@vellumai/assistant 0.12.3-staging.1 → 0.12.3-staging.2

package/src/runtime/routes/inbound-stages/backfill-sender-provenance.ts

@@ -0,0 +1,96 @@
+/**
+ * Provenance for backfilled Slack rows, resolved per sender.
+ *
+ * A backfilled row was written by someone other than the live inbound actor,
+ * so the live turn's trust context says nothing about it. Each sender is
+ * classified by the same gateway verdict live ingress uses
+ * (`resolve_inbound_trust`), so a backfilled row and a live row from the same
+ * person carry the same trust class and contact id. The verdict answers for
+ * the contact list at import time, which is when the row is written.
+ *
+ * When the verdict is unreadable or unusable, the row falls back to the
+ * guardian-address comparison, carries no contact id, and is marked
+ * `provenanceLookupFailed` so it stays distinguishable from a stranger.
+ *
+ * A read goes through `readInboundTrust`, so it also refreshes the
+ * member-verdict cache for that sender, as a live inbound read does.
+ */
+
+import { readInboundTrust } from "../../../calls/inbound-trust-reader.js";
+import type { ActorAuthorProvenance } from "../../../daemon/message-provenance.js";
+import type { Message as ProviderMessage } from "../../../messaging/provider-types.js";
+import { inboundIdentitiesMatch } from "../../../util/canonicalize-identity.js";
+import type { TrustClass } from "../../trust-class.js";
+import {
+  verdictMemberFromVerdict,
+  verdictUsability,
+} from "../../trust-verdict-consumer.js";
+
+export interface BackfilledSenderProvenance extends ActorAuthorProvenance {
+  provenanceTrustClass: TrustClass;
+  /** The lookup ran and returned no usable verdict; see `messageMetadataSchema`. */
+  provenanceLookupFailed?: true;
+}
+
+/**
+ * Resolves a backfilled message's sender provenance. One resolver serves one
+ * backfill pass and reads the gateway at most once per distinct sender.
+ */
+export type BackfilledSenderProvenanceResolver = (
+  senderId: string | undefined,
+) => Promise<BackfilledSenderProvenance>;
+
+export function createBackfilledSenderProvenanceResolver(
+  guardianExternalUserId: string | undefined,
+  messages: readonly ProviderMessage[],
+): BackfilledSenderProvenanceResolver {
+  const bySender = new Map<string, Promise<BackfilledSenderProvenance>>();
+  const resolve: BackfilledSenderProvenanceResolver = (senderId) => {
+    const trimmed = senderId?.trim();
+    if (!trimmed) {
+      return Promise.resolve({ provenanceTrustClass: "unknown" });
+    }
+    let pending = bySender.get(trimmed);
+    if (!pending) {
+      pending = resolveSenderProvenance(trimmed, guardianExternalUserId);
+      bySender.set(trimmed, pending);
+    }
+    return pending;
+  };
+  // Every sender's read starts now, so the pass waits on the slowest read
+  // rather than their sum. Bots included: a third-party bot's post is a user
+  // row, and singling out this assistant's own posts needs an async lookup.
+  // A read reports failure as a result, never a rejection.
+  for (const message of messages) {
+    void resolve(message.sender?.id);
+  }
+  return resolve;
+}
+
+async function resolveSenderProvenance(
+  senderId: string,
+  guardianExternalUserId: string | undefined,
+): Promise<BackfilledSenderProvenance> {
+  const read = await readInboundTrust({
+    channelType: "slack",
+    actorExternalId: senderId,
+  });
+  if (read.ok) {
+    const usability = verdictUsability(read.verdict);
+    if (usability.usable) {
+      const member = verdictMemberFromVerdict(usability.verdict);
+      return {
+        provenanceTrustClass: usability.verdict.trustClass,
+        ...(member ? { provenanceContactId: member.contactId } : {}),
+      };
+    }
+  }
+  return {
+    provenanceTrustClass:
+      guardianExternalUserId !== undefined &&
+      inboundIdentitiesMatch("slack", senderId, guardianExternalUserId)
+        ? "guardian"
+        : "unknown",
+    provenanceLookupFailed: true,
+  };
+}

