@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/config/platform-identity.ts

@@ -0,0 +1,201 @@
+/**
+ * Bound platform identity (assistant, organization, user).
+ *
+ * Django maps an assistant API key to these ids via
+ * `POST /v1/internal/assistants/validate/`. Process startup rehydrates from
+ * that endpoint into the in-memory overrides. Resolution reads those
+ * overrides (and `PLATFORM_ORGANIZATION_ID` / `PLATFORM_USER_ID` when set).
+ * When the in-memory assistant id is empty, the next resolve retries
+ * validate (single-flight, with a cooldown after a failed attempt).
+ */
+
+import { credentialKey } from "../security/credential-key.js";
+import { getSecureKeyAsync } from "../security/secure-keys.js";
+import { getLogger } from "../util/logger.js";
+import {
+  getPlatformAssistantId,
+  getPlatformBaseUrl,
+  getPlatformOrganizationId,
+  getPlatformUserId,
+  setPlatformAssistantId,
+  setPlatformOrganizationId,
+  setPlatformUserId,
+} from "./env.js";
+
+const log = getLogger("platform-identity");
+
+export const PLATFORM_IDENTITY_VALIDATE_PATH =
+  "/v1/internal/assistants/validate/";
+
+const VALIDATE_TIMEOUT_MS = 5_000;
+const ENSURE_COOLDOWN_MS = 10_000;
+
+export type PlatformIdentityIds = {
+  assistantId: string;
+  organizationId: string;
+  userId: string;
+};
+
+function asNonEmptyString(value: unknown): string | undefined {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+export function applyPlatformIdentityIds(ids: PlatformIdentityIds): void {
+  if (ids.assistantId) {
+    setPlatformAssistantId(ids.assistantId);
+  }
+  if (ids.organizationId) {
+    setPlatformOrganizationId(ids.organizationId);
+  }
+  if (ids.userId) {
+    setPlatformUserId(ids.userId);
+  }
+}
+
+/**
+ * Trade an assistant API key for the bound platform ids.
+ *
+ * Returns null when the platform is unreachable, refuses the key, or the
+ * body has no ids. Never throws.
+ */
+export async function fetchPlatformIdentityIds(
+  baseUrl: string,
+  apiKey: string,
+): Promise<PlatformIdentityIds | null> {
+  const url = `${baseUrl.replace(/\/+$/, "")}${PLATFORM_IDENTITY_VALIDATE_PATH}`;
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Api-Key ${apiKey}`,
+        "Content-Type": "application/json",
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(VALIDATE_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      log.warn(
+        { status: res.status },
+        "platform identity validate returned non-2xx",
+      );
+      return null;
+    }
+    const body: unknown = await res.json();
+    if (!body || typeof body !== "object") {
+      return null;
+    }
+    const obj = body as Record<string, unknown>;
+    const assistantId = asNonEmptyString(obj.assistant_id);
+    const organizationId = asNonEmptyString(obj.organization_id);
+    const userId = asNonEmptyString(obj.user_id);
+    if (!assistantId && !organizationId && !userId) {
+      return null;
+    }
+    return {
+      assistantId: assistantId ?? "",
+      organizationId: organizationId ?? "",
+      userId: userId ?? "",
+    };
+  } catch (err) {
+    log.warn({ err }, "platform identity validate failed");
+    return null;
+  }
+}
+
+async function readAssistantApiKey(): Promise<string> {
+  try {
+    const stored = (
+      await getSecureKeyAsync(credentialKey("vellum", "assistant_api_key"))
+    )?.trim();
+    if (stored) {
+      return stored;
+    }
+  } catch (err) {
+    log.warn({ err }, "failed to read assistant API key from credential store");
+  }
+  return process.env.ASSISTANT_API_KEY?.trim() ?? "";
+}
+
+let ensureInFlight: Promise<void> | null = null;
+let nextEnsureAttemptAt = 0;
+
+export function _resetPlatformIdentityEnsureForTests(): void {
+  ensureInFlight = null;
+  nextEnsureAttemptAt = 0;
+}
+
+/**
+ * Load in-memory platform ids from validate when they are missing.
+ *
+ * No-ops when the assistant id is already set, when auth prerequisites are
+ * missing, or when a failed attempt is still inside the cooldown window.
+ * Concurrent callers share one in-flight request.
+ */
+export async function ensurePlatformIdentityIds(): Promise<void> {
+  if (getPlatformAssistantId().trim()) {
+    return;
+  }
+  if (Date.now() < nextEnsureAttemptAt) {
+    return;
+  }
+  if (!ensureInFlight) {
+    ensureInFlight = (async () => {
+      try {
+        const apiKey = await readAssistantApiKey();
+        const baseUrl = getPlatformBaseUrl();
+        if (!apiKey || !baseUrl) {
+          return;
+        }
+        const ids = await fetchPlatformIdentityIds(baseUrl, apiKey);
+        if (!ids) {
+          nextEnsureAttemptAt = Date.now() + ENSURE_COOLDOWN_MS;
+          return;
+        }
+        applyPlatformIdentityIds(ids);
+        nextEnsureAttemptAt = 0;
+        log.info("Loaded platform identity from platform validate");
+      } finally {
+        ensureInFlight = null;
+      }
+    })();
+  }
+  await ensureInFlight;
+}
+
+export async function resolvePlatformAssistantId(): Promise<string> {
+  const existing = getPlatformAssistantId().trim();
+  if (existing) {
+    return existing;
+  }
+  await ensurePlatformIdentityIds();
+  return getPlatformAssistantId().trim();
+}
+
+export async function resolvePlatformAssistantIdOrNull(): Promise<
+  string | null
+> {
+  const id = await resolvePlatformAssistantId();
+  return id || null;
+}
+
+export async function resolvePlatformOrganizationId(): Promise<string> {
+  const existing = getPlatformOrganizationId().trim();
+  if (existing) {
+    return existing;
+  }
+  await ensurePlatformIdentityIds();
+  return getPlatformOrganizationId().trim();
+}
+
+export async function resolvePlatformUserId(): Promise<string> {
+  const existing = getPlatformUserId().trim();
+  if (existing) {
+    return existing;
+  }
+  await ensurePlatformIdentityIds();
+  return getPlatformUserId().trim();
+}

