@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/daemon/conversation-process.ts

@@ -60,9 +60,11 @@ import {
 } from "./conversation-slash.js";
 import { getModelInfo } from "./handlers/config-model.js";
 import { preactivateHostProxySkills } from "./host-proxy-preactivation.js";
+import { bindInteractiveTurnSender } from "./interactive-turn-sender.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import { buildTransportHints } from "./transport-hints.js";
 import { sameTrustIdentity, type TrustContext } from "./trust-context-types.js";
+import { turnOrRestingTrust } from "./trust-context-types.js";
 import { resolveVerificationSessionIntent } from "./verification-session-intent.js";
 
 const log = getLogger("conversation-process");
@@ -823,7 +825,7 @@ async function drainSingleMessage(
   if (slashResult.kind === "unknown") {
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainImageSourcePaths: Record<string, string> = {};
       for (let i = 0; i < next.attachments.length; i++) {
@@ -938,7 +940,7 @@ async function drainSingleMessage(
     let persistedCompactMessage = false;
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainChannelMeta = {
         ...drainProvenance,
@@ -1031,7 +1033,7 @@ async function drainSingleMessage(
     let persistedCleanMessage = false;
     try {
       const drainProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const drainChannelMeta = {
         ...drainProvenance,
@@ -1291,11 +1293,26 @@ async function drainSingleMessage(
     drainLoopOptions.isHiddenPrompt = true;
   }
 
+  // By the time the drain runs, the conversation-level sender is usually the
+  // no-op the just-finished interactive turn's restore (or conversation
+  // birth) left behind, and the drain bypasses `processMessage`, so without
+  // a fresh bind the PermissionPrompter's confirmation_request (which reads
+  // the conversation-level sender, not the turn's `onEvent`) would be
+  // emitted into nothing and hang until the permission timeout. Same
+  // bind/restore contract as `processMessage`.
+  const restoreSender =
+    next.isInteractive === true
+      ? bindInteractiveTurnSender(conversation)
+      : undefined;
+
   conversation
     .runAgentLoop(agentLoopContent, userMessageId, {
       ...drainLoopOptions,
       onEvent: next.onEvent,
     })
+    .finally(() => {
+      restoreSender?.();
+    })
     .catch((err) => {
       const message = err instanceof Error ? err.message : String(err);
       log.error(
@@ -1778,6 +1795,14 @@ async function drainBatch(
     drainLoopOptions.isHiddenPrompt = true;
   }
 
+  // Same sender contract as drainSingleMessage: an interactive drained batch
+  // must rebind the conversation-level sender or prompter confirmations
+  // raised during this turn reach no client.
+  const restoreSender =
+    drainLoopOptions.isInteractive === true
+      ? bindInteractiveTurnSender(conversation)
+      : undefined;
+
   // Fire-and-forget: runAgentLoop's finally block recursively calls drainQueue
   // when this run completes. Mirrors drainSingleMessage.
   conversation
@@ -1785,6 +1810,9 @@ async function drainBatch(
       ...drainLoopOptions,
       onEvent: fanOutOnEvent,
     })
+    .finally(() => {
+      restoreSender?.();
+    })
     .catch((err) => {
       const message = err instanceof Error ? err.message : String(err);
       log.error(
@@ -2024,7 +2052,9 @@ export async function processMessage(
   if (slashResult.kind === "unknown") {
     const pmTurnCtx = conversation.getTurnChannelContext();
     const pmInterfaceCtx = conversation.getTurnInterfaceContext();
-    const pmProvenance = provenanceFromTrustContext(conversation.trustContext);
+    const pmProvenance = provenanceFromTrustContext(
+      turnOrRestingTrust(conversation),
+    );
     const pmImageSourcePaths: Record<string, string> = {};
     for (let i = 0; i < attachments.length; i++) {
       const a = attachments[i];
@@ -2116,7 +2146,7 @@ export async function processMessage(
       const pmTurnCtx = conversation.getTurnChannelContext();
       const pmInterfaceCtx = conversation.getTurnInterfaceContext();
       const pmProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const pmChannelMeta = {
         ...pmProvenance,
@@ -2197,7 +2227,7 @@ export async function processMessage(
       const pmTurnCtx = conversation.getTurnChannelContext();
       const pmInterfaceCtx = conversation.getTurnInterfaceContext();
       const pmProvenance = provenanceFromTrustContext(
-        conversation.trustContext,
+        turnOrRestingTrust(conversation),
       );
       const pmChannelMeta = {
         ...pmProvenance,

