@vellumai/assistant 0.11.8-dev.202609021923.ac39943 → 0.11.8-dev.202609022016.7bd8f87

package/ARCHITECTURE.md

@@ -146,7 +146,7 @@ All guardian approval decisions, regardless of how they arrive, route through a
 **Text fallback path (always available):**
 
 - Every prompt includes a `requestCode` (6-char alphanumeric). Guardians can reply with `<requestCode> approve` or `<requestCode> reject` on any channel.
-- `access_request` prompts additionally embed explicit text directives in `questionText`: the request-code approve/reject directive and the `"open invite flow"` phrase for starting the Trusted Contacts invite flow.
+- `access_request` prompts carry the request-code verify/trust/reject/block directive in the card's `plainTextFallback`, appended by a transport only when it sends text without buttons; the `"open invite flow"` phrase for starting the Trusted Contacts invite flow stays in the text on every surface because nothing offers a button for it.
 - `pending_question` prompts (voice-originated) support `<requestCode> <your answer>` for free-text answers.
 - The `routeGuardianReply` router processes text replies through a priority-ordered pipeline: callback parsing -> request code parsing -> NL classification. All paths converge on `applyGuardianDecision`.
 

package/docs/trusted-contact-access.md

@@ -24,13 +24,7 @@ Design doc defining how unknown users gain access to a Vellum assistant via chan
 2. **The message is denied at the ingress ACL.** The gateway resolves the actor against its ACL DB and stamps a trust verdict onto the inbound metadata; the daemon's ACL stage (`runtime/routes/inbound-stages/acl-enforcement.ts`) consumes that verdict, finds no active member, replies _"Hmm looks like you don't have access to talk to me. I'll let <guardian> know you tried talking to me and get back to you."_ and returns `{ denied: true, reason: 'not_a_member' }`.
 3. **Notification pipeline alerts the guardian.** The denial triggers `notifyGuardianOfAccessRequest()` (`runtime/access-request-helper.ts`), which creates an access request in the gateway (`guardian_requests`, `kind: 'access_request'`, `toolName: 'ingress_access_request'`, via the `channels/gateway-guardian-requests.ts` client) and calls `emitNotificationSignal()` with `sourceEventName: 'ingress.access_request'`. The notification routes through the decision engine to the guardian's surfaces (vellum app, Telegram, Slack, etc.). The guardian sees who is requesting access, including a request code for approve/reject and an `open invite flow` option to start the Trusted Contacts invite flow.
 
-   **Access-request copy contract:** Every guardian-facing access-request notification must contain:
-   1. **Requester context** — best-available identity (display name, username, external ID, source channel), sanitized to prevent control-character injection.
-   2. **Request-code decision directive** — e.g., `Reply "A1B2C3 approve" to grant access or "A1B2C3 reject" to deny.`
-   3. **Invite directive** — the exact phrase `Reply "open invite flow" to start Trusted Contacts invite flow.`
-   4. **Revoked-member warning** (when applicable) — `Note: this user was previously revoked.`
-
-   Model-generated phrasing is permitted for the surrounding copy, but a post-generation enforcement step in the decision engine validates that all required directive elements are present. If any are missing, the full deterministic contract text is appended. This ensures the guardian can always parse and act on the notification regardless of LLM output quality.
+   **Access-request copy contract:** Every guardian-facing access-request notification carries the requester context (`buildAccessRequestContextText`): best-available identity (display name, username, external ID, source channel) sanitized to prevent control-character injection, the message preview, and a revoked-member warning when applicable (`Note: this user was previously revoked.`). The context also carries the invite directive (`Reply "open invite flow" to start Trusted Contacts invite flow.`), because no surface offers a button for the invite flow and typing the phrase is the only way to start it. The typed-reply mechanics are separate (`buildAccessRequestReplyMechanics`): the request-code directive (`Reply "A1B2C3 verify" ... "A1B2C3 trust" ... "A1B2C3 reject" ... "A1B2C3 block"`, without `verify` when no handshake is offered). It rides only in the card's `plainTextFallback`; a transport appends it when it sends text without buttons, and the decision engine strips any copy of it the model wrote into the composed text, so surfaces with buttons show the context alone.
 