package/src/config/platform-rehydration.ts

@@ -1,6 +1,5 @@
 /**
- * Rehydrate the in-memory platform identity/URL overrides from the credential
- * store at process startup.
+ * Rehydrate the in-memory platform identity/URL overrides at process startup.
  *
  * These overrides (`setPlatformBaseUrl` and the platform ID setters in
  * `config/env.ts`) are normally only populated at runtime by the secret-routes
@@ -10,18 +9,17 @@
  * environment default (e.g. dev-platform) while the credential store holds the
  * real production values, and requests are sent to the wrong environment.
  *
+ * Bound platform ids come from `POST /v1/internal/assistants/validate/`,
+ * which trades the assistant API key for assistant/organization/user ids.
+ *
  * Each field is best-effort: a credential-store read failure is logged and
  * skipped so a single missing value never blocks startup.
  */
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
-import {
-  setPlatformAssistantId,
-  setPlatformBaseUrl,
-  setPlatformOrganizationId,
-  setPlatformUserId,
-} from "./env.js";
+import { setPlatformBaseUrl } from "./env.js";
+import { ensurePlatformIdentityIds } from "./platform-identity.js";
 
 const log = getLogger("platform-rehydration");
 
@@ -47,30 +45,16 @@ async function rehydrateField(
 
 /**
  * Rehydrate the platform base URL and the related platform IDs (assistant,
- * organization, user) from the credential store into their in-memory
- * overrides. Safe to call more than once.
+ * organization, user). Safe to call more than once.
  */
 export async function rehydratePlatformCredentials(): Promise<void> {
-  // Base URL first so managed proxy activation resolves the correct
-  // environment for the ID lookups and every request that follows.
+  // Base URL first so managed proxy activation and identity validate resolve
+  // the correct environment for every request that follows.
   await rehydrateField(
     "platform_base_url",
     setPlatformBaseUrl,
     "platform base URL",
   );
-  await rehydrateField(
-    "platform_assistant_id",
-    setPlatformAssistantId,
-    "platform assistant ID",
-  );
-  await rehydrateField(
-    "platform_organization_id",
-    setPlatformOrganizationId,
-    "platform organization ID",
-  );
-  await rehydrateField(
-    "platform_user_id",
-    setPlatformUserId,
-    "platform user ID",
-  );
+
+  await ensurePlatformIdentityIds();
 }

