@vellumai/assistant 0.12.2-dev.202609181913.1108ac3 → 0.12.2-dev.202609182114.335fa56

package/ARCHITECTURE.md

@@ -300,7 +300,7 @@ The WhatsApp channel enables inbound and outbound messaging via the Meta WhatsAp
 
 **Egress** (daemon WhatsApp transport, `src/messaging/providers/whatsapp/`):
 
-1. Replies, approval prompts, and proactive sends go out through the daemon's `whatsappTransport` (`transport.ts`), which calls the Meta Cloud API itself. `isDirectDelivery()` in `src/messaging/providers/index.ts` resolves the `/deliver/whatsapp` callback URL to this transport through `channelForCallback()` (`src/messaging/providers/callback-routing.ts`), so the daemon never posts back to the gateway or dials the URL's host and port. The exception is on the gateway side: its replies to invite and verification codes it intercepts at ingress (`deliverVerificationReply` in `gateway/src/verification/reply-delivery.ts`) still POST to the callback URL, which no gateway route serves, so those replies are not delivered.
+1. Replies, approval prompts, and proactive sends go out through the daemon's `whatsappTransport` (`transport.ts`), which calls the Meta Cloud API itself. `isDirectDelivery()` in `src/messaging/providers/index.ts` resolves the `/deliver/whatsapp` callback URL to this transport through `channelForCallback()` (`src/messaging/providers/callback-routing.ts`), so the daemon never posts back to the gateway or dials the URL's host and port. The gateway's own replies to invite and verification codes it intercepts at ingress reach this transport the same way: `deliverVerificationReply` (`gateway/src/verification/reply-delivery.ts`) hands the reply and the inbound message's callback URL to the daemon's IPC-only `deliver_gateway_reply` method (`src/ipc/routes/channel-reply-ipc-routes.ts`), which resolves the transport from that URL.
 2. `api.ts` reads `phone_number_id` and `access_token` from the secure store and sends through the Cloud API `/{phoneNumberId}/messages` endpoint.
 3. `send.ts` splits text into 4096-character chunks, preferring newline and then whitespace boundaries.
 4. An approval prompt renders as an interactive message with up to three reply buttons whose ids follow the shared `apr:<requestId>:<action>` convention. When the cap forces a cut, the reject and block actions are kept. The gateway normalizes the guardian's `button_reply` back into callback data on ingress.
@@ -1930,12 +1930,14 @@ Keep-alive heartbeats (every 30 s by default):
 
 ### Key Source Files
 
-| File                                            | Role                                                                           |
-| ----------------------------------------------- | ------------------------------------------------------------------------------ |
-| `assistant/src/runtime/assistant-event.ts`      | `AssistantEvent` type, `buildAssistantEvent()` factory, SSE framing helpers    |
-| `assistant/src/runtime/assistant-event-hub.ts`  | `AssistantEventHub` class and process-level singleton                          |
-| `assistant/src/runtime/routes/events-routes.ts` | `handleSubscribeAssistantEvents()` — SSE route handler                         |
-| `assistant/src/daemon/server.ts`                | Session event paths that publish to the hub (`send` → `publishAssistantEvent`) |
+| File                                                 | Role                                                                                  |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `assistant/src/runtime/assistant-event.ts`           | `AssistantEvent` type, `buildAssistantEvent()` factory, SSE framing helpers           |
+| `assistant/src/runtime/assistant-event-hub.ts`       | `AssistantEventHub` class and process-level singleton                                 |
+| `assistant/src/runtime/assistant-event-targeting.ts` | `matchesTargeting()`, the targeting check live fanout and replay share                |
+| `assistant/src/runtime/assistant-stream-state.ts`    | Per-assistant `seq` counter and ring buffer behind reconnect and `events/tail` replay |
+| `assistant/src/runtime/routes/events-routes.ts`      | `handleSubscribeAssistantEvents()`, the SSE route handler                             |
+| `assistant/src/daemon/server.ts`                     | Session event paths that publish to the hub (`send` → `publishAssistantEvent`)        |
 
