@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/config/schemas/llm.ts

@@ -1,6 +1,9 @@
 import { z } from "zod";
 
-import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
+import {
+  PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
+  ROUTING_IDENTITY_PROVIDERS,
+} from "../../providers/inference/auth.js";
 import { PROVIDER_CATALOG } from "../../providers/model-catalog.js";
 import { isCodexSubscriptionModel } from "../../providers/openai/codex-models.js";
 import {
@@ -25,32 +28,54 @@ import {
 // Provider enum
 // ---------------------------------------------------------------------------
 
-export const LLMProvider = z
-  .enum([
-    "anthropic",
-    "openai",
-    "gemini",
-    "ollama",
-    "fireworks",
-    "openrouter",
-    "vercel-ai-gateway",
-    "openai-compatible",
-    "minimax",
-    "atlascloud",
-    "together",
-    "litellm",
-    "baseten",
-    "poolside",
-    // Routing identities rather than adapters: "vellum" = the platform-managed
-    // route (upstream derived from the model at dispatch), "chatgpt" = the
-    // subscription route to OpenAI. Neither has a PROVIDER_CATALOG entry;
-    // dispatch substitutes the real upstream before any adapter lookup.
-    "vellum",
-    "chatgpt",
-  ])
-  .meta({ id: "LLMProvider" });
+/**
+ * The provider values the write surfaces accept today: adapter-backed
+ * catalog providers plus the two routing identities. The schema itself is
+ * an open string so a stored provider outside this list parses instead of
+ * stripping its profile; dispatch resolves such a label as a connection
+ * entry name and fails with an explainable resolution error when no row
+ * carries it. Write-time membership is enforced at the profiles route and
+ * the `commitConfigWrite` choke point (`unknownLlmProviderIssue`), which
+ * is where entry names unlock when the entries model enables them.
+ */
+export const KNOWN_LLM_PROVIDERS = [
+  "anthropic",
+  "openai",
+  "gemini",
+  "ollama",
+  "fireworks",
+  "openrouter",
+  "vercel-ai-gateway",
+  "openai-compatible",
+  "minimax",
+  "atlascloud",
+  "together",
+  "litellm",
+  "baseten",
+  "poolside",
+  // Routing identities rather than adapters: "vellum" = the platform-managed
+  // route (upstream derived from the model at dispatch), "chatgpt" = the
+  // subscription route to OpenAI. Neither has a PROVIDER_CATALOG entry;
+  // dispatch substitutes the real upstream before any adapter lookup.
+  "vellum",
+  "chatgpt",
+] as const;
+
+export const LLMProvider = z.string().min(1).meta({ id: "LLMProvider" });
 export type LLMProvider = z.infer<typeof LLMProvider>;
 
+/**
+ * Write-surface membership check for a provider value. Returns a message
+ * when the value is outside {@link KNOWN_LLM_PROVIDERS}, null when it is
+ * allowed. Pure and sync so the profiles route and the config-write choke
+ * point share one rule.
+ */
+export function unknownLlmProviderIssue(provider: string): string | null {
+  return (KNOWN_LLM_PROVIDERS as readonly string[]).includes(provider)
+    ? null
+    : `Invalid provider "${provider}". Valid providers: ${KNOWN_LLM_PROVIDERS.join(", ")}.`;
+}
+
 /**
  * Providers that can back `llm.defaultProvider`: the named columns of the
  * default-profile matrix plus every API-key catalog provider whose personal
@@ -70,10 +95,10 @@ export const DEFAULT_PROVIDER_CHOICES: readonly LLMProvider[] = [
         entry.defaultModel !== "",
     )
       .map((entry) => entry.id)
-      // A catalog provider absent from `LLMProvider` cannot be referenced by
-      // any profile, so it cannot back the defaults either.
+      // A catalog provider outside the known provider set cannot be
+      // referenced by any profile, so it cannot back the defaults either.
       .filter((id): id is LLMProvider =>
-        (LLMProvider.options as readonly string[]).includes(id),
+        (KNOWN_LLM_PROVIDERS as readonly string[]).includes(id),
       ),
   ]),
 ];
@@ -84,13 +109,15 @@ export function isDefaultProviderChoice(value: string): value is LLMProvider {
 