    **Guardian identity resolution** is anchored on the assistant's vellum principal (`resolveAnchoredGuardian`), so access requests cannot bind to stale or cross-assistant contacts:
    1. A source-channel guardian binding (from the gateway contact list) that matches the vellum anchor principal.

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/package.json

@@ -24,7 +24,8 @@
     "./stripe-currency": "./src/stripe-currency.ts",
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
-    "./guardian-requests": "./src/guardian-requests.ts"
+    "./guardian-requests": "./src/guardian-requests.ts",
+    "./platform-credential": "./src/platform-credential.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/index.ts

@@ -28,6 +28,7 @@ export * from "./rpc.js";
 export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./no-response.js";
+export * from "./platform-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/platform-credential.ts

@@ -0,0 +1,41 @@
+/**
+ * Wire contract for asking an assistant whether its stored platform-managed
+ * credential still authenticates.
+ *
+ * The daemon route is the authoritative serving side:
+ *   - `POST /v1/platform/verify-credential`
+ *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *
+ * The daemon's platform client produces the verdict, the route reports it,
+ * and the `vellum` CLI reads it before deciding whether a stored key can be
+ * re-injected (`cli/src/lib/assistant-api-key-resolution.ts`), so all three
+ * share one definition and cannot silently drift. The web app reads the same
+ * shape through its generated daemon client.
+ */
+import { z } from "zod";
+
+/**
+ * What the platform said about the stored credential, right now.
+ *
+ *   - `valid`: the platform accepted it.
+ *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *     credential needs replacing.
+ *   - `unknown`: the check itself could not run (no credential stored, the
+ *     platform unreachable, a server error). Not evidence either way.
+ */
+export const PlatformCredentialVerificationStatusSchema = z.enum([
+  "valid",
+  "rejected",
+  "unknown",
+]);
+export type PlatformCredentialVerificationStatus = z.infer<
+  typeof PlatformCredentialVerificationStatusSchema
+>;
+
+/** `POST /v1/platform/verify-credential` response body. */
+export const PlatformVerifyCredentialResponseSchema = z.object({
+  status: PlatformCredentialVerificationStatusSchema,
+});
+export type PlatformVerifyCredentialResponse = z.infer<
+  typeof PlatformVerifyCredentialResponseSchema
+>;

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/package.json

@@ -24,7 +24,8 @@
     "./stripe-currency": "./src/stripe-currency.ts",
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
-    "./guardian-requests": "./src/guardian-requests.ts"
+    "./guardian-requests": "./src/guardian-requests.ts",
+    "./platform-credential": "./src/platform-credential.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/index.ts

@@ -28,6 +28,7 @@ export * from "./rpc.js";
 export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./no-response.js";
+export * from "./platform-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/platform-credential.ts

@@ -0,0 +1,41 @@
+/**
+ * Wire contract for asking an assistant whether its stored platform-managed
+ * credential still authenticates.
+ *
+ * The daemon route is the authoritative serving side:
+ *   - `POST /v1/platform/verify-credential`
+ *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *
+ * The daemon's platform client produces the verdict, the route reports it,
+ * and the `vellum` CLI reads it before deciding whether a stored key can be
+ * re-injected (`cli/src/lib/assistant-api-key-resolution.ts`), so all three
+ * share one definition and cannot silently drift. The web app reads the same
+ * shape through its generated daemon client.
+ */
+import { z } from "zod";
+
+/**
+ * What the platform said about the stored credential, right now.
+ *
+ *   - `valid`: the platform accepted it.
+ *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *     credential needs replacing.
+ *   - `unknown`: the check itself could not run (no credential stored, the
+ *     platform unreachable, a server error). Not evidence either way.
+ */
+export const PlatformCredentialVerificationStatusSchema = z.enum([
+  "valid",
+  "rejected",
+  "unknown",
+]);
+export type PlatformCredentialVerificationStatus = z.infer<
+  typeof PlatformCredentialVerificationStatusSchema
+>;
+
+/** `POST /v1/platform/verify-credential` response body. */
+export const PlatformVerifyCredentialResponseSchema = z.object({
+  status: PlatformCredentialVerificationStatusSchema,
+});
+export type PlatformVerifyCredentialResponse = z.infer<
+  typeof PlatformVerifyCredentialResponseSchema
+>;

