@vellumai/assistant 0.12.3 → 0.12.4-dev.202609231620.a15f321

package/src/config/default-profile-names.ts

@@ -67,6 +67,61 @@ export function isBackupProfileKey(value: string): value is BackupProfileKey {
   return (BACKUP_PROFILE_KEYS as readonly string[]).includes(value);
 }
 
+/**
+ * Managed profile for the TypeSafe decision model (Jev). Deliberately NOT
+ * part of `DEFAULT_PROFILE_KEYS`: it has no BYOK column, because the
+ * platform serves Jev only through the managed route, and its model returns
+ * structured answers rather than chat text, so it can never be the active
+ * or conversation profile. It exists as a pin target for the call sites
+ * that consume a yes/no verdict (the voice judges, the memory selector).
+ */
+export const JEV_MANAGED_PROFILE_KEY = "jev-managed";
+
+/**
+ * Managed profile that picks one of the default profiles per message: the
+ * agent loop asks Jev which default fits the user's latest message and runs
+ * the turn on that profile (`daemon/auto-profile-router.ts`). Its own body
+ * is the managed Balanced body, so any path that dispatches the name
+ * directly, or a turn on which the router is unavailable, runs Balanced.
+ * Managed column only, because the router depends on the managed Jev route,
+ * and flag-gated: it exists only while the `auto-profile` feature flag has
+ * reconciled it into the workspace (see `sync-gated-profiles.ts`).
+ * Deliberately NOT part of `DEFAULT_PROFILE_KEYS`: it is a selection over
+ * those keys, not a fifth intent.
+ */
+export const AUTO_PROFILE_KEY = "auto";
+export const AUTO_PROFILE_FEATURE_FLAG_KEY = "auto-profile";
+
+/** The call site the automatic profile router asks Jev through. */
+export const AUTO_PROFILE_ROUTER_CALL_SITE = "autoProfileRouter";
+
+/**
+ * The call sites that consume a structured verdict and so may be pinned to
+ * the Jev profile. Every other site expects chat text or a tool call, which
+ * the decision model never produces.
+ */
+export const JEV_MANAGED_PROFILE_CALL_SITES = [
+  "voiceEscalationJudge",
+  "voiceContinuationJudge",
+  "memoryV3SelectL2",
+  AUTO_PROFILE_ROUTER_CALL_SITE,
+] as const;
+
+/**
+ * Keys whose profile exists on the managed (`vellum`) column only: the
+ * backups, the Jev profile, and the Auto profile. Under a BYOK or ChatGPT
+ * default provider these names have no body to resolve to.
+ */
+export const MANAGED_ONLY_PROFILE_KEYS = [
+  ...BACKUP_PROFILE_KEYS,
+  JEV_MANAGED_PROFILE_KEY,
+  AUTO_PROFILE_KEY,
+] as const;
+
+export function isManagedOnlyProfileKey(value: string): boolean {
+  return (MANAGED_ONLY_PROFILE_KEYS as readonly string[]).includes(value);
+}
+
 /**
  * Flag-gated default profile: only available while the `os-beta` feature
  * flag has reconciled it into the workspace (see `sync-gated-profiles.ts`).
@@ -76,6 +131,20 @@ export function isBackupProfileKey(value: string): value is BackupProfileKey {
  */
 export const OS_BETA_PROFILE_KEY = "os-beta";
 
+/**
+ * Managed profiles that resolve only while a workspace entry exists, because
+ * a feature flag reconciles that entry in and out. Never always-valid
+ * reference targets: a reference to one is valid only with the entry present.
+ */
+export const FLAG_GATED_PROFILE_KEYS = [
+  OS_BETA_PROFILE_KEY,
+  AUTO_PROFILE_KEY,
+] as const;
+
+export function isFlagGatedProfileKey(value: string): boolean {
+  return (FLAG_GATED_PROFILE_KEYS as readonly string[]).includes(value);
+}
+
 /**
  * The named columns of the intent × provider matrix. `vellum` is the
  * platform-managed column (routed through the single `vellum` connection to