 /**
  * Default-provider choices whose profiles materialize from the shared BYOK
- * templates: every choice except the `vellum` routing identity, whose
- * defaults are pinned managed models.
+ * templates: every choice except the routing identities (`vellum`,
+ * `chatgpt`), whose defaults are pinned models on code-owned columns.
  */
 export function isByokDefaultProviderChoice(
   value: string,
 ): value is LLMProvider {
-  return value !== "vellum" && isDefaultProviderChoice(value);
+  return (
+    !ROUTING_IDENTITY_PROVIDERS.has(value) && isDefaultProviderChoice(value)
+  );
 }
 
 const DefaultProviderEnum = z.enum(
@@ -188,7 +215,7 @@ export const LLMCallSiteEnum = z.enum([
   "skillCategoryInference",
   "inference",
   "vision",
-  "voiceFrontDecision",
+  "voiceProgressNarration",
   "voiceFrontDoor",
   "trustRuleSuggestion",
   "homeGreeting",

package/src/config/schemas/mcp.ts

@@ -109,3 +109,26 @@ export const McpConfigSchema = z
 export type McpTransport = z.infer<typeof McpTransportSchema>;
 export type McpServerConfig = z.infer<typeof McpServerConfigSchema>;
 export type McpConfig = z.infer<typeof McpConfigSchema>;
+
+/**
+ * Who declared a server: the workspace `config.json`, which the user owns,
+ * or a plugin's `mcp.json`, which its author owns.
+ *
+ * Deliberately not a schema field. It is resolved from where the entry was
+ * read, never parsed from a file, so nothing on disk can claim to be
+ * workspace-owned. What it gates is credential access: only a workspace
+ * server resolves `mcp:<serverId>:*` from the credential store, because a
+ * plugin controls both its server key and its URL and would otherwise
+ * receive a workspace credential at an endpoint it chose.
+ */
+export type McpServerSource = "workspace" | "plugin";
+
+/** A server config with its origin resolved. */
+export interface ResolvedMcpServerConfig extends McpServerConfig {
+  readonly source: McpServerSource;
+}
+
+/** The MCP config the daemon runs: both origins, every server attributed. */
+export interface ResolvedMcpConfig extends Omit<McpConfig, "servers"> {
+  readonly servers: Record<string, ResolvedMcpServerConfig>;
+}

package/src/config/schemas/plugin-updates.ts

@@ -5,11 +5,15 @@ import { z } from "zod";
  *
  * The resource monitor process runs a periodic sweep (see
  * `monitoring/plugin-auto-update.ts`) that moves every installed, enabled
- * plugin to its source's current revision. The sweep is off by default:
+ * marketplace plugin to the catalog's current pin. The sweep is off by default:
  * `mode: "manual"` means nothing upgrades unless a human runs
  * `assistant plugins upgrade <name>` (or the equivalent route), which is the
  * behavior every workspace had before this block existed. Setting
  * `mode: "auto"` opts the workspace into the hourly sweep.
+ *
+ * Opting in never covers plugins installed straight from a GitHub URL. Those
+ * track a mutable ref rather than a reviewed pin, so the sweep leaves them to
+ * an explicit `assistant plugins upgrade`.
  */
 export const PluginUpdatesConfigSchema = z
   .object({
@@ -19,7 +23,7 @@ export const PluginUpdatesConfigSchema = z
       })
       .default("manual")
       .describe(
-        'How installed plugins move to newer revisions. "manual" (default) never upgrades on its own — upgrades happen only when a human asks for one. "auto" lets the resource monitor upgrade every installed, enabled plugin on the `checkIntervalMs` cadence.',
+        'How installed plugins move to newer revisions. "manual" (default) never upgrades on its own: upgrades happen only when a human asks for one. "auto" lets the resource monitor upgrade every installed, enabled marketplace plugin on the `checkIntervalMs` cadence. Plugins installed directly from a GitHub URL are never upgraded automatically, since they track a mutable ref instead of a reviewed pin.',
       ),
     strategy: z
       // Deliberately narrower than the full `PluginUpgradeStrategy` union: the

package/src/config/schemas/stt.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
  */
 export const VALID_STT_PROVIDERS = [
   "deepgram",
+  "deepgram-flux",
   "google-gemini",
   "openai-whisper",
   "xai",

package/src/context/outbound-sanitize.ts

@@ -102,6 +102,96 @@ export function compactAxTreeHistory(messages: Message[]): Message[] {
   });
 }
 
