@vellumai/assistant 0.11.6-dev.202608252309.48526e7 → 0.11.6-staging.2

package/ARCHITECTURE.md

@@ -84,7 +84,7 @@ All HTTP API requests use a single `Authorization: Bearer <jwt>` header for auth
 
 **Identity lifecycle:**
 
-1. **Bootstrap (loopback-only, desktop)**: On first launch, the desktop client calls `POST /v1/guardian/init` with `{ platform, deviceId }`. The endpoint is loopback-only and mints a JWT access token + refresh token pair. Returns `{ guardianPrincipalId, accessToken, accessTokenExpiresAt, refreshToken, refreshTokenExpiresAt, refreshAfter, isNew }`. The CLI obtains its bearer token during `hatch` and does not perform a separate bootstrap step.
+1. **Bootstrap (loopback-only, macOS)** — On first launch, the macOS client calls `POST /v1/guardian/init` with `{ platform, deviceId }`. The endpoint is loopback-only and mints a JWT access token + refresh token pair. Returns `{ guardianPrincipalId, accessToken, accessTokenExpiresAt, refreshToken, refreshTokenExpiresAt, refreshAfter, isNew }`. The CLI obtains its bearer token during `hatch` and does not perform a separate bootstrap step.
 
 2. **Refresh** — `POST /v1/guardian/refresh` accepts `{ refreshToken }` and returns a new access/refresh token pair. Single-use rotation with replay detection and family-based revocation.
 

package/docs/flux-turn-detection-spike.md

@@ -59,7 +59,7 @@ If it does not, set the Deepgram key the ordinary way (client Settings, Speech-t
 
 ## 2. Enable Flux
 
-> **Putting a provider on the `flux` model family turns off batch transcription for the whole workspace, not just live voice.** `services.stt.provider` plus `services.stt.providers.<provider>.model` is the single source of truth for every STT route, and Flux is the only family in the catalog with no `daemon-batch` boundary. For as long as it is set, these all stop working: voice-message and inbound-attachment transcription, the `transcribe` skill, the `media-processing` skill's audio segments, `POST /v1/stt/transcribe`, and phone-call transcription. Each reports a message naming Flux as the cause rather than failing silently, but they do not fall back to `deepgram` on their own. **Set `services.stt.providers.deepgram.model` back to `nova-3` when the spike is over**, and do not run the spike on an assistant that is also taking calls or handling voice messages.
+> **Setting `services.stt.provider` to `deepgram-flux` turns off batch transcription for the whole workspace, not just live voice.** `services.stt.provider` is the single source of truth for every STT route, and Flux is the only provider in the catalog with no `daemon-batch` boundary. For as long as it is set, these all stop working: voice-message and inbound-attachment transcription, the `transcribe` skill, the `media-processing` skill's audio segments, `POST /v1/stt/transcribe`, and phone-call transcription. Each reports a message naming Flux as the cause rather than failing silently, but they do not fall back to `deepgram` on their own. **Set `services.stt.provider` back to `deepgram` when the spike is over**, and do not run the spike on an assistant that is also taking calls or handling voice messages.
 
 Two keys in `config.json`, which lives at `$VELLUM_WORKSPACE_DIR/config.json` (default `~/.vellum/workspace/config.json`):
 
@@ -67,8 +67,7 @@ Two keys in `config.json`, which lives at `$VELLUM_WORKSPACE_DIR/config.json` (d
 {
   "services": {
     "stt": {
-      "provider": "deepgram",
-      "providers": { "deepgram": { "model": "flux" } }
+      "provider": "deepgram-flux"
     }
   },
   "liveVoice": {
@@ -94,12 +93,12 @@ The rest of `liveVoice.flux` is optional and defaulted (`config/schemas/live-voi
 
 ## 3. Run the A/B
 
-**Flip `turnEnd.enabled` between runs and leave the `flux` model family selected in both arms.** That holds the STT engine, the model, the socket, and the transcriber lifecycle constant, so the only thing that changes is which signal commits the turn.
+**Flip `turnEnd.enabled` between runs and leave `services.stt.provider` on `deepgram-flux` in both arms.** That holds the STT engine, the model, the socket, and the transcriber lifecycle constant, so the only thing that changes is which signal commits the turn.
 