package/node_modules/@vellumai/service-contracts/package.json

@@ -24,7 +24,8 @@
     "./stripe-currency": "./src/stripe-currency.ts",
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
-    "./guardian-requests": "./src/guardian-requests.ts"
+    "./guardian-requests": "./src/guardian-requests.ts",
+    "./platform-credential": "./src/platform-credential.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/service-contracts/src/index.ts

@@ -28,6 +28,7 @@ export * from "./rpc.js";
 export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./no-response.js";
+export * from "./platform-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@vellumai/service-contracts/src/platform-credential.ts

@@ -0,0 +1,41 @@
+/**
+ * Wire contract for asking an assistant whether its stored platform-managed
+ * credential still authenticates.
+ *
+ * The daemon route is the authoritative serving side:
+ *   - `POST /v1/platform/verify-credential`
+ *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *
+ * The daemon's platform client produces the verdict, the route reports it,
+ * and the `vellum` CLI reads it before deciding whether a stored key can be
+ * re-injected (`cli/src/lib/assistant-api-key-resolution.ts`), so all three
+ * share one definition and cannot silently drift. The web app reads the same
+ * shape through its generated daemon client.
+ */
+import { z } from "zod";
+
+/**
+ * What the platform said about the stored credential, right now.
+ *
+ *   - `valid`: the platform accepted it.
+ *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *     credential needs replacing.
+ *   - `unknown`: the check itself could not run (no credential stored, the
+ *     platform unreachable, a server error). Not evidence either way.
+ */
+export const PlatformCredentialVerificationStatusSchema = z.enum([
+  "valid",
+  "rejected",
+  "unknown",
+]);
+export type PlatformCredentialVerificationStatus = z.infer<
+  typeof PlatformCredentialVerificationStatusSchema
+>;
+
+/** `POST /v1/platform/verify-credential` response body. */
+export const PlatformVerifyCredentialResponseSchema = z.object({
+  status: PlatformCredentialVerificationStatusSchema,
+});
+export type PlatformVerifyCredentialResponse = z.infer<
+  typeof PlatformVerifyCredentialResponseSchema
+>;

package/openapi.yaml

@@ -21189,6 +21189,8 @@ paths:
                             - channelId
                             - channelTs
                           additionalProperties: false
+                        deletedAt:
+                          type: number
                         queueStatus:
                           type: string
                           enum:
@@ -24408,7 +24410,9 @@ paths:
     post:
       operationId: platform_connect_post
       summary: Connect to the Vellum Platform
-      description: Checks existing credentials and emits the show_platform_login signal for connected clients to show a login UI.
+      description:
+        Checks whether the stored platform credentials still connect. Reports a stored key the platform rejects as
+        credentialRejected, so the caller can direct the user to sign in again and replace it.
       tags:
         - platform
       responses:
@@ -24425,6 +24429,8 @@ paths:
                     type: string
                   showPlatformLogin:
                     type: boolean
+                  credentialRejected:
+                    type: boolean
                 additionalProperties: false
   /v1/platform/credits:
     get:
@@ -24793,6 +24799,32 @@ paths:
                   - package
                   - entitlements
                 additionalProperties: false
+  /v1/platform/verify-credential:
+    post:
+      operationId: platform_verifycredential_post
+      summary: Verify the Vellum-managed credential against the platform
+      description:
+        Asks the platform whether the stored assistant API key authenticates. POST because it performs a check; the
+        result is returned, not stored.
+      tags:
+        - platform
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                    enum:
+                      - valid
+                      - rejected
+                      - unknown
+                required:
+                  - status
+                additionalProperties: false
   /v1/playground/seed-conversation:
     post:
       operationId: playground_seedconversation_post

