@vellumai/assistant 0.11.8 → 0.11.9-staging.2

package/src/__tests__/notification-telegram-adapter.test.ts

@@ -323,6 +323,42 @@ describe("TelegramAdapter", () => {
     expect(call.text).toContain("XYZW");
   });
 
+  test("a question with no options is sent as text with its typed-reply instruction", async () => {
+    const adapter = new TelegramAdapter();
+    const payload = makePayload({
+      sourceEventName: "guardian.question",
+      copy: {
+        title: "Question",
+        body: "What time works?",
+        deliveryText: "What time works?",
+      },
+      contextPayload: {
+        requestId: "req-voice-1",
+        requestCode: "DEF456",
+        requestKind: "pending_question",
+        questionText: "What time works?",
+      },
+      approvalContext: {
+        requestId: "req-voice-1",
+        actions: [],
+        plainTextFallback:
+          'Reference code: DEF456. Reply "DEF456 <your answer>".',
+        intent: "question",
+      },
+    });
+
+    const result = await adapter.send(payload, makeDestination());
+
+    expect(result.success).toBe(true);
+    expect(sendCalls).toHaveLength(1);
+    // No buttons to draw, so no keyboard is attempted and the instruction
+    // joins the text: this is the only place the guardian learns the code.
+    expect(sendCalls[0]?.approval).toBeUndefined();
+    expect(sendCalls[0]?.text).toBe(
+      'What time works?\n\nReference code: DEF456. Reply "DEF456 <your answer>".',
+    );
+  });
+
   describe("update", () => {
     test("edits the delivered message in place and keeps its id", async () => {
       const adapter = new TelegramAdapter();

package/src/__tests__/openai-provider.test.ts

@@ -1962,7 +1962,7 @@ describe("FireworksProvider reasoning_effort ceiling", () => {
   test('DeepSeek V4 Pro accepts "max" unclamped', async () => {
     const fw = new FireworksProvider(
       "fw-key",
-      "accounts/fireworks/models/deepseek-v4-pro",
+      "accounts/fireworks/models/deepseek-v4-pro-0813",
     );
     await fw.sendMessage([userMsg("hi")], {
       systemPrompt: "system",
@@ -1974,7 +1974,7 @@ describe("FireworksProvider reasoning_effort ceiling", () => {
   test('DeepSeek V4 Pro accepts "xhigh" unclamped', async () => {
     const fw = new FireworksProvider(
       "fw-key",
-      "accounts/fireworks/models/deepseek-v4-pro",
+      "accounts/fireworks/models/deepseek-v4-pro-0813",
     );
     await fw.sendMessage([userMsg("hi")], {
       systemPrompt: "system",
@@ -2015,7 +2015,7 @@ describe("FireworksProvider reasoning_effort ceiling", () => {
   test("effort below ceiling is forwarded verbatim", async () => {
     const fw = new FireworksProvider(
       "fw-key",
-      "accounts/fireworks/models/deepseek-v4-pro",
+      "accounts/fireworks/models/deepseek-v4-pro-0813",
     );
     await fw.sendMessage([userMsg("hi")], {
       systemPrompt: "system",
@@ -2045,7 +2045,7 @@ describe("FireworksProvider reasoning_effort ceiling", () => {
       systemPrompt: "system",
       config: {
         effort: "max",
-        model: "accounts/fireworks/models/deepseek-v4-pro",
+        model: "accounts/fireworks/models/deepseek-v4-pro-0813",
       },
     });
     expect(lastCreateParams!.reasoning_effort).toBe("max");
@@ -2110,7 +2110,7 @@ describe("FireworksProvider sparse reasoning_effort support (GLM 5.3)", () => {
 
   test("models without supportedEfforts are unaffected", async () => {
     expect(
-      await send("accounts/fireworks/models/deepseek-v4-pro", "medium"),
+      await send("accounts/fireworks/models/deepseek-v4-pro-0813", "medium"),
     ).toBe("medium");
   });
 });

package/src/__tests__/outbound-slack-persistence.test.ts

@@ -138,6 +138,13 @@ mock.module("../persistence/conversation-crud.js", () => ({
   ),
 }));
 