 ---
 

package/docs/architecture/turn-actor.md

@@ -29,6 +29,8 @@ Do not read `trustContext` or `currentTurnTrustContext` directly. Call sites han
 
 **Use `getTurnOrRestingTrust()`** for provenance stamped onto persisted rows (see `provenanceFromTrustContext`). Provenance is read back by the memory indexer, which runs extraction only for guardian rows, and by the transcript assembly, which wraps non-guardian user content before it reaches the model. The turn's actor is correct when a turn is running; rows persisted with no turn in flight (wake notices) must keep the owner's class, because stamping `"unknown"` there silently stops memory extraction for the owner's own flows.
 
+That provenance describes the turn, so it is stamped on every row the turn writes, the assistant's replies and tool results included. Who wrote a row is a separate fact: `provenanceContactId` names the author's contact and needs positive evidence. It is added only where a person's own inbound words or actions are persisted (`actorAuthorProvenance`): a message channel ingress or its retry replay relays with an explicit `author`, unless that row is scripted or hidden, and the actor's reaction row. The shared user-message writer never infers an author from the conversation's trust, because machine-authored rows (ACP and subagent notifications, pointer turns) persist through it too. Rows the assistant writes during someone's turn never carry it. Slack backfill imports other people's messages, so the turn's actor says nothing about them; each backfilled sender is classified by the same gateway verdict live ingress uses (`resolve_inbound_trust`, see `inbound-stages/backfill-sender-provenance.ts`), which supplies both its trust class and its contact id.
+
 **Use `getTrustContext()`** when there is no turn: HTTP routes reporting conversation state, hydration, and persistence of conversation-level options. Also when a caller deliberately wants the conversation's owner rather than whoever is currently acting; that intent should be obvious from the call site, and if it is not, it is probably the wrong accessor.
 
 ## When the acting actor is unknown

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -24,13 +24,15 @@ export {
   PersistentIpcClient,
 } from "./ipc-client.js";
 
-// Outbound delivery contract (daemon → gateway) — Zod schemas + derived types
+// Outbound delivery contract: Zod schemas + derived types
 export {
   ApprovalActionOptionSchema,
   ApprovalUIMetadataSchema,
   AttachmentMetadataSchema,
   ChannelDeliveryResultSchema,
   ChannelReplyPayloadSchema,
+  DELIVER_GATEWAY_REPLY_IPC_METHOD,
+  GatewayReplyRequestSchema,
   MessageAudienceSchema,
   PermissionRequestDetailsSchema,
   StreamOpSchema,
@@ -45,6 +47,7 @@ export type {
   AttachmentMetadata,
   ChannelDeliveryResult,
   ChannelReplyPayload,
+  GatewayReplyRequest,
   MessageAudience,
   PermissionRequestDetails,
   StreamOp,

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -1,13 +1,17 @@
 /**
- * Daemon → gateway outbound delivery contract.
+ * Outbound channel delivery contract.
  *
- * Zod schemas defining the wire format for channel replies delivered from
- * the daemon to the gateway via `POST /deliver/{channel}`. Both services
- * import from here so the contract is enforced at compile time.
+ * Zod schemas for a reply to a channel chat. The daemon constructs these
+ * payloads in `deliverChannelReply()` and `deliverApprovalPrompt()` and hands
+ * them to the channel transport its callback URL names
+ * (`messaging/providers`). `/deliver/{channel}` is only that callback URL's
+ * addressing form: no service serves it. A callback URL no
+ * transport owns (a managed callback carrying a `callback_token`) is POSTed
+ * over HTTP by `http-delivery.ts` instead.
  *
- * The daemon constructs these payloads in `deliverChannelReply()` and
- * `deliverApprovalPrompt()`; the gateway validates and dispatches them
- * to the target channel provider.
+ * The gateway sends through the same transports, never to a provider itself:
+ * a reply it composes for a message it answered at ingress goes to the daemon
+ * as a {@link GatewayReplyRequest}.
  */
 
 import type { KnownBlock } from "@slack/types";
@@ -279,6 +283,33 @@ export const ChannelReplyPayloadSchema = z.object({
 
 export type ChannelReplyPayload = z.infer<typeof ChannelReplyPayloadSchema>;
 
