@vellumai/assistant 0.12.2-dev.202609182015.188de8a → 0.12.2-dev.202609182114.335fa56

package/src/__tests__/scripted-turn-metadata-persistence.test.ts

@@ -73,6 +73,7 @@ import type {
 import type { MessagingConversationContext } from "../daemon/conversation-messaging.js";
 import { persistQueuedMessageBody } from "../daemon/conversation-messaging.js";
 import type { MessageQueue } from "../daemon/conversation-queue-manager.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
 
 function createContext(): MessagingConversationContext {
   const channel: TurnChannelContext = {
@@ -223,3 +224,75 @@ describe("scripted-turn metadata persistence", () => {
     expect(lastUserMetadata().scripted).toBe(false);
   });
 });
+
+describe("author contact id on a persisted user message", () => {
+  const sender: TrustContext = {
+    sourceChannel: "slack",
+    trustClass: "trusted_contact",
+    requesterContactId: "contact-alice",
+  };
+
+  beforeEach(() => {
+    addMessageCalls.length = 0;
+  });
+
+  test("a message relayed from the sender names them as its author", async () => {
+    await persistQueuedMessageBody(createContext(), {
+      content: "the export endpoint needs a scoped token",
+      requestId: "req-author-typed",
+      trustContext: sender,
+      author: sender,
+    });
+
+    expect(lastUserMetadata().provenanceContactId).toBe("contact-alice");
+  });
+
+  test("a row persisted under the sender's trust but not relayed from them names no author", async () => {
+    // Machine-authored rows (ACP and subagent notifications, pointer turns)
+    // share this writer and the conversation's trust; only an explicit
+    // author names one.
+    await persistQueuedMessageBody(createContext(), {
+      content: "the delegated task finished",
+      requestId: "req-author-machine",
+      trustContext: sender,
+      metadata: { acpNotification: { acpSessionId: "acp-session-1" } },
+    });
+
+    expect(lastUserMetadata().provenanceContactId).toBeUndefined();
+  });
+
+  test.each([
+    ["scripted", { scripted: true }],
+    ["automated", { metadata: { automated: true } }],
+    ["hidden", { metadata: { hidden: true } }],
+    [
+      "ACP notification",
+      { metadata: { acpNotification: { acpSessionId: "acp-session-1" } } },
+    ],
+    [
+      "subagent notification",
+      {
+        metadata: {
+          subagentNotification: {
+            subagentId: "subagent-1",
+            label: "Research",
+            status: "completed",
+          },
+        },
+      },
+    ],
+  ] as const)(
+    "a %s row speaks in their voice without naming them",
+    async (kind, extra) => {
+      await persistQueuedMessageBody(createContext(), {
+        content: "sent on the sender's behalf",
+        requestId: `req-author-${kind}`,
+        trustContext: sender,
+        author: sender,
+        ...extra,
+      });
+
+      expect(lastUserMetadata().provenanceContactId).toBeUndefined();
+    },
+  );
+});

package/src/__tests__/thread-backfill.test.ts

@@ -90,6 +90,7 @@ mock.module("../messaging/providers/slack/adapter.js", () => ({
 
 import { v4 as uuid } from "uuid";
 
+import * as inboundTrustReader from "../calls/inbound-trust-reader.js";
 import {
   loadRawConfig,
   saveRawConfig,
@@ -142,10 +143,15 @@ installDefaultThreadPageMock();
 backfillThreadMock.mockResolvedValue([]);
 const backfillDmMock = spyOn(slackBackfill, "backfillDm");
 backfillDmMock.mockResolvedValue([]);
+// Backfilled senders are classified by the gateway verdict. With no gateway in
+// the test process the real read reports unreachable, so tests that need a
+// verdict stub it per call.
+const readInboundTrustSpy = spyOn(inboundTrustReader, "readInboundTrust");
 
 afterAll(() => {
   backfillThreadPageMock.mockRestore();
   backfillDmMock.mockRestore();
+  readInboundTrustSpy.mockRestore();
 });
 