+const recordedOutboundPosts: Array<Record<string, string>> = [];
+mock.module("../persistence/delivery-crud.js", () => ({
+  recordOutboundPost: (post: Record<string, string>) => {
+    recordedOutboundPosts.push(post);
+  },
+}));
+
 mock.module("../persistence/llm-request-log-store.js", () => ({
   recordRequestLog: () => {},
   backfillMessageIdOnLogs: () => {},
@@ -176,7 +183,7 @@ import {
   handleLlmCallStarted,
   handleMessageComplete,
 } from "../daemon/conversation-agent-loop-handlers.js";
-import { readSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
+import { readSlackMetadataFromMessageMetadata } from "../messaging/providers/slack/message-metadata.js";
 import { deliverReplyViaCallback } from "../runtime/channel-reply-delivery.js";
 import { setConfig } from "./helpers/set-config.js";
 
@@ -266,6 +273,7 @@ describe("outbound assistant Slack metadata persistence", () => {
     persistedRows.length = 0;
     setConfig("ui", {});
     nextDeliveryTs = null;
+    recordedOutboundPosts.length = 0;
     state = createEventHandlerState();
     state.turnStartedAt = 1_700_000_000_000;
   });
@@ -276,13 +284,14 @@ describe("outbound assistant Slack metadata persistence", () => {
     nextDeliveryTs = null;
   });
 
-  test("stamps slackMeta with threadTs from the turn's inbound thread id", async () => {
+  test("stamps the neutral envelope with the turn's inbound thread id", async () => {
     const conversationId = "conv-slack-threaded";
     const channelId = "C123CHANNEL";
 
-    // The turn arrived in a thread — its inbound thread ts is captured on the
+    // The turn arrived in a thread: its inbound thread ts is captured on the
     // trust context (`sourceThreadId`) at ingress, and the reply is stamped
-    // from that turn-local value.
+    // from that turn-local value. A Slack reply row writes the same neutral
+    // envelope every channel writes; Slack's own fields ride its passthrough.
     const deps = makeDeps(conversationId, {
       assistantMessageChannel: "slack",
       requesterChatId: channelId,
@@ -292,27 +301,29 @@ describe("outbound assistant Slack metadata persistence", () => {
     await handleMessageComplete(state, deps, makeMessageCompleteEvent("hi"));
 
     const persisted = lastAssistantPersisted();
-    const slackMetaRaw = persisted.metadata?.slackMeta;
-    expect(typeof slackMetaRaw).toBe("string");
+    expect(persisted.metadata?.slackMeta).toBeUndefined();
+    const providerMetaRaw = persisted.metadata?.providerMeta;
+    expect(typeof providerMetaRaw).toBe("string");
 
-    const slackMeta = JSON.parse(slackMetaRaw as string) as Record<
+    const providerMeta = JSON.parse(providerMetaRaw as string) as Record<
       string,
       unknown
     >;
-    expect(slackMeta.source).toBe("slack");
-    expect(slackMeta.eventKind).toBe("message");
-    expect(slackMeta.channelId).toBe(channelId);
-    expect(slackMeta.threadTs).toBe("1234.5678");
+    expect(providerMeta.source).toBe("slack");
+    expect(providerMeta.eventKind).toBe("message");
+    expect(providerMeta.conversationExternalId).toBe(channelId);
+    expect(providerMeta.threadId).toBe("1234.5678");
 
     // Persistence runs BEFORE the Slack adapter posts the message, so the
-    // authoritative `ts` (-> `channelTs`) is not yet known at this layer.
-    // The post-send reconciliation in `deliverReplyViaCallback` fills the
-    // field once the gateway returns the Slack-assigned ts (covered by
-    // `channel-reply-delivery.test.ts`). Until that runs, the partial
-    // metadata is intentionally rejected by `readSlackMetadata` so callers
-    // that try to use it before reconciliation get a clear null.
-    expect(slackMeta.channelTs).toBeUndefined();
-    expect(readSlackMetadata(slackMetaRaw as string)).toBeNull();
+    // authoritative ts (the envelope's `messageId`) is not yet known at this
+    // layer. The post-send reconciliation in `deliverReplyViaCallback` fills
+    // it once the gateway returns the Slack-assigned ts (covered by
+    // `channel-reply-delivery.test.ts`). Until then the row has no Slack
+    // view, so a Slack reader gets a clear null rather than a half row.
+    expect(providerMeta.messageId).toBeUndefined();
+    expect(
+      readSlackMetadataFromMessageMetadata(JSON.stringify(persisted.metadata)),
+    ).toBeNull();
   });
 