+// ---------------------------------------------------------------------------
+// Gateway reply: gateway to daemon
+// ---------------------------------------------------------------------------
+
+/**
+ * Daemon IPC method that delivers a {@link GatewayReplyRequest}. IPC-only:
+ * it has no HTTP route.
+ */
+export const DELIVER_GATEWAY_REPLY_IPC_METHOD = "deliver_gateway_reply";
+
+/**
+ * A text reply the gateway composed for an inbound message it answered
+ * itself (a verification code, an invite redemption), which the daemon
+ * delivers through the channel transport `callbackUrl` names. The callback
+ * URL is the one the inbound message carried, so the reply lands in the chat
+ * and thread the person wrote from.
+ */
+export const GatewayReplyRequestSchema = ChannelReplyPayloadSchema.pick({
+  chatId: true,
+  assistantId: true,
+}).extend({
+  callbackUrl: z.string().min(1),
+  text: z.string().min(1),
+});
+
+export type GatewayReplyRequest = z.infer<typeof GatewayReplyRequestSchema>;
+
 // ---------------------------------------------------------------------------
 // Channel delivery result — gateway response
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.2-dev.202609181913.1108ac3",
+  "version": "0.12.2-dev.202609182114.335fa56",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/assistant-event-targeting.test.ts

@@ -0,0 +1,186 @@
+/**
+ * Tests for `matchesTargeting`, the one targeting check behind live fanout
+ * (`AssistantEventHub.publish`) and replay (`getReplayWindow`).
+ *
+ * The parity block runs every case through both paths and requires them to
+ * agree, so a rule added to one path alone fails here.
+ */
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import type { AssistantEventEnvelope } from "../api/index.js";
+import type { HostProxyCapability, InterfaceId } from "../channels/types.js";
+import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
+import type { AssistantEventPublishOptions } from "../runtime/assistant-event-publish-options.js";
+import { matchesTargeting } from "../runtime/assistant-event-targeting.js";
+import {
+  _resetStreamStateForTesting,
+  getReplayWindow,
+  stampAndBuffer,
+} from "../runtime/assistant-stream-state.js";
+
+const CONV = "conv-targeting";
+
+interface ClientIdentity {
+  type: "client";
+  clientId: string;
+  interfaceId: InterfaceId;
+  capabilities: HostProxyCapability[];
+  actorPrincipalId?: string;
+}
+
+const MAC: ClientIdentity = {
+  type: "client",
+  clientId: "mac-1",
+  interfaceId: "macos",
+  capabilities: ["host_bash", "host_browser"],
+  actorPrincipalId: "principal-g",
+};
+const WEB: ClientIdentity = {
+  type: "client",
+  clientId: "web-1",
+  interfaceId: "web",
+  capabilities: [],
+  actorPrincipalId: "principal-g",
+};
+const OTHER_USER: ClientIdentity = {
+  type: "client",
+  clientId: "web-2",
+  interfaceId: "web",
+  capabilities: [],
+  actorPrincipalId: "principal-x",
+};
+const NO_PRINCIPAL: ClientIdentity = {
+  type: "client",
+  clientId: "legacy-1",
+  interfaceId: "web",
+  capabilities: [],
+};
+interface ProcessIdentity {
+  type: "process";
+}
+
+const PROCESS: ProcessIdentity = { type: "process" };
+
+const SUBSCRIBERS: Array<[string, ClientIdentity | ProcessIdentity]> = [
+  ["mac", MAC],
+  ["web", WEB],
+  ["other user", OTHER_USER],
+  ["no principal", NO_PRINCIPAL],
