedMessage,
 } from "../daemon/conversation-queue-manager.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 
 // ---------------------------------------------------------------------------
 // Fake context — captures preactivation calls, satisfies the bare minimum
@@ -172,6 +173,7 @@ function makeQueuedMessage(opts: {
   content?: string;
   turnInterfaceContext?: TurnInterfaceContext;
   sourceActorPrincipalId?: string;
+  trustContext?: TrustContext;
 }): QueuedMessage {
   return {
     content: opts.content ?? "follow up",
@@ -185,6 +187,7 @@ function makeQueuedMessage(opts: {
     authContext: opts.sourceActorPrincipalId
       ? ({ actorPrincipalId: opts.sourceActorPrincipalId } as never)
       : undefined,
+    trustContext: opts.trustContext,
   };
 }
 
@@ -371,6 +374,126 @@ describe("drainQueue preactivation re-add for host-proxy interfaces", () => {
     expect(ctx.currentTurnSourceActorPrincipalId).toBe("trusted-contact-user");
   });
 
+  test("drainSingleMessage runs the turn under the queued sender's trust, not the live slot", async () => {
+    // The conversation-level slot holds whichever actor sent most recently.
+    // A message that waited while someone else sent must still run as its own
+    // sender: trust decides `trustClass`, `executionChannel`, and
+    // `requesterExternalUserId`, so reading the slot hands the whole
+    // tool-approval path the wrong identity in both directions -- a contact
+    // inheriting guardian self-approval, or a guardian's own call escalating
+    // back to her as a contact's grant request.
+    const contactTrust: TrustContext = {
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact",
+        trustContext: contactTrust,
+      }),
+    );
+    const ctx = makeFakeContext({ queue });
+    // Someone else sent after this message was queued, moving the slot.
+    ctx.trustContext = {
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    };
+
+    await drainQueue(ctx);
+
+    expect(ctx.currentTurnTrustContext?.trustClass).toBe("trusted_contact");
+    expect(ctx.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+    expect(ctx.currentTurnTrustContext?.sourceChannel).toBe("slack");
+    // The slot itself is left alone; only the turn's view is corrected.
+    expect(ctx.trustContext?.trustClass).toBe("guardian");
+  });
+
+  test("buildPassthroughBatch refuses to coalesce two channel senders", async () => {
+    // Channel senders carry no principal, so the `sourceActorPrincipalId`
+    // boundary sees `undefined === undefined` and would batch two different
+    // Slack contacts into one turn running under the head's trust. The batch
+    // must split on the sender's trust identity instead.
+    const ifCtx: TurnInterfaceContext = {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact-a",
+        content: "from A",
+        turnInterfaceContext: ifCtx,
+        trustContext: {
+          trustClass: "trusted_contact",
+          sourceChannel: "slack",
+          requesterExternalUserId: "U-alex",
+        },
+      }),
+    );
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-contact-b",
+        content: "from B",
+        turnInterfaceContext: ifCtx,
+        trustContext: {
+          trustClass: "trusted_contact",
+          sourceChannel: "slack",
+          requesterExternalUserId: "U-blake",
+        },
+      }),
+    );
+    const ctx = makeFakeContext({ queue, turnInterfaceContext: ifCtx });
+
+    await drainQueue(ctx);
+
+    // B stays queued: it gets its own turn under its own trust.
+    expect(queue.length).toBe(1);
+    expect(queue.peek(0)?.requestId).toBe("req-contact-b");
+    expect(ctx.currentTurnTrustContext?.requesterExternalUserId).toBe("U-alex");
+  });
+
+  test("buildPassthroughBatch still coalesces two messages from the same sender", async () => {
+    // Sensitivity check on the split above: identical trust must still batch,
+    // otherwise the boundary would be splitting on something incidental and
+    // the test above would pass for the wrong reason.
+    const ifCtx: TurnInterfaceContext = {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    };
+    const sameTrust: TrustContext = {
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-alex",
+    };
+    const queue = new MessageQueue();
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-a1",
+        content: "first",
+        turnInterfaceContext: ifCtx,
+        trustContext: { ...sameTrust },
+      }),
+    );
+    queue.push(
+      makeQueuedMessage({
+        requestId: "req-a2",
+        content: "second",
+        turnInterfaceContext: ifCtx,
+        trustContext: { ...sameTrust },
+      }),
+    );
+    const ctx = makeFakeContext({ queue, turnInterfaceContext: ifCtx });
+
+    await drainQueue(ctx);
+
+    expect(queue.length).toBe(0);
+  });
+
   test("drainSingleMessage does NOT re-add 'app-control' for web-sourced message when no capable client is connected", async () => {
     // mockCapabilityClients remains [] (reset by afterEach from prior test)
     const queue = new MessageQueue();

