@vellumai/assistant 0.12.0-staging.1 → 0.12.0

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -10,6 +10,7 @@ import { SENTINEL_REDACTION_VERSION } from "@vellumai/service-contracts/redacted
 import type pino from "pino";
 import { v4 as uuid } from "uuid";
 
+import { onActivationToolCall } from "../activation/turn-hooks.js";
 import type { AgentEvent } from "../agent/loop.js";
 import type { AnsweredQuestion } from "../api/events/question-answered.js";
 import type { AssistantEvent } from "../api/index.js";
@@ -1760,6 +1761,10 @@ export function handleToolUse(
   event: Extract<AgentEvent, { type: "tool_use" }>,
 ): void {
   state.toolUseIdToName.set(event.id, event.name);
+  // Activation checklist: keep the launched task's live step count moving.
+  // Fire-and-forget and throttled inside the hook; a no-op for every
+  // conversation no activation task points at.
+  onActivationToolCall(deps.ctx.conversationId);
   if (event.name === "app_create" || event.name === "app_refresh") {
     state.appBuildToolUsedThisRun = true;
   }

package/src/daemon/conversation-agent-loop.ts

@@ -9,6 +9,7 @@
 
 import { v4 as uuid } from "uuid";
 
+import { onActivationTurnComplete } from "../activation/turn-hooks.js";
 import { repairHistoryForRun } from "../agent/history-repair/history-repair.js";
 import type {
   AgentEvent,
@@ -78,6 +79,7 @@ import type { Provider } from "../providers/types.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
 import { resolveTurnReplyMessageId } from "../runtime/channel-reply-delivery.js";
 import { isNoResponseOnlyText } from "../runtime/no-response.js";
+import { getByConversation as getPendingInteractionsByConversation } from "../runtime/pending-interactions.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { stampTurnOutcome } from "../telemetry/turn-outcome.js";
 import {
@@ -107,6 +109,7 @@ import {
 } from "./conversation-agent-loop-handlers.js";
 import {
   approveHostAttachmentRead,
+  type PersistedAttachmentFile,
   resolveAssistantAttachments,
 } from "./conversation-attachments.js";
 import {
@@ -130,6 +133,7 @@ import {
 } from "./conversation-runtime-assembly.js";
 import type { CurrentTurnSurface } from "./conversation-surfaces.js";
 import {
+  hasBlockingPendingSurface,
   markSurfaceCompleted,
   settleRunningTaskProgressSurfaces,
 } from "./conversation-surfaces.js";
@@ -256,6 +260,35 @@ const FALLBACK_TURN_TRUST: TrustContext = {
  */
 export type AssistantSurface = CurrentTurnSurface;
 
+/**
+ * Interaction kinds that are a prompt posed to the user. The `host_*` kinds
+ * are in-flight tool executions proxied to a client, which are the loop
+ * waiting on a machine rather than on a person.
+ */
+const USER_PROMPT_INTERACTION_KINDS = new Set([
+  "confirmation",
+  "acp_confirmation",
+  "question",
+  "secret",
+]);
+
+/**
+ * Whether this turn handed control back to the user instead of delivering.
+ *
+ * True when something the turn put on screen still needs an answer once the
+ * turn is over: a question or confirmation prompt that outlived it, or an
+ * interactive surface still awaiting an action. Both are structural, so a
+ * question the assistant asks in prose alone reads as a delivered turn.
+ */
+function turnEndedAwaitingUser(ctx: Conversation): boolean {
+  if (hasBlockingPendingSurface(ctx)) {
+    return true;
+  }
+  return getPendingInteractionsByConversation(ctx.conversationId).some(
+    (interaction) => USER_PROMPT_INTERACTION_KINDS.has(interaction.kind),
+  );
+}
+
 // ── abort watchdog ───────────────────────────────────────────────────
 
 /**
@@ -819,6 +852,11 @@ export async function runAgentLoopImpl(
   // provider-error turn's only assistant row is the synthetic error text, so
   // the deferred tail must not treat either as a final reply.
   let turnCompleted = false;
+  // Files this turn attached that survived resolution and persistence, in
+  // the shape the activation hook records as artifacts. Rejected directives
+  // never reach it, so a checklist card can never point at a file the turn
+  // failed to attach.
+  let persistedAttachmentFiles: readonly PersistedAttachmentFile[] = [];
   // True once `releaseTurn` has run. The happy path releases as soon as the
   // turn's content is settled; the `finally` calls it again as the backstop for
   // the cancel/error paths that never reached the early release.
@@ -1202,11 +1240,15 @@ export async function runAgentLoopImpl(
 