package/src/config/schema.ts

@@ -41,7 +41,6 @@ import {
   AuditLogConfigSchema,
   LogFileConfigSchema,
 } from "./schemas/logging.js";
-import { McpConfigSchema } from "./schemas/mcp.js";
 import { MemoryConfigSchema } from "./schemas/memory.js";
 import { MigrationsConfigSchema } from "./schemas/migrations.js";
 import { MonitoringConfigSchema } from "./schemas/monitoring.js";
@@ -62,6 +61,7 @@ import {
 } from "./schemas/timeouts.js";
 import { ToolsConfigSchema } from "./schemas/tools.js";
 import { UserRoutesConfigSchema } from "./schemas/user-routes.js";
+import { VoiceConfigSchema } from "./schemas/voice.js";
 import { WorkflowsConfigSchema } from "./schemas/workflows.js";
 import { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 
@@ -108,7 +108,6 @@ export const AssistantConfigSchema = z.object({
   ),
   journal: JournalConfigSchema.default(JournalConfigSchema.parse({})),
   backup: BackupConfigSchema.default(BackupConfigSchema.parse({})),
-  mcp: McpConfigSchema.default(McpConfigSchema.parse({})),
   acp: AcpConfigSchema.default(AcpConfigSchema.parse({})),
   skills: SkillsConfigSchema.default(SkillsConfigSchema.parse({})),
   workspaceGit: WorkspaceGitConfigSchema.default(
@@ -119,6 +118,7 @@ export const AssistantConfigSchema = z.object({
   twilio: TwilioConfigSchema.default(TwilioConfigSchema.parse({})),
   calls: CallsConfigSchema.default(CallsConfigSchema.parse({})),
   liveVoice: LiveVoiceConfigSchema.default(LiveVoiceConfigSchema.parse({})),
+  voice: VoiceConfigSchema.default(VoiceConfigSchema.parse({})),
   sight: SightConfigSchema.default(SightConfigSchema.parse({})),
   whatsapp: WhatsAppConfigSchema.default(WhatsAppConfigSchema.parse({})),
   telegram: TelegramConfigSchema.default(TelegramConfigSchema.parse({})),

package/src/config/schemas/__tests__/live-voice.test.ts

@@ -3,28 +3,9 @@ import { describe, expect, test } from "bun:test";
 import {
   LiveVoiceConfigSchema,
   LiveVoiceFluxConfigSchema,
-  LiveVoiceFrontModelConfigSchema,
   LiveVoiceVadConfigSchema,
-  VALID_LIVE_VOICE_MODES,
 } from "../live-voice.js";
 
-const PROGRESS_DEFAULTS = {
-  enabled: true,
-  opsThreshold: 3,
-  idleIntervalMs: 5_000,
-  maxSilenceMs: 35_000,
-  longOpMs: 15_000,
-  minGapMs: 6_000,
-  generationTimeoutMs: 1_500,
-};
-
-const FRONT_MODEL_DEFAULTS = {
-  endpointDecisionTimeoutMs: 1200,
-  endpointExtensionMs: 1500,
-  endpointMaxExtensions: 2,
-  progress: PROGRESS_DEFAULTS,
-};
-
 // `eagerEotThreshold` is deliberately absent: it has no default, and leaving it
 // unset is what keeps Deepgram from emitting speculative turn events. `model`
 // is absent for a related reason: unset means the spoken language selects the
@@ -130,117 +111,6 @@ describe("LiveVoiceVadConfigSchema", () => {
   });
 });
 
