@vellumai/assistant 0.11.3 → 0.11.4-staging.2

package/src/__tests__/llm-schema.test.ts

@@ -123,11 +123,14 @@ describe("LLMSchema", () => {
     expect(parsed.profileOrder).toEqual(["fast", "stale"]);
   });
 
-  test("invalid provider rejected", () => {
+  test("an unknown provider parses (read tolerance for entry names)", () => {
+    // The open provider schema keeps the profile; write-time membership is
+    // enforced at the profiles route and the config-write choke point, and
+    // dispatch resolves the value as a connection entry name.
     const result = LLMSchema.safeParse({
       profiles: { mine: { provider: "bogus-provider" } },
     });
-    expect(result.success).toBe(false);
+    expect(result.success).toBe(true);
   });
 
   test("invalid temperature (negative) rejected", () => {

package/src/__tests__/mcp-list-plugin-servers.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Route-level coverage for plugin-declared MCP servers appearing in
+ * `internal_mcp_list` (what `assistant mcp list` renders).
+ *
+ * The unit tests in `plugins/__tests__/mcp-servers.test.ts` cover reading
+ * `mcp.json`. This file covers the merge, and two properties that a
+ * refactor could quietly break:
+ *
+ * 1. A workspace entry of the same id wins. Getting precedence backwards
+ *    would let a plugin redirect a server the user configured by hand.
+ * 2. A plugin server is never health-checked. `McpClient.connect` resolves
+ *    `mcp:<serverId>:headers` and `mcp:<serverId>:tokens` from the
+ *    credential store, and a plugin controls both its server key and its
+ *    URL, so probing one would send a workspace credential to an endpoint
+ *    the plugin chose whenever an id happens to match a stored key.
+ */
+
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { beforeEach, describe, expect, jest, mock, test } from "bun:test";
+
+const mockConnect = jest.fn();
+const mockDisconnect = jest.fn();
+/** Server ids the route actually constructed an MCP client for. */
+const connectedServerIds: string[] = [];
+
+mock.module("../mcp/client.js", () => ({
+  McpClient: class {
+    constructor(serverId: string) {
+      connectedServerIds.push(serverId);
+    }
+    get isConnected() {
+      return true;
+    }
+    get lastError() {
+      return null;
+    }
+    connect = mockConnect;
+    disconnect = mockDisconnect;
+  },
+}));
+
+mock.module("../mcp/mcp-auth-orchestrator.js", () => ({
+  orchestrateMcpOAuthConnect: async () => ({
+    auth_url: "",
+    already_authenticated: false,
+  }),
+}));
+
+mock.module("../mcp/mcp-auth-state.js", () => ({
+  getMcpAuthState: () => null,
+}));
+
+mock.module("../mcp/mcp-oauth-provider.js", () => ({
+  // Stand in for a credential store that holds tokens for every id, which
+  // is the condition under which a leak would be observable.
+  hasMcpOAuthTokens: async () => true,
+  deleteMcpOAuthCredentials: async () => ({ ok: true, failedKeys: [] }),
+}));
+
+mock.module("../mcp/mcp-header-store.js", () => ({
+  getMcpHeaders: async () => ({ Authorization: "Bearer workspace-secret" }),
+  setMcpHeaders: async () => {},
+  deleteMcpHeaders: async () => true,
+}));
+
+mock.module("../daemon/mcp-reload-service.js", () => ({
+  reloadMcpServers: async () => {},
+}));
+
+import { setConfig } from "./helpers/set-config.js";
+
+setConfig("mcp", {
+  servers: {
+    "from-workspace": {
+      transport: { type: "streamable-http", url: "https://config.example/mcp" },
+      enabled: true,
+      defaultRiskLevel: "high",
+      maxTools: 20,
+    },
+    // Deliberately shares an id with the `shadowed` plugin below.
+    shadowed: {
+      transport: { type: "streamable-http", url: "https://wins.example/mcp" },
+      enabled: true,
+      defaultRiskLevel: "low",
+      maxTools: 20,
+    },
+  },
+});
+
+const { getWorkspacePluginsDir } = await import("../util/platform.js");
+const { ROUTES } = await import("../runtime/routes/mcp-auth-routes.js");
+
+const listHandler = ROUTES.find(
+  (r: { operationId: string }) => r.operationId === "internal_mcp_list",
+)!.handler;
+
+interface ListedServer {
+  id: string;
+  status: string;
+  source?: "workspace" | "plugin";
+  pluginName?: string;
+  defaultRiskLevel: string;
+  hasOAuth: boolean;
+  hasStaticAuth: boolean;
+  authType: string;
+  transport: { type: string; url?: string };
+}
+
+function writePlugin(name: string, mcpJson: unknown): void {
+  const dir = join(getWorkspacePluginsDir(), name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify({ name, version: "1.0.0" }),
+  );
+  writeFileSync(join(dir, "mcp.json"), JSON.stringify(mcpJson));
+}
+
+function unabyssManifest(): unknown {
+  return {
+    mcpServers: {