package/src/daemon/conversation-runtime-assembly.ts

@@ -2319,7 +2319,7 @@ export async function applyRuntimeInjections(
   // folded into the summary are excluded.
   const slackActiveThreadFocusBlock = channelCapabilities
     ? loadSlackActiveThreadFocusBlock(conversationId, channelCapabilities, {
-        trustClass: liveConversation?.trustContext?.trustClass,
+        trustClass: liveConversation?.getTrustContext()?.trustClass,
         contextCompactedMessageCount:
           liveConversation?.contextCompactedMessageCount,
         slackContextCompactionWatermarkTs:
@@ -2337,7 +2337,7 @@ export async function applyRuntimeInjections(
   // boundary without the orchestrator threading a snapshot in.
   const slackChronologicalMessages = channelCapabilities
     ? loadSlackChronologicalMessages(conversationId, channelCapabilities, {
-        trustClass: liveConversation?.trustContext?.trustClass,
+        trustClass: liveConversation?.getTrustContext()?.trustClass,
         contextSummary: liveConversation?.contextSummary,
         contextCompactedMessageCount:
           liveConversation?.contextCompactedMessageCount,
@@ -2380,8 +2380,7 @@ export async function applyRuntimeInjections(
     turnIndex: options.turnIndex ?? liveConversation?.turnCount ?? 0,
     trust:
       options.trust ??
-      liveConversation?.currentTurnTrustContext ??
-      liveConversation?.trustContext ??
+      liveConversation?.getTurnOrRestingTrust() ??
       fallbackTurnTrust(channelCapabilities),
     callSite: options.callSite ?? liveConversation?.currentCallSite,
     ...injectionInputs,

package/src/daemon/conversation-surfaces.ts

@@ -140,14 +140,28 @@ const MAX_UNDO_DEPTH = 10;
 
 /**
  * Pending surface types that do not hold the one-interactive-surface-at-a-time
- * lock. Both render content the user reads rather than a question they must
- * answer, so a live one must not block the next surface.
+ * lock. Each renders content the user reads (or settles on its own) rather
+ * than a question they must answer, so a live one must not block the next
+ * surface.
  */
 const NON_BLOCKING_PENDING_SURFACE_TYPES = new Set<SurfaceType>([
   "dynamic_page",
   "visual",
+  "voice_picker",
 ]);
 
+/**
+ * Surface types that carry no terminal action: the card settles when the user
+ * interacts with it, so no click could ever satisfy an attached `actions`
+ * entry or an explicit `await_action`. Both are generic ui_show params though,
+ * so nothing stops the model attaching them here, and doing so wedges the
+ * turn: the client latches `awaiting_user_input` on the presence of actions
+ * alone and no action ever arrives to clear it, leaving the composer disabled
+ * and Stop hidden while the daemon is still streaming. Stripping them makes
+ * the "never blocks a turn" contract structural rather than advisory.
+ */
+const ACTIONLESS_SURFACE_TYPES = new Set<SurfaceType>(["voice_picker"]);
+
 /**
  * Debounce window for persisting `ui_surface_update` data back to the
  * message row. Surfaces typically receive bursts of updates (e.g. a
@@ -3279,8 +3293,12 @@ export async function surfaceProxyResolver(
       }
       inputActions = valid.length > 0 ? valid : undefined;
     }
-    const actions =
-      choiceData !== undefined ? buildChoiceActions(choiceData) : inputActions;
+    const isActionless = ACTIONLESS_SURFACE_TYPES.has(surfaceType);
+    const actions = isActionless
+      ? undefined
+      : choiceData !== undefined
+        ? buildChoiceActions(choiceData)
+        : inputActions;
     const hasActions = Array.isArray(actions) && actions.length > 0;
     if (surfaceType === "choice" && !hasActions) {
       return {
@@ -3332,7 +3350,11 @@ export async function surfaceProxyResolver(
           : surfaceType === "table"
             ? hasActions
             : INTERACTIVE_SURFACE_TYPES.includes(surfaceType);
-    const awaitAction = (input.await_action as boolean) ?? isInteractive;
+    // An explicit `await_action: true` is honored for every other type; an
+    // actionless surface has nothing to await, so it is forced false.
+    const awaitAction = isActionless
+      ? false
+      : ((input.await_action as boolean) ?? isInteractive);
 