-describe("LiveVoiceFrontModelConfigSchema", () => {
-  test("empty object parses to defaults", () => {
-    const parsed = LiveVoiceFrontModelConfigSchema.parse({});
-    expect(parsed).toEqual(FRONT_MODEL_DEFAULTS);
-  });
-
-  test("accepts overrides", () => {
-    const parsed = LiveVoiceFrontModelConfigSchema.parse({
-      endpointDecisionTimeoutMs: 400,
-      endpointMaxExtensions: 0,
-    });
-    expect(parsed.endpointDecisionTimeoutMs).toBe(400);
-    expect(parsed.endpointMaxExtensions).toBe(0);
-    // Unspecified fields still get defaults
-    expect(parsed.endpointExtensionMs).toBe(1500);
-  });
-
-  test("strips retired generated-ack settings", () => {
-    const parsed = LiveVoiceFrontModelConfigSchema.parse({
-      ackFirstDeltaTimeoutMs: 2500,
-      ackGenerationTimeoutMs: 600,
-    });
-    expect(parsed).not.toHaveProperty("ackFirstDeltaTimeoutMs");
-    expect(parsed).not.toHaveProperty("ackGenerationTimeoutMs");
-  });
-
-  test("rejects non-positive endpointDecisionTimeoutMs", () => {
-    const result = LiveVoiceFrontModelConfigSchema.safeParse({
-      endpointDecisionTimeoutMs: 0,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  test("rejects negative endpointMaxExtensions", () => {
-    const result = LiveVoiceFrontModelConfigSchema.safeParse({
-      endpointMaxExtensions: -1,
-    });
-    expect(result.success).toBe(false);
-  });
-
-  test("absent progress namespace parses to full progress defaults", () => {
-    const parsed = LiveVoiceFrontModelConfigSchema.parse({});
-    expect(parsed.progress).toEqual(PROGRESS_DEFAULTS);
-  });
-
-  test("partial progress overrides merge with defaults", () => {
-    const parsed = LiveVoiceFrontModelConfigSchema.parse({
-      progress: { enabled: false, opsThreshold: 5 },
-    });
-    expect(parsed.progress.enabled).toBe(false);
-    expect(parsed.progress.opsThreshold).toBe(5);
-    // Unspecified progress fields still get defaults
-    expect(parsed.progress.idleIntervalMs).toBe(5_000);
-    expect(parsed.progress.maxSilenceMs).toBe(35_000);
-    expect(parsed.progress.longOpMs).toBe(15_000);
-    expect(parsed.progress.minGapMs).toBe(6_000);
-    expect(parsed.progress.generationTimeoutMs).toBe(1_500);
-  });
-
-  test("a stale maxPerTurn key is stripped, not rejected", () => {
-    // The cap was removed; configs written while it existed must still parse.
-    const parsed = LiveVoiceFrontModelConfigSchema.parse({
-      progress: { maxPerTurn: 3 },
-    });
-    expect("maxPerTurn" in parsed.progress).toBe(false);
-  });
-
-  test("rejects non-positive progress.opsThreshold", () => {
-    const result = LiveVoiceFrontModelConfigSchema.safeParse({
-      progress: { opsThreshold: 0 },
-    });
-    expect(result.success).toBe(false);
-  });
-
-  test("rejects a heartbeat ceiling shorter than the idle tick interval", () => {
-    // The heartbeat is only checked on the idle tick, so a shorter ceiling
-    // could be overshot by a full interval.
-    const result = LiveVoiceFrontModelConfigSchema.safeParse({
-      progress: { idleIntervalMs: 60_000, maxSilenceMs: 10_000 },
-    });
-    expect(result.success).toBe(false);
-    if (!result.success) {
-      const msgs = result.error.issues.map((issue) => issue.message);
-      expect(
-        msgs.some((msg) =>
-          msg.includes("liveVoice.frontModel.progress.maxSilenceMs"),
-        ),
-      ).toBe(true);
-    }
-    // The floor itself is allowed: the tick is exactly on the ceiling.
-    expect(
-      LiveVoiceFrontModelConfigSchema.safeParse({
-        progress: { idleIntervalMs: 60_000, maxSilenceMs: 60_000 },
-      }).success,
-    ).toBe(true);
-  });
-
-  test("rejects a non-boolean progress.enabled", () => {
-    const result = LiveVoiceFrontModelConfigSchema.safeParse({
-      progress: { enabled: "yes" },
-    });
-    expect(result.success).toBe(false);
-    if (!result.success) {
-      const msgs = result.error.issues.map((i) => i.message);
-      expect(
-        msgs.some((m) => m.includes("liveVoice.frontModel.progress.enabled")),
-      ).toBe(true);
-    }
-  });
-});
-
 describe("LiveVoiceFluxConfigSchema", () => {
   test("empty object parses to defaults, with turn-end on", () => {
     expect(LiveVoiceFluxConfigSchema.parse({})).toEqual(FLUX_DEFAULTS);
@@ -326,7 +196,6 @@ describe("LiveVoiceConfigSchema", () => {
   test("empty object parses to defaults", () => {
     const parsed = LiveVoiceConfigSchema.parse({});
     expect(parsed).toEqual({
-      mode: "open-mic",
       vad: {
         speechEnergyThreshold: 800,
         noiseFloorMargin: 3,
@@ -337,11 +206,9 @@ describe("LiveVoiceConfigSchema", () => {
         echoEmaHalfLifeMs: 400,
         echoDrainSlackMs: 300,
       },
-      frontModel: FRONT_MODEL_DEFAULTS,
       // Off by default: Flux turn detection is opt-in, so the front-door hold
       // verdict keeps committing turns until it is enabled.
       flux: FLUX_DEFAULTS,
-      maxSessionDurationSeconds: 1800,
       // Off by default: voice turns carry only their transcript, no audio
       // artifacts on the conversation messages (JARVIS-1283).
       archiveAudio: false,
@@ -365,43 +232,26 @@ describe("LiveVoiceConfigSchema", () => {
 