+/**
+ * Full-wrapper matcher for the `<channel_capabilities>` block. Both ends are
+ * required so a user message that merely opens with the tag (someone pasting
+ * prompt markup into chat) is never mistaken for an injected block, the same
+ * discipline `stripUserTextBlocksByPrefix` uses in `strip-injections.ts`.
+ */
+const CHANNEL_CAPABILITIES_OPEN = "<channel_capabilities>\n";
+const CHANNEL_CAPABILITIES_CLOSE = "\n</channel_capabilities>";
+
+/** Whether a text block is a complete `<channel_capabilities>…` block. */
+function isChannelCapabilitiesBlock(text: string): boolean {
+  return (
+    text.startsWith(CHANNEL_CAPABILITIES_OPEN) &&
+    text.endsWith(CHANNEL_CAPABILITIES_CLOSE)
+  );
+}
+
+/**
+ * Drop `<channel_capabilities>` blocks that repeat the last one still standing,
+ * so a conversation carries one copy per distinct set of capabilities instead
+ * of one per turn.
+ *
+ * Runtime injection prepends this block to the turn-starting user message and
+ * then freezes it into history: live, because injection splices into the
+ * conversation's own message array, and across restarts, because `loadFromDb`
+ * rehydrates it from message metadata. Nothing ever removes it, so an N-turn
+ * channel conversation ships N copies. Unlike `<turn_context>`, which at least
+ * carries a fresh timestamp, this block is a pure function of the channel
+ * (`buildChannelCapabilityBlock`): every copy after the first is byte-identical
+ * to the one above it and tells the model nothing it has not already read.
+ *
+ * ## Why "same as the last retained copy" and not "not the current turn"
+ *
+ * Prompt caching only pays off when the bytes a provider marked in turn N are
+ * still at the same position in turn N+1, an invariant this repo enforces end
+ * to end in `prompt-cache-cross-turn-stability.test.ts`. Any rule of the form
+ * "keep it on the current turn, collapse it above" necessarily re-renders one
+ * message every turn (the turn that just ended), which is a full cache miss on
+ * the whole message prefix, every turn, for every conversation.
+ *
+ * Comparing against the last RETAINED copy avoids that entirely: whether a
+ * given occurrence survives depends only on the messages above it, never on
+ * how many turns come later. A message's rendering is therefore fixed the
+ * moment it is written, and the prefix stays byte-stable as the conversation
+ * grows. Capabilities that genuinely change mid-conversation (the same
+ * conversation resumed from a different client) still differ from the retained
+ * copy, so the new block is kept and the model sees the change.
+ *
+ * The cost is placement: the surviving copy sits at the top of the conversation
+ * rather than next to the newest message. It is the same bytes either way.
+ *
+ * Idempotent, like every other transform in this module: re-running it over an
+ * already-deduplicated history retains exactly the same occurrences.
+ */
+export function dedupeChannelCapabilityBlocks(history: Message[]): Message[] {
+  let lastRetained: string | null = null;
+  let changed = false;
+
+  const next = history.map((message) => {
+    if (message.role !== "user") {
+      return message;
+    }
+
+    let messageChanged = false;
+    const content = message.content.filter((block) => {
+      if (block.type !== "text" || !isChannelCapabilitiesBlock(block.text)) {
+        return true;
+      }
+      if (block.text === lastRetained) {
+        messageChanged = true;
+        return false;
+      }
+      lastRetained = block.text;
+      return true;
+    });
+
+    // A user row is never only injections in practice, but guard anyway: an
+    // empty content array is not a message any provider will accept, and
+    // dropping the row would break tool_use/tool_result pairing and the
+    // row-to-history index mapping `summarizeUpToMessage` relies on.
+    if (!messageChanged || content.length === 0) {
+      return message;
+    }
+    changed = true;
+    return { ...message, content };
+  });
+
+  return changed ? next : history;
+}
+
 /**
  * Index of the last user message carrying `tool_result` blocks — the
  * "current turn" boundary {@link stripOldMediaBlocks} keeps intact while
@@ -194,6 +284,9 @@ function stripOldMediaBlocks(history: Message[]): Message[] {
  *   `web_search_tool_result` blocks to text summaries; Anthropic's opaque
  *   `encrypted_content` tokens expire / are route-scoped, and replaying a stale
  *   one is rejected with `Invalid encrypted_content in search_result block`.
+ * - {@link dedupeChannelCapabilityBlocks} keeps one `<channel_capabilities>`
+ *   block per distinct set of capabilities instead of the one-per-turn history
+ *   accumulates; every repeat is byte-identical to the copy above it.
  *
  * Transforms the outbound copy only — the durable history keeps the rich
  * originals and each send re-derives the sanitized projection (every transform
@@ -206,5 +299,7 @@ function stripOldMediaBlocks(history: Message[]): Message[] {
 export function preModelCallSanitize(history: Message[]): Message[] {
   const mediaStripped = stripOldMediaBlocks(history);
   const axCompacted = compactAxTreeHistory(mediaStripped);
-  return stripHistoricalWebSearchResults(axCompacted).messages;
+  const webSearchStripped =
+    stripHistoricalWebSearchResults(axCompacted).messages;
+  return dedupeChannelCapabilityBlocks(webSearchStripped);
 }