     // Only one non-persistent interactive surface at a time. If another
     // surface is already awaiting user input, reject this one so the LLM

package/src/daemon/conversation-tool-setup.ts

@@ -389,8 +389,7 @@ export function createToolExecutor(
     // Per-turn trust snapshot: prefer the snapshot captured at turn start so
     // a concurrent owner meta command (/status, /clean) that mutates the live
     // trustContext cannot elevate the in-flight turn to guardian.
-    const turnTrust =
-      ctx.currentTurnTrustContext ?? ctx.trustContext ?? FALLBACK_TURN_TRUST;
+    const turnTrust = ctx.getTurnOrRestingTrust() ?? FALLBACK_TURN_TRUST;
 
     const toolContext: ToolContext = {
       workingDir: ctx.workingDir,

package/src/daemon/conversation.ts

@@ -2488,6 +2488,54 @@ export class Conversation {
     return this.authContext;
   }
 
+  /**
+   * Trust the in-flight turn is executing under.
+   *
+   * Use this for authorization and for routing a reply to the requester:
+   * cases where substituting the conversation's owner would be wrong rather
+   * than approximate. Provenance is not such a case; see
+   * {@link getTurnOrRestingTrust} and `docs/architecture/turn-actor.md`.
+   *
+   * `undefined` when no turn recorded one, which is a gap in the entry point
+   * rather than an answer. Deliberately does not fall back to the
+   * conversation's trust: a caller that can accept the conversation's owner
+   * instead spells `?? getTrustContext()`, so the substitution is visible
+   * where it happens.
+   */
+  getTurnTrust(): TrustContext | undefined {
+    return this.currentTurnTrustContext;
+  }
+
+  /**
+   * Trust of the actor the conversation belongs to, independent of any turn.
+   *
+   * Use this where there is no turn to speak of: routes reporting on a
+   * conversation, hydration, and persisting conversation-level options. A
+   * caller that wants the conversation's owner *rather than* whoever is
+   * currently acting should be obviously doing so; if it is not obvious,
+   * {@link getTurnTrust} is probably the one meant.
+   */
+  getTrustContext(): TrustContext | undefined {
+    return this.trustContext;
+  }
+
+  /**
+   * Trust of the in-flight turn, or the conversation's owner when the turn
+   * recorded none. The substitution is in the name: callers that can accept
+   * the owner as a stand-in ask this, including provenance stamping, whose
+   * readers treat an absent trust class as more trusted than `"unknown"`.
+   * Callers for which the owner would be wrong rather than approximate call
+   * {@link getTurnTrust} and handle `undefined`.
+   *
+   * The fallback half is load-bearing, not transitional politeness: a
+   * deferred wake fires with no inbound actor, and refusing it an answer
+   * denies every sensitive tool in the resumed turn (LUM-2929). It becomes
+   * removable in one place when every entry point records a turn actor.
+   */
+  getTurnOrRestingTrust(): TrustContext | undefined {
+    return this.currentTurnTrustContext ?? this.trustContext;
+  }
+
   /**
    * The actor principal that owns the current turn, for host-proxy routing.
    * Prefers the in-flight turn's actor over the conversation's resting