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.8-dev.202609021923.ac39943",
+  "version": "0.11.8-dev.202609022016.7bd8f87",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/access-request-card-view.test.ts

@@ -2,7 +2,8 @@ import { describe, expect, test } from "bun:test";
 
 import {
   buildAccessRequestCardView,
-  buildAccessRequestContractText,
+  buildAccessRequestContextText,
+  buildAccessRequestReplyMechanics,
   parseAccessRequestPayload,
 } from "../notifications/access-request-copy.js";
 
@@ -111,10 +112,10 @@ describe("admitted-mode introduction nudge copy", () => {
       senderIdentifier: "Alice",
       sourceChannel: "telegram",
     };
-    expect(buildAccessRequestContractText(base)).toContain(
+    expect(buildAccessRequestContextText(base)).toContain(
       "is requesting access to the assistant.",
     );
-    const admitted = buildAccessRequestContractText({
+    const admitted = buildAccessRequestContextText({
       ...base,
       trigger: "admitted",
     });
@@ -122,8 +123,8 @@ describe("admitted-mode introduction nudge copy", () => {
     expect(admitted).not.toContain("is requesting access");
   });
 
-  test("admitted contract text keeps the decision directives", () => {
-    const text = buildAccessRequestContractText({
+  test("admitted reply mechanics keep the decision directives", () => {
+    const text = buildAccessRequestReplyMechanics({
       actorDisplayName: "Alice",
       sourceChannel: "telegram",
       requestCode: "ab12cd",

package/src/__tests__/access-request-seed-content-blocks.test.ts

@@ -136,10 +136,13 @@ describe("buildAccessRequestSeedContentBlocks", () => {
     );
   });
 
-  test("text fallback block contains contract text", () => {
+  test("text fallback block is the text-only rendering: context, invite directive, and the typed directive", () => {
     const textBlock = textOf(buildAccessRequestSeedContentBlocks(basePayload));
     expect(textBlock.text).toContain("requesting access to the assistant");
-    expect(textBlock.text).toContain("ABC123");
+    expect(textBlock.text).toContain('Reply "open invite flow"');
+    // A client that cannot draw the card's buttons still gets the directive.
+    expect(textBlock.text).toContain('"ABC123 trust"');
+    expect(textBlock.text).toContain('"ABC123 block"');
   });
 
   test("body shows fallback when no preview/warnings/permalink", () => {

package/src/__tests__/channel-retry-sweep.test.ts

@@ -401,6 +401,37 @@ describe("channel-retry-sweep", () => {
     expect(eventRow?.processingStatus).toBe("processed");
   });
 
+  test("restores the triggering message's id and thread on replay", async () => {
+    seedFailedEventWithTrustClass("guardian", {
+      sourceMessageId: "1700000000.000200",
+      sourceThreadId: "1700000000.000100",
+    });
+
+    let capturedTrust: Record<string, unknown> | undefined;
+    await sweepFailedEvents(async (conversationId, _content, options) => {
+      capturedTrust = (options as { trustContext?: Record<string, unknown> })
+        .trustContext;
+      const messageId = "message-location";
+      getDb()
+        .insert(messages)
+        .values({
+          id: messageId,
+          conversationId,
+          role: "user",
+          content: JSON.stringify([{ type: "text", text: "retry me" }]),
+          createdAt: Date.now(),
+        })
+        .run();
+      return { messageId };
+    });
+
+    // The replayed turn names the same message and thread the live turn
+    // did, so the turn's chat and thread lines and approval-card source
+    // links read the same on a retry as on the first attempt.
+    expect(capturedTrust?.sourceMessageId).toBe("1700000000.000200");
+    expect(capturedTrust?.sourceThreadId).toBe("1700000000.000100");
+  });
+
   test("fences a non-guardian Slack replay in external_content and carries the ingress idempotency key", async () => {
     seedFailedSlackEvent({
       trustClass: "unverified_contact",