   test("stamps assistant Slack rows with effective timestamp timezone and no speaker suffix", async () => {
@@ -335,16 +346,12 @@ describe("outbound assistant Slack metadata persistence", () => {
     );
 
     const persisted = lastAssistantPersisted();
-    const slackMetaRaw = persisted.metadata?.slackMeta;
-    expect(typeof slackMetaRaw).toBe("string");
-
-    const slackMeta = JSON.parse(slackMetaRaw as string) as Record<
-      string,
-      unknown
-    >;
-    expect(slackMeta.timestampTimezone).toBe("America/Denver");
-    expect(slackMeta.timestampTimezoneLabel).toBe("MT");
-    expect(slackMeta.speakerTimezoneLabel).toBeUndefined();
+    const providerMeta = JSON.parse(
+      persisted.metadata?.providerMeta as string,
+    ) as Record<string, unknown>;
+    expect(providerMeta.timestampTimezone).toBe("America/Denver");
+    expect(providerMeta.timestampTimezoneLabel).toBe("MT");
+    expect(providerMeta.speakerTimezoneLabel).toBeUndefined();
   });
 
   test("falls back to the turn client timezone when no configured user timezone is set", async () => {
@@ -364,14 +371,14 @@ describe("outbound assistant Slack metadata persistence", () => {
     );
 
     const persisted = lastAssistantPersisted();
-    const slackMeta = JSON.parse(
-      persisted.metadata?.slackMeta as string,
+    const providerMeta = JSON.parse(
+      persisted.metadata?.providerMeta as string,
     ) as Record<string, unknown>;
-    expect(slackMeta.timestampTimezone).toBe("America/Los_Angeles");
-    expect(slackMeta.timestampTimezoneLabel).toBe("PT");
+    expect(providerMeta.timestampTimezone).toBe("America/Los_Angeles");
+    expect(providerMeta.timestampTimezoneLabel).toBe("PT");
   });
 
-  test("post-send reconciliation preserves assistant Slack timezone metadata", async () => {
+  test("post-send reconciliation gives the row its Slack view, timezone fields intact", async () => {
     setConfig("ui", { userTimezone: "America/Denver" });
     const conversationId = "conv-slack-reconcile-timezone";
     const channelId = "C999RECONCILE";
@@ -389,9 +396,9 @@ describe("outbound assistant Slack metadata persistence", () => {
     );
 
     const persisted = lastAssistantPersisted();
-    const beforeRaw = persisted.metadata?.slackMeta;
-    expect(typeof beforeRaw).toBe("string");
-    expect(readSlackMetadata(beforeRaw as string)).toBeNull();
+    expect(
+      readSlackMetadataFromMessageMetadata(JSON.stringify(persisted.metadata)),
+    ).toBeNull();
 