package/src/__tests__/conversation-queue.test.ts

@@ -556,6 +556,98 @@ describe("Conversation message queue", () => {
     await new Promise((r) => setTimeout(r, 10));
   });
 
+  test("enqueueMessage captures the sender's trust, immune to a later slot change", async () => {
+    // Trust must ride with the queued message. The conversation-level slot is
+    // rewritten by whoever sends next, so a message that reads it at drain time
+    // would run as the wrong actor. Capturing at enqueue is what makes the
+    // drain's identity independent of who sent afterwards.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({ content: "msg-2", requestId: "req-2" });
+
+    // A different actor sends while the message waits, moving the slot.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    const queued = conversation.queue.peek(0);
+    expect(queued?.requestId).toBe("req-2");
+    expect(queued?.trustContext?.trustClass).toBe("trusted_contact");
+    expect(queued?.trustContext?.requesterExternalUserId).toBe("U-contact");
+
+    await resolveRun(0);
+    await p1;
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
+  test("a drained turn keeps its sender's trust once the agent loop is running", async () => {
+    // Exercises the real drain -> runAgentLoop ordering against a live
+    // Conversation. The loop re-initializes the per-turn trust snapshot on
+    // entry, so a drain that only stamped the field before calling it would
+    // have that stamp silently undone and the turn would execute as whoever
+    // sent most recently. Asserting inside the run is the point: checking
+    // before the loop starts passes either way.
+    const conversation = makeConversation();
+    await conversation.loadFromDb();
+
+    conversation.setTrustContext({
+      trustClass: "trusted_contact",
+      sourceChannel: "slack",
+      requesterExternalUserId: "U-contact",
+    });
+
+    const p1 = conversation.processMessage({
+      content: "msg-1",
+      attachments: [],
+      onEvent: () => {},
+      requestId: "req-1",
+    });
+    await waitForPendingRun(1);
+
+    conversation.enqueueMessage({ content: "msg-2", requestId: "req-2" });
+
+    // The guardian sends while the contact's message waits, moving the slot.
+    conversation.setTrustContext({
+      trustClass: "guardian",
+      sourceChannel: "vellum",
+      requesterExternalUserId: "guardian-principal",
+    });
+
+    // Finish the first turn so the queue drains into a second run.
+    await resolveRun(0);
+    await p1;
+    await waitForPendingRun(2);
+
+    // Read while run 2 is in flight: this is what tool setup and the
+    // guardian-request producers resolve against.
+    expect(conversation.currentTurnTrustContext?.trustClass).toBe(
+      "trusted_contact",
+    );
+    expect(conversation.currentTurnTrustContext?.requesterExternalUserId).toBe(
+      "U-contact",
+    );
+
+    await resolveRun(1);
+    await new Promise((r) => setTimeout(r, 10));
+  });
+
   test("[experimental] queued passthrough siblings drain as a single batched run", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();

package/src/__tests__/oauth-provider-seed-logos.test.ts

@@ -1,7 +1,44 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
 import { PROVIDER_SEED_DATA } from "../oauth/seed-providers.js";
 