package/src/config/feature-flag-registry.json

@@ -170,14 +170,6 @@
       "description": "Enable Anthropic fast mode for Opus models (4.6, 4.7, 4.8), delivering up to 2.5x higher output tokens per second at premium pricing",
       "defaultEnabled": false
     },
-    {
-      "id": "teleport",
-      "scope": "client",
-      "key": "teleport",
-      "label": "Teleport",
-      "description": "Enable the local-to-platform teleport UI in General settings. Platform-to-local teleport is GA and not gated by this flag",
-      "defaultEnabled": false
-    },
     {
       "id": "apple-container",
       "scope": "client",
@@ -346,6 +338,14 @@
       "description": "Show the Add Server action on the MCP settings page. The MCP page itself remains visible; this flag gates only creating new Model Context Protocol server connections.",
       "defaultEnabled": false
     },
+    {
+      "id": "mcp-catalog-qa-integrations",
+      "scope": "assistant",
+      "key": "mcp-catalog-qa-integrations",
+      "label": "MCP Catalog QA Integrations",
+      "description": "Show Gamma, Guru, Intercom, Ramp, Semrush, and Typeform in the installable plugin catalog while their OAuth flows are validated. When off, catalog search, detail, and install-by-name cannot resolve them. Existing installed connections remain available.",
+      "defaultEnabled": false
+    },
     {
       "id": "os-beta",
       "scope": "assistant",
@@ -354,6 +354,14 @@
       "description": "Enable the OS Beta model profile (MiniMax M3 / Together) in the assistant's model profile selection.",
       "defaultEnabled": false
     },
+    {
+      "id": "auto-profile",
+      "scope": "assistant",
+      "key": "auto-profile",
+      "label": "Auto Profile",
+      "description": "Enable the Auto model profile, which asks Jev which default profile should answer each message.",
+      "defaultEnabled": false
+    },
     {
       "id": "new-thread-suggestions",
       "scope": "client",
@@ -557,7 +565,15 @@
       "scope": "client",
       "key": "assistant-inbox",
       "label": "Assistant Inbox",
-      "description": "Shows an Assistant Inbox entry above Preferences in the web sidebar and the /assistant/inbox page it opens: a mailbox for the assistant's managed vellum.me address (received and sent, with a reading pane), the inline email setup card for entitled orgs with no address yet, and an upgrade card for orgs without the managed_email entitlement. Off hides the entry and redirects the route to chat.",
+      "description": "Shows an Assistant Inbox entry above Preferences in the web sidebar and the /assistant/inbox page it opens: a mailbox for the assistant's managed vellum.me address (received and sent, with a reading pane), the inline email setup card for entitled orgs with no address yet, and an upgrade card for orgs without the managed_email entitlement. With it on, email setup happens only there: the billing wizard hands off to the inbox instead of its own domain step, the billing page's finish-setup nudge gives way to the inbox's rail entry, and the Channels page's Email section points there instead of registering an address itself. Off hides the entry, redirects the route to chat, and keeps the older setup surfaces.",
+      "defaultEnabled": false
+    },
+    {
+      "id": "sidebar-done",
+      "scope": "both",
+      "key": "sidebar-done",
+      "label": "Sidebar Done",
+      "description": "Turns archiving a chat into marking it done: the sidebar row carries a Done check instead of the overflow menu, an All chats page lists the full history, and done chats stay findable in search by default. Off keeps today's Archive wording, the overflow menu, and search that hides archived rows unless the query asks for them.",
       "defaultEnabled": false
     }
   ]

package/src/config/inference-profile-validation.ts

@@ -1,4 +1,4 @@
-import { getUserSelectableProfilesForProvider } from "./default-profile-catalog.js";
+import { getConversationProfilesForProvider } from "./default-profile-catalog.js";
 import { getConfigReadOnly } from "./loader.js";
 