+  ["process", PROCESS],
+];
+
+/** Each targeting case with the subscribers it must reach, by label. */
+const CASES: Array<{
+  name: string;
+  targeting: AssistantEventPublishOptions | undefined;
+  reaches: string[];
+}> = [
+  {
+    name: "untargeted",
+    targeting: undefined,
+    reaches: ["mac", "web", "other user", "no principal", "process"],
+  },
+  {
+    name: "self-echo exclusion",
+    targeting: { excludeClientId: "web-1" },
+    reaches: ["mac", "other user", "no principal", "process"],
+  },
+  {
+    name: "interface",
+    targeting: { targetInterfaceId: "web" },
+    reaches: ["web", "other user", "no principal"],
+  },
+  {
+    name: "principal",
+    targeting: { targetActorPrincipalId: "principal-g" },
+    reaches: ["mac", "web"],
+  },
+  {
+    name: "client",
+    targeting: { targetClientId: "mac-1" },
+    reaches: ["mac"],
+  },
+  {
+    name: "capability",
+    targeting: { targetCapability: "host_browser" },
+    reaches: ["mac"],
+  },
+  {
+    name: "client without the capability",
+    targeting: { targetClientId: "web-1", targetCapability: "host_browser" },
+    reaches: [],
+  },
+  {
+    name: "principal and interface together",
+    targeting: {
+      targetActorPrincipalId: "principal-g",
+      targetInterfaceId: "web",
+    },
+    reaches: ["web"],
+  },
+];
+
+function makeEvent(): AssistantEventEnvelope {
+  return {
+    id: `evt-${Math.random().toString(36).slice(2, 10)}`,
+    conversationId: CONV,
+    emittedAt: new Date().toISOString(),
+    message: { type: "assistant_text_delta", conversationId: CONV, text: "x" },
+  };
+}
+
+async function reachedLive(
+  targeting: AssistantEventPublishOptions | undefined,
+): Promise<string[]> {
+  const hub = new AssistantEventHub();
+  const reached: string[] = [];
+  for (const [label, identity] of SUBSCRIBERS) {
+    const callback = () => {
+      reached.push(label);
+    };
+    if (identity.type === "process") {
+      hub.subscribe({ type: "process", callback });
+    } else {
+      hub.subscribe({ ...identity, callback });
+    }
+  }
+  await hub.publish(makeEvent(), targeting);
+  return reached.sort();
+}
+
+function reachedOnReplay(
+  targeting: AssistantEventPublishOptions | undefined,
+): string[] {
+  _resetStreamStateForTesting();
+  stampAndBuffer(makeEvent(), targeting ? { targeting } : undefined);
+  return SUBSCRIBERS.filter(
+    ([, identity]) => (getReplayWindow(0, identity) ?? []).length > 0,
+  )
+    .map(([label]) => label)
+    .sort();
+}
+
+describe("matchesTargeting", () => {
+  for (const { name, targeting, reaches } of CASES) {
+    test(`${name}: reaches exactly its subscribers`, () => {
+      const reached = SUBSCRIBERS.filter(([, identity]) =>
+        matchesTargeting(targeting, identity),
+      ).map(([label]) => label);
+      expect(reached.sort()).toEqual([...reaches].sort());
+    });
+  }
+});
+
+describe("live fanout and replay agree", () => {
+  beforeEach(() => {
+    _resetStreamStateForTesting();
+  });
+
+  for (const { name, targeting, reaches } of CASES) {
+    test(`${name}: both paths deliver to the same subscribers`, async () => {
+      const expected = [...reaches].sort();
+      expect(await reachedLive(targeting)).toEqual(expected);
+      expect(reachedOnReplay(targeting)).toEqual(expected);
+    });
+  }
+});