package/src/daemon/__tests__/plugin-mcp-reconcile.test.ts

@@ -0,0 +1,82 @@
+/**
+ * The plugin source reconcile drives MCP reload.
+ *
+ * Without this, installing a plugin leaves its `mcp.json` servers
+ * unconnected and its tools unregistered until an explicit MCP reload, a
+ * config edit, or a restart — and, worse in the other direction, an
+ * uninstalled or disabled plugin's connected client and registered tools
+ * stay callable. The reconcile is the seam every install / uninstall /
+ * upgrade / enable / disable already funnels through.
+ *
+ * The guard is equally load-bearing: a reconcile also fires for plugin
+ * edits that touch no `mcp.json`, and reloading on those would tear down
+ * every healthy workspace connection to rebuild it for nothing.
+ */
+
+import { beforeEach, describe, expect, jest, mock, test } from "bun:test";
+
+let pluginServersChanged = true;
+
+const managerStop = jest.fn(async () => {});
+const managerStart = jest.fn(async () => []);
+
+mock.module("../../mcp/effective-config.js", () => ({
+  buildEffectiveMcpConfig: () => ({
+    servers: {
+      unabyss: {
+        transport: { type: "streamable-http", url: "https://mcp.example/x" },
+        enabled: true,
+        defaultRiskLevel: "low",
+        maxTools: 20,
+        source: "plugin",
+      },
+    },
+    globalMaxTools: 50,
+  }),
+  pluginMcpServersChangedSinceLastBuild: () => pluginServersChanged,
+}));
+
+mock.module("../../mcp/manager.js", () => ({
+  getMcpServerManager: () => ({ stop: managerStop, start: managerStart }),
+}));
+
+mock.module("../../mcp/mcp-header-store.js", () => ({
+  migrateLegacyMcpHeaders: async () => {},
+}));
+
+mock.module("../../config/loader.js", () => ({
+  getConfig: () => ({ mcp: { servers: {}, globalMaxTools: 50 } }),
+  invalidateConfigCache: () => {},
+}));
+
+mock.module("../../tools/registry.js", () => ({
+  registerMcpTools: () => [],
+  unregisterAllMcpTools: () => {},
+}));
+
+const { reconcilePluginMcpServers } = await import("../mcp-reload-service.js");
+
+describe("reconcilePluginMcpServers", () => {
+  beforeEach(() => {
+    managerStop.mockClear();
+    managerStart.mockClear();
+  });
+
+  test("reloads when the plugin-declared set changed", async () => {
+    pluginServersChanged = true;
+
+    await reconcilePluginMcpServers();
+
+    expect(managerStop).toHaveBeenCalledTimes(1);
+    expect(managerStart).toHaveBeenCalledTimes(1);
+  });
+
+  test("does nothing when no plugin changed the set", async () => {
+    pluginServersChanged = false;
+
+    await reconcilePluginMcpServers();
+
+    expect(managerStop).not.toHaveBeenCalled();
+    expect(managerStart).not.toHaveBeenCalled();
+  });
+});