package/src/__tests__/conversation-sync-tags.test.ts

@@ -85,9 +85,7 @@ describe("conversation sync tags", () => {
     // (`patchConversation` in `metadata-handlers.ts`) and the per-
     // conversation `sync_changed` metadata tag is included as a belt-and-
     // suspenders signal for sibling-tab consumers that missed the typed
-    // event. The legacy `conversation_list_invalidated` broadcast is
-    // scoped to `targetInterfaceId: "macos"` and therefore not visible to
-    // this process-type subscriber.
+    // event. No `conversation_list_invalidated` broadcast is emitted.
     const conversation = createConversation("Old title");
     const route = findRoute(
       CONVERSATION_MANAGEMENT_ROUTES,
@@ -115,13 +113,6 @@ describe("conversation sync tags", () => {
     expect((received[1]!.message as { tags: string[] }).tags).not.toContain(
       SYNC_TAGS.conversationsList,
     );
-    // The legacy invalidation broadcast is macOS-scoped and must not
-    // reach this process-type subscriber.
-    expect(
-      received.some(
-        (event) => event.message.type === "conversation_list_invalidated",
-      ),
-    ).toBe(false);
   });
 
   test("auto-title generation emits the typed title event and a metadata-only sync tag (no list umbrella)", async () => {
@@ -159,8 +150,7 @@ describe("conversation sync tags", () => {
     // fetched). The umbrella `conversationsList` tag is the signal for
     // that redrain. Per-conversation metadata is included so any future
     // single-row consumer can patch the freshly added row in place
-    // without an extra GET. The legacy macOS-only invalidation broadcast
-    // is not visible to process subscribers.
+    // without an extra GET.
     const route = findRoute(
       CONVERSATION_MANAGEMENT_ROUTES,
       "createConversation",
@@ -185,11 +175,6 @@ describe("conversation sync tags", () => {
         conversationMetadataSyncTag(conversationId!),
       ],
     });
-    expect(
-      received.some(
-        (event) => event.message.type === "conversation_list_invalidated",
-      ),
-    ).toBe(false);
   });
 
   test("reorder emits a sync_changed with the umbrella tag and per-conversation metadata tags", async () => {
@@ -228,11 +213,6 @@ describe("conversation sync tags", () => {
         conversationMetadataSyncTag(second.id),
       ],
     });
-    expect(
-      received.some(
-        (event) => event.message.type === "conversation_list_invalidated",
-      ),
-    ).toBe(false);
   });
 
   test("record seen emits only a per-conversation metadata sync tag (no list umbrella)", async () => {
@@ -245,11 +225,6 @@ describe("conversation sync tags", () => {
     // single `sync_changed` with only the per-conversation
     // `conversation:<id>:metadata` tag, which web consumes by GET-and-
     // patching the single cached row via `refreshConversationRow`.
-    //
-    // The legacy `conversation_list_invalidated` broadcast is still
-    // emitted for macOS (which has no per-row patcher) but is scoped
-    // to `targetInterfaceId: "macos"` and therefore not visible to
-    // this process-type subscriber.
     const conversation = createConversation("Attention");
     projectAssistantMessage({
       conversationId: conversation.id,
@@ -283,11 +258,6 @@ describe("conversation sync tags", () => {
     expect((received[0]!.message as { tags: string[] }).tags).not.toContain(
       SYNC_TAGS.conversationsList,
     );
-    expect(
-      received.some(
-        (event) => event.message.type === "conversation_list_invalidated",
-      ),
-    ).toBe(false);
   });
 
   test("mark unread emits only a per-conversation metadata sync tag (no list umbrella)", async () => {
@@ -327,11 +297,6 @@ describe("conversation sync tags", () => {
     expect((received[0]!.message as { tags: string[] }).tags).not.toContain(
       SYNC_TAGS.conversationsList,
     );
-    expect(
-      received.some(
-        (event) => event.message.type === "conversation_list_invalidated",
-      ),
-    ).toBe(false);
   });
 
   test("addMessage('assistant') emits a metadata sync tag when attention state transitions", async () => {

package/src/__tests__/credential-health-service.test.ts

@@ -53,6 +53,12 @@ let managedPingOutcome:
   | { kind: "credential_required" }
   | { kind: "throw"; message: string } = { kind: "status", status: 200 };
 