package/src/__tests__/assistant-stream-state.test.ts

@@ -9,10 +9,8 @@ import { dirname, join } from "node:path";
 import { beforeEach, describe, expect, test } from "bun:test";
 
 import type { AssistantEventEnvelope } from "../api/index.js";
-import type {
-  EventTargeting,
-  ReplaySubscriber,
-} from "../runtime/assistant-stream-state.js";
+import type { AssistantEventPublishOptions } from "../runtime/assistant-event-publish-options.js";
+import type { SubscriberIdentity } from "../runtime/assistant-event-targeting.js";
 import {
   _peekStreamForTesting,
   _resetStreamStateForTesting,
@@ -103,7 +101,7 @@ describe("assistant-stream-state", () => {
       /** Targeted events stay in the ring so replay can filter them. */
 
       // GIVEN a targeting modifier
-      const targeting: EventTargeting = {
+      const targeting: AssistantEventPublishOptions = {
         targetCapability: "host_bash",
       };
 
@@ -334,28 +332,28 @@ describe("assistant-stream-state", () => {
   });
 
   describe("getReplayWindow — targeting filter", () => {
-    const MACOS_CLIENT: ReplaySubscriber = {
+    const MACOS_CLIENT: SubscriberIdentity = {
       type: "client",
       clientId: "mac-1",
       interfaceId: "macos",
       capabilities: ["host_bash", "host_file", "host_cu", "host_browser"],
     };
 
-    const WEB_CLIENT: ReplaySubscriber = {
+    const WEB_CLIENT: SubscriberIdentity = {
       type: "client",
       clientId: "web-1",
       interfaceId: "web",
       capabilities: [],
     };
 
-    const CHROME_EXT_CLIENT: ReplaySubscriber = {
+    const CHROME_EXT_CLIENT: SubscriberIdentity = {
       type: "client",
       clientId: "ext-1",
       interfaceId: "chrome-extension",
       capabilities: ["host_browser"],
     };
 
-    const PROCESS_SUB: ReplaySubscriber = { type: "process" };
+    const PROCESS_SUB: SubscriberIdentity = { type: "process" };
 
     test("untargeted events are replayed to all subscriber types", () => {
       /** Events without targeting metadata go to everyone. */

package/src/__tests__/channel-retry-sweep.test.ts

@@ -98,6 +98,7 @@ import {
   clearConversations,
   setConversation,
 } from "../daemon/conversation-registry.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 import { getDb } from "../persistence/db-connection.js";
 import { initializeDb } from "../persistence/db-init.js";
 import * as deliveryCrud from "../persistence/delivery-crud.js";
@@ -318,7 +319,11 @@ describe("channel-retry-sweep", () => {
           }
         | undefined;
 
+      let capturedAuthor: TrustContext | undefined;
+      let capturedTrust: TrustContext | undefined;
       await sweepFailedEvents(async (conversationId, _content, options) => {
+        capturedAuthor = options?.author;
+        capturedTrust = options?.trustContext;
         capturedOptions = options as {
           trustContext?: {
             trustClass?: string;
@@ -345,6 +350,10 @@ describe("channel-retry-sweep", () => {
         "principal-1",
       );
       expect(capturedOptions?.isInteractive).toBe(c.expectedInteractive);
+      // The replay persists the sender's own message, so it names them as
+      // the row's author, exactly as live ingress does.
+      expect(capturedAuthor?.trustClass).toBe(c.trustClass);
+      expect(capturedAuthor).toEqual(capturedTrust);
 
       const db = getDb();
       const row = db

package/src/__tests__/dm-backfill.test.ts

@@ -11,7 +11,15 @@
  *  - When `backfillDm` throws, the turn proceeds without a crash and
  *    nothing extra is persisted.
  */
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  afterAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  spyOn,
+  test,
+} from "bun:test";
 
 // ---------------------------------------------------------------------------
 // Mocks (must precede module imports under test)
@@ -68,6 +76,7 @@ mock.module("../messaging/providers/slack/backfill.js", () => ({
   backfillThread: () => backfillThreadMock(),
 }));
 
