@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/config/bundled-skills/settings/tools/open-system-settings.ts

@@ -2,28 +2,50 @@ import type {
   ToolContext,
   ToolExecutionResult,
 } from "../../../../tools/types.js";
+import { isWindows } from "../../../../util/platform.js";
 
 const PANES = {
   microphone: {
-    url: "x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone",
     label: "Microphone privacy",
-    instruction: "Please toggle Vellum Assistant on.",
+    urls: {
+      macos:
+        "x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone",
+      windows: "ms-settings:privacy-microphone",
+    },
   },
   speech_recognition: {
-    url: "x-apple.systempreferences:com.apple.preference.security?Privacy_SpeechRecognition",
     label: "Speech Recognition privacy",
-    instruction: "Please toggle Vellum Assistant on.",
+    urls: {
+      macos:
+        "x-apple.systempreferences:com.apple.preference.security?Privacy_SpeechRecognition",
+      windows: "ms-settings:privacy-speech",
+    },
   },
 } as const;
 
 type PaneName = keyof typeof PANES;
+type SettingsPlatform = keyof (typeof PANES)[PaneName]["urls"];
 
+const VALID_PLATFORMS: SettingsPlatform[] = ["macos", "windows"];
 const VALID_PANES = Object.keys(PANES) as PaneName[];
 
 export async function run(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
+  const requestedPlatform = input.platform as string | undefined;
+  if (
+    requestedPlatform !== undefined &&
+    !VALID_PLATFORMS.includes(requestedPlatform as SettingsPlatform)
+  ) {
+    return {
+      content: `Error: unknown platform "${requestedPlatform}". Valid platforms: ${VALID_PLATFORMS.join(
+        ", ",
+      )}`,
+      isError: true,
+    };
+  }
+
   const pane = input.pane as string;
   if (!VALID_PANES.includes(pane as PaneName)) {
     return {
@@ -34,20 +56,23 @@ export async function run(
     };
   }
 
+  const platform =
+    (requestedPlatform as SettingsPlatform | undefined) ??
+    (isWindows() ? "windows" : "macos");
   const meta = PANES[pane as PaneName];
 
-  // Send open_url to the client - the x-apple.systempreferences: scheme
-  // opens System Settings directly without a browser confirmation dialog.
   if (context.sendToClient) {
     context.sendToClient({
       type: "open_url",
-      url: meta.url,
+      url: meta.urls[platform],
       conversationId: context.conversationId,
     });
   }
 
+  const settingsName =
+    platform === "windows" ? "Windows Settings" : "System Settings";
   return {
-    content: `Opened System Settings to ${meta.label}. ${meta.instruction}`,
+    content: `Opened ${settingsName} to ${meta.label}. Please enable Vellum Assistant.`,
     isError: false,
   };
 }

package/src/config/bundled-skills/settings/tools/voice-config-update.ts

@@ -4,6 +4,11 @@ import {
   DEEPGRAM_MULTI_LANGUAGE_CODES,
   DEEPGRAM_NOVA3_MONOLINGUAL_CODES,
 } from "../../../../providers/speech-to-text/deepgram.js";
+import {
+  isManagedSttProvider,
+  listProviderModelFamilies,
+} from "../../../../providers/speech-to-text/provider-catalog.js";
+import type { SttProviderId } from "../../../../stt/types.js";
 import type {
   ToolContext,
   ToolExecutionResult,
@@ -47,6 +52,7 @@ const VOICE_SETTINGS = {
   },
   stt_provider: { type: "string" },
   stt_language: { type: "string" },
+  stt_model: { type: "string" },
 } satisfies Record<string, VoiceSettingMeta>;
 
 type VoiceSettingName = keyof typeof VOICE_SETTINGS;
@@ -64,6 +70,7 @@ const FRIENDLY_NAMES: Record<VoiceSettingName, string> = {
   fish_audio_reference_id: "Fish Audio voice",
   stt_provider: "Speech-to-text provider",
   stt_language: "Speech-to-text language",
+  stt_model: "Speech-to-text model family",
 };
 