 // ---------------------------------------------------------------------------
@@ -307,6 +313,7 @@ interface PersistedRow {
   provenanceSourceChannel: string | undefined;
   provenanceGuardianExternalUserId: string | undefined;
   provenanceRequesterIdentifier: string | undefined;
+  provenanceContactId: string | undefined;
 }
 
 const EXTERNAL_CONTENT_WRAPPER =
@@ -340,6 +347,7 @@ function readPersistedSlackRows(conversationId: string): PersistedRow[] {
       provenanceSourceChannel: undefined,
       provenanceGuardianExternalUserId: undefined,
       provenanceRequesterIdentifier: undefined,
+      provenanceContactId: undefined,
     };
     if (!row.metadata) {
       out.push(blank);
@@ -402,6 +410,10 @@ function readPersistedSlackRows(conversationId: string): PersistedRow[] {
         typeof envelope.provenanceRequesterIdentifier === "string"
           ? envelope.provenanceRequesterIdentifier
           : undefined,
+      provenanceContactId:
+        typeof envelope.provenanceContactId === "string"
+          ? envelope.provenanceContactId
+          : undefined,
     });
   }
   return out;
@@ -1149,6 +1161,47 @@ describe("triggerSlackThreadBackfillIfNeeded — gap detection and persistence",
     expect(persisted.provenanceRequesterIdentifier).toBe("U_ANITA");
   });
 
+  test("backfilled thread rows record the sender's gateway trust class and contact id", async () => {
+    const conv = createTestConversation();
+    readInboundTrustSpy.mockImplementationOnce(async () => ({
+      ok: true,
+      verdict: {
+        trustClass: "trusted_contact",
+        canonicalSenderId: "U_ANITA",
+        contactId: "contact-anita",
+        channelId: "channel-anita",
+        status: "active",
+        policy: "allow",
+      },
+      admissionPolicy: null,
+    }));
+    backfillThreadMock.mockImplementation(async () => [
+      makeBackfillMessage({
+        id: "1234.0",
+        text: "the export endpoint needs a scoped token",
+        threadId: undefined,
+        sender: { id: "U_ANITA", name: "Anita" },
+      }),
+    ]);
+
+    await triggerSlackThreadBackfillIfNeeded({
+      conversationId: conv.id,
+      channelId: SLACK_CHANNEL_ID,
+      threadTs: "1234.0",
+      guardianExternalUserId: "U_GUARDIAN",
+    });
+
+    const [persisted] = readPersistedSlackRows(conv.id).filter(
+      (p) => p.channelTs === "1234.0",
+    );
+    expect(persisted?.provenanceTrustClass).toBe("trusted_contact");
+    expect(persisted?.provenanceContactId).toBe("contact-anita");
+    expect(readInboundTrustSpy).toHaveBeenLastCalledWith({
+      channelType: "slack",
+      actorExternalId: "U_ANITA",
+    });
+  });
+
   test("backfilled Slack timezone metadata derives timestamp and speaker fields", async () => {
     const conv = createTestConversation();
     setConfiguredUserTimezone("America/Denver");

package/src/approvals/AGENTS.md

@@ -21,7 +21,7 @@ Conversational guardian verification control-plane invocation is guardian-only.
 
 ## Memory Provenance Invariant
 
-All memory retrieval decisions must consider actor-role provenance. Untrusted actors (non-guardian, unverified_channel) must not receive memory recall results. This invariant is enforced in `indexer.ts` (write gate) and the memory plugin's `injectors.ts` (read gate), which admits personal-memory content only for a turn whose trust context passes `isPersonalMemoryAllowed`.
+Memory access follows the acting actor's capabilities: `resolveCapabilities(trustClass).canAccessMemory`, which only `guardian` holds. An actor without it neither reads nor writes the guardian's memory. The memory plugin's `injectors.ts` admits personal-memory content only for a turn whose trust context passes `isPersonalMemoryAllowed`; the `recall`, `remember`, and `delete_memory_page` tools refuse such a turn (`plugins/defaults/memory/tools.ts`); and extraction from conversation messages runs only for guardian-provenance rows, or legacy rows with none (`plugins/defaults/memory/indexer.ts`).
 