 /**
@@ -6,17 +6,18 @@ import { getConfigReadOnly } from "./loader.js";
  * (code-defined defaults + workspace `llm.profiles`). Returns a user-facing
  * error message when the key is empty or unknown, or `null` when valid.
  *
- * Resolved through the `llm.defaultProvider`-aware user-selectable view so
- * availability matches what a direct profile pin can choose. Managed backup
- * routes remain available to automatic fallback resolution but are not
- * reported as selectable profiles.
+ * Resolved through the `llm.defaultProvider`-aware conversation view, since
+ * every caller (schedules, subagent spawns, per-conversation pins) runs chat
+ * turns on the result. Managed backup routes remain available to automatic
+ * fallback resolution, and the managed Jev profile to the verdict call
+ * sites, but neither is reported as a selectable profile here.
  */
 export function validateInferenceProfileKey(profile: string): string | null {
   if (!profile.trim()) {
     return "inferenceProfile must be a non-empty string";
   }
   const llm = getConfigReadOnly().llm;
-  const profiles = getUserSelectableProfilesForProvider(
+  const profiles = getConversationProfilesForProvider(
     llm?.profiles,
     llm?.defaultProvider ?? null,
   );

package/src/config/llm-resolver.ts

@@ -627,6 +627,22 @@ export function resolveDefaultProfileKey(
   return selectWinningProfile(callSite, llm, {}).profileName ?? undefined;
 }
 
+/**
+ * Returns the code-owned profile tier for catalog display when that tier is
+ * available through the workspace's default provider. Workspace call-site
+ * pins do not affect this value. A managed-only tier on a BYOK install returns
+ * undefined so clients do not report a profile that cannot run there.
+ */
+export function resolveShippedDefaultProfileKey(
+  callSite: LLMCallSite,
+  llm: z.infer<typeof LLMSchema>,
+): string | undefined {
+  const intent = CALL_SITE_DEFAULTS[callSite]?.profile ?? "balanced";
+  return usableDefaultIntent(intent, llm, {}, () => undefined) == null
+    ? undefined
+    : intent;
+}
+
 /**
  * Returns the profile key that `resolveCallSiteConfig` treats as the winning
  * (highest-precedence) profile for a turn — the profile whose fragment supplies

package/src/config/profile-text-generation.test.ts

@@ -15,6 +15,15 @@ describe("profileSupportsTextGeneration", () => {
     ).toBe(false);
   });
 
+  test("false for the managed Jev profile shape", () => {
+    expect(
+      profileSupportsTextGeneration(
+        { provider: "vellum", model: "jev-latest" },
+        {},
+      ),
+    ).toBe(false);
+  });
+
   test("true for a chat model and for unlisted custom ids", () => {
     expect(
       profileSupportsTextGeneration(

package/src/config/schemas/call-site-catalog.ts

@@ -307,7 +307,7 @@ const CATALOG_RECORD: CatalogRecord = {
     id: "voiceEscalationJudge",
     displayName: "Voice Escalation Judge",
     description:
-      "Second opinion on the voice front door's escalate decision. Runs only when pinned to a TypeSafe profile; a confident 'needs tools' verdict hands the turn to the escalated leg.",
+      "Second opinion on the voice front door's escalate decision. Uses managed Jev when Vellum-managed inference is available, or an explicitly configured TypeSafe profile; a confident 'needs tools' verdict hands the turn to the escalated leg.",
     domain: "agentLoop",
   },
   voiceContinuationJudge: {
@@ -317,6 +317,13 @@ const CATALOG_RECORD: CatalogRecord = {
       "Decides from the caller's interruption whether a barged-in request should keep running in the background. Runs only when pinned to a TypeSafe profile.",
     domain: "agentLoop",
   },
+  autoProfileRouter: {
+    id: "autoProfileRouter",
+    displayName: "Auto Profile Router",
+    description:
+      "Picks which default profile answers a message when the conversation runs on the Auto profile. Asks managed Jev one choice question over the latest message; when unavailable the turn runs on Balanced.",
+    domain: "agentLoop",
+  },
   voiceContinuationLabel: {
     id: "voiceContinuationLabel",
     displayName: "Voice Continuation Label",

package/src/config/schemas/llm.ts

@@ -14,15 +14,28 @@ import {
   parseVellumModel,
 } from "../../providers/vellum-model-routing.js";
 import {
-  BACKUP_PROFILE_KEYS,
+  AUTO_PROFILE_KEY,
   DEFAULT_PROFILE_KEYS,
   DEFAULT_PROFILE_PROVIDERS,
   FALLBACK_PROFILE_BY_KEY,
-  isBackupProfileKey,
   isDefaultProfileKey,
+  isFlagGatedProfileKey,
+  isManagedOnlyProfileKey,
+  JEV_MANAGED_PROFILE_CALL_SITES,
+  JEV_MANAGED_PROFILE_KEY,
+  MANAGED_ONLY_PROFILE_KEYS,
 } from "../default-profile-names.js";
 import { InputModalitiesSchema } from "../input-modalities.js";
 