package/src/runtime/routes/inbound-stages/background-dispatch.test.ts

@@ -173,10 +173,10 @@ import {
 } from "../../../daemon/conversation-registry.js";
 import type { TrustContext } from "../../../daemon/trust-context-types.js";
 import type { MessageProcessor } from "../../http-types.js";
+import { hasDeliverableAssistantText } from "../../no-response.js";
 import {
   isBoundGuardianActor,
   processChannelMessageInBackground,
-  shouldShowActivityForText,
   shouldShowActivityImmediately,
 } from "./background-dispatch.js";
 import { __resetChannelTurnAdmissionForTests } from "./channel-turn-admission.js";
@@ -260,6 +260,35 @@ describe("processChannelMessageInBackground — reply delivery", () => {
   const flush = (): Promise<void> =>
     new Promise((resolve) => setTimeout(resolve, 10));
 
+  test("names the inbound sender as the persisted message's author", async () => {
+    let capturedAuthor: TrustContext | undefined;
+    const processMessage: MessageProcessor = async (
+      _conversationId,
+      _content,
+      options,
+    ) => {
+      capturedAuthor = options?.author;
+      return { messageId: "user-msg-author" };
+    };
+
+    processChannelMessageInBackground({
+      processMessage,
+      conversationId: "conv-author",
+      eventId: "evt-author",
+      content: "the export endpoint needs a scoped token",
+      sourceChannel: "slack",
+      sourceInterface: "slack",
+      externalChatId: "C-AUTHOR",
+      trustCtx,
+      metadataHints: [],
+      replyCallbackUrl: "https://example.test/deliver/slack?channel=C-AUTHOR",
+    });
+
+    await flush();
+
+    expect(capturedAuthor).toBe(trustCtx);
+  });
+
   test("records callback delivery failures without failing processing", async () => {
     const conversationId = "conv-delivery-failure";
     const channelId = "C-DELIVERY-FAILURE";
@@ -1070,14 +1099,14 @@ describe("channel activity timing", () => {
   });
 
   test("recognizes only deliverable text as a reason to show activity", () => {
-    expect(shouldShowActivityForText("")).toBe(false);
-    expect(shouldShowActivityForText("   ")).toBe(false);
-    expect(shouldShowActivityForText("<")).toBe(false);
-    expect(shouldShowActivityForText("<no_response")).toBe(false);
-    expect(shouldShowActivityForText("<no_response/>")).toBe(false);
-    expect(shouldShowActivityForText("  <no_response />  ")).toBe(false);
-    expect(shouldShowActivityForText("Real response.")).toBe(true);
-    expect(shouldShowActivityForText("<no_response/>\nReal response.")).toBe(
+    expect(hasDeliverableAssistantText("")).toBe(false);
+    expect(hasDeliverableAssistantText("   ")).toBe(false);
+    expect(hasDeliverableAssistantText("<")).toBe(false);
+    expect(hasDeliverableAssistantText("<no_response")).toBe(false);
+    expect(hasDeliverableAssistantText("<no_response/>")).toBe(false);
+    expect(hasDeliverableAssistantText("  <no_response />  ")).toBe(false);
+    expect(hasDeliverableAssistantText("Real response.")).toBe(true);
+    expect(hasDeliverableAssistantText("<no_response/>\nReal response.")).toBe(
       true,
     );
   });

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -286,6 +286,7 @@ export function processChannelMessageInBackground(
           },
           assistantId,
           trustContext: trustCtx,
+          author: trustCtx,
           isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
           ...(displayContent !== undefined ? { displayContent } : {}),
           ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
@@ -452,10 +453,6 @@ type ChannelActivityController = {
   stop: () => void;
 };
 
-export function shouldShowActivityForText(text: string): boolean {
-  return hasDeliverableAssistantText(text);
-}
-
 /**
  * Room shapes with one other participant, in each channel's own word for it.
  *
@@ -613,7 +610,7 @@ function startChannelActivity(params: {
         return;
       }
       observedAssistantText += msg.text;
-      if (shouldShowActivityForText(observedAssistantText)) {
+      if (hasDeliverableAssistantText(observedAssistantText)) {
         show();
       }
     },