 /**
@@ -293,6 +300,25 @@ function validateSetting(
       }
       return { ok: true, coerced: value.trim() };
     }
+    case "stt_model": {
+      const families = listProviderModelFamilies(
+        (activeSttProviderId ?? "") as SttProviderId,
+      );
+      if (families.length === 0) {
+        return {
+          ok: false,
+          error: `the active speech-to-text provider${activeSttProviderId ? ` (${activeSttProviderId})` : ""} offers a single model, so stt_model cannot be set`,
+        };
+      }
+      const normalized = typeof value === "string" ? value.trim() : "";
+      if (!families.includes(normalized as never)) {
+        return {
+          ok: false,
+          error: `stt_model must be one of: ${families.join(", ")}`,
+        };
+      }
+      return { ok: true, coerced: normalized };
+    }
     case "stt_language": {
       if (typeof value !== "string") {
         return {
@@ -410,7 +436,9 @@ export async function run(
   // same source the sparse-config write-seeding below reads): the extended
   // roster and "multi" are only valid where nova-3 runs.
   const activeSttProviderId =
-    setting === "stt_language" ? getConfig().services.stt.provider : undefined;
+    setting === "stt_language" || setting === "stt_model"
+      ? getConfig().services.stt.provider
+      : undefined;
 
   const validation = validateSetting(
     setting,
@@ -422,9 +450,14 @@ export async function run(
     return { content: `Error: ${validation.error}`, isError: true };
   }
 
+  // Managed speech has more than one STT id, so the gate reads the catalog
+  // rather than a literal: without this, setting a managed provider other
+  // than "vellum" on a disconnected assistant persists happily and then
+  // resolves no transcriber at all.
   const wantsManagedSpeech =
-    (setting === "stt_provider" || setting === "tts_provider") &&
-    validation.coerced === "vellum";
+    (setting === "stt_provider" &&
+      isManagedSttProvider(validation.coerced as SttProviderId)) ||
+    (setting === "tts_provider" && validation.coerced === "vellum");
   if (wantsManagedSpeech && !(await managedSpeechAvailable())) {
     return {
       content:
@@ -504,6 +537,24 @@ export async function run(
     invalidateConfigCache();
   }
 
+  if (setting === "stt_model") {
+    // Scoped to the provider that is active now, which validation already
+    // checked can serve the family. The provider is seeded for the same
+    // reason stt_language seeds it: a sparse block missing `provider` fails
+    // SttServiceSchema and trips the loader's salvage ladder.
+    const provider = getConfig().services.stt.provider;
+    if (!rawSttProviderPresent(raw)) {
+      setNestedValue(raw, "services.stt.provider", provider);
+    }
+    setNestedValue(
+      raw,
+      `services.stt.providers.${provider}.model`,
+      validation.coerced,
+    );
+    saveRawConfig(raw);
+    invalidateConfigCache();
+  }
+
   // Provider scoping happened in validation (xai only accepts its verified
   // set); for the remaining providers the write is unconditional. Auto-detect
   // providers ignore the value at resolve time, so writing it is harmless and

package/src/config/bundled-skills/transcribe/tools/transcribe-media.ts

@@ -239,7 +239,7 @@ export async function run(
   // the model verbatim rather than as the "nothing configured" copy below.
   let transcriber: BatchTranscriber | null;
   try {
-    transcriber = await resolveBatchTranscriber();
+    transcriber = await resolveBatchTranscriber({ role: "batch" });
   } catch (err) {
     return { content: (err as Error).message, isError: true };
   }