+/**
+ * Managed-only keys that are valid reference targets on the managed column
+ * whether or not a workspace stub exists. The flag-gated ones (`os-beta`,
+ * `auto`) are excluded: they resolve only while their reconciled stub is
+ * present, so they enter the reference set through `llm.profiles` alone.
+ */
+const ALWAYS_RESOLVING_MANAGED_ONLY_PROFILE_KEYS =
+  MANAGED_ONLY_PROFILE_KEYS.filter((key) => !isFlagGatedProfileKey(key));
+
 /**
  * Unified LLM configuration schema.
  *
@@ -232,6 +245,7 @@ export const LLMCallSiteEnum = z.enum([
   "voiceEscalationJudge",
   "voiceContinuationJudge",
   "voiceContinuationLabel",
+  "autoProfileRouter",
   "trustRuleSuggestion",
   "homeGreeting",
   "homeSuggestedPrompts",
@@ -766,10 +780,16 @@ function unresolvableProfileReason(
   name: string,
   backupsResolve: boolean,
 ): string {
-  return !backupsResolve &&
-    (BACKUP_PROFILE_KEYS as readonly string[]).includes(name)
-    ? "is a managed backup profile, which resolves only while llm.defaultProvider is the managed provider"
-    : "is not defined in llm.profiles";
+  if (backupsResolve || !isManagedOnlyProfileKey(name)) {
+    return "is not defined in llm.profiles";
+  }
+  if (name === JEV_MANAGED_PROFILE_KEY) {
+    return "is the managed Jev profile, which resolves only while llm.defaultProvider is the managed provider";
+  }
+  if (name === AUTO_PROFILE_KEY) {
+    return "is the managed Auto profile, which resolves only while llm.defaultProvider is the managed provider";
+  }
+  return "is a managed backup profile, which resolves only while llm.defaultProvider is the managed provider";
 }
 
 /**
@@ -800,7 +820,7 @@ function referenceableProfileKeys(
 ): string[] {
   return Object.entries(profiles ?? {})
     .filter(([name, value]) => {
-      if (backupsResolve || !isBackupProfileKey(name)) {
+      if (backupsResolve || !isManagedOnlyProfileKey(name)) {
         return true;
       }
       const entry =
@@ -854,7 +874,7 @@ export function collectFallbackProfileIssues(
   const profileNames = new Set([
     ...referenceableProfileKeys(profiles, backupsResolve),
     ...DEFAULT_PROFILE_KEYS,
-    ...(backupsResolve ? BACKUP_PROFILE_KEYS : []),
+    ...(backupsResolve ? ALWAYS_RESOLVING_MANAGED_ONLY_PROFILE_KEYS : []),
   ]);
   const mixProfileNames = new Set(
     entries
@@ -1004,6 +1024,8 @@ export const LLMSchema = z
     // they join the set only under a managed `llm.defaultProvider`: on a BYOK
     // or ChatGPT default provider they have no body to resolve to, and
     // keeping the reference would strand a selection the picker cannot show.
+    // The managed Jev profile (`JEV_MANAGED_PROFILE_KEY`) is scoped the same
+    // way, as a pin target for the judge call sites.
     // The flag-gated `os-beta` is excluded: it resolves only while a
     // workspace entry exists, so a reference to it is valid only when that
     // entry is present in `config.profiles`. A backup name materialized as a
@@ -1018,9 +1040,23 @@ export const LLMSchema = z
         backupsResolve,
       ),
       ...DEFAULT_PROFILE_KEYS,
-      ...(backupsResolve ? BACKUP_PROFILE_KEYS : []),
+      ...(backupsResolve ? ALWAYS_RESOLVING_MANAGED_ONLY_PROFILE_KEYS : []),
     ]);
     for (const [siteId, siteConfig] of Object.entries(config.callSites ?? {})) {
+      // The Jev profile answers with structured verdicts, so only the sites
+      // built to read one may pin it; a text-producing site would receive
+      // output it cannot use. (Mix arms are covered by the profile-level
+      // mix validation below, which bars the profile from any mix.)
+      if (
+        siteConfig?.profile === JEV_MANAGED_PROFILE_KEY &&
+        !(JEV_MANAGED_PROFILE_CALL_SITES as readonly string[]).includes(siteId)
+      ) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["callSites", siteId, "profile"],
+          message: `Profile "${JEV_MANAGED_PROFILE_KEY}" returns structured answers rather than chat text, so it can only be pinned to ${JEV_MANAGED_PROFILE_CALL_SITES.join(", ")}`,
+        });
+      }
       if (siteConfig?.profile == null) {
         continue;
       }
@@ -1052,6 +1088,20 @@ export const LLMSchema = z
         message: `Profile "${config.advisorProfile}" referenced by llm.advisorProfile ${unresolvableProfileReason(config.advisorProfile, backupsResolve)}`,
       });
     }
+    // The managed Jev profile is a valid reference target for call-site pins
+    // only. Its model returns structured verdicts rather than chat text, so
+    // the conversation positions reject it here as well as at the write
+    // routes, which keeps a raw config write from handing the main agent or
+    // the advisor a model that cannot answer in prose.
+    for (const field of ["activeProfile", "advisorProfile"] as const) {
+      if (config[field] === JEV_MANAGED_PROFILE_KEY) {
+        ctx.addIssue({
+          code: "custom",
+          path: [field],
+          message: `Profile "${JEV_MANAGED_PROFILE_KEY}" referenced by llm.${field} returns structured answers rather than chat text, so it cannot be the conversation or advisor profile`,
+        });
+      }
+    }
 