+      unabyss: { type: "streamable-http", url: "https://mcp.unabyss.com" },
+    },
+  };
+}
+
+async function listServers(): Promise<ListedServer[]> {
+  const result = (await listHandler({})) as { servers: ListedServer[] };
+  return result.servers;
+}
+
+describe("internal_mcp_list, plugin-declared servers", () => {
+  beforeEach(() => {
+    mockConnect.mockReset();
+    mockDisconnect.mockReset();
+    connectedServerIds.length = 0;
+    rmSync(getWorkspacePluginsDir(), { recursive: true, force: true });
+    mkdirSync(getWorkspacePluginsDir(), { recursive: true });
+  });
+
+  test("a plugin's mcp.json server appears alongside workspace servers", async () => {
+    writePlugin("unabyss", unabyssManifest());
+
+    const ids = (await listServers()).map((s) => s.id);
+    expect(ids).toContain("from-workspace");
+    expect(ids).toContain("unabyss");
+  });
+
+  test("plugin servers are labelled with their origin, workspace servers are not", async () => {
+    writePlugin("unabyss", unabyssManifest());
+
+    const servers = await listServers();
+    const plugin = servers.find((s) => s.id === "unabyss")!;
+    const workspace = servers.find((s) => s.id === "from-workspace")!;
+
+    expect(plugin.source).toEqual("plugin");
+    expect(plugin.pluginName).toEqual("unabyss");
+    expect(workspace.source).toEqual("workspace");
+    expect(workspace.pluginName).toBeUndefined();
+  });
+
+  test("a workspace server of the same id wins over the plugin's", async () => {
+    writePlugin("shadowed", {
+      mcpServers: {
+        shadowed: { type: "streamable-http", url: "https://loses.example/mcp" },
+      },
+    });
+
+    const matches = (await listServers()).filter((s) => s.id === "shadowed");
+
+    expect(matches).toHaveLength(1);
+    expect(matches[0].source).toEqual("workspace");
+    expect(matches[0].transport.url).toEqual("https://wins.example/mcp");
+  });
+
+  test("plugin servers are not health-checked, so no credential can reach them", async () => {
+    writePlugin("unabyss", unabyssManifest());
+
+    const servers = await listServers();
+
+    expect(servers.find((s) => s.id === "unabyss")!.status).toEqual("declared");
+    // The credential mocks above return a token and an Authorization header
+    // for every id. Constructing a client for the plugin server is what
+    // would ship them to the plugin-declared URL.
+    expect(connectedServerIds).toContain("from-workspace");
+    expect(connectedServerIds).not.toContain("unabyss");
+  });
+
+  test("plugin servers report no assistant-owned auth even when the store has some", async () => {
+    writePlugin("unabyss", unabyssManifest());
+
+    const plugin = (await listServers()).find((s) => s.id === "unabyss")!;
+    expect(plugin.hasOAuth).toBe(false);
+    expect(plugin.hasStaticAuth).toBe(false);
+    expect(plugin.authType).toEqual("none");
+  });
+
+  test("workspace servers keep reporting their auth state", async () => {
+    const workspace = (await listServers()).find(
+      (s) => s.id === "from-workspace",
+    )!;
+    expect(workspace.hasOAuth).toBe(true);
+    expect(workspace.hasStaticAuth).toBe(true);
+  });
+
+  test("plugin servers default to low risk", async () => {
+    writePlugin("unabyss", unabyssManifest());
+
+    const servers = await listServers();
+    expect(servers.find((s) => s.id === "unabyss")!.defaultRiskLevel).toEqual(
+      "low",
+    );
+  });
+
+  test("a directory with no valid package.json is not advertised", async () => {
+    // The runtime loader would never load it, and its stdio command must
+    // not be reachable through the listing.
+    const dir = join(getWorkspacePluginsDir(), "no-manifest");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      join(dir, "mcp.json"),
+      JSON.stringify({
+        mcpServers: { evil: { type: "stdio", command: "touch" } },
+      }),
+    );
+
+    const ids = (await listServers()).map((s) => s.id);
+    expect(ids).not.toContain("no-manifest__evil");
+    expect(ids).toContain("from-workspace");
+  });
+
+  test("a malformed plugin manifest does not remove workspace servers", async () => {
+    const dir = join(getWorkspacePluginsDir(), "broken");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      join(dir, "package.json"),
+      JSON.stringify({ name: "broken", version: "1.0.0" }),
+    );
+    writeFileSync(join(dir, "mcp.json"), "{ not json");
+
+    const ids = (await listServers()).map((s) => s.id);
+    expect(ids).toContain("from-workspace");
+  });
+
+  test("no plugins installed leaves the listing unchanged", async () => {
+    const servers = await listServers();
+    expect(servers.every((s) => s.source === "workspace")).toBe(true);
+  });
+});