package/src/daemon/interactive-turn-sender.ts

@@ -0,0 +1,59 @@
+/**
+ * The interactive-turn sender contract, in one place.
+ *
+ * `Conversation.sendToClient` is conversation-level mutable state: born a
+ * no-op, bound to the SSE hub for the duration of an interactive turn, and
+ * restored when that turn ends. Some subsystems read this conversation-level
+ * sender instead of the turn's own `onEvent` sink; the `PermissionPrompter`
+ * is the load-bearing one, so a `confirmation_request` raised by a turn that
+ * never bound the sender is emitted into the no-op, reaches no client, and
+ * hangs until the permission timeout auto-denies. Every path that runs an
+ * interactive agent turn MUST therefore bind before the loop and restore
+ * after it. The queue drain bypasses `processMessage`, so it uses this
+ * helper directly.
+ *
+ * The restore is a snapshot of the sender state taken at bind time, not an
+ * unconditional reset to a no-op: a live binding that predated the turn
+ * (e.g. installed by the send route while a non-interactive turn was
+ * running) survives the turn, so out-of-turn producers that read the live
+ * sender (call transcript and completion notifiers) keep their client. In
+ * the ordinary interactive flow the snapshot is the no-op the previous
+ * turn's restore left behind, so restoring it is identical to the reset
+ * this contract has always performed. The restore is also identity-guarded:
+ * it only replaces the hub binding this contract installed, so a sender
+ * some other subsystem rebound mid-turn to anything else is left alone.
+ *
+ * TRANSITIONAL: this helper is the paved road for a pattern we want less
+ * of. Bind/restore of shared mutable sender state is why the drain, the
+ * compaction card, and the host-browser proxy have each needed their own
+ * restore step. The durable design is a per-turn sink threaded to the
+ * prompter and the other conversation-level-sender readers, at which point
+ * this module and every call site of it should be deleted. Prefer that
+ * refactor over adding new bind/restore call sites.
+ */
+
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
+import { getSubagentManager } from "../subagent/index.js";
+import type { Conversation } from "./conversation.js";
+
+/**
+ * Point the conversation-level sender (and the subagent parent sender) at
+ * the SSE hub for the duration of an interactive turn. Returns the restore
+ * closure the turn's cleanup must invoke.
+ */
+export function bindInteractiveTurnSender(
+  conversation: Conversation,
+): () => void {
+  const previousSender = conversation.getCurrentSender();
+  const previousHasNoClient = conversation.hasNoClient;
+  conversation.updateClient(broadcastMessage, false);
+  getSubagentManager().updateParentSender(
+    conversation.conversationId,
+    broadcastMessage,
+  );
+  return () => {
+    if (conversation.getCurrentSender() === broadcastMessage) {
+      conversation.updateClient(previousSender, previousHasNoClient);
+    }
+  };
+}

package/src/daemon/mcp-reload-service.ts

@@ -6,6 +6,10 @@
  */
 
 import { getConfig, invalidateConfigCache } from "../config/loader.js";
+import {
+  buildEffectiveMcpConfig,
+  pluginMcpServersChangedSinceLastBuild,
+} from "../mcp/effective-config.js";
 import { getMcpServerManager } from "../mcp/manager.js";
 import { migrateLegacyMcpHeaders } from "../mcp/mcp-header-store.js";
 import { createMcpToolsFromServer } from "../tools/mcp/mcp-tool-factory.js";
@@ -52,6 +56,29 @@ export function reloadMcpServers(): Promise<McpReloadResult> {
   return reloadInProgress;
 }
 
+/**
+ * Reload MCP servers if — and only if — the plugin-declared set moved.
+ *
+ * Called by the plugin source reconcile, which every install / uninstall /
+ * upgrade / enable / disable already funnels through, so a plugin's MCP
+ * tools come up and go down with the plugin instead of lingering until an
+ * explicit reload, a config edit, or a restart.
+ *
+ * The guard matters: a reconcile also fires for plugin edits that touch no
+ * `mcp.json` at all, and an unconditional reload would tear down every
+ * healthy workspace connection to re-establish it for nothing.
+ *
+ * Never throws — the reconcile is best-effort and must not fail an install
+ * whose files already landed on disk.
+ */
+export async function reconcilePluginMcpServers(): Promise<void> {
+  if (!pluginMcpServersChangedSinceLastBuild()) {
+    return;
+  }
+  log.info("Plugin-declared MCP servers changed; reloading");
+  await reloadMcpServers();
+}
+
 async function doReload(): Promise<McpReloadResult> {
   try {
     const manager = getMcpServerManager();
@@ -74,17 +101,20 @@ async function doReload(): Promise<McpReloadResult> {
     // 2. Stop existing MCP servers + unregister their tools
     await manager.stop();
     unregisterAllMcpTools();
-    const serverIds = config.mcp?.servers
-      ? Object.keys(config.mcp.servers)
-      : [];
+
+    // Plugins are re-read here too: installing or removing one changes the
+    // server set exactly like editing config.json does, and both arrive
+    // through this same reload.
+    const mcpConfig = buildEffectiveMcpConfig(config.mcp);
+    const serverIds = Object.keys(mcpConfig.servers);
 
     // 3. Restart MCP servers
     let serverCount = 0;
     let toolCount = 0;
     const servers: McpReloadServerResult[] = [];
 