package/src/config/default-profile-catalog.ts

@@ -9,15 +9,21 @@ import type { ModelIntent } from "../providers/types.js";
 import { getManagedUpstream } from "../providers/vellum-model-routing.js";
 import { getBalancedModelExperimentArm } from "./balanced-model-experiment.js";
 import {
+  BACKUP_PROFILE_KEYS,
+  type BackupProfileKey,
   DEFAULT_PROFILE_KEYS,
   DEFAULT_PROFILE_PROVIDERS,
   type DefaultProfileKey,
   type DefaultProfileProvider,
+  FALLBACK_PROFILE_BY_KEY,
+  isBackupProfileKey,
+  isDefaultProfileKey,
   isDefaultProfileProvider,
   OS_BETA_PROFILE_KEY,
 } from "./default-profile-names.js";
 import { resolveDefaultConnectionName } from "./default-provider-resolution.js";
 import {
+  backupProfilesResolveUnderDefaultProvider,
   DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
   DEFAULT_PROVIDER_CHOICES,
   type DefaultProviderConfig,
@@ -70,6 +76,13 @@ type ProfileImpls = Record<DefaultProfileKey, DefaultProfileTemplate>;
  * concrete dispatch providers, and the model is what selects the upstream.
  * Overwritten in workspace config on every daemon boot so Vellum can push
  * model/config updates to customers in new releases.
+ *
+ * Each implementation points at its managed backup profile via
+ * `fallbackProfile` (`BACKUP_PROFILE_IMPLS` below): a backup pins a model at
+ * a different upstream provider, so an outage-type failure at the primary's
+ * provider can be served by re-sending on the backup. Vellum column only:
+ * the BYOK and chatgpt columns carry no pointers, since those installs may
+ * hold no credential for the backup's provider.
  */
 const VELLUM_PROFILE_IMPLS: ProfileImpls = {
   balanced: {
@@ -78,6 +91,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     source: "managed",
     label: "Balanced",
     description: "Good balance of quality, cost, and speed",
+    fallbackProfile: FALLBACK_PROFILE_BY_KEY.balanced,
     maxTokens: 32000,
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
@@ -91,6 +105,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     source: "managed",
     label: "Quality",
     description: "High-quality results with the most capable model",
+    fallbackProfile: FALLBACK_PROFILE_BY_KEY["quality-optimized"],
     maxTokens: 32000,
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
@@ -107,6 +122,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     // surface the live model beside the description, so a model name in
     // this copy would go stale the moment the pin moves.
     description: "Cheapest responses, for high-volume work",
+    fallbackProfile: FALLBACK_PROFILE_BY_KEY["cost-optimized"],
     maxTokens: 8192,
     // Explicit reasoning opt-out. OpenAI-compat APIs default reasoning to
     // "medium" when the field is omitted, and effort-driven providers encode
@@ -136,6 +152,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     source: "managed",
     label: "Speed",
     description: "Fastest responses, with reasoning turned off",
+    fallbackProfile: FALLBACK_PROFILE_BY_KEY["latency-optimized"],
     maxTokens: 8192,
     // Explicit reasoning opt-out, matching `cost-optimized` above: this
     // profile advertises reasoning as off, and OpenAI-compat APIs default
@@ -149,6 +166,80 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
   },
 };
 
+/**
+ * The managed backup profiles, one per default profile: the route a primary's
+ * `fallbackProfile` pointer names. Vellum column only: backups never
+ * materialize for BYOK or chatgpt installs. Like the primaries, models are
+ * pinned (never intents) and stamped `provider: "vellum"`, so dispatch
+ * derives the upstream from the model. Every backup pins its model at a
+ * DIFFERENT upstream provider than its primary (that cross-provider split is
+ * the entire point), and the module-load validation below enforces
+ * routability.
+ *
+ * Descriptions name the tier they back, never the concrete model: clients
+ * surface the live model beside the description, so a model name in this
+ * copy would go stale the moment a pin moves.
+ */
+const BACKUP_PROFILE_IMPLS: Record<BackupProfileKey, DefaultProfileTemplate> = {
+  "balanced-backup": {
+    model: "claude-sonnet-5",
+    provider: "vellum",
+    source: "managed",
+    label: "Balanced Backup",
+    description: "Automatic backup for the Balanced profile",
+    maxTokens: 32000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: {
+      maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
+    },
+  },
+  "quality-optimized-backup": {
+    model: "claude-opus-5",
+    provider: "vellum",
+    source: "managed",
+    label: "Quality Backup",
+    description: "Automatic backup for the Quality profile",
+    maxTokens: 32000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: {
+      maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
+    },
+  },
+  "cost-optimized-backup": {
+    model: "gemini-3.1-flash-lite",
+    provider: "vellum",
+    source: "managed",
+    label: "Cost Backup",
+    description: "Automatic backup for the Cost profile",
+    maxTokens: 8192,
+    // Explicit reasoning opt-out, matching the primary Cost profile: OpenAI-
+    // compat APIs default reasoning to "medium" when the field is omitted,
+    // and effort-driven providers encode disabled thinking through this same
+    // knob (see DISABLED_THINKING_USES_EFFORT_PROVIDERS in
+    // providers/retry.ts).
+    effort: "none",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: {
+      maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
+    },
+  },
+  "latency-optimized-backup": {
+    model: "claude-haiku-4-5-20251001",
+    provider: "vellum",
+    source: "managed",
+    label: "Speed Backup",
+    description: "Automatic backup for the Speed profile",
+    maxTokens: 8192,
+    effort: "low",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: {
+      maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS,
+    },
+  },
+};
+
 /**
  * Arm to managed model pin for the `experiment-balanced-model-2026-08-06` A/B
  * test (`balanced-model-experiment.ts` owns the flag read). An arm repoints
@@ -335,14 +426,18 @@ export const PROFILE_IMPLS: Record<
 >;
 