     // --- Mix profile validation --------------------------------------------
     // Config keys a mix profile must NOT also set (a mix only references other
@@ -1105,6 +1155,17 @@ export const LLMSchema = z
           });
           continue;
         }
+        // A mix is a conversation profile, so an arm that returns structured
+        // verdicts rather than text would hand a chat turn to the decision
+        // model whenever the seeded pick lands on it.
+        if (arm.profile === JEV_MANAGED_PROFILE_KEY) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["profiles", name, "mix", index, "profile"],
+            message: `Mix profile "${name}" references "${JEV_MANAGED_PROFILE_KEY}", which returns structured answers rather than chat text and cannot be a mix constituent.`,
+          });
+          continue;
+        }
         // (b) No nesting — a mix arm must be a standard (non-mix) profile.
         if (mixProfileNames.has(arm.profile)) {
           ctx.addIssue({

package/src/config/sidebar-done-gate.ts

@@ -0,0 +1,27 @@
+import { isAssistantFeatureFlagEnabled } from "./assistant-feature-flags.js";
+import type { AssistantConfig } from "./schema.js";
+
+export const SIDEBAR_DONE_FLAG_KEY = "sidebar-done" as const;
+
+/**
+ * Whether archiving a chat means marking it done.
+ *
+ * The flag is `both`-scoped: clients gate the Done affordances and the Old
+ * chats page on it, and the daemon gates the halves the feature needs. Done is
+ * `archived_at`, so no row changes shape in either state.
+ *
+ * On the daemon side there are two. The first is search reach: off, an
+ * archived conversation is hidden from search unless the query names it
+ * (`is:archived`); on, a done chat is findable by default and `is:unarchived`
+ * is the opt-out, because a chat the user marked done is filed, not deleted,
+ * and search is how they get back to it.
+ *
+ * The second is that a done chat keeps working. Off, an archived conversation
+ * rejects every wake and nothing but the unarchive route clears the column, so
+ * marking a chat done silently kills its schedule or its channel thread. On, a
+ * wake still runs on it, and a message the user reads landing in it brings the
+ * conversation back to the list.
+ */
+export function isSidebarDoneEnabled(config?: AssistantConfig): boolean {
+  return isAssistantFeatureFlagEnabled(SIDEBAR_DONE_FLAG_KEY, config);
+}

package/src/config/sync-gated-profiles.ts

@@ -2,8 +2,16 @@ import { isDeepStrictEqual } from "node:util";
 