package/src/__tests__/memory-retrieval-hook.test.ts

@@ -73,6 +73,7 @@ import type { QdrantSparseVector } from "../persistence/embeddings/qdrant-client
 import type { ConversationGraphMemory } from "../plugins/defaults/memory/graph/conversation-graph-memory.js";
 import userPromptSubmitMemoryRetrieval from "../plugins/defaults/memory/hooks/user-prompt-submit.js";
 import type { Message } from "../providers/types.js";
+import { asConversation } from "./helpers/mock-conversation.js";
 
 /** Canonical metrics payload the graph retriever attaches to a real hit. */
 function makeMetrics() {
@@ -172,15 +173,15 @@ function installConversation(
   graphMemory: ConversationGraphMemory,
   opts?: {
     trusted?: boolean;
-    signal?: AbortSignal;
+    abortController?: AbortController;
   },
 ): void {
   currentTrustClass = opts?.trusted === false ? "unknown" : "guardian";
-  currentConversation = {
+  currentConversation = asConversation({
     graphMemory,
     trustContext: undefined,
-    abortController: { signal: opts?.signal ?? new AbortController().signal },
-  } as unknown as Conversation;
+    abortController: opts?.abortController ?? new AbortController(),
+  });
 }
 
 beforeEach(() => {
@@ -492,7 +493,7 @@ describe("user-prompt-submit hook (memory retrieval)", () => {
     const controller = new AbortController();
     installConversation(graphMemory, {
       trusted: true,
-      signal: controller.signal,
+      abortController: controller,
     });
     const ctx = makeHookCtx();
 