 ## Guardian Privilege Isolation Invariant
 

package/src/cli/commands/roadmap.help.ts

@@ -25,7 +25,7 @@ no verb to post one.
 Examples:
   $ assistant roadmap list --sort upvotes --limit 10
   $ assistant roadmap get scheduled-messages
-  $ assistant roadmap create --title "Add dark mode" --tag ui
+  $ assistant roadmap create --title "Add dark mode" --tag area-interface
   $ assistant roadmap upvote scheduled-messages`,
   subcommands: [
     {
@@ -97,7 +97,7 @@ accepted, since status is assigned by Vellum.
 Examples:
   $ assistant roadmap create --title "Add dark mode"
   $ assistant roadmap create --title "Recurring reminders" \\
-      --description "Repeat a scheduled message weekly" --tag scheduling`,
+      --description "Repeat a scheduled message weekly" --tag area-assistant`,
     },
     {
       name: "update",
@@ -130,7 +130,6 @@ assistant does not own.
 
 Examples:
   $ assistant roadmap update dark-mode --description "Follow the OS setting"
-  $ assistant roadmap update dark-mode --tag ui --tag theming
   $ assistant roadmap update dark-mode --clear-tags`,
     },
     {

package/src/daemon/conversation-messaging.ts

@@ -63,7 +63,10 @@ import {
   syncMessageToDisk,
   updateMetaFile,
 } from "../persistence/conversation-disk-view.js";
-import { SIGHT_FRAME_ATTACHMENT_IDS_KEY } from "../persistence/conversation-types.js";
+import {
+  isEchoSuppressedUserMessage,
+  SIGHT_FRAME_ATTACHMENT_IDS_KEY,
+} from "../persistence/conversation-types.js";
 import {
   attachmentIdFragment,
   type ContentBlock,
@@ -76,6 +79,7 @@ import type { ConversationModeSessionCoordinator } from "./conversation-mode-ses
 import type { MessageQueue } from "./conversation-queue-manager.js";
 import type { SlackInboundMessageMetadata } from "./handlers/shared.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
+import { actorAuthorProvenance } from "./message-provenance.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
 import { bestEffortModeSessionTracking } from "./mode-session-tracking.js";
 import {
@@ -964,6 +968,13 @@ export interface PersistMessageOptions {
    * persisting a message the current actor just sent.
    */
   trustContext?: TrustContext;
+  /**
+   * The person whose own inbound message this row records, passed only by a
+   * caller relaying one (channel ingress and its retry replay). It names the
+   * row's author (`actorAuthorProvenance`). Machine-authored callers omit it,
+   * so their rows name no author whatever the conversation's trust is.
+   */
+  author?: TrustContext;
   /**
    * Persist the row without indexing it (no memory segments, embeddings, or
    * lexical-index entry). For machine-authored prompts that must not enter
@@ -1320,6 +1331,13 @@ export async function persistQueuedMessageBody(
     const mergedMetadata = {
       ...metadataWithoutSlackInbound,
       ...provenance,
+      // A scripted row, or one the repo classes as machine-injected (hidden,
+      // ACP or subagent notification, background event), is not a person's
+      // own words, so even a relayed author is not named on one.
+      ...(resolvedScripted ||
+      isEchoSuppressedUserMessage(metadataWithoutSlackInbound)
+        ? {}
+        : actorAuthorProvenance(options.author)),
       ...(turnCtx
         ? {
             userMessageChannel: turnCtx.userMessageChannel,

package/src/daemon/message-provenance.ts

@@ -13,9 +13,13 @@
  * context compactor (image manifest) can apply the identical filter without
  * creating an import cycle through `conversation-lifecycle` ↔
  * `window-manager` ↔ `compactor`.
+ *
+ * It also owns the author field (`actorAuthorProvenance`), which says who
+ * wrote a row rather than whose turn wrote it.
  */
 import type { MessageRow } from "../persistence/conversation-crud.js";
 import { type TrustClass, trustClassSchema } from "../runtime/trust-class.js";
+import type { TrustContext } from "./trust-context-types.js";
 
 export function parseProvenanceTrustClass(
   metadata: string | null,
@@ -56,3 +60,22 @@ export function filterMessagesForUntrustedActor(
 ): MessageRow[] {
   return messages.filter((m) => isRowVisibleToUntrustedActor(m.metadata));
 }
+
+/** The persisted author field: the contact who wrote the row. */
+export interface ActorAuthorProvenance {
+  provenanceContactId?: string;
+}
+
+/**
+ * Author fields for a row the trust context's actor wrote themselves: their
+ * own message or reaction. `provenanceFromTrustContext` describes the turn and
+ * is also stamped on the assistant's replies, tool results, and notices, so
+ * those rows must never carry these.
+ */
+export function actorAuthorProvenance(
+  trustContext: TrustContext | undefined,
+): ActorAuthorProvenance {
+  return trustContext?.requesterContactId
+    ? { provenanceContactId: trustContext.requesterContactId }
+    : {};
+}