     nextDeliveryTs = "1772678280.000200";
     await deliverReplyViaCallback(
@@ -406,19 +413,28 @@ describe("outbound assistant Slack metadata persistence", () => {
       (candidate) => candidate.id === persisted.id,
     );
     expect(typeof row?.metadata).toBe("string");
-    const envelope = JSON.parse(row!.metadata!) as Record<string, unknown>;
-    const reconciled = readSlackMetadata(envelope.slackMeta as string);
-    expect(reconciled).not.toBeNull();
-    expect(reconciled!.channelTs).toBe("1772678280.000200");
-    expect(reconciled!.timestampTimezone).toBe("America/Denver");
-    expect(reconciled!.timestampTimezoneLabel).toBe("MT");
-    expect(reconciled!.speakerTimezoneLabel).toBeUndefined();
+    // The Slack renderers read the reconciled row through its Slack view.
+    const view = readSlackMetadataFromMessageMetadata(row!.metadata!);
+    expect(view).not.toBeNull();
+    expect(view!.channelId).toBe(channelId);
+    expect(view!.channelTs).toBe("1772678280.000200");
+    expect(view!.timestampTimezone).toBe("America/Denver");
+    expect(view!.timestampTimezoneLabel).toBe("MT");
+    expect(view!.speakerTimezoneLabel).toBeUndefined();
+    // And the post is in the outbound index, exactly as any channel's is.
+    expect(recordedOutboundPosts).toContainEqual({
+      sourceChannel: "slack",
+      externalChatId: channelId,
+      providerMessageId: "1772678280.000200",
+      messageId: persisted.id,
+      conversationId,
+    });
   });
 
-  test("stamps slackMeta WITHOUT threadTs for top-level Slack replies", async () => {
+  test("stamps no threadId for top-level Slack replies", async () => {
     const conversationId = "conv-slack-toplevel";
     const channelId = "C456NOTHREAD";
-    // The turn arrived at the channel root — no `sourceThreadId` on the trust
+    // The turn arrived at the channel root: no `sourceThreadId` on the trust
     // context, so the reply targets the channel root, not a thread.
 
     const deps = makeDeps(conversationId, {
@@ -429,20 +445,14 @@ describe("outbound assistant Slack metadata persistence", () => {
     await handleMessageComplete(state, deps, makeMessageCompleteEvent("hello"));
 
     const persisted = lastAssistantPersisted();
-    const slackMetaRaw = persisted.metadata?.slackMeta;
-    expect(typeof slackMetaRaw).toBe("string");
-
-    const slackMeta = JSON.parse(slackMetaRaw as string) as Record<
-      string,
-      unknown
-    >;
-    expect(slackMeta.source).toBe("slack");
-    expect(slackMeta.eventKind).toBe("message");
-    expect(slackMeta.channelId).toBe(channelId);
-    // threadTs is intentionally absent — top-level reply.
-    expect(slackMeta.threadTs).toBeUndefined();
-    // channelTs is still absent for the same persistence-vs-send reason.
-    expect(slackMeta.channelTs).toBeUndefined();
+    const providerMeta = JSON.parse(
+      persisted.metadata?.providerMeta as string,
+    ) as Record<string, unknown>;
+    expect(providerMeta.source).toBe("slack");
+    expect(providerMeta.eventKind).toBe("message");
+    expect(providerMeta.conversationExternalId).toBe(channelId);
+    expect(providerMeta.threadId).toBeUndefined();
+    expect(providerMeta.messageId).toBeUndefined();
   });
 
   test("envelope resolves from the turn's actor when the slot has moved", async () => {
@@ -471,17 +481,17 @@ describe("outbound assistant Slack metadata persistence", () => {
 
     const persisted = lastAssistantPersisted();
     expect(persisted.metadata?.provenanceTrustClass).toBe("trusted_contact");
-    const slackMeta = JSON.parse(
-      persisted.metadata?.slackMeta as string,
+    const providerMeta = JSON.parse(
+      persisted.metadata?.providerMeta as string,
     ) as Record<string, unknown>;
-    expect(slackMeta.channelId).toBe("C-CONTACT");
-    expect(slackMeta.threadTs).toBe("1723300000.000100");
+    expect(providerMeta.conversationExternalId).toBe("C-CONTACT");
+    expect(providerMeta.threadId).toBe("1723300000.000100");
   });
 
   test("ignores a non-ts sourceThreadId", async () => {
     const conversationId = "conv-slack-bad-thread";
     const channelId = "C789BAD";
-    // A malformed thread id must not be stamped as a threadTs (isSlackTs guard).
+    // A malformed thread id must not be stamped as a thread (isSlackTs guard).
     const deps = makeDeps(conversationId, {
       assistantMessageChannel: "slack",
       requesterChatId: channelId,
@@ -495,13 +505,10 @@ describe("outbound assistant Slack metadata persistence", () => {
     );
 