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -35,6 +35,7 @@ import { createApprovalCopyGenerator } from "../../../daemon/approval-generators
 import { findConversation } from "../../../daemon/conversation-registry.js";
 import { getDiskPressureStatus } from "../../../daemon/disk-pressure-guard.js";
 import { classifyDiskPressureTurnPolicy } from "../../../daemon/disk-pressure-policy.js";
+import { actorAuthorProvenance } from "../../../daemon/message-provenance.js";
 import { processMessage } from "../../../daemon/process-message.js";
 import { renderReactionHistoryText } from "../../../daemon/reaction-history-render.js";
 import type { TrustContext } from "../../../daemon/trust-context-types.js";
@@ -544,6 +545,7 @@ async function persistReactionAsMessage(params: {
     {
       metadata: {
         ...provenanceFromTrustContext(params.trustCtx),
+        ...actorAuthorProvenance(params.trustCtx),
         ...buildReactionRowEnvelope(facts),
       },
       skipIndexing: true,

package/src/runtime/routes/llm-context-normalization.ts

@@ -1025,7 +1025,7 @@ function anthropicMessageSections(
         toolName: asString(block.name) ?? asString(block.tool_use_id),
         data:
           type === "web_search_tool_result"
-            ? sanitizeAnthropicWebSearchToolResultData(block)
+            ? sanitizeAnthropicStructuredValue(block)
             : undefined,
         text: collectAnthropicToolResultText(block),
       });
@@ -1397,12 +1397,6 @@ function collectAnthropicToolResultText(
   return collectAnthropicText(block.content);
 }
 
-function sanitizeAnthropicWebSearchToolResultData(
-  block: Record<string, unknown>,
-): unknown {
-  return sanitizeAnthropicStructuredValue(block);
-}
-
 function sanitizeAnthropicStructuredValue(value: unknown): unknown {
   if (Array.isArray(value)) {
     return value.map((entry) => sanitizeAnthropicStructuredValue(entry));

package/src/runtime/routes/migration-routes.ts

@@ -20,11 +20,13 @@ import { createReadStream } from "node:fs";
 import { hostname } from "node:os";
 import { PassThrough, Readable } from "node:stream";
 
+import { GatewayDebugExportIpcResponseSchema } from "@vellumai/gateway-client/gateway-ipc-contracts";
 import { z } from "zod";
 
 import { invalidateConfigCache } from "../../config/loader.js";
 import { resolvePlatformAssistantId } from "../../config/platform-identity.js";
 import { getAssistantName } from "../../daemon/identity-helpers.js";
+import { ipcCallPersistent } from "../../ipc/gateway-client.js";
 import { runAsyncSqlite } from "../../persistence/db-async-query.js";
 import {
   getDb,
@@ -470,8 +472,40 @@ const EXPORT_TO_GCS_PUT_TIMEOUT_MS = 60 * 60 * 1000;
 const MigrationExportToGcsBody = z.object({
   upload_url: z.string().url(),
   description: z.string().optional(),
+  /**
+   * `debug`: a bundle for Vellum staff to inspect. Adds the gateway's
+   * database and recent logs under `gateway/`. `migration` is the default.
+   */
+  profile: z.enum(["migration", "debug"]).default("migration"),
 });
 