+const REPO_ROOT = dirname(dirname(dirname(import.meta.dir)));
+const WEB_PUBLIC_DIR = join(REPO_ROOT, "clients/web/public");
+const INTEGRATION_ICON_SOURCE = join(
+  REPO_ROOT,
+  "clients/web/src/components/integrations/integration-icon.tsx",
+);
+
+/**
+ * Provider keys the web client draws without a `BUNDLED_LOGO_URLS` entry.
+ * Google's mark is multi-colour, so it ships as the `GoogleLogo` component
+ * and is returned before the bundled-asset lookup runs.
+ */
+const COMPONENT_RENDERED_PROVIDERS = new Set(["google"]);
+
+/** `publicAsset("/images/...")` paths from `BUNDLED_LOGO_URLS`, by key. */
+function readBundledLogoMap(): Map<string, string> {
+  const source = readFileSync(INTEGRATION_ICON_SOURCE, "utf8");
+  const block = source.match(
+    /const BUNDLED_LOGO_URLS: Record<string, string> = \{([\s\S]*?)\n\};/,
+  );
+  if (!block) {
+    throw new Error(
+      `Could not find BUNDLED_LOGO_URLS in ${INTEGRATION_ICON_SOURCE}. If it ` +
+        `was renamed or restructured, update this test rather than deleting it.`,
+    );
+  }
+  const entries = new Map<string, string>();
+  for (const [, key, path] of block[1]!.matchAll(
+    /(\w+):\s*publicAsset\("([^"]+)"\)/g,
+  )) {
+    entries.set(key!, path!);
+  }
+  return entries;
+}
+
 /**
  * Allowed CDN prefixes for the ``logoUrl`` field on ``PROVIDER_SEED_DATA``
  * (``assistant/src/oauth/seed-providers.ts``):
@@ -41,3 +78,31 @@ describe("PROVIDER_SEED_DATA logo URLs", () => {
     expect(invalid).toEqual([]);
   });
 });
+
+/**
+ * The `logoUrl` above is a fallback for providers registered at runtime. Every
+ * provider we seed ourselves must draw from an asset we ship, because an icon
+ * CDN can drop a brand at any time and the client then degrades to an initials
+ * avatar with nothing in CI to notice: the prefix check above passes just as
+ * happily for a URL that 404s. Simple Icons hosts no Microsoft mark and no
+ * Slack mark, so the seeded URLs for those brands do not resolve there.
+ */
+describe("PROVIDER_SEED_DATA bundled logo coverage", () => {
+  test("every seeded provider renders from a bundled asset", () => {
+    const bundled = readBundledLogoMap();
+    const uncovered = Object.keys(PROVIDER_SEED_DATA).filter(
+      (provider) =>
+        !bundled.has(provider) && !COMPONENT_RENDERED_PROVIDERS.has(provider),
+    );
+
+    expect(uncovered).toEqual([]);
+  });
+
+  test("every bundled logo path resolves to a file on disk", () => {
+    const missingFiles = [...readBundledLogoMap()]
+      .filter(([, path]) => !existsSync(join(WEB_PUBLIC_DIR, path)))
+      .map(([provider, path]) => ({ provider, path }));
+
+    expect(missingFiles).toEqual([]);
+  });
+});

package/src/__tests__/tool-grant-request-escalation.test.ts

@@ -101,17 +101,20 @@ import {
   getRegisteredKinds,
   getResolver,
 } from "../approvals/guardian-request-resolvers.js";
+import { getConfig } from "../config/loader.js";
 import { getDb } from "../persistence/db-connection.js";
 import { getSqlite } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import { scopedApprovalGrants } from "../persistence/schema/index.js";
 import {
+  TC_GRANT_WAIT_MAX_MS,
   ToolApprovalHandler,
   waitForInlineGrant,
 } from "../tools/tool-approval-handler.js";
 import type { ToolContext } from "../tools/types.js";
+import { setConfig } from "./helpers/set-config.js";
 
-/** Short wait config for tests — avoids blocking test suite on the 60s default. */
+/** Short wait config for tests: keeps escalation cases off the real budget. */
 const TEST_INLINE_WAIT_CONFIG = { maxWaitMs: 100, intervalMs: 20 };
 
 await initializeDb();
@@ -490,6 +493,42 @@ describe("inline wait-and-resume", () => {
     expect(elapsed).toBeLessThan(500);
   });
 