-- **Arm A (control):** `providers.deepgram.model: "flux"`, `turnEnd.enabled: false`. Flux transcribes; the four turn-detection events are ignored; the local silence boundary and the front-door hold path run exactly as they do today.
-- **Arm B (treatment):** `providers.deepgram.model: "flux"`, `turnEnd.enabled: true`.
+- **Arm A (control):** `provider: "deepgram-flux"`, `turnEnd.enabled: false`. Flux transcribes; the four turn-detection events are ignored; the local silence boundary and the front-door hold path run exactly as they do today.
+- **Arm B (treatment):** `provider: "deepgram-flux"`, `turnEnd.enabled: true`.
 
-**Do not A/B by switching the model family between `nova-3` and `flux`.** That confounds two changes at once:
+**Do not A/B by switching the provider between `deepgram` and `deepgram-flux`.** That confounds two changes at once:
 
 1. It swaps the STT model. `deepgram` runs `nova-2` (`DEFAULT_MODEL`, `deepgram-realtime.ts`), so any transcript-quality or first-partial difference lands in your latency numbers.
 2. It swaps the transcriber lifecycle. `deepgram` implements `finalizeUtterance`, so the session adopts it as a persistent stream shared across the whole session (`sharedTranscriber`) and never tears it down between turns. Flux implements no `finalizeUtterance`, so every utterance owns its own `/v2/listen` socket and every release closes it. That per-turn socket churn is inside `roundTripMs` and `totalMs` on the Flux side and absent on the `deepgram` side, so a naive provider-swap A/B attributes it to turn detection. The next section is what it costs and why it cannot be removed.
@@ -231,7 +230,7 @@ Check these if you port the spike anywhere else, because a run that violates eit
 
 ## 8. Falling back
 
-Set `liveVoice.flux.turnEnd.enabled` back to `false` (or delete the key) and restart. That is the whole rollback: the latch goes down, the turn-detection events become no-ops, and the silence-boundary path runs unchanged. You can leave the `flux` family selected or move back to `nova-3`; either is a working configuration.
+Set `liveVoice.flux.turnEnd.enabled` back to `false` (or delete the key) and restart. That is the whole rollback: the latch goes down, the turn-detection events become no-ops, and the silence-boundary path runs unchanged. You can leave `services.stt.provider` on `deepgram-flux` or move it back to `deepgram`; either is a working configuration.
 
 Runtime fallback needs no action. A Flux stream that never emits `turn-end` is caught by the fail-open deadline and the utterance replays onto the silence path, so an outage degrades to today's behavior rather than to a hung turn.
 

package/node_modules/@vellumai/gateway-client/src/__tests__/contact-read-contracts.test.ts

@@ -20,7 +20,6 @@ describe("contact read contracts", () => {
       contactType: "human",
       lastInteraction: 1700000000,
       interactionCount: 12,
-      autoApproveThreshold: "medium",
       createdAt: 1699000000,
       updatedAt: 1700000000,
       channels: [
@@ -47,7 +46,6 @@ describe("contact read contracts", () => {
     const parsed = ContactReadSchema.parse(contact);
     expect(parsed.createdAt).toBe(1699000000);
     expect(parsed.updatedAt).toBe(1700000000);
-    expect(parsed.autoApproveThreshold).toBe("medium");
   });
 
   test("ContactReadSchema accepts null interactionCount (daemon-native gateway-telemetry outage fail-soft)", () => {
@@ -84,36 +82,6 @@ describe("contact read contracts", () => {
     const parsed = ContactReadSchema.parse(contact);
     expect(parsed.interactionCount).toBeNull();
     expect(parsed.channels[0].interactionCount).toBeNull();
-    expect(parsed.autoApproveThreshold).toBeUndefined();
-  });
-
-  test("ContactReadSchema accepts a null auto-approve threshold", () => {
-    const contact = {
-      id: "c1",
-      displayName: "Example User",
-      role: "contact",
-      interactionCount: 0,
-      autoApproveThreshold: null,
-      createdAt: 1699000000,
-      updatedAt: 1700000000,
-      channels: [],
-    };
-    expect(ContactReadSchema.parse(contact).autoApproveThreshold).toBeNull();
-  });
-
-  test("ContactReadSchema rejects an unknown auto-approve threshold", () => {
-    expect(() =>
-      ContactReadSchema.parse({
-        id: "c1",
-        displayName: "Example User",
-        role: "contact",
-        interactionCount: 0,
-        autoApproveThreshold: "full",
-        createdAt: 1699000000,
-        updatedAt: 1700000000,
-        channels: [],
-      }),
-    ).toThrow();
   });
 