+// Managed assistant-credential mock state. The verdict is what the platform
+// answers about the stored assistant API key; `platformClientAvailable` covers
+// the case where the client cannot be built at all.
+let assistantKeyVerdict: "valid" | "rejected" | "unknown" = "valid";
+let platformClientAvailable = true;
+
 // ── Module mocks ─────────────────────────────────────────────────────
 
 mock.module("../security/secure-keys.js", () => ({
@@ -123,14 +129,20 @@ mock.module("../security/token-manager.js", () => ({
 // seeded into the real workspace config via `seedGoogleOAuthMode` below.
 mock.module("../platform/client.js", () => ({
   VellumPlatformClient: {
-    create: async () => ({
-      platformAssistantId: "test-assistant",
-      fetch: async (_path: string) => ({
-        ok: managedListResponse.ok,
-        status: managedListResponse.status,
-        json: async () => managedListResponse.body ?? { results: [] },
-      }),
-    }),
+    create: async () => {
+      if (!platformClientAvailable) {
+        return null;
+      }
+      return {
+        platformAssistantId: "test-assistant",
+        fetch: async (_path: string) => ({
+          ok: managedListResponse.ok,
+          status: managedListResponse.status,
+          json: async () => managedListResponse.body ?? { results: [] },
+        }),
+        verifyCredential: async () => assistantKeyVerdict,
+      };
+    },
   },
 }));
 
@@ -164,8 +176,12 @@ mock.module("../oauth/platform-connection.js", () => ({
 
 import { setConfig } from "./helpers/set-config.js";
 
-const { checkAllCredentials, checkCredentialForProvider, _setFetchFn } =
-  await import("../credential-health/credential-health-service.js");
+const {
+  checkAllCredentials,
+  checkAssistantApiKey,
+  checkCredentialForProvider,
+  _setFetchFn,
+} = await import("../credential-health/credential-health-service.js");
 
 /** Seed the real workspace config's `services.google-oauth.mode`. */
 function seedGoogleOAuthMode(mode: "managed" | "your-own"): void {
@@ -259,6 +275,8 @@ describe("credential-health-service", () => {
     seedGoogleOAuthMode("your-own");
     managedListResponse = { ok: true, status: 200, body: { results: [] } };
     managedPingOutcome = { kind: "status", status: 200 };
+    assistantKeyVerdict = "valid";
+    platformClientAvailable = true;
   });
 