package/src/__tests__/messages-read-boundary-guard.test.ts

@@ -0,0 +1,134 @@
+import { readFileSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { Glob } from "bun";
+
+/**
+ * Ratchet over direct reads of the `messages` table outside `persistence/`.
+ *
+ * Every row in `messages` is conversation content in some state of
+ * completeness, and each read encodes a visibility decision (completed
+ * history vs. any row). `persistence/` owns that contract: named accessors in
+ * `message-reads.ts` and the history readers in `conversation-crud.ts` state
+ * their decision in their name; everything else should go through them. A
+ * direct reader that re-decides visibility on its own is how the contract
+ * fails silently, so a new direct read is a reviewed exception, not a
+ * default.
+ *
+ * The BASELINE lists every file outside `persistence/` that reads the table
+ * directly today. Each entry has been audited and carries its visibility
+ * decision as a comment at the read site. The guard fails when a file outside
+ * the baseline gains a direct read (route it through an accessor, or audit it
+ * and baseline it with a site comment explaining the decision in your PR),
+ * and when a baseline entry goes stale (remove it, so coverage cannot rot).
+ *
+ * Detection is deliberately shape-based (from/join of `messages` in drizzle
+ * builders, `FROM messages` / `JOIN messages` in raw SQL): this is a ratchet
+ * against sprawl, not a proof, and matching the read shapes keeps it free of
+ * false positives from unrelated identifiers.
+ *
+ * Regenerate after an intentional change with:
+ *   UPDATE_MESSAGES_READ_BASELINE=1 bun test src/__tests__/messages-read-boundary-guard.test.ts
+ * and paste the printed list here, explaining the new read in your PR.
+ */
+
+const SRC_REL = "src";
+const SRC_ABS = join(process.cwd(), SRC_REL);
+
+/**
+ * Audited direct readers outside persistence/, as file -> count of matching
+ * read sites. Counts, not just filenames: a new read added inside an
+ * already-baselined file must fail the ratchet too, since each site carries
+ * its own visibility decision. A same-file refactor that replaces one read
+ * with another at equal count passes; that is accepted ratchet granularity
+ * (the diff still shows the site to its reviewer).
+ */
+const BASELINE: Readonly<Record<string, number>> = {
+  "src/apps/app-store.ts": 1,
+  "src/daemon/credential-transcript-scrub.ts": 1,
+  "src/live-voice/live-voice-archive.ts": 1,
+  "src/monitoring/recovery/inflight-content.ts": 2,
+  "src/plugins/defaults/memory/context-search/sources/conversations.ts": 1,
+  "src/plugins/defaults/memory/graph/image-ref-utils.ts": 1,
+  "src/plugins/defaults/memory/indexer.ts": 2,
+  "src/plugins/defaults/memory/memory-retrospective-accounting.ts": 4,
+  "src/plugins/defaults/memory/substrate/sweep-job.ts": 1,
+  "src/plugins/defaults/memory/v1/graph/extraction.ts": 3,
+  "src/plugins/defaults/memory/v1/job-handlers/backfill.ts": 1,
+  "src/plugins/defaults/memory/v1/job-handlers/embedding.ts": 1,
+  "src/plugins/defaults/memory/v1/job-handlers/index-maintenance.ts": 1,
+  "src/plugins/defaults/memory/v2/harness/oracle.ts": 1,
+  "src/plugins/defaults/memory/v2/harness/replay-input.ts": 1,
+  "src/plugins/defaults/memory/v3-eval/eval-packets.ts": 2,
+  "src/plugins/defaults/memory/v3/prune.ts": 1,
+  "src/plugins/defaults/memory/v3/selection-log-store.ts": 1,
+  "src/runtime/pre-first-message-gate.ts": 1,
+  "src/runtime/routes/log-export-routes.ts": 1,
+  "src/runtime/routes/surface-conversation-resolver.ts": 2,
+  "src/telemetry/turn-events-store.ts": 2,
+  "src/telemetry/turn-trace-store.ts": 2,
+  "src/workspace/migrations/rebuild-conversation-disk-view.ts": 1,
+};
+
+const DRIZZLE_READ =
+  /\.(?:from|innerJoin|leftJoin|rightJoin|fullJoin)\(\s*messages\s*[,)]/g;
+const RAW_SQL_READ = /(?:FROM|JOIN)\s+messages\b/g;
+
+function isExempt(relPath: string): boolean {
+  const parts = relPath.split(sep);
+  return (
+    parts[1] === "persistence" ||
+    parts.includes("__tests__") ||
+    relPath.endsWith(".test.ts")
+  );
+}
+
+async function scanDirectReaders(): Promise<Map<string, number>> {
+  const glob = new Glob("**/*.ts");
+  const found = new Map<string, number>();
+  for await (const file of glob.scan({ cwd: SRC_ABS, absolute: true })) {
+    const relPath = join(SRC_REL, relative(SRC_ABS, file));
+    if (isExempt(relPath)) {
+      continue;
+    }
+    const source = readFileSync(file, "utf-8");
+    const count =
+      [...source.matchAll(DRIZZLE_READ)].length +
+      [...source.matchAll(RAW_SQL_READ)].length;
+    if (count > 0) {
+      found.set(relPath, count);
+    }
+  }
+  return found;
+}
+
+describe("messages read boundary", () => {
+  test("no new direct messages reads beyond the audited baseline", async () => {
+    const found = await scanDirectReaders();
+
+    if (process.env.UPDATE_MESSAGES_READ_BASELINE === "1") {
+      console.log(
+        JSON.stringify(Object.fromEntries([...found].sort()), null, 2),
+      );
+    }
+
+    const grown = [...found]
+      .filter(([file, count]) => count > (BASELINE[file] ?? 0))
+      .map(([file, count]) => `${file}: ${BASELINE[file] ?? 0} -> ${count}`);
+    expect(
+      grown,
+      `New direct reads of the messages table outside persistence/ (route ` +
+        `through an accessor in persistence/message-reads.ts, or audit the ` +
+        `read, state its visibility decision at the site, and baseline it):`,
+    ).toEqual([]);
+
+    const shrunk = Object.entries(BASELINE)
+      .filter(([file, count]) => (found.get(file) ?? 0) < count)
+      .map(([file, count]) => `${file}: ${count} -> ${found.get(file) ?? 0}`);
+    expect(
+      shrunk,
+      "Stale baseline entries (fewer direct reads than baselined; ratchet the count down so coverage cannot rot):",
+    ).toEqual([]);
+  });
+});