-    if (config.mcp?.servers && Object.keys(config.mcp.servers).length > 0) {
-      const serverToolInfos = await manager.start(config.mcp);
+    if (serverIds.length > 0) {
+      const serverToolInfos = await manager.start(mcpConfig);
       for (const { serverId, serverConfig, tools } of serverToolInfos) {
         const mcpTools = createMcpToolsFromServer(
           tools,
@@ -105,7 +135,7 @@ async function doReload(): Promise<McpReloadResult> {
       // Include servers that were configured but failed to connect or are disabled
       for (const id of serverIds) {
         if (!servers.some((s) => s.id === id)) {
-          const serverConfig = config.mcp!.servers![id];
+          const serverConfig = mcpConfig.servers[id];
           const isDisabled = serverConfig?.enabled === false;
           servers.push({
             id,

package/src/daemon/process-message.ts

@@ -34,7 +34,6 @@ import { updateMetaFile } from "../persistence/conversation-disk-view.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
-import { getSubagentManager } from "../subagent/index.js";
 import {
   readTurnFailure,
   type TurnFailure,
@@ -70,7 +69,9 @@ import {
   preactivateHostProxySkills,
   shouldAttachHostProxyForCapability,
 } from "./host-proxy-preactivation.js";
+import { bindInteractiveTurnSender } from "./interactive-turn-sender.js";
 import type { SubagentToolGateMode } from "./tool-setup-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 const log = getLogger("process-message");
 
@@ -455,7 +456,10 @@ export async function processMessage(
   if (slashResult.kind === "unknown") {
     const serverTurnCtx = conversation.getTurnChannelContext();
     const serverProvenance = provenanceFromTrustContext(
-      conversation.trustContext,
+      // Ingress persists before any per-turn stamp; the slot was just written
+      // by this message's own resolution, and the per-turn field may still
+      // hold the previous turn's actor.
+      restingTrust(conversation),
     );
     const imageSourcePaths: Record<string, string> = {};
     for (let i = 0; i < attachments.length; i++) {
@@ -557,7 +561,10 @@ export async function processMessage(
   if (slashResult.kind === "compact") {
     const serverTurnCtx = conversation.getTurnChannelContext();
     const serverProvenance = provenanceFromTrustContext(
-      conversation.trustContext,
+      // Ingress persists before any per-turn stamp; the slot was just written
+      // by this message's own resolution, and the per-turn field may still
+      // hold the previous turn's actor.
+      restingTrust(conversation),
     );
     const compactChannelMeta = {
       ...serverProvenance,
@@ -612,7 +619,10 @@ export async function processMessage(
   if (slashResult.kind === "clean") {
     const serverTurnCtx = conversation.getTurnChannelContext();
     const serverProvenance = provenanceFromTrustContext(
-      conversation.trustContext,
+      // Ingress persists before any per-turn stamp; the slot was just written
+      // by this message's own resolution, and the per-turn field may still
+      // hold the previous turn's actor.
+      restingTrust(conversation),
     );
     const cleanChannelMeta = {
       ...serverProvenance,
@@ -699,10 +709,10 @@ export async function processMessage(
     };
   }
 
-  if (options?.isInteractive === true) {
-    conversation.updateClient(broadcastMessage, false);
-    getSubagentManager().updateParentSender(conversationId, broadcastMessage);
-  }
+  const restoreSender =
+    options?.isInteractive === true
+      ? bindInteractiveTurnSender(conversation)
+      : undefined;
 
   const restoreToolScope = applyTurnToolAllowlist(conversation, options);
   try {
@@ -721,12 +731,7 @@ export async function processMessage(
     });
   } finally {
     restoreToolScope();
-    if (
-      options?.isInteractive === true &&
-      conversation.getCurrentSender() === broadcastMessage
-    ) {
-      conversation.updateClient(() => {}, true);
-    }
+    restoreSender?.();
   }
 
   // Read the just-finished turn's outcome from the stamp `runAgentLoop`'s
@@ -785,10 +790,10 @@ export async function processMessageInBackground(
     return { messageId };
   }
 