     // Unified `<turn_context>` actor input for this turn (model-facing grounding
     // metadata; the conversation runtime context remains the source for policy
-    // gating). Resolved once at turn start and frozen onto the conversation so
-    // the post-compaction hook re-emits this same value during in-loop recovery
+    // gating). Derived from the turn's own actor, so the block describes who
+    // is speaking now rather than who last touched the conversation. Resolved
+    // once at turn start and frozen onto the conversation so the
+    // post-compaction hook re-emits this same value during in-loop recovery
     // instead of re-resolving against contact/member registry state that may
     // have drifted mid-turn.
-    const actorContext = resolveTurnInboundActorContext(ctx.trustContext);
+    const actorContext = resolveTurnInboundActorContext(
+      turnOrRestingTrust(ctx),
+    );
     ctx.currentTurnInboundActorContext = actorContext;
 
     // Surface long gaps between user messages so the model can acknowledge
@@ -1925,6 +1967,7 @@ export async function runAgentLoopImpl(
         state.toolContentBlockToolNames,
       );
       const { assistantAttachments, emittedAttachments } = attachmentResult;
+      persistedAttachmentFiles = attachmentResult.persistedFiles;
 
       ctx.lastAssistantAttachments = assistantAttachments;
       ctx.lastAttachmentWarnings = attachmentResult.directiveWarnings;
@@ -2104,6 +2147,31 @@ export async function runAgentLoopImpl(
     try {
       if (turnStarted) {
         ctx.turnCount++;
+
+        // Activation checklist: a completed turn in a conversation an
+        // activation task was launched into finishes that task, unless the
+        // turn ended waiting on the user, in which case the answer's turn
+        // finishes it (see `markActivationTurnComplete`). Cancelled turns
+        // and handoffs deliberately fall through: the task is still
+        // running. No-op for every conversation no task points at.
+        //
+        // Ahead of the turn-boundary commit, and fire-and-forget: a commit
+        // that fails, times out, or is deferred to the next turn must not
+        // leave the task showing as still running while the client is
+        // already free to restart it.
+        if (turnCompleted) {
+          onActivationTurnComplete({
+            conversationId: ctx.conversationId,
+            toolCallCount: state.toolUseIdToName.size,
+            attachedFiles: persistedAttachmentFiles.map((file) => ({
+              path: file.sourcePath,
+              filename: file.displayName,
+              sourceType: file.sourceType,
+            })),
+            endedAwaitingUser: turnEndedAwaitingUser(ctx),
+          });
+        }
+
         const runTurnCommit = async (): Promise<void> => {
           const config = getConfig();
           const maxWait =

package/src/daemon/conversation-attachments.ts

@@ -10,6 +10,7 @@ import { getLogger } from "../util/logger.js";
 import {
   type ApproveHostRead,
   type AssistantAttachmentDraft,
+  type AttachmentSourceType,
   contentBlocksToDrafts,
   deduplicateDrafts,
   type DirectiveRequest,
@@ -63,10 +64,30 @@ export async function approveHostAttachmentRead(
   return response.decision === "allow";
 }
 
+/**
+ * A file the assistant named that survived resolution, validation, and
+ * persistence. Rejected directives (missing, oversized, denied) and drafts
+ * whose upload was skipped never appear here, so a caller pointing a user
+ * at "the files this turn produced" cannot offer a broken one.
+ */
+export interface PersistedAttachmentFile {
+  /** Absolute path the attachment was read from. */
+  sourcePath: string;
+  /** Name the attachment was persisted under. */
+  displayName: string;
+  /**
+   * Boundary the path was resolved against. A caller that surfaces the path
+   * needs it: only `sandbox_file` paths are the assistant's own workspace,
+   * and a `host_file` path is the user's machine.
+   */
+  sourceType: AttachmentSourceType;
+}
+
 export interface AttachmentResolutionResult {
   assistantAttachments: AssistantAttachmentDraft[];
   emittedAttachments: UserMessageAttachment[];
   directiveWarnings: string[];
+  persistedFiles: PersistedAttachmentFile[];
 }
 