+  test("waitForInlineGrant spends timeouts.permissionTimeoutSec when no explicit budget is given", async () => {
+    // The guardian's escalation window must track the configured approval
+    // budget rather than a compiled-in constant, so an operator raising
+    // permissionTimeoutSec actually widens the window a guardian has to
+    // answer in. Omitting maxWaitMs is what production does.
+    const priorTimeouts = getConfig().timeouts;
+    setConfig("timeouts", {
+      ...priorTimeouts,
+      permissionTimeoutSec: 0.15,
+    });
+    try {
+      const req = seedGrantRequest("sha256:configbudget");
+
+      const start = Date.now();
+      const result = await waitForInlineGrant(
+        req.id,
+        {
+          toolName: "bash",
+          inputDigest: "sha256:configbudget",
+          consumingRequestId: "consume-config-budget",
+        },
+        { intervalMs: 20 },
+      );
+      const elapsed = Date.now() - start;
+
+      expect(result.outcome).toBe("timeout");
+      // Bounded well under TC_GRANT_WAIT_MAX_MS: a regression that ignores
+      // config and falls back to the constant blows this ceiling by ~400x.
+      expect(elapsed).toBeGreaterThanOrEqual(120);
+      expect(elapsed).toBeLessThan(3_000);
+      expect(elapsed).toBeLessThan(TC_GRANT_WAIT_MAX_MS);
+    } finally {
+      setConfig("timeouts", priorTimeouts);
+    }
+  }, 10_000);
+
   test("waitForInlineGrant returns aborted when signal fires during wait", async () => {
     const req = seedGrantRequest("sha256:abortwait");
 

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -170,6 +170,7 @@ mock.module("../channels/gateway-guardian-requests.js", () => sim.module);
 import { applyGuardianDecision } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
 import { getResolver } from "../approvals/guardian-request-resolvers.js";
+import { getConfig } from "../config/loader.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
@@ -177,12 +178,14 @@ import { scopedApprovalGrants } from "../persistence/schema/index.js";
 import { bridgeConfirmationRequestToGuardian } from "../runtime/confirmation-request-guardian-bridge.js";
 import { resolveRoutingState } from "../runtime/trust-context-resolver.js";
 import {
+  resolveInlineGrantWaitMs,
   TC_GRANT_WAIT_MAX_MS,
   ToolApprovalHandler,
   waitForInlineGrant,
 } from "../tools/tool-approval-handler.js";
 import type { ToolContext } from "../tools/types.js";
 import { seedContactChannel } from "./helpers/seed-contact-channel.js";
+import { setConfig } from "./helpers/set-config.js";
 
 await initializeDb();
 
@@ -754,7 +757,10 @@ describe("(f) timeout/stale flow: stale guardian decision after inline wait time
   test("inline_wait_active staleness guard: expired marker allows retry notification", async () => {
     // Create a guardian request with a stale inline_wait_active marker
     // that simulates a daemon crash during the wait.
-    const staleTimestamp = Date.now() - TC_GRANT_WAIT_MAX_MS - 60_000;
+    // Age the marker past the real wait budget, which the resolver's
+    // staleness threshold tracks. Deriving it from the same helper the
+    // waiter uses keeps this case meaningful if the budget changes.
+    const staleTimestamp = Date.now() - resolveInlineGrantWaitMs() - 60_000;
     const req = sim.seedRequest({
       id: `req-stale-${Date.now()}`,
       kind: "tool_grant_request",
@@ -802,6 +808,67 @@ describe("(f) timeout/stale flow: stale guardian decision after inline wait time
     expect(retryNotifications.length).toBeGreaterThan(0);
   });
 