+/** Archive path of the gateway's contribution to a debug bundle. */
+export const GATEWAY_DEBUG_EXPORT_PATH = "gateway/export.tar.gz";
+
+/**
+ * Ask the gateway for its debug archive over the local socket. The daemon
+ * cannot read the gateway's files itself: in local mode they sit in the
+ * protected directory beside the encryption keys, and in Docker on a volume
+ * the daemon does not mount.
+ */
+async function collectGatewayDebugExport(): Promise<{
+  archivePath: string;
+  data: Uint8Array;
+}> {
+  const raw = await ipcCallPersistent(
+    "gateway_debug_export",
+    {},
+    GATEWAY_DEBUG_EXPORT_TIMEOUT_MS,
+  );
+  const parsed = GatewayDebugExportIpcResponseSchema.parse(raw);
+  return {
+    archivePath: GATEWAY_DEBUG_EXPORT_PATH,
+    data: new Uint8Array(Buffer.from(parsed.archive_base64, "base64")),
+  };
+}
+
+const GATEWAY_DEBUG_EXPORT_TIMEOUT_MS = 120_000;
+
 /**
  * Collected credentials plus warning markers if the credential store was
  * unreachable. The caller surfaces the warning in logs; production callers
@@ -559,9 +593,10 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
   const parsed = MigrationExportToGcsBody.safeParse(body);
   if (!parsed.success) {
     throw new BadRequestError(
-      "Request body must be { upload_url: string, description?: string } with a valid URL",
+      "Request body must be { upload_url: string, description?: string, profile?: 'migration' | 'debug' } with a valid URL",
     );
   }
+  const isDebugProfile = parsed.data.profile === "debug";
 
   // ── 2. Validate the upload URL. Never log `parsed.data.upload_url`.
   const validated = validateGcsSignedUrl(
@@ -608,8 +643,11 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
   // "managed"), and teleport clients re-provision platform identity after
   // a platform→local import — so redact instead of emitting a bundle the
   // importer is guaranteed to reject.
+  //
+  // A debug bundle goes to Vellum staff, so it never carries credentials
+  // either, whatever the deployment mode.
   let collected: CollectedCredentials;
-  if (manifestInputs.origin.mode === "managed") {
+  if (manifestInputs.origin.mode === "managed" || isDebugProfile) {
     collected = {
       credentials: [],
       unreachable: false,
@@ -632,17 +670,44 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
     collected.perAccountUnreachable,
   );
 
+  if (isDebugProfile) {
+    manifestInputs = {
+      ...manifestInputs,
+      exportOptions: { ...manifestInputs.exportOptions, include_gateway: true },
+    };
+  }
+
   // ── 4. Enqueue the job. The runner captures the collected credentials.
   let job;
   try {
     job = migrationJobs.startJob("export", async () => {
       let cleanup: (() => Promise<void>) | undefined;
       try {
+        // The gateway snapshot can take a while on a large database, so it
+        // runs inside the job (after the export slot is held) rather than
+        // before the 202. A debug bundle without the gateway's data is not
+        // what staff asked for, so a failure fails the job and nothing is
+        // uploaded.
+        let extraFiles: Array<{ archivePath: string; data: Uint8Array }> = [];
+        if (isDebugProfile) {
+          try {
+            extraFiles = [await collectGatewayDebugExport()];
+          } catch (err) {
+            log.error({ err }, "Failed to collect the gateway's debug export");
+            const wrapped = new Error(
+              "The gateway did not provide its debug export; the bundle was not sent.",
+            );
+            (wrapped as { code?: string }).code = "gateway_debug_export_failed";
+            throw wrapped;
+          }
+        }
+
         const result = await streamExportVBundle({
           workspaceDir: getWorkspaceDir(),
           ...manifestInputs,
           secretsRedacted,
           credentials: collected.credentials,
+          extraFiles,
           checkpoint: checkpointDbsForExport,
         });
 
@@ -2402,6 +2467,12 @@ export const ROUTES: RouteDefinition[] = [
         .string()
         .optional()
         .describe("Human-readable export description."),
+      profile: z
+        .enum(["migration", "debug"])
+        .optional()
+        .describe(
+          "Export profile. 'migration' (default) builds a teleport bundle. 'debug' builds a bundle for Vellum staff to open on a debug clone: no credentials, plus the gateway's database and logs under gateway/.",
+        ),
     }),
     responseStatus: "202",
     responseBody: z.object({