 /**
@@ -84,6 +105,17 @@ export async function resolveAssistantAttachments(
 ): Promise<AttachmentResolutionResult> {
   let assistantAttachments: AssistantAttachmentDraft[] = [];
   const emittedAttachments: UserMessageAttachment[] = [];
+  const persistedFiles: PersistedAttachmentFile[] = [];
+
+  const recordPersistedFile = (draft: AssistantAttachmentDraft): void => {
+    if (draft.sourcePath) {
+      persistedFiles.push({
+        sourcePath: draft.sourcePath,
+        displayName: draft.filename,
+        sourceType: draft.sourceType,
+      });
+    }
+  };
 
   log.info(
     {
@@ -208,6 +240,7 @@ export async function resolveAssistantAttachments(
         }
       }
 
+      recordPersistedFile(draft);
       emittedAttachments.push({
         id: stored.id,
         filename: draft.filename,
@@ -220,6 +253,9 @@ export async function resolveAssistantAttachments(
       });
     }
   } else if (assistantAttachments.length > 0) {
+    // No assistant message to attach to: the drafts are emitted to the client
+    // for this turn only and nothing is stored, so none of them is a
+    // persisted file.
     for (const draft of assistantAttachments) {
       emittedAttachments.push({
         filename: draft.filename,
@@ -230,5 +266,10 @@ export async function resolveAssistantAttachments(
     }
   }
 
-  return { assistantAttachments, emittedAttachments, directiveWarnings };
+  return {
+    assistantAttachments,
+    emittedAttachments,
+    directiveWarnings,
+    persistedFiles,
+  };
 }

package/src/daemon/conversation-event-sink.ts

@@ -0,0 +1,25 @@
+import type { AssistantEvent } from "../api/index.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
+
+/**
+ * Delivery sink for a top-level conversation: the assistant event hub,
+ * scoped to that conversation.
+ *
+ * The hub attributes an event to a conversation from the id it is handed,
+ * falling back to a `conversationId` on the payload, and that attribution
+ * decides three things: which conversation-filtered subscribers receive the
+ * event, whether it is seq-stamped, and whether it is replayed after a
+ * reconnect. Binding the id here makes all three a property of the emitting
+ * conversation rather than of each event's schema, so an event whose payload
+ * names no conversation (`subagent_spawned`, `subagent_status_changed`) is
+ * scoped exactly like one that does.
+ *
+ * Payload attribution stays the fallback for events published straight to the
+ * hub, including `open_conversation`, whose id names the conversation to open
+ * rather than the one it was emitted from.
+ */
+export function conversationEventSink(
+  conversationId: string,
+): (msg: AssistantEvent) => void {
+  return (msg) => broadcastMessage(msg, conversationId);
+}

package/src/daemon/conversation-process.ts

@@ -64,7 +64,7 @@ import { preactivateHostProxySkills } from "./host-proxy-preactivation.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import { buildTransportHints } from "./transport-hints.js";
 import { sameTrustIdentity, type TrustContext } from "./trust-context-types.js";
-import { turnOrRestingTrust } from "./trust-context-types.js";
+import { restingTrust, turnOrRestingTrust } from "./trust-context-types.js";
 import { resolveVerificationSessionIntent } from "./verification-session-intent.js";
 
 const log = getLogger("conversation-process");
@@ -646,6 +646,52 @@ export async function kickQueueDrain(
   }
 }
 