   test("returns empty report when no providers exist", async () => {
@@ -763,4 +781,74 @@ describe("credential-health-service", () => {
       expect(result!.status).toBe("missing_token");
     });
   });
+
+  describe("managed assistant credential", () => {
+    const KEY = "credential/vellum/assistant_api_key";
+    const BASE_URL = "credential/vellum/platform_base_url";
+
+    // Checked directly rather than through `checkAllCredentials`: the managed
+    // credential is not enrolled in the heartbeat pass yet, because the alert
+    // that pass raises has nowhere to send the reader until the notification
+    // carries the repair.
+    const assistantKeyResult = checkAssistantApiKey;
+
+    test("is not reported when the workspace was never connected", async () => {
+      expect(await assistantKeyResult()).toBeNull();
+    });
+
+    test("is missing_token when a platform identity exists without a key", async () => {
+      secureKeyValues.set(BASE_URL, "https://platform.example");
+
+      const result = await assistantKeyResult();
+      expect(result!.status).toBe("missing_token");
+      expect(result!.canAutoRecover).toBe(true);
+    });
+
+    test("is healthy when the platform accepts the stored key", async () => {
+      secureKeyValues.set(BASE_URL, "https://platform.example");
+      secureKeyValues.set(KEY, "stored-key");
+      assistantKeyVerdict = "valid";
+
+      expect((await assistantKeyResult())!.status).toBe("healthy");
+    });
+
+    test("is revoked when the platform rejects the stored key", async () => {
+      secureKeyValues.set(BASE_URL, "https://platform.example");
+      secureKeyValues.set(KEY, "stored-key");
+      assistantKeyVerdict = "rejected";
+
+      const result = await assistantKeyResult();
+      expect(result!.status).toBe("revoked");
+      // Recovery needs a signed-in client to rotate the key, but no
+      // re-authorization from the user.
+      expect(result!.canAutoRecover).toBe(true);
+    });
+
+    // The anti-churn invariant: only a settled rejection may read as revoked,
+    // because `revoked` is what drives a rotation. An unsettled answer (server
+    // error, transport failure) must degrade to `unreachable`, which the
+    // heartbeat drops before notifying.
+    test("an unsettled platform answer is unreachable, never revoked", async () => {
+      secureKeyValues.set(BASE_URL, "https://platform.example");
+      secureKeyValues.set(KEY, "stored-key");
+      assistantKeyVerdict = "unknown";
+
+      expect((await assistantKeyResult())!.status).toBe("unreachable");
+    });
+
+    test("an unreadable credential store is unreachable, never revoked", async () => {
+      secureKeyValues.set(BASE_URL, "https://platform.example");
+      markUnreachable(KEY);
+
+      expect((await assistantKeyResult())!.status).toBe("unreachable");
+    });
+
+    test("is unreachable when the platform client cannot be built", async () => {
+      secureKeyValues.set(BASE_URL, "https://platform.example");
+      secureKeyValues.set(KEY, "stored-key");
+      platformClientAvailable = false;
+
+      expect((await assistantKeyResult())!.status).toBe("unreachable");
+    });
+  });
 });

package/src/__tests__/delete-propagation.test.ts

@@ -16,6 +16,18 @@ mock.module("../config/env.js", () => ({
   getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
 }));
 
+// A client showing the conversation learns of the deletion through the
+// messages-changed invalidation; capture it rather than opening the SSE hub.
+const publishedConversationIds: string[] = [];
+const actualSyncEvents =
+  await import("../runtime/sync/resource-sync-events.js");
+mock.module("../runtime/sync/resource-sync-events.js", () => ({
+  ...actualSyncEvents,
+  publishConversationMessagesChanged: (conversationId: string) => {
+    publishedConversationIds.push(conversationId);
+  },
+}));
+
 import { eq } from "drizzle-orm";
 
 import {
@@ -44,6 +56,7 @@ const SLACK_DELETE_ACTOR_ID = "U_DELETE_ACTOR";
 const SLACK_DELETE_ACTOR_DISPLAY_NAME = "Delete Actor";
 
 function resetState(): void {
+  publishedConversationIds.length = 0;
   const db = getDb();
   db.run("DELETE FROM channel_inbound_events");
   db.run("DELETE FROM messages");
@@ -291,6 +304,7 @@ describe("Discord delete propagation (unattributed)", () => {
     const neutral = readProviderMetadata(row!.metadata);
     expect(neutral!.deletedAt).toBeDefined();
     expect(neutral!.messageId).toBe(sentId);
+    expect(publishedConversationIds).toEqual([minted.conversationId]);
   });
 
   test("deleting one post of a split reply keeps the surviving posts live", async () => {
@@ -614,6 +628,8 @@ describe("Slack delete propagation", () => {
     expect(slackMeta!.channelTs).toBe("1234.5678");
     expect(slackMeta!.eventKind).toBe("message");
     expect(slackMeta!.displayName).toBe("Test User");
+    // A client showing the conversation is told to refetch.
+    expect(publishedConversationIds).toEqual([seeded.conversationId]);
   });
 
   test("deleting the assistant's own Slack post is recorded without an actor", async () => {