package/src/__tests__/mtime-cache.test.ts

@@ -30,10 +30,10 @@ import {
 } from "bun:test";
 
 import { _inspectHookCacheForTests } from "../hooks/hook-loader.js";
+import { getUserHooksFor } from "../hooks/registry.js";
 import {
   _inspectToolCacheForTests,
   getCachedUserTools,
-  getUserHooksFor,
   populateCacheAtBoot,
   reconcilePluginSourcesNow,
   resetPluginCacheForTests,

package/src/__tests__/non-member-access-request.test.ts

@@ -501,7 +501,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest returns no_sender_id when actorExternalId is absent", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: undefined,
@@ -522,7 +521,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest creates request with self-healed principal when no binding exists", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -565,7 +563,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "tg-chat",
       actorExternalId: "unknown-tg-user",
@@ -619,7 +616,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -660,7 +656,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -688,7 +683,6 @@ describe("access-request-helper unit tests", () => {
   test("notifyGuardianOfAccessRequest resolves the vellum anchor from the gateway delivery", async () => {
     // Only the vellum anchor (seeded in resetState) is served by the gateway.
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -722,7 +716,6 @@ describe("access-request-helper unit tests", () => {
 
     await expect(
       notifyGuardianOfAccessRequest({
-        canonicalAssistantId: "self",
         sourceChannel: "telegram",
         conversationExternalId: "chat-123",
         actorExternalId: "unknown-user",
@@ -739,7 +732,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest for voice channel includes actorDisplayName in contextPayload", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "phone",
       conversationExternalId: "+15559998888",
       actorExternalId: "+15559998888",
@@ -770,7 +762,6 @@ describe("access-request-helper unit tests", () => {
 
   test("notifyGuardianOfAccessRequest includes requestCode in contextPayload", async () => {
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -794,7 +785,6 @@ describe("access-request-helper unit tests", () => {
     // is created and the status is forwarded to the card payload. (A `revoked`
     // status would instead suppress — covered by the keep-out tests.)
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "pending-user",
@@ -834,7 +824,6 @@ describe("access-request-helper unit tests", () => {
     };
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "phone",
       conversationExternalId: "+15556667777",
       actorExternalId: "+15556667777",
@@ -897,7 +886,6 @@ describe("access-request-helper unit tests", () => {
     };
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-123",
       actorExternalId: "unknown-user",
@@ -929,7 +917,6 @@ describe("access-request-helper unit tests", () => {
     // request row. A revoked/blocked contact is deliberately kept out — no new
     // prompt, signal, or pending request.
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-kept-out",
       actorExternalId: "revoked-user",
@@ -969,7 +956,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-parked",
       actorExternalId: "parked-user",
@@ -1006,7 +992,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-approved",
       actorExternalId: "approved-user",
@@ -1047,7 +1032,6 @@ describe("access-request-helper unit tests", () => {
     bridgeState.requests.get(requestId)!.updatedAt = staleUpdatedAt;
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-stale",
       actorExternalId: "stale-user",
@@ -1082,7 +1066,6 @@ describe("access-request-helper unit tests", () => {
     });
 