package/src/daemon/process-message.ts

@@ -67,12 +67,19 @@ import {
   preactivateHostProxySkills,
   shouldAttachHostProxyForCapability,
 } from "./host-proxy-preactivation.js";
+import { actorAuthorProvenance } from "./message-provenance.js";
 import type { SubagentToolGateMode } from "./tool-setup-types.js";
-import { restingTrust } from "./trust-context-types.js";
+import { restingTrust, type TrustContext } from "./trust-context-types.js";
 
 const log = getLogger("process-message");
 
 type ProcessMessageOptions = ConversationCreateOptions & {
+  /**
+   * The person whose own inbound message this turn persists, set only by
+   * channel ingress and its retry replay. Names the author on the persisted
+   * user row; see `PersistMessageOptions.author`.
+   */
+  author?: TrustContext;
   /** Per-turn observer for live agent-loop events. Does not replace SSE broadcast. */
   onEvent?: (msg: AssistantEvent) => void;
   /** IDs of user-uploaded attachments to resolve and include in the turn. */
@@ -539,7 +546,7 @@ export async function processMessage(
       ...(Object.keys(imageSourcePaths).length > 0 ? { imageSourcePaths } : {}),
     };
     const userMetaWithSlack = withChannelEnvelopes(
-      serverChannelMeta,
+      { ...serverChannelMeta, ...actorAuthorProvenance(options?.author) },
       slackMeta,
       providerMeta,
     );
@@ -638,7 +645,7 @@ export async function processMessage(
         : {}),
     };
     const compactUserMeta = withChannelEnvelopes(
-      compactChannelMeta,
+      { ...compactChannelMeta, ...actorAuthorProvenance(options?.author) },
       slackMeta,
       providerMeta,
     );
@@ -698,7 +705,7 @@ export async function processMessage(
         : {}),
     };
     const cleanUserMeta = withChannelEnvelopes(
-      cleanChannelMeta,
+      { ...cleanChannelMeta, ...actorAuthorProvenance(options?.author) },
       slackMeta,
       providerMeta,
     );
@@ -744,6 +751,7 @@ export async function processMessage(
       requestId,
       metadata: persistMetadata,
       displayContent: options?.displayContent,
+      ...(options?.author ? { author: options.author } : {}),
       ...(options?.skipUserMessageIndexing ? { skipIndexing: true } : {}),
       ...(ingressKey ? { clientMessageId: ingressKey } : {}),
     },
@@ -825,6 +833,7 @@ export async function processMessageInBackground(
       requestId,
       metadata: persistMetadata,
       displayContent: options?.displayContent,
+      ...(options?.author ? { author: options.author } : {}),
       ...(ingressKey ? { clientMessageId: ingressKey } : {}),
     },
   );

package/src/persistence/conversation-crud.ts

@@ -402,6 +402,14 @@ export const messageMetadataSchema = z
     provenanceSourceChannel: channelIdSchema.optional(),
     provenanceGuardianExternalUserId: z.string().optional(),
     provenanceRequesterIdentifier: z.string().optional(),
+    /**
+     * Contact id of the person who wrote this row, from the gateway trust
+     * verdict at persist time. Stamped only on a person's own message or
+     * reaction (`actorAuthorProvenance`), never on rows the assistant writes
+     * during their turn: the other `provenance*` fields describe the turn,
+     * this one the author. Absent when the author resolved to no contact.
+     */
+    provenanceContactId: z.string().optional(),
     automated: z.boolean().optional(),
     /**
      * Transcript-suppression flag: the row is a machine signal (e.g. the