 /**
- * Managed profiles, i.e. the `vellum` column keyed by profile name. Keyed by
- * the user-facing defaults only: an internal profile is code-resolved and
- * never listed or ordered.
+ * Managed profiles, i.e. the `vellum` column keyed by profile name, plus the
+ * managed backup profiles. Backups come after the primaries, which is what
+ * places them after the primaries in the seeded `profileOrder`: the seeder
+ * inserts missing managed keys in this record's order. Keyed by the
+ * user-facing defaults only: an internal profile is code-resolved and never
+ * listed or ordered.
  */
 export const MANAGED_PROFILE_TEMPLATES: Record<string, DefaultProfileTemplate> =
-  Object.fromEntries(
-    DEFAULT_PROFILE_KEYS.map((key) => [key, PROFILE_IMPLS[key].vellum]),
-  );
+  Object.fromEntries([
+    ...DEFAULT_PROFILE_KEYS.map((key) => [key, PROFILE_IMPLS[key].vellum]),
+    ...BACKUP_PROFILE_KEYS.map((key) => [key, BACKUP_PROFILE_IMPLS[key]]),
+  ]);
 
 /**
  * The values BYOK hatch seeding wrote onto each `custom-*` copy, for the keys
@@ -413,8 +508,23 @@ export const OS_BETA_PROFILE_TEMPLATE: DefaultProfileTemplate = {
  * audible dead air rather than a slow reply. A same-named
  * workspace entry stays on disk and stays listed; it just never governs what
  * this name resolves to.
+ *
+ * All four backups carry the same protection rather than only
+ * `latency-optimized-backup`. The narrow argument covers that one alone: it
+ * serves the live-voice path whenever the primary falls back, so a shadow
+ * reintroduces exactly the dead-air risk the primary's protection exists to
+ * prevent. The broader argument covers all four, and is why the whole set is
+ * here: a backup only earns its place by pinning a model at a different
+ * upstream than the primary it backs (see `BACKUP_PROFILE_IMPLS`), and a
+ * user-owned shadow can silently repoint it at the primary's own provider,
+ * so the fallback re-sends into the outage it exists to route around. A
+ * backup also has no per-provider matrix column, so there is nothing a
+ * workspace overlay could legitimately own on it.
  */
-export const CODE_OWNED_PROFILE_NAMES = new Set<string>(["latency-optimized"]);
+export const CODE_OWNED_PROFILE_NAMES = new Set<string>([
+  "latency-optimized",
+  ...BACKUP_PROFILE_KEYS,
+]);
 
 // All managed profiles, including the flag-gated os-beta, are invariant:
 // their MANAGED-SOURCE entries are read-only to user-facing writes except
@@ -423,6 +533,7 @@ export const CODE_OWNED_PROFILE_NAMES = new Set<string>(["latency-optimized"]);
 // the on-disk entry's `source` being `managed`.
 export const INVARIANT_PROFILE_NAMES = new Set<string>([
   ...DEFAULT_PROFILE_KEYS,
+  ...BACKUP_PROFILE_KEYS,
   OS_BETA_PROFILE_KEY,
 ]);
 
@@ -435,6 +546,7 @@ export const INVARIANT_PROFILE_NAMES = new Set<string>([
 // same-named user profile.
 export const MANAGED_PROFILE_NAMES = new Set<string>([
   ...DEFAULT_PROFILE_KEYS,
+  ...BACKUP_PROFILE_KEYS,
   OS_BETA_PROFILE_KEY,
 ]);
 