package/src/runtime/routes/notification-routes.ts

@@ -14,6 +14,10 @@ import {
   NotificationSourceChannelSchema,
   RoutingIntentSchema,
 } from "../../notifications/signal.js";
+import {
+  NotificationDeliveryResultSchema,
+  NotificationReceiptClassSchema,
+} from "../../notifications/types.js";
 import { UrgencySchema } from "../../notifications/urgency.js";
 import { getDb } from "../../persistence/db-connection.js";
 import { notificationDeliveries } from "../../persistence/schema/index.js";
@@ -78,6 +82,9 @@ const EmitSignalResponse = z.object({
   dispatched: z.boolean(),
   deduplicated: z.boolean(),
   reason: z.string(),
+  selectedChannels: z.array(z.string()),
+  deliveryResults: z.array(NotificationDeliveryResultSchema),
+  receiptClass: NotificationReceiptClassSchema,
 });
 
 async function handleEmitSignal({ body = {} }: RouteHandlerArgs) {
@@ -94,6 +101,9 @@ async function handleEmitSignal({ body = {} }: RouteHandlerArgs) {
     dispatched: result.dispatched,
     deduplicated: result.deduplicated,
     reason: result.reason,
+    selectedChannels: result.selectedChannels,
+    deliveryResults: result.deliveryResults,
+    receiptClass: result.receiptClass,
   };
 }
 

package/src/runtime/routes/oauth-providers.ts

@@ -6,6 +6,7 @@
  * the standard runtime auth middleware.
  */
 
+import { INTEGRATION_CATEGORIES } from "@vellumai/service-contracts/integration-categories";
 import { z } from "zod";
 
 import { loadConfig } from "../../config/loader.js";
@@ -401,6 +402,12 @@ export const oauthProviderSummarySchema = z.object({
   supports_managed_mode: z.boolean(),
   managed_service_is_paid: z.boolean(),
   feature_flag: z.string().nullable(),
+  category: z
+    .enum(INTEGRATION_CATEGORIES)
+    .nullable()
+    .describe(
+      "Where the integrations catalog files the provider; null for a provider without a seed entry.",
+    ),
   tenant_host: z
     .object({
       pattern: z.string(),

package/src/runtime/routes/plugins-routes.ts

@@ -226,6 +226,12 @@ const mcpPluginIntegrationSchema = z.object({
   }),
   logo: z.string(),
   oauthProvider: z.string().optional(),
+  category: z
+    .string()
+    .optional()
+    .describe(
+      "Where the integrations catalog files the entry: a slug from the shared integration-category vocabulary, passed through as the catalog declares it.",
+    ),
 });
 
 const pluginSearchMatchSchema = z.object({

package/src/runtime/routes/roadmap-routes.ts

@@ -379,16 +379,55 @@ const createRequestSchema = z.object({
   tags: z.array(z.string()).optional().describe("Tag slugs"),
 });
 
+/** Item fields the roadmap service reserves for staff on an update. */
+const STAFF_ONLY_UPDATE_FIELDS = new Set(["status", "tags"]);
+
+function listFields(fields: string[]): string {
+  return `${fields.join(", ")} ${fields.length === 1 ? "is" : "are"}`;
+}
+
+/**
+ * Why an update carrying fields other than title and description is refused.
+ * A staff-only field and an unknown one need different remedies, so each is
+ * named for what it is.
+ */
+function unsupportedUpdateFieldsMessage(keys: string[]): string {
+  const staffOnly = keys.filter((k) => STAFF_ONLY_UPDATE_FIELDS.has(k));
+  const unknown = keys.filter((k) => !STAFF_ONLY_UPDATE_FIELDS.has(k));
+  const reasons = [
+    ...(staffOnly.length > 0
+      ? [`${listFields(staffOnly)} set by Vellum staff`]
+      : []),
+    ...(unknown.length > 0
+      ? [`${listFields(unknown)} not a roadmap update field`]
+      : []),
+  ];
+  return `An assistant can change only an item's title and description; ${reasons.join("; ")}.`;
+}
+
+/**
+ * Only the fields the roadmap service lets this assistant change. An
+ * assistant is always the author tier there, never staff, and an author may
+ * edit only an open item's title and description; status and tags are staff
+ * triage and answer 403. Strict, so a caller that sends anything else learns
+ * why here instead of from the upstream refusal.
+ */
 const updateRequestSchema = z
-  .object({
-    title: z.string().optional(),
-    description: z.string().optional(),
-    status: z.string().optional(),
-    tags: z.array(z.string()).optional().describe("Tag slugs"),
-  })
+  .strictObject(
+    {
+      title: z.string().optional(),
+      description: z.string().optional(),
+    },
+    {
+      error: (issue) =>
+        issue.code === "unrecognized_keys"
+          ? unsupportedUpdateFieldsMessage(issue.keys)
+          : undefined,
+    },
+  )
   .refine(
     (patch) => Object.values(patch).some((v) => v !== undefined),
-    "At least one of title, description, status or tags is required.",
+    "At least one of title or description is required.",
   );
 