+import * as inboundTrustReader from "../calls/inbound-trust-reader.js";
 import {
   loadRawConfig,
   saveRawConfig,
@@ -87,6 +96,15 @@ import {
 
 await initializeDb();
 
+// Backfilled senders are classified by the gateway verdict; with no gateway
+// in the test process the read reports unreachable unless a test says so.
+// A spy rather than mock.module, so the stub does not leak into other files.
+const readInboundTrustMock = spyOn(inboundTrustReader, "readInboundTrust");
+
+afterAll(() => {
+  readInboundTrustMock.mockRestore();
+});
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -180,6 +198,7 @@ function readPersistedSlackRows(): Array<{
   provenanceSourceChannel: string | undefined;
   provenanceGuardianExternalUserId: string | undefined;
   provenanceRequesterIdentifier: string | undefined;
+  provenanceContactId: string | undefined;
   sentAt: number | undefined;
   createdAt: number;
 }> {
@@ -234,6 +253,10 @@ function readPersistedSlackRows(): Array<{
           typeof envelope.provenanceRequesterIdentifier === "string"
             ? envelope.provenanceRequesterIdentifier
             : undefined,
+        provenanceContactId:
+          typeof envelope.provenanceContactId === "string"
+            ? envelope.provenanceContactId
+            : undefined,
         sentAt:
           typeof envelope.sentAt === "number" ? envelope.sentAt : undefined,
         createdAt: row.createdAt,
@@ -279,6 +302,8 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     backfillDmMock.mockReset();
     backfillDmMock.mockImplementation(async () => []);
     backfillThreadMock.mockReset();
+    readInboundTrustMock.mockReset();
+    readInboundTrustMock.mockImplementation(async () => ({ ok: false }));
   });
 
   test("first DM in cold conversation triggers backfill exactly once and persists history", async () => {
@@ -523,6 +548,63 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(botRow?.provenanceRequesterIdentifier).toBe("B_BOT");
   });
 
+  test("backfilled rows record the sender's gateway trust class and contact id", async () => {
+    readInboundTrustMock.mockImplementation(async (input) =>
+      input.actorExternalId === SLACK_DM_USER_ID
+        ? {
+            ok: true,
+            verdict: {
+              trustClass: "trusted_contact",
+              canonicalSenderId: SLACK_DM_USER_ID,
+              contactId: "contact-dm-user",
+              channelId: "channel-dm-user",
+              status: "active",
+              policy: "allow",
+            },
+            admissionPolicy: null,
+          }
+        : { ok: false },
+    );
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: "1700000000.000001",
+        text: "first from member",
+      }),
+      makeBackfilledMessage({
+        id: "1700000000.000002",
+        text: "assistant's own post",
+        sender: { id: "U_BOT", name: "assistant-bot" },
+        metadata: { isBot: true },
+      }),
+      makeBackfilledMessage({
+        id: "1700000000.000003",
+        text: "second from member",
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live new DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const rows = readPersistedSlackRows();
+    const memberRows = rows.filter((r) => r.role === "user");
+    expect(memberRows.map((r) => r.content).sort()).toEqual([
+      "first from member",
+      "second from member",
+    ]);
+    for (const row of memberRows) {
+      expect(row.provenanceTrustClass).toBe("trusted_contact");
+      expect(row.provenanceContactId).toBe("contact-dm-user");
+    }
+    const ownPost = rows.find((r) => r.role === "assistant");
+    expect(ownPost?.provenanceTrustClass).toBe("unknown");
+    expect(ownPost?.provenanceContactId).toBeUndefined();
+    // One read per distinct sender, the member's rows sharing theirs.
+    expect(readInboundTrustMock).toHaveBeenCalledTimes(2);
+  });
+
   test("skips Slack assistant new-thread placeholder during DM backfill", async () => {
     backfillDmMock.mockImplementation(async () => [
       makeBackfilledMessage({