+/**
+ * Commit `actor` as the actor the turn about to start runs for: the resting
+ * slot names them, so the history is scoped to them and every reader of the
+ * slot (the `<turn_context>` actor section, memory retrieval, the Slack
+ * transcript filters) describes them rather than whoever sent last, and the
+ * per-turn snapshot then reads back that same actor, which is also returned
+ * for callers that must hold it in a local. A caller with no actor of its own
+ * (internal dispatch, or a queued message whose enqueue found the slot empty)
+ * passes `undefined`, and the resting actor stands.
+ *
+ * `reloadHistory` is off only for a steered drain, which keeps its resident
+ * history: a steer comes from the actor whose turn it cut off, and that
+ * history may hold the in-memory repair of the abandoned `tool_use`, which a
+ * reload would discard.
+ *
+ * The committed actor is captured and snapshotted before the reload awaits:
+ * the slot is writable out-of-band across that await (a wake's stamp, a
+ * pointer elevation), and a read after it would hand the turn that writer's
+ * actor. A reload that fails starts no turn, so the slot is put back to what
+ * it held before, guarded so a writer that legitimately moved it in between
+ * is left alone.
+ */
+async function commitTurnActor(
+  conversation: Conversation,
+  actor: TrustContext | undefined,
+  options: { reloadHistory: boolean },
+): Promise<TrustContext | undefined> {
+  const prior = restingTrust(conversation);
+  if (actor) {
+    conversation.setTrustContext(actor);
+  }
+  const turnTrustContext = restingTrust(conversation);
+  conversation.currentTurnTrustContext = turnTrustContext;
+  if (options.reloadHistory) {
+    try {
+      await conversation.ensureActorScopedHistory();
+    } catch (err) {
+      if (actor && restingTrust(conversation) === actor) {
+        conversation.setTrustContext(prior ?? null);
+      }
+      throw err;
+    }
+  }
+  return turnTrustContext;
+}
+
 async function drainSingleMessage(
   conversation: Conversation,
   next: QueuedMessage,
@@ -749,8 +795,11 @@ async function drainSingleMessage(
   // Trust comes from the queued message, not the live slot: the slot holds
   // whichever actor sent most recently, which is this sender only when nobody
   // else sent while this message waited.
-  conversation.currentTurnTrustContext =
-    next.trustContext ?? conversation.trustContext;
+  const turnTrustContext = await commitTurnActor(
+    conversation,
+    next.trustContext,
+    { reloadHistory: !steered },
+  );
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1220,10 +1269,10 @@ async function drainSingleMessage(
     cronRunId?: string | null;
   } = {
     isUserMessage: true,
-    // Carry the sender's trust into the run. The loop re-initializes the
-    // per-turn snapshot on entry, so without this the stamp above is undone
-    // and the turn reverts to the conversation's most recent actor.
-    turnTrustContext: conversation.currentTurnTrustContext,
+    // Carry the sender's trust into the run from the local captured at the
+    // commit: the loop re-initializes the per-turn snapshot on entry, and the
+    // field is writable out-of-band across the awaits above.
+    turnTrustContext,
   };
   if (next.isInteractive !== undefined) {
     drainLoopOptions.isInteractive = next.isInteractive;
@@ -1359,8 +1408,11 @@ async function drainBatch(
   // `buildPassthroughBatch` refuses to coalesce messages from different
   // actors; without that boundary this would run a tail under the head's
   // trust.
-  conversation.currentTurnTrustContext =
-    head.trustContext ?? conversation.trustContext;
+  const turnTrustContext = await commitTurnActor(
+    conversation,
+    head.trustContext,
+    { reloadHistory: true },
+  );
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1703,9 +1755,9 @@ async function drainBatch(
     cronRunId?: string | null;
   } = {
     isUserMessage: true,
-    // Same reason as the single-message drain: the loop re-initializes the
-    // per-turn snapshot, so the head's trust has to travel with the call.
-    turnTrustContext: conversation.currentTurnTrustContext,
+    // Same reason as the single-message drain: the head's trust travels from
+    // the local captured at the commit, not a late read of the field.
+    turnTrustContext,
   };
   if (lastPushEligibleUserMessageId !== undefined) {
     drainLoopOptions.notifyUserMessageId = lastPushEligibleUserMessageId;
@@ -1838,20 +1890,16 @@ export async function processMessage(
     metadata: callerMetadata,
     trustContext: committingTrustContext,
   } = options;
-  if (committingTrustContext) {
-    conversation.setTrustContext(committingTrustContext);
-  }
-  await conversation.ensureActorScopedHistory();
-  // Snapshot persona context at turn start so later tool turns can't pick up
-  // a different actor's context if a concurrent request mutates the live fields.
-  //
   // Held in a local as well as on the conversation: the field is writable
   // out-of-band while this turn is in flight (`agent-wake` stamps it and
   // restores the prior value in a `finally`), so reading it back at the agent
   // loop call below would reintroduce the late read this capture exists to
   // avoid. The local is what the loop runs under.
-  const turnTrustContext = conversation.trustContext;
-  conversation.currentTurnTrustContext = turnTrustContext;
+  const turnTrustContext = await commitTurnActor(
+    conversation,
+    committingTrustContext,
+    { reloadHistory: true },
+  );
   conversation.currentTurnAuthContext = conversation.authContext;
   conversation.currentTurnSourceActorPrincipalId =
     sourceActorPrincipalId ?? conversation.authContext?.actorPrincipalId;