-  if (options?.isInteractive === true) {
-    conversation.updateClient(broadcastMessage, false);
-    getSubagentManager().updateParentSender(conversationId, broadcastMessage);
-  }
+  const restoreSender =
+    options?.isInteractive === true
+      ? bindInteractiveTurnSender(conversation)
+      : undefined;
 
   const restoreToolScope = applyTurnToolAllowlist(conversation, options);
   conversation
@@ -804,12 +809,7 @@ export async function processMessageInBackground(
     })
     .finally(() => {
       restoreToolScope();
-      if (
-        options?.isInteractive === true &&
-        conversation.getCurrentSender() === broadcastMessage
-      ) {
-        conversation.updateClient(() => {}, true);
-      }
+      restoreSender?.();
     })
     .catch((err) => {
       log.error({ err, conversationId }, "Background agent loop failed");

package/src/daemon/providers-setup.ts

@@ -1,6 +1,7 @@
 import { maybeDefaultSpeechToManaged } from "../config/managed-speech-defaults.js";
 import { rehydratePlatformCredentials } from "../config/platform-rehydration.js";
 import type { AssistantConfig } from "../config/types.js";
+import { buildEffectiveMcpConfig } from "../mcp/effective-config.js";
 import { getMcpServerManager } from "../mcp/manager.js";
 import { gmailMessagingProvider } from "../messaging/providers/gmail/adapter.js";
 import { outlookMessagingProvider } from "../messaging/providers/outlook/adapter.js";
@@ -61,11 +62,13 @@ export async function initializeProvidersAndTools(
     );
   }
 
-  // Start MCP servers and register their tools
-  if (config.mcp?.servers && Object.keys(config.mcp.servers).length > 0) {
+  // Start MCP servers — workspace-configured and plugin-declared alike —
+  // and register their tools.
+  const mcpConfig = buildEffectiveMcpConfig(config.mcp);
+  if (Object.keys(mcpConfig.servers).length > 0) {
     const manager = getMcpServerManager();
     try {
-      const serverToolInfos = await manager.start(config.mcp);
+      const serverToolInfos = await manager.start(mcpConfig);
       for (const { serverId, serverConfig, tools } of serverToolInfos) {
         const mcpTools = createMcpToolsFromServer(
           tools,

package/src/daemon/trust-context-types.ts

@@ -106,3 +106,32 @@ export function sameTrustIdentity(
     a.guardianPrincipalId === b.guardianPrincipalId
   );
 }
+
+/** The two trust fields a conversation-shaped value carries. */
+export interface TrustCarrier {
+  currentTurnTrustContext?: TrustContext;
+  trustContext?: TrustContext;
+}
+
+/**
+ * The acting turn's trust, else the owner's. Structural counterpart of
+ * `Conversation.getTurnOrRestingTrust` for call sites handed a
+ * conversation-shaped context rather than the class, so a partial test double
+ * needs only the fields it already has.
+ */
+export function turnOrRestingTrust(
+  carrier: TrustCarrier | undefined,
+): TrustContext | undefined {
+  return carrier?.currentTurnTrustContext ?? carrier?.trustContext;
+}
+
+/**
+ * The owner's trust, independent of any turn. Structural counterpart of
+ * `Conversation.getTrustContext`; see `docs/architecture/turn-actor.md` for
+ * when the owner is the right actor.
+ */
+export function restingTrust(
+  carrier: Pick<TrustCarrier, "trustContext"> | undefined,
+): TrustContext | undefined {
+  return carrier?.trustContext;
+}

package/src/daemon/wake-conversation-ops.ts

@@ -32,6 +32,7 @@ import type {
   SubagentToolGateMode,
   WakeToolContextPin,
 } from "./tool-setup-types.js";
+import { restingTrust } from "./trust-context-types.js";
 
 const log = getLogger("wake-conversation-ops");
 
@@ -222,7 +223,7 @@ export async function persistWakeTailMessage(
   const turnChannelCtx = conversation.getTurnChannelContext();
   const turnInterfaceCtx = conversation.getTurnInterfaceContext();
   const metadata: Record<string, unknown> = {
-    ...provenanceFromTrustContext(conversation.trustContext),
+    ...provenanceFromTrustContext(restingTrust(conversation)),
     userMessageChannel: turnChannelCtx?.userMessageChannel ?? "vellum",
     assistantMessageChannel:
       turnChannelCtx?.assistantMessageChannel ?? "vellum",
@@ -301,7 +302,7 @@ export async function persistWakeTriggerMessage(
   const turnChannelCtx = conversation.getTurnChannelContext();
   const turnInterfaceCtx = conversation.getTurnInterfaceContext();
   const metadata: Record<string, unknown> = {
-    ...provenanceFromTrustContext(conversation.trustContext),
+    ...provenanceFromTrustContext(restingTrust(conversation)),
     userMessageChannel: turnChannelCtx?.userMessageChannel ?? "vellum",
     assistantMessageChannel:
       turnChannelCtx?.assistantMessageChannel ?? "vellum",