     const persisted = lastAssistantPersisted();
-    const slackMetaRaw = persisted.metadata?.slackMeta;
-    expect(typeof slackMetaRaw).toBe("string");
-    const slackMeta = JSON.parse(slackMetaRaw as string) as Record<
-      string,
-      unknown
-    >;
-    expect(slackMeta.threadTs).toBeUndefined();
+    const providerMeta = JSON.parse(
+      persisted.metadata?.providerMeta as string,
+    ) as Record<string, unknown>;
+    expect(providerMeta.threadId).toBeUndefined();
   });
 
   test("does NOT stamp slackMeta on non-Slack outbound assistant messages", async () => {
@@ -613,6 +620,12 @@ describe("outbound assistant Slack metadata persistence", () => {
     ) as Record<string, unknown>;
     expect(metaAfter.messageId).toBe("1234567890123456789");
     expect(metaAfter.additionalMessageIds).toEqual(["8888888888888888888"]);
+    // Both ids also land in the channel_outbound_posts resolution index,
+    // written by the same reconciliation so envelope and index cannot drift.
+    expect(recordedOutboundPosts.map((post) => post.providerMessageId)).toEqual(
+      ["1234567890123456789", "8888888888888888888"],
+    );
+    expect(recordedOutboundPosts[0].messageId).toBe(persisted.id);
 
     // A redelivery reporting an already-recorded id changes nothing.
     nextDeliveryTs = "8888888888888888888";

package/src/__tests__/persist-user-message-set-processing-failure.test.ts

@@ -1,111 +1,129 @@
 /**
- * Regression: `persistUserMessage` calls `ctx.setProcessing(true)`, which
- * persists the flag to the DB and can throw (e.g. SQLITE_BUSY). That call must
- * run inside the function's try/catch so a failure unwinds the request-id and
- * abort-controller bookkeeping instead of stranding it on the conversation.
- * A later failure while clearing the flag must not mask the original error.
+ * How `persistUserMessage` takes and gives back the conversation's processing
+ * flag.
+ *
+ * It acquires rather than sets: the read and the take are one step, and the
+ * hold it takes is released only by the claim that took it. That is what keeps
+ * a turn that is starting from publishing an idle conversation, and what keeps
+ * an earlier holder from releasing a turn that claimed the flag away.
+ *
+ * A failure anywhere after the acquire must unwind the request-id and
+ * abort-controller bookkeeping rather than stranding it on the conversation,
+ * and a failure while releasing must not mask the original error.
  */
 import { describe, expect, test } from "bun:test";
 
 import type { MessagingConversationContext } from "../daemon/conversation-messaging.js";
-import { persistUserMessage } from "../daemon/conversation-messaging.js";
+import {
+  CONVERSATION_BUSY_MESSAGE,
+  persistUserMessage,
+} from "../daemon/conversation-messaging.js";
 
-type SetProcessingBehavior = (value: boolean) => void;
+interface ContextBehavior {
+  /** Answered in place of taking the flag. `undefined` takes it for real. */
+  acquire?: () => Promise<number | null>;
+  /** Runs before the release completes, so it can throw. */
+  onRelease?: (owner: number) => void;
+}
 
-function makeContext(
-  setProcessing: SetProcessingBehavior,
-): MessagingConversationContext & {
-  processing: boolean;
+function makeContext(behavior: ContextBehavior = {}): {
+  ctx: MessagingConversationContext;
+  processing: () => boolean;
+  releases: number[];
 } {
   let processing = false;
+  let owner = 0;
+  const releases: number[] = [];
   const ctx = {
-    conversationId: "conv-set-processing-failure",
+    conversationId: "conv-processing-ownership",
     messages: [],
     abortController: null,
     currentRequestId: undefined,
     queue: {} as never,
-    get processing() {
-      return processing;
-    },
     isProcessing: () => processing,
     setProcessing: (value: boolean) => {
-      setProcessing(value);
       processing = value;
     },
+    acquireProcessingFenced: async () => {
+      if (behavior.acquire) {
+        return behavior.acquire();
+      }
+      if (processing) {
+        return null;
+      }
+      processing = true;
+      owner += 1;
+      return owner;
+    },
+    releaseProcessing: (claim: number) => {
+      releases.push(claim);
+      behavior.onRelease?.(claim);
+      if (claim !== owner) {
+        return false;
+      }
+      processing = false;
+      return true;
+    },
     getTurnChannelContext: () => null,
     getTurnInterfaceContext: () => null,
-  } as unknown as MessagingConversationContext & { processing: boolean };
-  return ctx;
+  } as unknown as MessagingConversationContext;
+  return { ctx, processing: () => processing, releases };
 }
 