package/src/daemon/conversation-store.ts

@@ -27,10 +27,10 @@ import {
 } from "../providers/connection-resolution.js";
 import { RateLimitProvider } from "../providers/ratelimit.js";
 import { listProviders } from "../providers/registry.js";
-import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { getSubagentManager } from "../subagent/index.js";
 import { getSandboxWorkingDir } from "../util/platform.js";
 import { Conversation } from "./conversation.js";
+import { conversationEventSink } from "./conversation-event-sink.js";
 import {
   removeFromEvictor,
   touchConversation,
@@ -377,8 +377,9 @@ async function acquireConversation(
         provider,
         systemPrompt,
         // Top-level conversations deliver to the SSE hub for their whole life,
-        // so every subscribed client sees every event with no per-turn wiring.
-        broadcastMessage,
+        // so every subscribed client sees every event with no per-turn wiring,
+        // scoped to this conversation whatever the event's payload carries.
+        conversationEventSink(conversationId),
         workingDir,
         {
           maxTokens,

package/src/daemon/conversation-surfaces.ts

@@ -166,6 +166,24 @@ const NON_BLOCKING_PENDING_SURFACE_TYPES = new Set<SurfaceType>([
   "voice_picker",
 ]);
 
+/**
+ * Whether a surface this conversation showed is still waiting on the user.
+ *
+ * The one-interactive-surface-at-a-time gate reads it to reject a second
+ * card, and the turn boundary reads it to tell a turn that delivered from a
+ * turn that posed a question and handed control back.
+ */
+export function hasBlockingPendingSurface(ctx: {
+  pendingSurfaceActions: Map<string, { surfaceType: SurfaceType }>;
+}): boolean {
+  for (const entry of ctx.pendingSurfaceActions.values()) {
+    if (!NON_BLOCKING_PENDING_SURFACE_TYPES.has(entry.surfaceType)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Surface types that carry no terminal action: the card settles when the user
  * interacts with it, so no click could ever satisfy an attached `actions`
@@ -3546,10 +3564,7 @@ export async function surfaceProxyResolver(
     // content rather than a question posed to the user, so a pending one
     // never blocks the next surface.
     if (awaitAction) {
-      const hasExistingPending = [...ctx.pendingSurfaceActions.values()].some(
-        (entry) => !NON_BLOCKING_PENDING_SURFACE_TYPES.has(entry.surfaceType),
-      );
-      if (hasExistingPending) {
+      if (hasBlockingPendingSurface(ctx)) {
         return {
           content:
             "Another interactive surface is already awaiting user input. Present one at a time — wait for the user to respond to the current surface before showing the next.",

package/src/daemon/message-types/sync.ts

@@ -18,6 +18,8 @@ export const SYNC_TAGS = {
   documentsList: "documents:list",
   pluginsList: "plugins:list",
   conversationsList: "conversations:list",
+  /** Activation-checklist progress: task launches, step counts, completions. */
+  activationProgress: "activation:progress",
   featureFlagsClient: "feature-flags:client",
   featureFlagsAssistant: "feature-flags:assistant",
   /** ACP credential-failure markers, which drive the inline Connect card.

package/src/ipc/assistant-server.ts

@@ -58,6 +58,7 @@ import type {
 import { RouteResponse } from "../runtime/routes/types.js";
 import { getLogger } from "../util/logger.js";
 import { mapGatewayIpcConnectError } from "./gateway-ipc-errors.js";
+import { ACTIVATION_SYNC_IPC_METHODS } from "./routes/activation-sync-ipc-routes.js";
 import { CONTACTS_INFO_IPC_METHODS } from "./routes/contacts-info-ipc-routes.js";
 import { CONTACTS_MIRROR_IPC_METHODS } from "./routes/contacts-mirror-ipc-routes.js";
 import { CONVERSATION_SYNC_IPC_METHODS } from "./routes/conversation-sync-ipc-routes.js";
@@ -219,6 +220,7 @@ export class AssistantIpcServer {
       GUARDIAN_LABEL_IPC_METHODS,
       CONVERSATION_SYNC_IPC_METHODS,
       DOCUMENTS_SYNC_IPC_METHODS,
+      ACTIVATION_SYNC_IPC_METHODS,
       EVENTS_IPC_METHODS,
     ]) {
       for (const [operationId, handler] of Object.entries(methodMap)) {