+  test("inline_wait_active marker older than the fallback constant but inside the real budget still suppresses retry", async () => {
+    // The staleness threshold must track the wait budget, not the fallback
+    // constant. A marker aged past TC_GRANT_WAIT_MAX_MS + buffer but still
+    // well inside the configured budget belongs to a waiter that is very
+    // much alive: telling the requester to retry would race a call that is
+    // about to resume, and the retry then fails against the one-time grant
+    // the live waiter consumes.
+    const priorTimeouts = getConfig().timeouts;
+    // Seed the budget rather than leaning on the ambient default, so the
+    // window this case probes exists no matter what the suite's config holds.
+    setConfig("timeouts", { ...priorTimeouts, permissionTimeoutSec: 300 });
+    try {
+      const budgetMs = resolveInlineGrantWaitMs();
+      // Comfortably past the old 90s threshold, comfortably short of the budget.
+      const markerAgeMs = TC_GRANT_WAIT_MAX_MS + 45_000;
+      const liveTimestamp = Date.now() - markerAgeMs;
+      expect(markerAgeMs).toBeLessThan(budgetMs);
+
+      const req = sim.seedRequest({
+        id: `req-live-${Date.now()}`,
+        kind: "tool_grant_request",
+        sourceType: "channel",
+        sourceChannel: "telegram",
+        sourceConversationId: "conv-live-1",
+        requesterExternalUserId: "requester-1",
+        requesterChatId: "requester-chat-1",
+        guardianExternalUserId: "guardian-1",
+        guardianPrincipalId: "test-principal-id",
+        toolName: "bash",
+        inputDigest: "sha256:livewait",
+        expiresAt: Date.now() + 60_000,
+      });
+
+      await sim.module.updateGuardianRequest(req.id, {
+        followupState: `inline_wait_active:${liveTimestamp}`,
+      });
+
+      deliveredReplies.length = 0;
+      const approvalResult = await applyGuardianDecision({
+        requestId: req.id,
+        action: "approve_once",
+        actorContext: guardianActor(),
+        channelDeliveryContext: {
+          replyCallbackUrl: "http://localhost:3000/reply",
+          guardianChatId: "guardian-chat-1",
+          assistantId: "self",
+        },
+      });
+      expect(approvalResult.applied).toBe(true);
+
+      const retryNotifications = deliveredReplies.filter(
+        (r) =>
+          typeof r.payload.text === "string" &&
+          (r.payload.text as string).includes("Please retry"),
+      );
+      expect(retryNotifications.length).toBe(0);
+    } finally {
+      setConfig("timeouts", priorTimeouts);
+    }
+  });
+
   test("fresh inline_wait_active marker suppresses retry notification", async () => {
     // Create a request with a FRESH inline_wait_active marker
     const freshTimestamp = Date.now();

package/src/approvals/guardian-request-resolvers.ts

@@ -54,7 +54,7 @@ import {
   readBatchMetadata,
   resolvePendingQuestion,
 } from "../runtime/question-resolution.js";
-import { TC_GRANT_WAIT_MAX_MS } from "../tools/tool-approval-handler.js";
+import { resolveInlineGrantWaitMs } from "../tools/tool-approval-handler.js";
 import { getLogger } from "../util/logger.js";
 import {
   channelCanAddressOneReaderInBand,
@@ -1587,7 +1587,10 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
     // outlive the actual waiter if the daemon crashes or restarts during
     // the wait. To avoid permanently suppressing the retry notification, we
     // treat the marker as stale if the encoded start timestamp is older than
-    // the maximum wait budget plus a 30s buffer.
+    // the maximum wait budget plus a 30s buffer. The budget is read from the
+    // same resolver the waiter itself uses, so a config change moves both
+    // together; sizing this off a constant would let it fall below the real
+    // wait and declare a live waiter dead.
     const INLINE_WAIT_STALENESS_BUFFER_MS = 30_000;
     const freshRequest = await getGuardianRequestOrNull(request.id);
     const followupState = freshRequest?.followupState ?? "";
@@ -1604,7 +1607,7 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
         ? Date.now() - waitStartMs
         : Infinity; // Treat unparseable timestamps as stale for safety.
       const stalenessThresholdMs =
-        TC_GRANT_WAIT_MAX_MS + INLINE_WAIT_STALENESS_BUFFER_MS;
+        resolveInlineGrantWaitMs() + INLINE_WAIT_STALENESS_BUFFER_MS;
       if (markerAgeMs > stalenessThresholdMs) {
         log.warn(
           {

package/src/config/schemas/timeouts.ts

@@ -26,7 +26,7 @@ export const TimeoutConfigSchema = z
       .positive("timeouts.permissionTimeoutSec must be a positive number")
       .default(300)
       .describe(
-        "How long to wait for user permission approval before timing out (seconds)",
+        "How long to wait for a human to approve a tool call before timing out (seconds). Spent by both approval paths: the interactive permission prompt, and the inline wait when a contact's sensitive tool call is escalated to the guardian.",
       ),
     questionResponseTimeoutSec: z
       .number({ error: "timeouts.questionResponseTimeoutSec must be a number" })