 type RoadmapItem = z.infer<typeof itemSchema>;
@@ -684,7 +723,7 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Update a roadmap item",
     description:
-      "Updates a roadmap item. At least one field is required; the roadmap service decides which items this assistant may edit.",
+      "Updates the title or description of a roadmap item this assistant filed, while the item is still open. Status and tags are set by Vellum staff.",
     tags: ["roadmap"],
     pathParams: SLUG_PARAM,
     requestBody: updateRequestSchema,

package/src/runtime/routes/secret-routes.ts

@@ -303,7 +303,7 @@ async function handleAddSecret({ body }: RouteHandlerArgs) {
           );
           return { success: false, error: validation.reason };
         }
-      } else if (name === "jev") {
+      } else if (name === "typesafe") {
         const validation = await validateJevApiKey(value);
         if (!validation.valid) {
           log.warn(

package/src/runtime/routes/settings-routes.ts

@@ -662,10 +662,16 @@ async function handleToolPermissionSimulate({ body = {} }: RouteHandlerArgs) {
     const manifestOverride = resolveManifestOverride(toolName);
     // Permission Simulator path: registered tool wins, then explicit
     // manifest override, then the standard inference rules.
-    const executionTarget =
-      getTool(toolName)?.executionTarget ??
-      manifestOverride?.execution_target ??
-      resolveExecutionTarget({ name: toolName });
+    const tool = getTool(toolName);
+    const executionTarget = resolveExecutionTarget(
+      {
+        name: toolName,
+        executionTarget:
+          tool?.executionTarget ?? manifestOverride?.execution_target,
+        getExecutionTarget: tool?.getExecutionTarget,
+      },
+      input,
+    );
     const executionContext =
       isInteractive === false ? "headless" : "conversation";
     const policyContext = { executionTarget, executionContext } as const;

package/src/runtime/routes/watcher-routes.ts

@@ -86,7 +86,7 @@ function handleWatcherCreate({ body = {} }: RouteHandlerArgs) {
   const credentialService =
     credentialServiceOverride ?? provider.requiredCredentialService;
 
-  const watcher = createWatcher({
+  return createWatcher({
     name,
     providerId,
     actionPrompt,
@@ -94,8 +94,6 @@ function handleWatcherCreate({ body = {} }: RouteHandlerArgs) {
     pollIntervalMs,
     configJson: config ? JSON.stringify(config) : null,
   });
-
-  return watcher;
 }
 
 function handleWatcherList({ body = {} }: RouteHandlerArgs) {

package/src/runtime/trust-class.test.ts

@@ -1,11 +1,12 @@
 import { afterEach, describe, expect, test } from "bun:test";
 
+import { TRUST_CLASS_VALUES } from "@vellumai/gateway-client";
+
 import { resolveCapabilities } from "./capabilities.js";
 import {
   derivePersonaTrustFlags,
   isContactTrustClass,
   type PersonaTrustFlags,
-  trustClassSchema,
 } from "./trust-class.js";
 