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -143,6 +143,7 @@ import type {
   WebSearchResultItem,
 } from "./message-types/web-activity.js";
 import { referenceMediaBlocksForPersist } from "./persist-media-references.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import type { TurnLatencyTracker } from "./turn-latency-tracker.js";
 
 const log = getLogger("agent-loop-handlers");
@@ -1330,7 +1331,7 @@ function buildAssistantChannelMetadata(
   deps: EventHandlerDeps,
 ): Record<string, unknown> {
   const metadata: Record<string, unknown> = {
-    ...provenanceFromTrustContext(deps.ctx.trustContext),
+    ...provenanceFromTrustContext(turnOrRestingTrust(deps.ctx)),
     userMessageChannel: deps.turnChannelContext.userMessageChannel,
     assistantMessageChannel: deps.turnChannelContext.assistantMessageChannel,
     userMessageInterface: deps.turnInterfaceContext.userMessageInterface,
@@ -1340,15 +1341,19 @@ function buildAssistantChannelMetadata(
   };
 
   if (deps.turnChannelContext.assistantMessageChannel === "slack") {
-    const channelId = deps.ctx.trustContext?.requesterChatId;
+    // The whole envelope resolves from one turn-local snapshot: the actor the
+    // provenance above names is the actor whose channel and thread the row
+    // routes to. Reading the live slot here instead would let a concurrent
+    // inbound repoint the reply mid-turn, and could stamp one actor's class
+    // beside another actor's routing identity.
+    const rowTrust = turnOrRestingTrust(deps.ctx);
+    const channelId = rowTrust?.requesterChatId;
     if (channelId) {
-      // Resolve the reply thread from this turn's own inbound thread id,
-      // captured turn-locally on the trust context at ingress (the same field
-      // guardian-approval cards read). This is deliberately not the shared
-      // conversation binding: on a legacy flat→thread aliased Slack
-      // conversation a concurrent inbound can rewrite the binding's
-      // externalThreadId mid-turn, whereas the trust context is per-turn.
-      const turnThreadTs = deps.ctx.trustContext?.sourceThreadId;
+      // This turn's own inbound thread id (the same field guardian-approval
+      // cards read). Deliberately not the shared conversation binding: on a
+      // legacy flat→thread aliased Slack conversation a concurrent inbound
+      // can rewrite the binding's externalThreadId mid-turn.
+      const turnThreadTs = rowTrust?.sourceThreadId;
       const threadTs = isSlackTs(turnThreadTs) ? turnThreadTs : undefined;
       const timestampTimezone = resolveAssistantReplyTimestampTimezone(
         deps.ctx,
@@ -1896,7 +1901,7 @@ function buildToolResultMetadata(
   deps: EventHandlerDeps,
 ): Record<string, unknown> {
   return {
-    ...provenanceFromTrustContext(deps.ctx.trustContext),
+    ...provenanceFromTrustContext(turnOrRestingTrust(deps.ctx)),
     userMessageChannel: deps.turnChannelContext.userMessageChannel,
     assistantMessageChannel: deps.turnChannelContext.assistantMessageChannel,
     userMessageInterface: deps.turnInterfaceContext.userMessageInterface,

package/src/daemon/conversation-agent-loop.ts

@@ -61,7 +61,11 @@ import { HOOKS } from "../plugin-api/constants.js";
 import type { ConversationGraphMemory } from "../plugins/defaults/memory/graph/conversation-graph-memory.js";
 import { enqueueMemoryRetrospectiveOnCompaction } from "../plugins/defaults/memory/memory-retrospective-enqueue.js";
 import { runHook } from "../plugins/pipeline.js";
-import { isManagedConnectionRoute } from "../providers/connection-resolution.js";
+import {
+  dispatchProviderResolvable,
+  isManagedConnectionRoute,
+  resolveEntryConnectionName,
+} from "../providers/connection-resolution.js";
 import {
   ConnectionResolutionError,
   resolveRoutingIdentity,
@@ -130,6 +134,7 @@ import {
 } from "./inflight-turn-registry.js";
 import type { UsageStats } from "./message-protocol.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import { resolveTurnCallSite } from "./turn-call-site.js";
 import { runWithLatencySubSpans } from "./turn-latency-sub-spans.js";
 import {
@@ -491,10 +496,13 @@ export async function runAgentLoopImpl(
   const turnErrorAttribution = (): ConversationErrorAttribution => {
     try {
       const overrideProfile = readCurrentOverrideProfile();
+      // Mirrors dispatch's selection (including the resolvable-provider
+      // healing) so attribution names the profile that actually ran.
       const resolveOpts = {
         overrideProfile,
         forceOverrideProfile,
         selectionSeed: ctx.conversationId,
+        isResolvableProvider: dispatchProviderResolvable,
       };
       const { config: resolved, profileName } =
         resolveCallSiteConfigWithProfile(turnCallSite, config.llm, resolveOpts);
@@ -509,6 +517,10 @@ export async function runAgentLoopImpl(
         }
         connectionName = error.connectionName;
       }
+      // An entry-name provider IS the connection name, matching the
+      // dispatch-side translation.
+      connectionName ??=
+        resolveEntryConnectionName(resolved.provider) ?? undefined;
       // Managed-ness comes from the connection row, matching what dispatch
       // decides. The profile's own provider can't stand in: a concrete
       // provider tweak over a managed winner keeps the managed connection
@@ -1283,8 +1295,7 @@ export async function runAgentLoopImpl(
     // context, then the fallback — matching the trust the runtime injection
     // assembly resolves for the same turn. The loop's other turn-identity
     // fields self-resolve from its own conversation id.
-    const loopTrust =
-      ctx.currentTurnTrustContext ?? ctx.trustContext ?? FALLBACK_TURN_TRUST;
+    const loopTrust = ctx.getTurnOrRestingTrust() ?? FALLBACK_TURN_TRUST;
 