package/src/daemon/conversation-agent-loop.ts

@@ -366,6 +366,13 @@ export async function runAgentLoopImpl(
      * scheduled execute turn attributes its LLM spend to that firing.
      */
     cronRunId?: string | null;
+    /**
+     * Trust this turn runs under. Queue drains pass the trust captured from
+     * the sender at enqueue; without it the initialization below would reset
+     * the turn to the conversation slot, which holds whichever actor sent
+     * most recently rather than the one this turn belongs to.
+     */
+    turnTrustContext?: TrustContext;
   },
 ): Promise<void> {
   if (!ctx.abortController) {
@@ -376,9 +383,12 @@ export async function runAgentLoopImpl(
   // voice-session-bridge, regenerate, etc.) that invoke runAgentLoop directly
   // without going through processMessage/drainQueue. This ensures the system
   // prompt callback always reads a valid snapshot rather than undefined.
-  // processMessage/drainQueue set these fields before calling runAgentLoop;
-  // those existing assignments remain correct and are merely redundant here.
-  ctx.currentTurnTrustContext = ctx.trustContext;
+  //
+  // A queue drain runs a message whose sender may not be the conversation's
+  // most recent one, so it passes that sender's trust explicitly. Falling back
+  // to the slot here would undo the drain's stamp and hand the turn back to
+  // whoever sent last.
+  ctx.currentTurnTrustContext = options?.turnTrustContext ?? ctx.trustContext;
   ctx.currentTurnChannelCapabilities = ctx.channelCapabilities;
 
   // Re-resolve the system prompt under the snapshots just set and push it into

package/src/daemon/conversation-messaging.ts

@@ -565,6 +565,12 @@ export interface EnqueueMessageOptions {
   sourceActorPrincipalId?: string;
   /** Auth context snapshot captured for queued turn-scoped authorization. */
   authContext?: AuthContext;
+  /**
+   * Sender's trust, for the drain to run this message under. Defaults to the
+   * conversation's trust at enqueue time, which the sending route has just
+   * set to this sender.
+   */
+  trustContext?: TrustContext;
 }
 
 // ── enqueueMessage ───────────────────────────────────────────────────
@@ -593,6 +599,9 @@ export function enqueueMessage(
     options.sourceActorPrincipalId ??
     ctx.currentTurnSourceActorPrincipalId ??
     queuedAuthContext?.actorPrincipalId;
+  // Deliberately not falling back to `currentTurnTrustContext`: that is the
+  // in-flight turn's actor, which is precisely who this message is not from.
+  const queuedTrustContext = options.trustContext ?? ctx.trustContext;
 
   if (!ctx.isProcessing()) {
     return { queued: false, requestId };
@@ -619,6 +628,7 @@ export function enqueueMessage(
     isInteractive,
     sourceActorPrincipalId,
     authContext: queuedAuthContext,
+    trustContext: queuedTrustContext,
     transport,
     displayContent,
     sentAt: Date.now(),
@@ -668,6 +678,14 @@ export interface PersistMessageOptions {
   metadata?: Record<string, unknown>;
   displayContent?: string;
   clientMessageId?: string;
+  /**
+   * Trust to attribute the stored row to. Queue drains pass the sender's
+   * captured trust so persisted provenance names the same actor the turn
+   * executes as; the conversation slot may by then hold someone else.
+   * Defaults to the conversation's trust, which is correct for callers
+   * persisting a message the current actor just sent.
+   */
+  trustContext?: TrustContext;
   /**
    * Persist the row without indexing it (no memory segments, embeddings, or
    * lexical-index entry). For machine-authored prompts that must not enter
@@ -844,7 +862,9 @@ export async function persistQueuedMessageBody(
       extractTurnChannelContext(metadata) ?? ctx.getTurnChannelContext();
     const turnIfCtx =
       extractTurnInterfaceContext(metadata) ?? ctx.getTurnInterfaceContext();
-    const provenance = provenanceFromTrustContext(ctx.trustContext);
+    const provenance = provenanceFromTrustContext(
+      options.trustContext ?? ctx.trustContext,
+    );
     const imageSourcePaths = extractImageSourcePaths(attachments);
 
     // Strip the transient `slackInbound` carrier key from the persisted