package/src/__tests__/emit-signal-routing-intent.test.ts

@@ -662,7 +662,7 @@ describe("high/critical urgency channel force", () => {
       sourceChannel: "watcher" | "assistant_tool",
     ) {
       return emitNotificationSignal({
-        sourceEventName: "watcher.escalation",
+        sourceEventName: "watcher.notification",
         sourceChannel,
         sourceContextId: "watch-1",
         routingIntent: "single_channel",

package/src/__tests__/helpers/verification-sessions-ipc-sim.ts

@@ -276,6 +276,11 @@ export function createOutboundSessionGuarded(
     }
     source.status = "revoked";
     source.updatedAt = Date.now();
+    // Like the gateway, the replacement keeps the claimed session's purpose.
+    return createOutboundSession({
+      ...createParams,
+      verificationPurpose: source.verificationPurpose,
+    });
   }
 
   return createOutboundSession(createParams);

package/src/__tests__/message-provenance-contact-id.test.ts

@@ -0,0 +1,69 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { actorAuthorProvenance } from "../daemon/message-provenance.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
+import {
+  addMessage,
+  createConversation,
+  getMessageById,
+  parseMessageMetadata,
+  provenanceFromTrustContext,
+} from "../persistence/conversation-crud.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+
+await initializeDb();
+
+const ALICE: TrustContext = {
+  sourceChannel: "slack",
+  trustClass: "trusted_contact",
+  requesterIdentifier: "@alice",
+  requesterContactId: "contact-alice",
+};
+
+async function persistWith(
+  role: "user" | "assistant",
+  metadata: Record<string, unknown>,
+): Promise<ReturnType<typeof parseMessageMetadata>> {
+  const conversation = createConversation("provenance-contact-id");
+  const row = await addMessage(conversation.id, role, "hello", { metadata });
+  const stored = getMessageById(row.id, conversation.id);
+  return parseMessageMetadata(stored?.metadata ?? null);
+}
+
+describe("message provenance contact id", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run(`DELETE FROM messages`);
+    db.run(`DELETE FROM conversations`);
+  });
+
+  test("a person's own row names them as its author", async () => {
+    const metadata = await persistWith("user", {
+      ...provenanceFromTrustContext(ALICE),
+      ...actorAuthorProvenance(ALICE),
+    });
+
+    expect(metadata?.provenanceTrustClass).toBe("trusted_contact");
+    expect(metadata?.provenanceContactId).toBe("contact-alice");
+  });
+
+  test("a row written during their turn carries the turn's trust but no author", async () => {
+    // The assistant's replies, tool results, and notices are stamped with the
+    // turn's provenance alone.
+    const metadata = await persistWith(
+      "assistant",
+      provenanceFromTrustContext(ALICE),
+    );
+
+    expect(metadata?.provenanceTrustClass).toBe("trusted_contact");
+    expect(metadata?.provenanceContactId).toBeUndefined();
+  });
+
+  test("an actor with no resolved contact names no author", () => {
+    expect(
+      actorAuthorProvenance({ sourceChannel: "slack", trustClass: "unknown" }),
+    ).toEqual({});
+    expect(actorAuthorProvenance(undefined)).toEqual({});
+  });
+});

package/src/__tests__/notification-telegram-adapter.test.ts

@@ -183,7 +183,7 @@ describe("TelegramAdapter", () => {
 
     await adapter.send(
       makePayload({
-        sourceEventName: "watcher.escalation",
+        sourceEventName: "watcher.notification",
         copy: {
           title: " ",
           body: "",
@@ -191,7 +191,7 @@ describe("TelegramAdapter", () => {
       }),
       makeDestination(),
     );
-    expect(sendCalls[2]?.text).toBe("watcher escalation");
+    expect(sendCalls[2]?.text).toBe("watcher notification");
   });
 
   // ── Access request inline keyboard tests ──────────────────────────────