     /**
      * Shared closure: runs the agent loop with the wrapper's turn context and
@@ -1404,7 +1415,7 @@ export async function runAgentLoopImpl(
     // row here rather than writing a duplicate.
     if (state.pendingToolResults.size > 0) {
       const toolResultMetadata = {
-        ...provenanceFromTrustContext(ctx.trustContext),
+        ...provenanceFromTrustContext(turnOrRestingTrust(ctx)),
         userMessageChannel: capturedTurnChannelContext.userMessageChannel,
         assistantMessageChannel:
           capturedTurnChannelContext.assistantMessageChannel,
@@ -1431,7 +1442,7 @@ export async function runAgentLoopImpl(
         budgetYieldClassification.userMessage,
       );
       const yieldNoticeMetadata = {
-        ...provenanceFromTrustContext(ctx.trustContext),
+        ...provenanceFromTrustContext(turnOrRestingTrust(ctx)),
         userMessageChannel: capturedTurnChannelContext.userMessageChannel,
         assistantMessageChannel:
           capturedTurnChannelContext.assistantMessageChannel,
@@ -1565,7 +1576,7 @@ export async function runAgentLoopImpl(
         state.lastAssistantMessageId = undefined;
       } else {
         const errChannelMeta = {
-          ...provenanceFromTrustContext(ctx.trustContext),
+          ...provenanceFromTrustContext(turnOrRestingTrust(ctx)),
           userMessageChannel: capturedTurnChannelContext.userMessageChannel,
           assistantMessageChannel:
             capturedTurnChannelContext.assistantMessageChannel,

package/src/daemon/conversation-messaging.ts

@@ -68,6 +68,7 @@ import type { SlackInboundMessageMetadata } from "./handlers/shared.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 const log = getLogger("conversation-messaging");
 
@@ -863,7 +864,10 @@ export async function persistQueuedMessageBody(
     const turnIfCtx =
       extractTurnInterfaceContext(metadata) ?? ctx.getTurnInterfaceContext();
     const provenance = provenanceFromTrustContext(
-      options.trustContext ?? ctx.trustContext,
+      // Callers that own a turn pass the sender's trust; the fallback serves
+      // ingress paths that persist before any per-turn stamp exists, where
+      // the slot their own resolution just wrote is the right actor.
+      options.trustContext ?? restingTrust(ctx),
     );
     const imageSourcePaths = extractImageSourcePaths(attachments);
 

package/src/daemon/conversation-notifiers.ts

@@ -25,6 +25,7 @@ import {
 } from "../persistence/conversation-crud.js";
 import type { Message } from "../providers/types.js";
 import type { TrustContext } from "./trust-context-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 /**
  * Subset of Conversation state that notifier callbacks need to read at
@@ -58,7 +59,14 @@ export function registerConversationNotifiers(
         JSON.stringify([{ type: "text", text: questionText }]),
         {
           metadata: {
-            ...provenanceFromTrustContext(ctx.trustContext),
+            ...provenanceFromTrustContext(
+              // This callback fires after the voice turn has settled: the
+              // per-turn field may still hold that turn's actor (nothing
+              // clears it at release), while voice cleanup has restored the
+              // conversation's resting trust. The owner is the right actor
+              // for a row persisted outside any turn.
+              restingTrust(ctx),
+            ),
             userMessageChannel: "phone",
             assistantMessageChannel: "phone",
             userMessageInterface: "phone",