-describe("persistUserMessage setProcessing failure", () => {
-  test("clears request-id and abort bookkeeping when setProcessing(true) throws", async () => {
-    const ctx = makeContext((value) => {
-      if (value) {
-        throw new Error("database is locked (SQLITE_BUSY)");
-      }
-    });
+describe("persistUserMessage processing ownership", () => {
+  test("unwinds its bookkeeping and its hold when the persist fails", async () => {
+    // No database stands behind this context, so the body throws. The flag it
+    // took has to come back with it.
+    const { ctx, processing, releases } = makeContext();
 
     await expect(
       persistUserMessage(ctx, { content: "hello", requestId: "req-1" }),
-    ).rejects.toThrow("database is locked");
+    ).rejects.toThrow();
 
     expect(ctx.currentRequestId).toBeUndefined();
     expect(ctx.abortController).toBeNull();
-    expect(ctx.isProcessing()).toBe(false);
+    expect(processing()).toBe(false);
+    expect(releases).toEqual([1]);
   });
 
-  test("retries a transient SQLITE_BUSY from setProcessing(true)", async () => {
-    // A coded SQLITE_BUSY is transient WAL contention: `persistUserMessage`
-    // wraps the acquiring `setProcessing(true)` in `withSqliteRetry`, so it is
-    // re-attempted rather than failing the send immediately.
-    let trueCalls = 0;
-    const ctx = makeContext((value) => {
-      if (value) {
-        trueCalls += 1;
-        throw Object.assign(new Error("database is locked"), {
-          code: "SQLITE_BUSY",
-        });
-      }
-    });
+  test("refuses a conversation another holder is already processing", async () => {
+    const { ctx, releases } = makeContext();
+    ctx.setProcessing(true);
 
     await expect(
       persistUserMessage(ctx, { content: "hello", requestId: "req-busy" }),
-    ).rejects.toThrow("database is locked");
+    ).rejects.toThrow(CONVERSATION_BUSY_MESSAGE);
 
-    // Initial attempt + 3 retries before withSqliteRetry gives up.
-    expect(trueCalls).toBe(4);
-    expect(ctx.currentRequestId).toBeUndefined();
-    expect(ctx.abortController).toBeNull();
+    // Nothing was taken, so nothing is given back.
+    expect(releases).toEqual([]);
   });
 
-  test("does not retry a non-transient setProcessing(true) failure", async () => {
-    // No SQLite code / a non-BUSY code → not contention → fail fast, no retry.
-    let trueCalls = 0;
-    const ctx = makeContext((value) => {
-      if (value) {
-        trueCalls += 1;
-        throw new Error("boom");
-      }
-    });
+  test("reports busy rather than stealing a flag the acquire finds taken", async () => {
+    // The acquire is the only thing that decides: a caller cannot set its way
+    // past a holder.
+    const { ctx, releases } = makeContext({ acquire: async () => null });
 
     await expect(
-      persistUserMessage(ctx, { content: "hello", requestId: "req-boom" }),
-    ).rejects.toThrow("boom");
+      persistUserMessage(ctx, { content: "hello", requestId: "req-taken" }),
+    ).rejects.toThrow(CONVERSATION_BUSY_MESSAGE);
 
-    expect(trueCalls).toBe(1);
+    expect(ctx.currentRequestId).toBeUndefined();
+    expect(ctx.abortController).toBeNull();
+    expect(releases).toEqual([]);
   });
 