   test("ContactReadSchema requires createdAt/updatedAt", () => {

package/node_modules/@vellumai/gateway-client/src/__tests__/trust-verdict-contract.test.ts

@@ -31,7 +31,6 @@ const fullVerdict: TrustVerdict = {
   verifiedAt: 1699999999,
   interactionCount: 12,
   memberDisplayName: "Member Name",
-  autoApproveThreshold: "high",
 };
 
 describe("TrustVerdictSchema", () => {
@@ -39,23 +38,6 @@ describe("TrustVerdictSchema", () => {
     expect(TrustVerdictSchema.parse(fullVerdict)).toEqual(fullVerdict);
   });
 
-  test("parses a verdict with a null contact auto-approve threshold", () => {
-    const verdict = {
-      ...fullVerdict,
-      autoApproveThreshold: null,
-    } satisfies TrustVerdict;
-    expect(TrustVerdictSchema.parse(verdict)).toEqual(verdict);
-  });
-
-  test("rejects an unknown contact auto-approve threshold", () => {
-    expect(() =>
-      TrustVerdictSchema.parse({
-        ...fullVerdict,
-        autoApproveThreshold: "full",
-      }),
-    ).toThrow();
-  });
-
   test("parses a minimal verdict", () => {
     const minimal = {
       trustClass: "unknown",

package/node_modules/@vellumai/gateway-client/src/admission-policy-contract.ts

@@ -82,10 +82,15 @@ export function isAdmissionPolicyExemptChannel(channelType: string): boolean {
  * `vellum` is the local desktop/web client surface; the guardian is always
  * max-rank there, so the seed default admits them regardless of the floor.
  *
+ * `discord` has no ingress implementation, so there is nothing for a floor to
+ * gate and nothing for the user to configure. Hiding keeps it pinned at the
+ * seed default rather than offering a Channel Trust Floors row for a channel
+ * that receives nothing.
  */
 export const ADMISSION_POLICY_HIDDEN_CHANNELS: ReadonlySet<string> = new Set([
   "vellum",
   "whatsapp",
+  "discord",
 ]);
 
 export function isAdmissionPolicyHiddenChannel(channelType: string): boolean {

package/node_modules/@vellumai/gateway-client/src/channel-permission-contract.ts

@@ -10,9 +10,7 @@
  *
  * Storage lives in the gateway DB (`channel_permission_overrides`) so the
  * assistant cannot tamper with it, matching `channel_admission_policy` and
- * `auto_approve_thresholds`. A contact-level ceiling can live on
- * `contacts.auto_approve_threshold` and is stamped on the trust verdict;
- * that override is not a matrix cell.
+ * `auto_approve_thresholds`.
  */
 
 import { z } from "zod";

package/node_modules/@vellumai/gateway-client/src/gateway-ipc-contracts.ts

@@ -5,8 +5,6 @@
 import { CHANNEL_IDS } from "@vellumai/service-contracts/channels";
 import { z } from "zod";
 
-import { RiskThresholdSchema } from "./channel-permission-contract.js";
-
 export const GATEWAY_LOG_LEVEL_NAMES = [
   "trace",
   "debug",
@@ -277,11 +275,6 @@ export const ContactReadSchema = z.object({
   contactType: z.string().nullable().optional(),
   lastInteraction: z.number().nullable().optional(),
   interactionCount: z.number().nullable(),
-  /**
-   * Per-contact auto-approve ceiling. Null when unset (inherit cascade).
-   * Optional on the wire for version skew; gateway reads always emit it.
-   */
-  autoApproveThreshold: RiskThresholdSchema.nullable().optional(),
   createdAt: z.number(),
   updatedAt: z.number(),
   channels: z.array(ContactReadChannelSchema),