package/src/plugins/defaults/memory/__tests__/archive-removal-framing.test.ts

@@ -0,0 +1,64 @@
+/**
+ * The daily archive (`memory/archive/`) holds raw buffer entries only. Per-turn
+ * injection reads concept pages and never the archive, and text a pass
+ * composes or derives on a page is not in it. So nothing the consolidation
+ * agent reads may present the archive as making removal safe: that framing
+ * licenses deleting filed content that exists nowhere else.
+ *
+ * The check is sentence-level: no sentence may pair the archive with
+ * reassurance that removing content loses nothing. A sentence warning that
+ * removed text IS lost stays allowed.
+ */
+import { describe, expect, test } from "bun:test";
+
+import { renderConsolidationPrompt } from "../substrate/prompts/consolidation.js";
+import { deleteMemoryPageTool } from "../tools.js";
+
+function archiveSafetyClaims(text: string): string[] {
+  return text
+    .split(/(?<=[.!?])\s+/)
+    .filter(
+      (sentence) =>
+        /archive/i.test(sentence) &&
+        /don.t worry|no need to worry|never los|nothing is lost|won.t lose|safe to (?:delete|remove|cut|drop)/i.test(
+          sentence,
+        ),
+    );
+}
+
+describe("the archive is never framed as making removal safe", () => {
+  test("neither consolidation article shape makes the claim", () => {
+    const v2 = renderConsolidationPrompt("May 1, 12:00 PM", {
+      includeCorePagesSection: false,
+      articleShape: "v2",
+      bufferEntries: "",
+    });
+    // The over-long-sections step carries the one legitimate archive
+    // sentence, so the v3 render includes it.
+    const v3 = renderConsolidationPrompt("May 1, 12:00 PM", {
+      includeCorePagesSection: true,
+      articleShape: "v3",
+      bufferEntries: "",
+      overlongSections: {
+        windowChars: 6000,
+        sections: [{ slug: "journal", title: "", chars: 7200 }],
+      },
+    });
+
+    expect(v3).toContain("the archive is a record");
+    expect(archiveSafetyClaims(v2)).toEqual([]);
+    expect(archiveSafetyClaims(v3)).toEqual([]);
+  });
+
+  test("a warning that removed text is lost is not the claim", () => {
+    expect(
+      archiveSafetyClaims(
+        "Text you cut from a page is lost to retrieval: the archive does not bring it back.",
+      ),
+    ).toEqual([]);
+  });
+
+  test("the delete_memory_page description does not make the claim", () => {
+    expect(archiveSafetyClaims(deleteMemoryPageTool.description)).toEqual([]);
+  });
+});

package/src/plugins/defaults/memory/substrate/prompts/consolidation.ts

@@ -312,7 +312,7 @@ Cutoff timestamp for this run: \`${CUTOFF_PLACEHOLDER}\`. The entries for this p
 - Updated \`memory/threads.md\` (≤10000 chars)
 - Updated \`edges:\` frontmatter in any pages whose outgoing links changed
 
-How retrieval works: high-activation pages are loaded at the start of each turn. Activations spread along **directed** edges from source to target — activating A pulls in the pages A points at, but not the reverse. The immutable archive retains the entire buffer forever, so don't worry about losing information.
+How retrieval works: high-activation pages are loaded at the start of each turn. Activations spread along **directed** edges from source to target: activating A pulls in the pages A points at, but not the reverse.
 
 ---
 
@@ -724,7 +724,7 @@ Three consequences:
 
 1. **The lead IS the card, and the fallback.** Write every lead as a standalone orientation: what this article is, the one or two facts that identify it, where it sits. If the lead only makes sense after reading the sections, the card is useless and so is the fallback. One to three short paragraphs.
 2. **Section names are navigation.** They appear on the selector's card as the table of contents and head every injected section. Name sections so future-you can tell from the name alone whether the answer lives there.
-3. **Sections are the unit of growth and retrieval.** A fact filed in the right section of the right article is findable and arrives in context with its section (kept under the 6000-character chunk window, so the section travels whole); a fact buried mid-paragraph in an overlong lead is not. The immutable archive retains the entire buffer forever, so don't worry about losing information.
+3. **Sections are the unit of growth and retrieval.** A fact filed in the right section of the right article is findable and arrives in context with its section (kept under the 6000-character chunk window, so the section travels whole); a fact buried mid-paragraph in an overlong lead is not.
 