   test("accepts overrides", () => {
     const parsed = LiveVoiceConfigSchema.parse({
-      mode: "ptt",
       vad: { silenceThresholdMs: 900 },
-      frontModel: { endpointDecisionTimeoutMs: 300 },
       flux: { turnEnd: { enabled: true } },
-      maxSessionDurationSeconds: 600,
     });
-    expect(parsed.mode).toBe("ptt");
     expect(parsed.vad.silenceThresholdMs).toBe(900);
     // Unspecified vad fields still get defaults
     expect(parsed.vad.speechEnergyThreshold).toBe(800);
     expect(parsed.vad.maxTurnDurationMs).toBe(30_000);
-    // Partial frontModel overrides merge with defaults
-    expect(parsed.frontModel.endpointDecisionTimeoutMs).toBe(300);
-    expect(parsed.frontModel.endpointExtensionMs).toBe(1500);
     // Partial flux overrides merge with defaults
     expect(parsed.flux.turnEnd.enabled).toBe(true);
     expect(parsed.flux.eotThreshold).toBe(0.7);
-    expect(parsed.maxSessionDurationSeconds).toBe(600);
-  });
-
-  test("rejects invalid mode", () => {
-    const result = LiveVoiceConfigSchema.safeParse({ mode: "always-on" });
-    expect(result.success).toBe(false);
-    if (!result.success) {
-      const msgs = result.error.issues.map((i) => i.message);
-      expect(msgs.some((m) => m.includes("liveVoice.mode"))).toBe(true);
-    }
   });
 
-  test("rejects non-positive maxSessionDurationSeconds", () => {
-    const result = LiveVoiceConfigSchema.safeParse({
-      maxSessionDurationSeconds: -1,
+  test("persisted configs carrying retired keys keep parsing", () => {
+    // Zod strips unrecognized keys, so a persisted config that still carries
+    // `mode` or `maxSessionDurationSeconds` parses.
+    const parsed = LiveVoiceConfigSchema.parse({
+      mode: "ptt",
+      maxSessionDurationSeconds: 600,
     });
-    expect(result.success).toBe(false);
-  });
-
-  test("VALID_LIVE_VOICE_MODES lists ptt and open-mic", () => {
-    expect(VALID_LIVE_VOICE_MODES).toEqual(["ptt", "open-mic"]);
+    expect(parsed).not.toHaveProperty("mode");
+    expect(parsed).not.toHaveProperty("maxSessionDurationSeconds");
   });
 });