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -61,14 +61,6 @@ export const ApprovalUIMetadataSchema = z.object({
   actions: z.array(ApprovalActionOptionSchema),
   plainTextFallback: z.string(),
   permissionDetails: PermissionRequestDetailsSchema.optional(),
-  /**
-   * What the recipient is being asked to do, so a renderer can head the card
-   * with the right verb. Resolved once by the producer; a renderer that reads
-   * the actions to work it out would be parsing a payload it is meant only to
-   * draw. Absent means an approval, which is what every existing producer
-   * sends and what a renderer without this field already assumes.
-   */
-  intent: z.enum(["approval", "question"]).optional(),
 });
 
 export type ApprovalUIMetadata = z.infer<typeof ApprovalUIMetadataSchema>;

package/node_modules/@vellumai/gateway-client/src/trust-verdict-contract.ts

@@ -78,17 +78,6 @@ export const TrustVerdictSchema = z.object({
   policy: z.string().optional(),
   verifiedAt: z.number().nullable().optional(),
   memberDisplayName: z.string().optional(),
-  /**
-   * Contact-level auto-approve ceiling from the gateway `contacts` row.
-   * Present when a member channel resolves. Null means the contact has no
-   * explicit override (inherit the room / trust-class cascade).
-   * Same vocabulary as `RiskThreshold` (`none` | `low` | `medium` | `high`).
-   * Inlined here so this leaf contract does not import the permission matrix.
-   */
-  autoApproveThreshold: z
-    .enum(["none", "low", "medium", "high"])
-    .nullable()
-    .optional(),
 
   // Gateway-owned interaction telemetry (a trust signal, not an info field per
   // the 2×2) — carried straight off the member `contact_channels` row.