@@ -502,6 +614,22 @@ for (const key of DEFAULT_PROFILE_KEYS) {
   }
 }
 
+// Backup profiles get the same eager verification as the vellum column: a
+// pinned model that no managed upstream serves would make the fallback route
+// undispatchable exactly when it is needed. The cross-provider rule (backup
+// upstream differs from the primary's) is asserted in
+// __tests__/default-profile-catalog-fallback.test.ts, arm pins included.
+for (const key of BACKUP_PROFILE_KEYS) {
+  const impl = BACKUP_PROFILE_IMPLS[key];
+  if (impl.model == null || getManagedUpstream(impl.model) === null) {
+    throw new Error(
+      `BACKUP_PROFILE_IMPLS[${key}] references model "${impl.model ?? ""}" ` +
+        `which is not served by any managed upstream. ` +
+        `Update model-catalog.ts or default-profile-catalog.ts.`,
+    );
+  }
+}
+
 // The experiment arms substitute into the managed column at request time, so
 // they need the same routability guarantee as the pins validated above: a
 // LaunchDarkly arm must never select a model no managed upstream serves.
@@ -542,6 +670,10 @@ function buildDefaultProfileEntries(): Record<string, ProfileEntry> {
     const impl = PROFILE_IMPLS[key].vellum;
     entries[key] = materializeProfile(impl, impl.provider);
   }
+  for (const key of BACKUP_PROFILE_KEYS) {
+    const impl = BACKUP_PROFILE_IMPLS[key];
+    entries[key] = materializeProfile(impl, impl.provider);
+  }
   entries[OS_BETA_PROFILE_KEY] = materializeProfile(
     OS_BETA_PROFILE_TEMPLATE,
     OS_BETA_PROFILE_TEMPLATE.provider,
@@ -617,6 +749,16 @@ function resolveAgainstBody(
   body: ProfileEntry | undefined,
 ): ProfileEntry | undefined {
   if (body == null) {
+    // A managed stub is the workspace's slot for a code-owned profile, never
+    // a profile of its own, so with no body behind it there is nothing to
+    // resolve. Only a backup name reaches this branch with a stub (the
+    // default keys always have a body), and it reaches it on the columns
+    // where the backups do not exist. Resolving to the stub would list a
+    // profile with no provider or model and let a reference to it look
+    // valid, which is precisely what `LLMSchema` rejects on those columns.
+    if (isBackupProfileKey(name) && workspace?.source === "managed") {
+      return undefined;
+    }
     return workspace;
   }
   if (CODE_OWNED_PROFILE_NAMES.has(name)) {
@@ -670,9 +812,7 @@ export function resolveDefaultProfileForProvider(
   );
 }
 
-export function isDefaultProfileKey(name: string): name is DefaultProfileKey {
-  return (DEFAULT_PROFILE_KEYS as readonly string[]).includes(name);
-}
+export { isDefaultProfileKey } from "./default-profile-names.js";
 
 /**
  * The implementation of default profile `key` on `provider`: the named matrix
@@ -706,6 +846,18 @@ function defaultProfileBodyForProvider(
   defaultProvider: DefaultProviderConfig | null,
 ): ProfileEntry | undefined {
   if (!isDefaultProfileKey(name)) {
+    // Backup profiles are companions of the managed (`vellum`) column only:
+    // under a BYOK or chatgpt default provider the primaries carry no
+    // `fallbackProfile` pointers, and the backups must not materialize
+    // either, since the install may hold no credential for the backup's
+    // provider. A null defaultProvider predates `llm.defaultProvider` and
+    // resolves to the managed column, so it keeps its backups.
+    if (
+      isBackupProfileKey(name) &&
+      !backupProfilesResolveUnderDefaultProvider(defaultProvider)
+    ) {
+      return undefined;
+    }
     return CODE_DEFAULT_PROFILE_ENTRIES[name];
   }
   if (defaultProvider == null) {
@@ -752,6 +904,14 @@ function clampMaxTokensToModelCap(body: ProfileEntry): ProfileEntry {
  * available code default, merged per `getEffectiveProfile`. This is the
  * record all runtime readers of `llm.profiles` should consume; the raw
  * workspace record is a write-path concern.
+ *
+ * Deliberately provider-agnostic: it lists the managed backups whatever
+ * `llm.defaultProvider` says, because it resolves names against the passed
+ * catalog alone and never reads config. Internal resolution and reference
+ * validation use `getEffectiveProfilesForProvider`; user-facing selectors use
+ * `getUserSelectableProfilesForProvider`, which additionally removes backups
+ * from the managed column. Keeping those views separate lets automatic
+ * fallback resolve an internal route without offering it as a direct choice.
  */
 export function getEffectiveProfiles(
   workspaceProfiles: Record<string, ProfileEntry> | undefined,
@@ -794,7 +954,32 @@ export function getEffectiveProfilesForProvider(
     );
     if (entry != null) {
       effective[name] = entry;
+      continue;
     }
+    // Nothing resolved, so the name must not survive from the workspace
+    // spread above: a backup carrying only a managed stub on a column that
+    // has no backups would otherwise be listed as an available profile with
+    // no provider or model behind it.
+    delete effective[name];
   }
   return effective;
 }
+
+/**
+ * The effective profile view used by user-facing selectors. Managed backups
+ * remain in the full effective catalog for automatic fallback resolution, but
+ * are internal routes rather than profiles a user can choose directly.
+ */
+export function getUserSelectableProfilesForProvider(
+  workspaceProfiles: Record<string, ProfileEntry> | undefined,
+  defaultProvider: DefaultProviderConfig | null,
+): Record<string, ProfileEntry> {
+  const selectable = getEffectiveProfilesForProvider(
+    workspaceProfiles,
+    defaultProvider,
+  );
+  for (const name of BACKUP_PROFILE_KEYS) {
+    delete selectable[name];
+  }
+  return selectable;
+}