package/src/config/schemas/__tests__/voice.test.ts

@@ -0,0 +1,148 @@
+import { describe, expect, test } from "bun:test";
+
+import { VoiceConfigSchema, VoiceFrontModelConfigSchema } from "../voice.js";
+
+const PROGRESS_DEFAULTS = {
+  enabled: true,
+  opsThreshold: 3,
+  idleIntervalMs: 5_000,
+  maxSilenceMs: 35_000,
+  longOpMs: 15_000,
+  minGapMs: 6_000,
+  generationTimeoutMs: 1_500,
+};
+
+const FRONT_MODEL_DEFAULTS = {
+  endpointDecisionTimeoutMs: 1200,
+  endpointExtensionMs: 1500,
+  endpointMaxExtensions: 2,
+  progress: PROGRESS_DEFAULTS,
+};
+
+describe("VoiceFrontModelConfigSchema", () => {
+  test("empty object parses to defaults", () => {
+    const parsed = VoiceFrontModelConfigSchema.parse({});
+    expect(parsed).toEqual(FRONT_MODEL_DEFAULTS);
+  });
+
+  test("accepts overrides", () => {
+    const parsed = VoiceFrontModelConfigSchema.parse({
+      endpointDecisionTimeoutMs: 400,
+      endpointMaxExtensions: 0,
+    });
+    expect(parsed.endpointDecisionTimeoutMs).toBe(400);
+    expect(parsed.endpointMaxExtensions).toBe(0);
+    // Unspecified fields still get defaults
+    expect(parsed.endpointExtensionMs).toBe(1500);
+  });
+
+  test("strips retired generated-ack settings", () => {
+    const parsed = VoiceFrontModelConfigSchema.parse({
+      ackFirstDeltaTimeoutMs: 2500,
+      ackGenerationTimeoutMs: 600,
+    });
+    expect(parsed).not.toHaveProperty("ackFirstDeltaTimeoutMs");
+    expect(parsed).not.toHaveProperty("ackGenerationTimeoutMs");
+  });
+
+  test("rejects non-positive endpointDecisionTimeoutMs", () => {
+    const result = VoiceFrontModelConfigSchema.safeParse({
+      endpointDecisionTimeoutMs: 0,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  test("rejects negative endpointMaxExtensions", () => {
+    const result = VoiceFrontModelConfigSchema.safeParse({
+      endpointMaxExtensions: -1,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  test("absent progress namespace parses to full progress defaults", () => {
+    const parsed = VoiceFrontModelConfigSchema.parse({});
+    expect(parsed.progress).toEqual(PROGRESS_DEFAULTS);
+  });
+
+  test("partial progress overrides merge with defaults", () => {
+    const parsed = VoiceFrontModelConfigSchema.parse({
+      progress: { enabled: false, opsThreshold: 5 },
+    });
+    expect(parsed.progress.enabled).toBe(false);
+    expect(parsed.progress.opsThreshold).toBe(5);
+    // Unspecified progress fields still get defaults
+    expect(parsed.progress.idleIntervalMs).toBe(5_000);
+    expect(parsed.progress.maxSilenceMs).toBe(35_000);
+    expect(parsed.progress.longOpMs).toBe(15_000);
+    expect(parsed.progress.minGapMs).toBe(6_000);
+    expect(parsed.progress.generationTimeoutMs).toBe(1_500);
+  });
+
+  test("a stale maxPerTurn key is stripped, not rejected", () => {
+    // The cap was removed; configs written while it existed must still parse.
+    const parsed = VoiceFrontModelConfigSchema.parse({
+      progress: { maxPerTurn: 3 },
+    });
+    expect("maxPerTurn" in parsed.progress).toBe(false);
+  });
+
+  test("rejects non-positive progress.opsThreshold", () => {
+    const result = VoiceFrontModelConfigSchema.safeParse({
+      progress: { opsThreshold: 0 },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  test("rejects a heartbeat ceiling shorter than the idle tick interval", () => {
+    // The heartbeat is only checked on the idle tick, so a shorter ceiling
+    // could be overshot by a full interval.
+    const result = VoiceFrontModelConfigSchema.safeParse({
+      progress: { idleIntervalMs: 60_000, maxSilenceMs: 10_000 },
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const msgs = result.error.issues.map((issue) => issue.message);
+      expect(
+        msgs.some((msg) =>
+          msg.includes("voice.frontModel.progress.maxSilenceMs"),
+        ),
+      ).toBe(true);
+    }
+    // The floor itself is allowed: the tick is exactly on the ceiling.
+    expect(
+      VoiceFrontModelConfigSchema.safeParse({
+        progress: { idleIntervalMs: 60_000, maxSilenceMs: 60_000 },
+      }).success,
+    ).toBe(true);
+  });
+
+  test("rejects a non-boolean progress.enabled", () => {
+    const result = VoiceFrontModelConfigSchema.safeParse({
+      progress: { enabled: "yes" },
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const msgs = result.error.issues.map((i) => i.message);
+      expect(
+        msgs.some((m) => m.includes("voice.frontModel.progress.enabled")),
+      ).toBe(true);
+    }
+  });
+});
+
+describe("VoiceConfigSchema", () => {
+  test("empty object parses to front-model defaults", () => {
+    expect(VoiceConfigSchema.parse({})).toEqual({
+      frontModel: FRONT_MODEL_DEFAULTS,
+    });
+  });
+
+  test("partial frontModel overrides merge with defaults", () => {
+    const parsed = VoiceConfigSchema.parse({
+      frontModel: { endpointDecisionTimeoutMs: 300 },
+    });
+    expect(parsed.frontModel.endpointDecisionTimeoutMs).toBe(300);
+    expect(parsed.frontModel.endpointExtensionMs).toBe(1500);
+    expect(parsed.frontModel.progress).toEqual(PROGRESS_DEFAULTS);
+  });
+});