 import { getLogger } from "../util/logger.js";
 import { isAssistantFeatureFlagEnabled } from "./assistant-feature-flags.js";
-import { OS_BETA_PROFILE_TEMPLATE } from "./default-profile-catalog.js";
-import { OS_BETA_PROFILE_KEY } from "./default-profile-names.js";
+import {
+  AUTO_PROFILE_TEMPLATE,
+  type DefaultProfileTemplate,
+  OS_BETA_PROFILE_TEMPLATE,
+} from "./default-profile-catalog.js";
+import {
+  AUTO_PROFILE_FEATURE_FLAG_KEY,
+  AUTO_PROFILE_KEY,
+  OS_BETA_PROFILE_KEY,
+} from "./default-profile-names.js";
 import {
   getConfigReadOnly,
   invalidateConfigCache,
@@ -18,16 +26,56 @@ import {
 
 const log = getLogger("sync-gated-profiles");
 
+interface GatedProfile {
+  key: string;
+  flag: string;
+  template: DefaultProfileTemplate;
+  /** Insert the key into a `profileOrder` that does not yet list it. */
+  place: (profileOrder: string[]) => void;
+  /**
+   * Whether a BYOK install first materializes the stub disabled. True for a
+   * profile whose managed route exists but is unusable until the user enables
+   * the managed connection; false for a managed-only profile, whose stub has
+   * no body on a BYOK column and so is never offered there anyway.
+   */
+  byokStartsDisabled: boolean;
+}
+
+const GATED_PROFILES: readonly GatedProfile[] = [
+  {
+    key: OS_BETA_PROFILE_KEY,
+    flag: OS_BETA_FEATURE_FLAG_KEY,
+    template: OS_BETA_PROFILE_TEMPLATE,
+    place: (profileOrder) => {
+      const balancedIndex = profileOrder.indexOf("balanced");
+      if (balancedIndex >= 0) {
+        profileOrder.splice(balancedIndex + 1, 0, OS_BETA_PROFILE_KEY);
+      } else {
+        profileOrder.push(OS_BETA_PROFILE_KEY);
+      }
+    },
+    byokStartsDisabled: true,
+  },
+  {
+    key: AUTO_PROFILE_KEY,
+    flag: AUTO_PROFILE_FEATURE_FLAG_KEY,
+    template: AUTO_PROFILE_TEMPLATE,
+    // Auto leads the picker.
+    place: (profileOrder) => profileOrder.unshift(AUTO_PROFILE_KEY),
+    byokStartsDisabled: false,
+  },
+];
+
 /**
  * Reconcile flag-gated managed profiles against the current feature-flag state.
  *
  * `seedInferenceProfiles()` runs synchronously at boot before feature flags are
- * available, so the OS Beta profile (MiniMax M3 / together-managed) is
- * materialized here once flags have loaded. When the `os-beta` flag is on, the
- * managed profile is created (ordered right after `balanced`); when it is off, a
- * previously managed entry is removed with `profileOrder` / `activeProfile` /
- * `advisorProfile` fallbacks. The reconcile is idempotent and never touches a
- * user-owned profile of the same name.
+ * available, so the gated profiles (OS Beta, Auto) are materialized here once
+ * flags have loaded. When a profile's flag is on, its managed stub is created
+ * and placed in `profileOrder`; when it is off, a previously managed entry is
+ * removed with `profileOrder` / `activeProfile` / `advisorProfile` / call-site
+ * fallbacks. The reconcile is idempotent and never touches a user-owned
+ * profile of the same name.
  *
  * Returns whether the on-disk config changed.
  */
@@ -49,44 +97,52 @@ export function reconcileFlagGatedProfiles(): boolean {
     : [];
   llm.profileOrder = profileOrder;
 
-  // The resolver reads flag state from the gateway-populated override cache and
-  // ignores the config argument; pass the read-only config for signature parity
-  // without mutating disk before the reconcile decision is made.
-  const enabled = isAssistantFeatureFlagEnabled(
-    OS_BETA_FEATURE_FLAG_KEY,
-    getConfigReadOnly(),
-  );
-
   const isPlatform =
     process.env.IS_PLATFORM === "true" || process.env.IS_PLATFORM === "1";
   const isByokMode = !isPlatform;
 
-  const previous = readObject(profiles[OS_BETA_PROFILE_KEY]);
+  let changed = false;
+  for (const gated of GATED_PROFILES) {
+    // The resolver reads flag state from the gateway-populated override cache
+    // and ignores the config argument; pass the read-only config for signature
+    // parity without mutating disk before the reconcile decision is made.
+    const enabled = isAssistantFeatureFlagEnabled(
+      gated.flag,
+      getConfigReadOnly(),
+    );
+
+    const previous = readObject(profiles[gated.key]);
 