package/openapi.yaml

@@ -2766,8 +2766,8 @@ paths:
       operationId: backup_destinations_get
       summary: List configured offsite backup destinations
       description:
-        Returns the current offsite destinations array. When no explicit array is configured, macOS materializes
-        its encrypted iCloud Drive default while Windows and Linux return no implicit destination.
+        Returns the current offsite destinations array, materializing the iCloud Drive default when no explicit
+        array is configured.
       tags:
         - backups
       responses:
@@ -2799,8 +2799,8 @@ paths:
       operationId: backup_destinations_add_post
       summary: Add an offsite backup destination
       description:
-        Appends a new destination. Materializes the platform default first if destinations is currently null.
-        Errors if the path already exists.
+        Appends a new destination. Materializes the iCloud default first if destinations is currently null. Errors
+        if the path already exists.
       tags:
         - backups
       requestBody:
@@ -4342,15 +4342,6 @@ paths:
                             - type: "null"
                         memberDisplayName:
                           type: string
-                        autoApproveThreshold:
-                          anyOf:
-                            - type: string
-                              enum:
-                                - none
-                                - low
-                                - medium
-                                - high
-                            - type: "null"
                         interactionCount:
                           type: number
                         hasInterceptableVerificationSession:
@@ -5232,10 +5223,6 @@ paths:
                     required:
                       - profile
                       - weight
-                fallbackProfile:
-                  readOnly: true
-                  type: string
-                  minLength: 1
       responses:
         "200":
           description: Successful response
@@ -5606,15 +5593,6 @@ paths:
                         anyOf:
                           - type: number
                           - type: "null"
-                      autoApproveThreshold:
-                        anyOf:
-                          - type: string
-                            enum:
-                              - none
-                              - low
-                              - medium
-                              - high
-                          - type: "null"
                       createdAt:
                         type: number
                       updatedAt:
@@ -5779,15 +5757,6 @@ paths:
                           anyOf:
                             - type: number
                             - type: "null"
-                        autoApproveThreshold:
-                          anyOf:
-                            - type: string
-                              enum:
-                                - none
-                                - low
-                                - medium
-                                - high
-                            - type: "null"
                         createdAt:
                           type: number
                         updatedAt:
@@ -5921,15 +5890,6 @@ paths:
                         anyOf:
                           - type: number
                           - type: "null"
-                      autoApproveThreshold:
-                        anyOf:
-                          - type: string
-                            enum:
-                              - none
-                              - low
-                              - medium
-                              - high
-                          - type: "null"
                       createdAt:
                         type: number
                       updatedAt:
@@ -6334,15 +6294,6 @@ paths:
                         anyOf:
                           - type: number
                           - type: "null"
-                      autoApproveThreshold:
-                        anyOf:
-                          - type: string
-                            enum:
-                              - none
-                              - low
-                              - medium
-                              - high
-                          - type: "null"
                       createdAt:
                         type: number
                       updatedAt:
@@ -6542,15 +6493,6 @@ paths:
                       anyOf:
                         - type: number
                         - type: "null"
-                    autoApproveThreshold:
-                      anyOf:
-                        - type: string
-                          enum:
-                            - none
-                            - low
-                            - medium
-                            - high
-                        - type: "null"
                     createdAt:
                       type: number
                     updatedAt:
@@ -15046,8 +14988,8 @@ paths:
           description: Profile not found
         "409":
           description:
-            Profile is still referenced by activeProfile, advisorProfile, a call site, a default-tier override, a mix
-            arm, or another profile's fallbackProfile
+            Profile is still referenced by activeProfile, advisorProfile, a call site, a default-tier override, or a
+            mix arm
     get:
       operationId: inference_profiles_by_name_get
       summary: Get an effective inference profile
@@ -34816,12 +34758,6 @@ components:
                   - profile
                   - weight
             - type: "null"
-        fallbackProfile:
-          anyOf:
-            - readOnly: true
-              type: string
-              minLength: 1
-            - type: "null"
       additionalProperties: {}
     ProfileStatus:
       type: string
@@ -35593,10 +35529,6 @@ components:
               - profile
               - weight
             additionalProperties: false
-        fallbackProfile:
-          readOnly: true
-          type: string
-          minLength: 1
         supportsVision:
           type: boolean
         invariant:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.6-dev.202608252309.48526e7",
+  "version": "0.11.6-staging.2",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/compactor-call-site-logging.test.ts

@@ -194,64 +194,3 @@ describe("compactor records llm_request_logs with call_site=compactionAgent", ()
     expect(recordRequestLogCalls[0]!.callSite).toBe("compactionAgent");
   });
 });
-
-describe("compaction result reports what actually served the summary", () => {
-  beforeEach(() => {
-    recordRequestLogCalls.length = 0;
-  });
-
-  test("rerouted summary carries the backup provider and profile", async () => {
-    // `RetryProvider` escalated the summary call to a backup profile on
-    // another provider and stamped the response, so the result must report
-    // the backup even though the compactor resolved `primaryProfile`.
-    const provider: Provider = {
-      name: "openai",
-      sendMessage: async () => ({
-        content: [{ type: "text", text: compactionResponse }],
-        model: "claude-sonnet-5",
-        actualProvider: "anthropic",
-        actualInferenceProfile: "backupProfile",
-        usage: { inputTokens: 100, outputTokens: 50 },
-        stopReason: "end_turn",
-        rawRequest: RAW_REQUEST,
-        rawResponse: RAW_RESPONSE,
-      }),
-    };
-
-    const result = await runAssistantDrivenCompaction({
-      ...args(provider),
-      overrideProfile: "primaryProfile",
-    });
-
-    expect(result.summaryModel).toBe("claude-sonnet-5");
-    expect(result.summaryActualProvider).toBe("anthropic");
-    expect(result.summaryActualInferenceProfile).toBe("backupProfile");
-    // The primary's resolution is still reported, just outranked downstream.
-    expect(result.summaryOverrideProfile).toBe("primaryProfile");
-    // Same value the request log recorded: one source of truth, not two.
-    expect(recordRequestLogCalls[0]!.provider).toBe("anthropic");
-  });
-
-  test("non-rerouted summary carries the configured provider and no profile", async () => {
-    const provider: Provider = {
-      name: "openai",
-      sendMessage: async () => ({
-        content: [{ type: "text", text: compactionResponse }],
-        model: "mock-model",
-        usage: { inputTokens: 100, outputTokens: 50 },
-        stopReason: "end_turn",
-        rawRequest: RAW_REQUEST,
-        rawResponse: RAW_RESPONSE,
-      }),
-    };
-
-    const result = await runAssistantDrivenCompaction({
-      ...args(provider),
-      overrideProfile: "primaryProfile",
-    });
-
-    expect(result.summaryActualProvider).toBe("openai");
-    expect(result.summaryActualInferenceProfile).toBeUndefined();
-    expect(result.summaryOverrideProfile).toBe("primaryProfile");
-  });
-});