package/src/config/default-profile-names.ts

@@ -26,6 +26,47 @@ export const DEFAULT_PROFILE_KEYS = [
 ] as const;
 export type DefaultProfileKey = (typeof DEFAULT_PROFILE_KEYS)[number];
 
+/**
+ * Stable keys of the managed backup profiles, one per default profile.
+ * Deliberately NOT part of `DEFAULT_PROFILE_KEYS`: that array drives picker
+ * order and the intent x provider matrix, while backups are companions of
+ * the managed (`vellum`) column only. Each backup pins a model at a
+ * different upstream provider than its primary, so an outage at the
+ * primary's provider can be served by re-sending on the backup (see the
+ * `fallbackProfile` field on `ProfileEntry`).
+ */
+export const BACKUP_PROFILE_KEYS = [
+  "balanced-backup",
+  "quality-optimized-backup",
+  "cost-optimized-backup",
+  "latency-optimized-backup",
+] as const;
+export type BackupProfileKey = (typeof BACKUP_PROFILE_KEYS)[number];
+
+/**
+ * The backup profile each default profile falls back to. Applied to the
+ * managed (`vellum`) column implementations only: BYOK installs may hold no
+ * credential for the backup's provider, so their columns carry no
+ * `fallbackProfile` pointers.
+ */
+export const FALLBACK_PROFILE_BY_KEY: Record<
+  DefaultProfileKey,
+  BackupProfileKey
+> = {
+  balanced: "balanced-backup",
+  "quality-optimized": "quality-optimized-backup",
+  "cost-optimized": "cost-optimized-backup",
+  "latency-optimized": "latency-optimized-backup",
+};
+
+export function isDefaultProfileKey(value: string): value is DefaultProfileKey {
+  return (DEFAULT_PROFILE_KEYS as readonly string[]).includes(value);
+}
+
+export function isBackupProfileKey(value: string): value is BackupProfileKey {
+  return (BACKUP_PROFILE_KEYS as readonly string[]).includes(value);
+}
+
 /**
  * Flag-gated default profile: only available while the `os-beta` feature
  * flag has reconciled it into the workspace (see `sync-gated-profiles.ts`).