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-flip",
       actorExternalId: "flip-user",
@@ -1101,7 +1084,6 @@ describe("access-request-helper unit tests", () => {
     // Suppression is scoped to the sender via their own contact status, so a
     // kept-out contact never bleeds into a different sender's prompt.
     const keptOut = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-kept",
       actorExternalId: "revoked-user",
@@ -1112,7 +1094,6 @@ describe("access-request-helper unit tests", () => {
 
     // A different sender with no keep-out still gets a fresh prompt.
     const result = await notifyGuardianOfAccessRequest({
-      canonicalAssistantId: "self",
       sourceChannel: "telegram",
       conversationExternalId: "chat-fresh",
       actorExternalId: "fresh-user",
@@ -1141,7 +1122,6 @@ describe("maybeNotifyGuardianOfAdmittedContact", () => {
   });
 
   const baseParams = {
-    canonicalAssistantId: "self",
     sourceChannel: "telegram" as const,
     conversationExternalId: "chat-123",
     actorExternalId: "user-unknown-456",

package/src/__tests__/outbound-slack-persistence.test.ts

@@ -103,7 +103,10 @@ mock.module("../persistence/conversation-crud.js", () => ({
   },
   // The handler treats provenance as a flat spread; returning {} keeps the
   // metadata snapshot focused on the fields under test.
-  provenanceFromTrustContext: () => ({}),
+  // Mirrors the real mapping so provenance assertions observe what production
+  // stamps rather than a placeholder.
+  provenanceFromTrustContext: (ctx?: { trustClass?: string }) =>
+    ctx ? { provenanceTrustClass: ctx.trustClass } : {},
   reserveMessage: mock(
     async (
       conversationId: string,
@@ -187,6 +190,8 @@ function makeDeps(
     requesterTimezoneLabel?: string;
     clientTimezone?: string;
     sourceThreadId?: string;
+    /** Turn-local trust; when set, the live slot below diverges from it. */
+    currentTurnTrustContext?: Record<string, unknown>;
   } = {},
 ): EventHandlerDeps {
   const assistantMessageChannel = overrides.assistantMessageChannel ?? "slack";
@@ -195,6 +200,7 @@ function makeDeps(
       conversationId,
       provider: { name: "anthropic" },
       currentTurnSurfaces: [],
+      currentTurnTrustContext: overrides.currentTurnTrustContext,
       trustContext: {
         sourceChannel: assistantMessageChannel,
         trustClass: "guardian",
@@ -439,6 +445,39 @@ describe("outbound assistant Slack metadata persistence", () => {
     expect(slackMeta.channelTs).toBeUndefined();
   });
 
+  test("envelope resolves from the turn's actor when the slot has moved", async () => {
+    // Provenance class and Slack routing must come from ONE actor: the turn's.
+    // A queued Slack turn runs while the guardian has since written the live
+    // slot; the assistant row must carry the sender's class AND the sender's
+    // channel/thread, not a mixed envelope.
+    const conversationId = "conv-slack-moved-slot";
+    const deps = makeDeps(conversationId, {
+      assistantMessageChannel: "slack",
+      // Live slot: the guardian, on a different chat, no thread.
+      requesterChatId: "C-GUARDIAN",
+      currentTurnTrustContext: {
+        sourceChannel: "slack",
+        trustClass: "trusted_contact",
+        requesterChatId: "C-CONTACT",
+        sourceThreadId: "1723300000.000100",
+      },
+    });
+    await handleLlmCallStarted(state, deps);
+    await handleMessageComplete(
+      state,
+      deps,
+      makeMessageCompleteEvent("reply to the contact"),
+    );
+
+    const persisted = lastAssistantPersisted();
+    expect(persisted.metadata?.provenanceTrustClass).toBe("trusted_contact");
+    const slackMeta = JSON.parse(
+      persisted.metadata?.slackMeta as string,
+    ) as Record<string, unknown>;
+    expect(slackMeta.channelId).toBe("C-CONTACT");
+    expect(slackMeta.threadTs).toBe("1723300000.000100");
+  });
+
   test("ignores a non-ts sourceThreadId", async () => {
     const conversationId = "conv-slack-bad-thread";
     const channelId = "C789BAD";