package/src/ipc/routes/__tests__/activation-sync-ipc-routes.test.ts

@@ -0,0 +1,51 @@
+/**
+ * The daemon-side handler for the worker → daemon activation-progress
+ * hand-off. A sidecar worker's own hub has no SSE subscriber, so it asks the
+ * daemon to republish the invalidation where clients actually observe it.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const publishCalls: Array<string | undefined> = [];
+
+mock.module("../../../runtime/sync/resource-sync-events.js", () => ({
+  publishActivationProgressChanged: (originClientId?: string) => {
+    publishCalls.push(originClientId);
+  },
+}));
+
+import { DB_MIGRATION_READINESS_EXEMPT_OPERATIONS } from "../../../daemon/daemon-readiness.js";
+import { NOTIFY_ACTIVATION_PROGRESS_CHANGED_IPC_METHOD } from "../../../runtime/sync/worker-daemon-notify.js";
+import {
+  ACTIVATION_SYNC_IPC_METHODS,
+  handleNotifyActivationProgressChanged,
+} from "../activation-sync-ipc-routes.js";
+
+describe("activation-sync IPC route", () => {
+  beforeEach(() => {
+    publishCalls.length = 0;
+  });
+
+  test("republishes the activation-progress invalidation on the daemon", () => {
+    const result = handleNotifyActivationProgressChanged({ body: {} });
+
+    expect(result).toEqual({ ok: true });
+    expect(publishCalls).toEqual([undefined]);
+  });
+
+  test("is reachable on the IPC surface under the shared method name", () => {
+    expect(
+      typeof ACTIVATION_SYNC_IPC_METHODS[
+        NOTIFY_ACTIVATION_PROGRESS_CHANGED_IPC_METHOD
+      ],
+    ).toBe("function");
+  });
+
+  test("is DB-migration readiness gated (absent from the exempt set)", () => {
+    expect(
+      DB_MIGRATION_READINESS_EXEMPT_OPERATIONS.has(
+        NOTIFY_ACTIVATION_PROGRESS_CHANGED_IPC_METHOD,
+      ),
+    ).toBe(false);
+  });
+});

package/src/ipc/routes/activation-sync-ipc-routes.ts

@@ -0,0 +1,42 @@
+/**
+ * IPC-only route the sidecar workers (schedule, memory) call after a turn
+ * moved a launched checklist task.
+ *
+ * Workers disable SSE seq stamping (`disableStreamSeqStamping`) so the daemon
+ * is the sole seq authority, and the SSE subscribers live in the daemon too. A
+ * worker that published `activation:progress` on its own hub would reach
+ * nobody, so a task worked by a scheduled or background turn would keep
+ * showing as running until the client refetched for some other reason.
+ *
+ * This route runs the publish on the daemon instead, where real subscribers
+ * observe it. The hand-off carries no originating client, so nothing suppresses
+ * the broadcast as its own echo.
+ *
+ * IPC-only: registered directly on the assistant IPC server (see
+ * `assistant-server.ts`), never in the shared `ROUTES` array. The handler
+ * touches no database, but the IPC server's uniform DB-migration gate still
+ * applies (the method is not exempt); the worker's call is best-effort and
+ * tolerates that.
+ */
+
+import type { RouteHandlerArgs } from "../../runtime/routes/types.js";
+import { publishActivationProgressChanged } from "../../runtime/sync/resource-sync-events.js";
+import { NOTIFY_ACTIVATION_PROGRESS_CHANGED_IPC_METHOD } from "../../runtime/sync/worker-daemon-notify.js";
+
+/** Republish a worker's activation-progress invalidation to daemon subscribers. */
+export function handleNotifyActivationProgressChanged(_args: RouteHandlerArgs) {
+  publishActivationProgressChanged();
+  return { ok: true };
+}
+
+/**
+ * IPC-only activation-sync methods, keyed by operationId. Registered directly
+ * on the assistant IPC server (see `assistant-server.ts`).
+ */
+export const ACTIVATION_SYNC_IPC_METHODS: Record<
+  string,
+  (args: RouteHandlerArgs) => unknown
+> = {
+  [NOTIFY_ACTIVATION_PROGRESS_CHANGED_IPC_METHOD]:
+    handleNotifyActivationProgressChanged,
+};

package/src/notifications/AGENTS.md

@@ -10,7 +10,7 @@ Guardian-request producers (access requests, tool approvals, tool-grant escalati
 