 describe("isContactTrustClass", () => {
@@ -27,7 +28,7 @@ describe("isContactTrustClass", () => {
   test("agrees with derivePersonaTrustFlags for every trust class", () => {
     // The predicate and the persona flags encode the same grouping; pin them
     // together so neither can drift without failing here.
-    for (const trustClass of trustClassSchema.options) {
+    for (const trustClass of TRUST_CLASS_VALUES) {
       expect(isContactTrustClass(trustClass)).toBe(
         derivePersonaTrustFlags(trustClass).isTrustedContact,
       );
@@ -46,7 +47,7 @@ describe("derivePersonaTrustFlags", () => {
   });
 
   test("trusted_contact and unverified_contact derive identical contact flags", () => {
-    // The admission-only equivalence documented on trustClassSchema: the two
+    // The admission-only equivalence documented in trust-class.ts: the two
     // classes must never drift apart at the persona layer.
     const expected: PersonaTrustFlags = {
       trustClass: "trusted_contact",
@@ -82,9 +83,9 @@ describe("derivePersonaTrustFlags", () => {
   });
 
   test("exactly one flag is true for every trust class", () => {
-    // Iterates the Zod enum so a newly added class is covered automatically
+    // Iterates the canonical class list so a newly added class is covered
     // (the helper itself won't compile until the new class gets a case).
-    for (const trustClass of trustClassSchema.options) {
+    for (const trustClass of TRUST_CLASS_VALUES) {
       const flags = derivePersonaTrustFlags(trustClass);
       const trueCount = [
         flags.isGuardian,
@@ -128,7 +129,7 @@ describe("derivePersonaTrustFlags", () => {
       isTrustedContact: "social-engineering-defense",
       isStranger: "stranger-warning",
     };
-    for (const trustClass of trustClassSchema.options) {
+    for (const trustClass of TRUST_CLASS_VALUES) {
       const flags = derivePersonaTrustFlags(trustClass);
       const guidance = resolveCapabilities(trustClass).promptTrustGuidance;
       for (const [flag, expected] of Object.entries(guidanceByFlag)) {

package/src/runtime/trust-class.ts

@@ -1,10 +1,9 @@
 /**
- * Trust classification for an inbound actor — the single source of truth for
- * both the {@link TrustClass} type and the Zod enum ({@link trustClassSchema})
- * that validates it in persisted message metadata.
- *
- * Kept as a leaf module (imports only `zod`) so the runtime trust layer and the
- * persistence schema can share one definition without a circular import.
+ * The daemon's reading of an inbound actor's trust class. The vocabulary
+ * itself ({@link TrustClass}, `TrustClassSchema`) belongs to the gateway,
+ * which classifies every actor; it lives in `@vellumai/gateway-client`
+ * (`trust-verdict-contract.ts`) and is re-exported here, never redeclared.
+ * This module holds what the daemon derives from a class:
  *
  * - `'guardian'`: The sender matches the active guardian binding for this
  *   (assistant, channel). Guardians have full control-plane access and
@@ -21,21 +20,14 @@
  *   actors are fail-closed with no escalation path.
  */
 
-import { z } from "zod";
-
-export const trustClassSchema = z.enum([
-  "guardian",
-  "trusted_contact",
-  "unverified_contact",
-  "unknown",
-]);
+import type { TrustClass } from "@vellumai/gateway-client";
 
-export type TrustClass = z.infer<typeof trustClassSchema>;
+export type { TrustClass };
 
 /**
  * Whether a trust class names a known non-guardian contact — the
  * `trusted_contact` / `unverified_contact` pair whose admission-only
- * equivalence is documented on {@link trustClassSchema}.
+ * equivalence is documented in this module's header.
  *
  * Accepts a raw string (not just `TrustClass`) because several call sites
  * classify trust classes read back from persisted turn metadata, which may
@@ -75,7 +67,7 @@ export interface PersonaTrustFlags {
  *   needs the opposite default — fail closed, so a turn that never resolved an
  *   actor still renders the guardrail rather than a guardian exemption.
  * - `unverified_contact` derives identically to `trusted_contact`, making the
- *   admission-only equivalence documented on {@link trustClassSchema}
+ *   admission-only equivalence documented in this module's header
  *   executable in one place.
  * - The switch is exhaustive with no default: adding a `TrustClass` member is a
  *   compile error here, forcing a deliberate persona decision for the new