-  test("a failing clear does not mask the original persist error", async () => {
-    // setProcessing throws on both the set and the clear; the original error
-    // must still propagate and the bookkeeping must still be reset.
-    const ctx = makeContext(() => {
-      throw new Error("database is locked (SQLITE_BUSY)");
+  test("a failing release does not mask the original error", async () => {
+    const { ctx } = makeContext({
+      onRelease: () => {
+        throw new Error("release exploded");
+      },
     });
 
-    await expect(
-      persistUserMessage(ctx, { content: "hello", requestId: "req-2" }),
-    ).rejects.toThrow("database is locked");
+    const attempt = persistUserMessage(ctx, {
+      content: "hello",
+      requestId: "req-2",
+    });
+    await expect(attempt).rejects.not.toThrow("release exploded");
 
     expect(ctx.currentRequestId).toBeUndefined();
     expect(ctx.abortController).toBeNull();

package/src/__tests__/platform-client-verify-credential.test.ts

@@ -0,0 +1,100 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+let platformAssistantId = "asst_123";
+let fetchImpl: (
+  url: string,
+  init?: RequestInit,
+) => Promise<Response> = async () => new Response("{}", { status: 200 });
+const fetchCalls: Array<{ url: string; init?: RequestInit }> = [];
+
+mock.module("../platform/feature-gate.js", () => ({
+  arePlatformFeaturesEnabled: () => true,
+}));
+
+mock.module("../providers/platform-proxy/context.js", () => ({
+  resolveManagedProxyContext: async () => ({
+    enabled: true,
+    platformBaseUrl: "https://platform.test/",
+    assistantApiKey: "assistant-key",
+  }),
+}));
+
+mock.module("../config/env.js", () => ({
+  getPlatformAssistantId: () => platformAssistantId,
+}));
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async () => null,
+}));
+
+const { VellumPlatformClient } = await import("../platform/client.js");
+
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  platformAssistantId = "asst_123";
+  fetchCalls.length = 0;
+  fetchImpl = async () => new Response("{}", { status: 200 });
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = typeof input === "string" ? input : input.toString();
+    fetchCalls.push({ url, init });
+    return fetchImpl(url, init);
+  }) as typeof fetch;
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+async function createClient() {
+  const client = await VellumPlatformClient.create();
+  if (!client) {
+    throw new Error("client prerequisites were not satisfied");
+  }
+  return client;
+}
+
+describe("VellumPlatformClient.verifyCredential", () => {
+  test("an accepted request is a valid credential, asked on the owner-consent carrier with the stored key", async () => {
+    const client = await createClient();
+
+    expect(await client.verifyCredential()).toBe("valid");
+
+    expect(fetchCalls).toHaveLength(1);
+    expect(fetchCalls[0]?.url).toBe(
+      "https://platform.test/v1/assistants/asst_123/owner-consent/",
+    );
+    const headers = new Headers(fetchCalls[0]?.init?.headers);
+    expect(headers.get("Authorization")).toBe("Api-Key assistant-key");
+    // The heartbeat awaits this check, so it must carry a deadline.
+    expect(fetchCalls[0]?.init?.signal).toBeInstanceOf(AbortSignal);
+  });
+
+  // Only the platform's own refusal may drive a rotation.
+  test.each([401, 403])("a %i is the settled rejection", async (status) => {
+    fetchImpl = async () => new Response("", { status });
+    const client = await createClient();
+    expect(await client.verifyCredential()).toBe("rejected");
+  });
+
+  test("a server error is unsettled, not a rejection", async () => {
+    fetchImpl = async () => new Response("", { status: 503 });
+    const client = await createClient();
+    expect(await client.verifyCredential()).toBe("unknown");
+  });
+
+  test("an unreachable platform is unsettled, not a rejection", async () => {
+    fetchImpl = async () => {
+      throw new TypeError("fetch failed");
+    };
+    const client = await createClient();
+    expect(await client.verifyCredential()).toBe("unknown");
+  });
+
+  test("without a platform assistant id there is nothing to verify", async () => {
+    platformAssistantId = "";
+    const client = await createClient();
+    expect(await client.verifyCredential()).toBe("unknown");
+    expect(fetchCalls).toHaveLength(0);
+  });
+});