 Approval-card **source references** (the link back to the channel message that triggered a request) resolve only through `resolveApprovalSourceReference()` in `runtime/approval-source-link.ts` -- producers spread the result into the `guardian.question` context payload and never hand-build links. Channel-format knowledge (id shapes, permalinks, mrkdwn) lives only in `messaging/providers/<channel>/` and `notifications/adapters/<channel>`; the four-layer ownership map is documented at the top of `approval-source-link.ts`. Exception: access-request cards predate the registry and still derive their Slack permalink from payload `messageTs` in `access-request-copy.ts` -- converge them onto the registry rather than adding a third resolution path.
 
-A notification delivered to an external channel (Slack, Telegram, Discord) becomes a conversation row **only after the adapter acknowledges the send**. `pairDeliveryWithConversation` resolves the chat's home conversation before the send for `continue_existing_conversation` channels (`resolveProactiveHomeConversation`: the chat's thread-less inbound conversation, else its `notification:`-namespace conversation) and writes nothing there; on adapter success the broadcaster calls `recordDeliveredChannelPost`, which writes the sent text with the neutral `providerMeta` envelope and `automated: true`, runs the shared post-send reconciliation (`runtime/outbound-post-reconciliation.ts`) so the acknowledged id lands on the envelope and in `channel_outbound_posts`, and marks a resident conversation stale. The delivery audit names that row in `canonical_message_id`; `message_id` keeps its meaning (provider id for a channel delivery, row id for a vellum delivery). A failed or pending delivery therefore has no conversation row, so nothing the channel never accepted can read as the assistant's words. Vellum and passive deliveries keep their pre-send pairing row, which the feed card's deep link and rewritable row depend on. Editing a notification rewrites the canonical row after the channel update succeeds and re-indexes it; deleting the channel post resolves to the row through the index.
+A notification delivered to an external channel (Slack, Telegram, Discord) becomes a conversation row **only after the adapter acknowledges the send**. `pairDeliveryWithConversation` resolves the chat's home conversation before the send for `continue_existing_conversation` channels (`resolveProactiveHomeConversation`: the chat's thread-less inbound conversation, else its `notification:`-namespace conversation; a post into a thread goes to the thread's own conversation as ingress resolves it, since Slack and Telegram key inbound conversations per thread and the replies arrive there) and writes nothing there; on adapter success the broadcaster calls `recordDeliveredChannelPost`, which writes the sent text with the neutral `providerMeta` envelope and `automated: true`, runs the shared post-send reconciliation (`runtime/outbound-post-reconciliation.ts`) so the acknowledged id lands on the envelope and in `channel_outbound_posts`, and marks a resident conversation stale. The delivery audit names that row in `canonical_message_id`; `message_id` keeps its meaning (provider id for a channel delivery, row id for a vellum delivery). A failed or pending delivery therefore has no conversation row, so nothing the channel never accepted can read as the assistant's words. Vellum and passive deliveries keep their pre-send pairing row, which the feed card's deep link and rewritable row depend on. Editing a notification rewrites the canonical row after the channel update succeeds and re-indexes it; deleting the channel post resolves to the row through the index.
 
 Guardian-request card rows are **not conversation history**. Only the vellum delivery persists a message row (`pairDeliveryWithConversation` pins it to the conversation the request is _about_, via `buildVellumCardAffinity`); channel guardian cards are delivery projections and pair no conversation at all, with the gateway delivery row (chat id + channel-native message id) as their only persisted envelope. `isGuardianCardRow` in `approval-card-data.ts` is the single definition of which rows are guardian cards (including rows channel deliveries paired before the projection-only policy), derived from the card's own `ui_surface` id rather than a stored marker so old rows need no backfill. **Both** history assemblers must consult it -- `Conversation.loadFromDb` and `loadSlackChronologicalContext`, which re-reads rows rather than using `this.messages` -- or the unfiltered one replays the card between a parked turn's `tool_use` and its `tool_result` and history repair destroys the real result. Surface state is exempt on purpose: the card's buttons must still route after a restart. Full rationale in [docs/guardian-request-flow.md](../../docs/guardian-request-flow.md).