 ---
 

package/src/plugins/defaults/memory/tools.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -305,6 +305,29 @@ describe("rememberTool.execute — buffer writes", () => {
   });
 });
 
+describe("rememberTool.execute — memory access", () => {
+  test.each(["trusted_contact", "unverified_contact", "unknown"] as const)(
+    "refuses a %s write without touching the memory buffer",
+    async (trustClass) => {
+      const fact = `a claim made on a ${trustClass} turn`;
+      const result = await rememberTool.execute(
+        { content: fact, finish_turn: true },
+        makeContext({ trustClass }),
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("Not saved");
+      // The turn continues so the model can relay the refusal.
+      expect(result.yieldToUser).toBeUndefined();
+      const bufferPath = join(tmpWorkspace, "memory", "buffer.md");
+      const buffer = existsSync(bufferPath)
+        ? readFileSync(bufferPath, "utf-8")
+        : "";
+      expect(buffer).not.toContain(fact);
+    },
+  );
+});
+
 describe("rememberTool.execute — batch (array) content", () => {
   beforeEach(() => {
     enqueueCalls.length = 0;

package/src/plugins/defaults/memory/tools.ts

@@ -55,6 +55,17 @@ export const rememberTool = {
     const typedInput = input as unknown as RememberInput;
     // The append below writes the memory buffer, so a cancelled turn stops here.
     throwIfCancelled(context);
+    if (!resolveCapabilities(context.trustClass).canAccessMemory) {
+      // No yield even when finish_turn is set: the model has to see this, so
+      // it never tells someone a fact was saved when it was not. An error, not
+      // a quiet no-op: a non-error `remember` result reads as a durable write to
+      // `memory-run-evidence`.
+      return {
+        content:
+          "Not saved: remember writes the guardian's long-term memory, which is only available on the guardian's own turns. Retrying will not help. Tell the person only if they asked you to remember this or you said you would.",
+        isError: true,
+      };
+    }
     const result = handleRemember(
       typedInput,
       context.conversationId,
@@ -127,7 +138,7 @@ export const recallTool = {
 export const deleteMemoryPageTool = {
   name: "delete_memory_page",
   description:
-    "Delete one concept page from your memory wiki, addressed by slug (its path under `memory/concepts/` minus `.md`, e.g. `alice`, `people/alice`, `procs/git-flow`). Use during a consolidation/maintenance pass to retire a page you merged into another, renamed (write the new page, then delete the old slug), or dropped as a dead stub. Only concept pages can be deleted: the index files (`recent.md`, `essentials.md`, `threads.md`) are rewritten with file_write/file_edit, never deleted, and `buffer.md` is never written by you at all; the runtime removes the entries it handed you once the pass completes. Idempotent: deleting a slug that is already gone is not an error. The immutable archive retains buffer history, so removing a page never loses source facts.",
+    "Delete one concept page from your memory wiki, addressed by slug (its path under `memory/concepts/` minus `.md`, e.g. `alice`, `people/alice`, `procs/git-flow`). Use during a consolidation/maintenance pass to retire a page you merged into another, renamed (write the new page, then delete the old slug), or dropped as a dead stub. Only concept pages can be deleted: the index files (`recent.md`, `essentials.md`, `threads.md`) are rewritten with file_write/file_edit, never deleted, and `buffer.md` is never written by you at all; the runtime removes the entries it handed you once the pass completes. Idempotent: deleting a slug that is already gone is not an error.",
   category: "memory",
   executionTarget: "sandbox",
   defaultRiskLevel: RiskLevel.Low,

package/src/runtime/assistant-event-hub.ts

@@ -53,6 +53,7 @@ import { appendEventToStream } from "../signals/event-stream.js";
 import { getLogger } from "../util/logger.js";
 import { buildAssistantEvent } from "./assistant-event.js";
 import type { AssistantEventPublishOptions } from "./assistant-event-publish-options.js";
+import { matchesTargeting } from "./assistant-event-targeting.js";
 import { stampAndBuffer } from "./assistant-stream-state.js";
 import { isMainDaemonProcess } from "./process-role.js";
 