package/src/__tests__/config-loader-backfill.test.ts

@@ -1411,71 +1411,6 @@ describe("loadConfig startup behavior", () => {
     expect(effective.balanced?.provider_connection).toBe("anthropic-personal");
   });
 
-  test("an active managed backup profile survives a reload", () => {
-    // A managed backup resolves from the code catalog without being
-    // materialized in `llm.profiles`, so selecting one persists nothing but
-    // the reference. If the schema did not treat backup keys as
-    // always-available references, the strip-and-reparse in `loadConfig`
-    // would drop `activeProfile` and the seeder would reset the user's
-    // chat-model selection to `balanced` on the next boot.
-    writeConfig({
-      llm: {
-        defaultProvider: { provider: "vellum" },
-        profiles: {},
-        activeProfile: "balanced-backup",
-      },
-    });
-
-    const config = loadConfig();
-    expect(config.llm.activeProfile).toBe("balanced-backup");
-
-    mergeDefaultConfigAndSeedInferenceProfiles();
-
-    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
-    expect(raw.llm.activeProfile).toBe("balanced-backup");
-    expect(raw.llm.profiles["balanced-backup"]).toBeUndefined();
-  });
-
-  test("an active managed backup profile is repaired on a BYOK install", () => {
-    // Backups live on the managed column alone, so under a BYOK default
-    // provider the selection names a profile that resolves to nothing. The
-    // schema rejects the reference on load and the seeder, which resolves
-    // availability through the same provider-aware view, repairs the stored
-    // selection instead of preserving a dead pointer.
-    writeConfig({
-      llm: {
-        defaultProvider: { provider: "anthropic" },
-        profiles: {},
-        activeProfile: "balanced-backup",
-      },
-    });
-
-    const config = loadConfig();
-    expect(config.llm.activeProfile).toBeUndefined();
-
-    mergeDefaultConfigAndSeedInferenceProfiles();
-
-    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
-    expect(raw.llm.activeProfile).toBe("balanced");
-  });
-
-  test("a call site pinned to a managed backup profile survives a reload", () => {
-    writeConfig({
-      llm: {
-        defaultProvider: { provider: "vellum" },
-        profiles: {},
-        activeProfile: "balanced",
-        callSites: { recall: { profile: "cost-optimized-backup" } },
-      },
-    });
-
-    const config = loadConfig();
-    expect(config.llm.callSites.recall?.profile).toBe("cost-optimized-backup");
-
-    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
-    expect(raw.llm.callSites.recall.profile).toBe("cost-optimized-backup");
-  });
-
   test("still quarantines corrupt JSON", () => {
     // Corrupt-config quarantine is a recovery path: the broken file is
     // renamed to `config.json.corrupt-<ts>.json` and the daemon proceeds
@@ -1865,10 +1800,6 @@ describe("seedInferenceProfiles BYOK-mode default profiles", () => {
       "quality-optimized",
       "cost-optimized",
       "latency-optimized",
-      "balanced-backup",
-      "quality-optimized-backup",
-      "cost-optimized-backup",
-      "latency-optimized-backup",
       "my-custom",
     ]);
   });

package/src/__tests__/config-schema.test.ts

@@ -960,6 +960,7 @@ describe("AssistantConfigSchema", () => {
       },
       flux: {
         turnEnd: { enabled: false },
+        model: "flux-general-en",
         eotThreshold: 0.7,
         eotTimeoutMs: 5000,
       },