package/src/config/feature-flag-registry.json

@@ -289,7 +289,7 @@
       "scope": "assistant",
       "key": "channel-trust-floors",
       "label": "Channel Trust Floors",
-      "description": "Expose the Channel Trust Floors settings card (per-channel inbound admission policy) on the Privacy settings page. When off, the card is hidden and channels fall back to their default admission floors. On by default; disable to hide the card.",
+      "description": "Server-side switch for admission-floor enforcement: the gateway kill switch, the runtime floor stage, and enforcement-time policy resolution gate on it. Configuration reads and writes stay available while it is off. On by default. Client UI visibility is version-gated, not flag-gated.",
       "defaultEnabled": true
     },
     {
@@ -386,7 +386,39 @@
       "scope": "client",
       "key": "obscure-credits",
       "label": "Obscure Credits",
-      "description": "Replaces the dollar amounts on the billing Plan section with a usage-relative view: the current-plan tile trades its price footer for a Usage Balance bar (managed spend this billing cycle against the package's included credits) and the credits spec chip reads \"<Package> usage, reset monthly\" instead of naming a dollar bundle. Spec chips wrap horizontally to fit the shorter labels. Off leaves the Plan section exactly as it ships today.",
+      "description": "Obscures raw credit dollar amounts across the web billing surfaces in favor of a usage-relative view. The Plan section's current-plan tile trades its price footer for a Usage Balance bar and its credits spec chip reads \"<Package> usage, reset monthly\"; the plans takeover, custom-plan modal, and Pro provisioning takeover swap dollar credit wording for the catalog's usage labels; the Credits balance tile and the chat preferences menu show only credit bought or earned beyond the plan's included grants. Chat low-balance and daily-limit banners still name credits. Off leaves every surface exactly as it ships today.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "ios-avatar-app-icon",
+      "scope": "client",
+      "key": "ios-avatar-app-icon",
+      "label": "iOS Avatar App Icon",
+      "description": "Shows the App icon picker in Settings -> General, where any user chooses an eyes-on-color home screen icon for iOS, seeds the picker from their assistant's character avatar, or resets to the default. Every change is a press, and iOS confirms each one with an alert of its own. Off hides the picker and leaves the default icon in place.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "channel-conversation-sidecar",
+      "scope": "client",
+      "key": "channel-conversation-sidecar",
+      "label": "Channel Conversation Sidecar",
+      "description": "Renders a conversation bound to an external channel (Slack, Telegram, Discord, phone, email, and any other channel adapter) as two lanes in web chat: Vellum stays the primary full-width lane, and the canonical external-channel transcript moves into the existing read-only right drawer, opened from a channel-thread control in the chat header. Rows the client can attribute to the external channel are drawn once, in the drawer, instead of being blended into the Vellum lane. The drawer offers an Open in <channel> secondary action and a per-message Reference in Vellum action that stages one quoted reference above the Vellum composer. The Vellum composer stays the only input; nothing about delivery, routing, or permissions changes. Off leaves the header deep-link pill and the blended transcript unchanged.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "monday-oauth",
+      "scope": "assistant",
+      "key": "monday-oauth",
+      "label": "monday.com Integration",
+      "description": "Gates the seeded monday.com OAuth provider. When off, the provider is hidden from GET /v1/oauth/providers, its get-by-id route, and the connect/update routes, so it cannot be listed or connected from the CLI, gateway, or web integrations list. The row is still seeded into oauth_providers on startup; only its visibility changes.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "chatgpt-device-code-login",
+      "scope": "client",
+      "key": "chatgpt-device-code-login",
+      "label": "ChatGPT Device Code Login",
+      "description": "Gates the device-code sign-in as the primary ChatGPT subscription connect flow in the web client. Off: the redirect-and-paste flow is the only flow the connect section shows, with no device code UI and no other-sign-in-options disclosure. On: device code leads, and the redirect-and-paste flow stays reachable behind that disclosure and takes the section over when the assistant has no device-auth route.",
       "defaultEnabled": false
     }
   ]

package/src/config/inference-profile-validation.ts

@@ -1,16 +1,25 @@
-import { getEffectiveProfiles } from "./default-profile-catalog.js";
+import { getUserSelectableProfilesForProvider } from "./default-profile-catalog.js";
 import { getConfigReadOnly } from "./loader.js";
 
 /**
  * Validate an inference-profile key against the effective profile catalog
  * (code-defined defaults + workspace `llm.profiles`). Returns a user-facing
  * error message when the key is empty or unknown, or `null` when valid.
+ *
+ * Resolved through the `llm.defaultProvider`-aware user-selectable view so
+ * availability matches what a direct profile pin can choose. Managed backup
+ * routes remain available to automatic fallback resolution but are not
+ * reported as selectable profiles.
  */
 export function validateInferenceProfileKey(profile: string): string | null {
   if (!profile.trim()) {
     return "inferenceProfile must be a non-empty string";
   }
-  const profiles = getEffectiveProfiles(getConfigReadOnly().llm?.profiles);
+  const llm = getConfigReadOnly().llm;
+  const profiles = getUserSelectableProfilesForProvider(
+    llm?.profiles,
+    llm?.defaultProvider ?? null,
+  );
   const entry = profiles[profile];
   if (entry === undefined) {
     const available = Object.keys(profiles).sort();