@@ -323,24 +324,14 @@ export class AssistantEventHub {
    * Publish an event to all matching subscribers.
    *
    * Matching rules:
-   * - if `excludeClientId` is set, the subscriber with that clientId is
-   *   skipped regardless of every other rule (self-echo suppression — the
-   *   client that originated the mutation does not receive its own
-   *   invalidation back through the hub).
-   * - if `targetClientId` is set, deliver only to the subscriber with that
-   *   clientId, bypassing the conversation-id filter entirely (the web-origin
-   *   event's conversationId differs from the macOS client's subscribed
-   *   conversation).
-   * - if `filter.conversationId` is set (and `targetClientId` is not), the
-   *   `event.conversationId` must equal it
-   * - if `targetCapability` is set, only subscribers whose capabilities include
-   *   it receive the event; untargeted events go to all
-   * - if `targetInterfaceId` is set, only client subscribers whose
-   *   `interfaceId` matches receive the event; process subscribers and
-   *   non-matching clients are skipped.
-   * - if `targetActorPrincipalId` is set, only client subscribers whose
-   *   verified `actorPrincipalId` equals it receive the event; process
-   *   subscribers and clients without a principal are skipped.
+   * - the event's targeting (`excludeClientId`, `targetInterfaceId`,
+   *   `targetActorPrincipalId`, `targetClientId`, `targetCapability`) must
+   *   admit the subscriber, per {@link matchesTargeting}, the same check
+   *   replay applies
+   * - a subscriber's `filter.conversationId` must equal `event.conversationId`,
+   *   unless the event names a client with `targetClientId` (a web-origin
+   *   event's conversationId can differ from the conversation the targeted
+   *   macOS client subscribed to)
    *
    * Fanout is isolated: a throwing or rejecting subscriber does not abort
    * delivery to remaining subscribers.
@@ -365,11 +356,6 @@ export class AssistantEventHub {
       }
     }
 
-    const targetCapability = options?.targetCapability;
-    const targetClientId = options?.targetClientId;
-    const targetInterfaceId = options?.targetInterfaceId;
-    const targetActorPrincipalId = options?.targetActorPrincipalId;
-    const excludeClientId = options?.excludeClientId;
     const snapshot = Array.from(this.subscribers);
     const errors: unknown[] = [];
 
@@ -377,74 +363,18 @@ export class AssistantEventHub {
       if (!entry.active) {
         continue;
       }
-
-      // Self-echo suppression: the originating client never receives the
-      // event back. Checked before every other rule so it composes with
-      // both targeted and untargeted broadcasts.
+      if (!matchesTargeting(options, entry)) {
+        continue;
+      }
       if (
-        excludeClientId != null &&
-        entry.type === "client" &&
-        entry.clientId === excludeClientId
+        options?.targetClientId == null &&
+        event.conversationId != null &&
+        entry.filter.conversationId != null &&
+        entry.filter.conversationId !== event.conversationId
       ) {
         continue;
       }
 
-      // Interface targeting: skip any subscriber that is not a client of
-      // the requested interface. Composes with `targetClientId` and
-      // `targetCapability` below.
-      if (targetInterfaceId != null) {
-        if (
-          entry.type !== "client" ||
-          entry.interfaceId !== targetInterfaceId
-        ) {
-          continue;
-        }
-      }
-
-      // Principal targeting: an event scoped to one person reaches only that
-      // person's own connections. Composes with every other rule.
-      if (targetActorPrincipalId != null) {
-        if (
-          entry.type !== "client" ||
-          entry.actorPrincipalId !== targetActorPrincipalId
-        ) {
-          continue;
-        }
-      }
-
-      if (targetClientId != null) {
-        // Targeted: bypass conversation filter, deliver only to the named client.
-        if (entry.type !== "client" || entry.clientId !== targetClientId) {
-          continue;
-        }
-        if (
-          targetCapability != null &&
-          !entry.capabilities.includes(targetCapability)
-        ) {
-          continue;
-        }
-      } else {
-        // Untargeted: existing conversation-scoped + capability logic.
-        if (
-          event.conversationId != null &&
-          entry.filter.conversationId != null &&
-          entry.filter.conversationId !== event.conversationId
-        ) {
-          continue;
-        }
-
-        // Capability targeting: targeted events only go to subscribers that
-        // declare the required capability.
-        if (targetCapability != null) {
-          if (
-            entry.type !== "client" ||
-            !entry.capabilities.includes(targetCapability)
-          ) {
-            continue;
-          }
-        }
-      }
-
       try {
         await entry.callback(event);
       } catch (err) {