-  // Never clobber a user-owned profile that happens to be named `os-beta`. The
-  // entry is ours to manage only when it is absent or already managed; a
-  // user-sourced entry of the same name is left untouched on every path.
-  const isOursToManage = previous == null || previous.source === "managed";
-  if (!isOursToManage) {
-    return false;
-  }
+    // Never clobber a user-owned profile that happens to share the name. The
+    // entry is ours to manage only when it is absent or already managed; a
+    // user-sourced entry of the same name is left untouched on every path.
+    const isOursToManage = previous == null || previous.source === "managed";
+    if (!isOursToManage) {
+      continue;
+    }
 
-  const changed = enabled
-    ? enableProfile(profiles, profileOrder, previous, isByokMode)
-    : disableProfile(llm, profiles, profileOrder, previous);
+    const order = llm.profileOrder as string[];
+    const profileChanged = enabled
+      ? enableProfile(gated, profiles, order, previous, isByokMode)
+      : disableProfile(gated.key, llm, profiles, order, previous);
+    if (profileChanged) {
+      changed = true;
+      log.info(
+        { profile: gated.key, enabled },
+        "Reconciled flag-gated profile",
+      );
+    }
+  }
 
   if (changed) {
     saveRawConfig(config);
     invalidateConfigCache();
-    log.info(
-      { profile: OS_BETA_PROFILE_KEY, enabled },
-      "Reconciled flag-gated profile",
-    );
   }
   return changed;
 }
 
 function enableProfile(
+  gated: GatedProfile,
   profiles: Record<string, Record<string, unknown>>,
   profileOrder: string[],
   previous: Record<string, unknown> | null,
@@ -100,13 +156,13 @@ function enableProfile(
 
   // BYOK installs create the stub disabled: the managed inference connection
   // backing this profile isn't usable until the user enables it, so a fresh
-  // OS Beta entry starts disabled to avoid offering an unusable route. The
+  // entry starts disabled to avoid offering an unusable route. The
   // " (Managed)" label suffix disambiguates it from personal profiles in
   // pickers. A user's own overrides (preserved below) win on later
   // reconciles.
-  if (isByokMode && !previous) {
+  if (gated.byokStartsDisabled && isByokMode && !previous) {
     next.status = "disabled";
-    next.label = `${OS_BETA_PROFILE_TEMPLATE.label} (Managed)`;
+    next.label = `${gated.template.label} (Managed)`;
   }
 
   if (previous) {
@@ -124,17 +180,12 @@ function enableProfile(
 
   let changed = false;
   if (!previous || !isDeepStrictEqual(previous, next)) {
-    profiles[OS_BETA_PROFILE_KEY] = next as ProfileEntry;
+    profiles[gated.key] = next as ProfileEntry;
     changed = true;
   }
 
-  if (!profileOrder.includes(OS_BETA_PROFILE_KEY)) {
-    const balancedIndex = profileOrder.indexOf("balanced");
-    if (balancedIndex >= 0) {
-      profileOrder.splice(balancedIndex + 1, 0, OS_BETA_PROFILE_KEY);
-    } else {
-      profileOrder.push(OS_BETA_PROFILE_KEY);
-    }
+  if (!profileOrder.includes(gated.key)) {
+    gated.place(profileOrder);
     changed = true;
   }
 
@@ -146,6 +197,7 @@ function enableProfile(
 const MIX_MIN_ARMS = 2;
 
 function disableProfile(
+  key: string,
   llm: Record<string, unknown>,
   profiles: Record<string, Record<string, unknown>>,
   profileOrder: string[],
@@ -155,13 +207,13 @@ function disableProfile(
     return false;
   }
 
-  delete profiles[OS_BETA_PROFILE_KEY];
+  delete profiles[key];
 
   // The removal closure: every name here is absent from `profiles` once the
   // closure settles, so the written config can never reference one. A mix that
   // loses arms below the >= 2 minimum is itself invalid, so it joins the set
   // and the loop runs to a fixpoint to resolve any references that cascade.
-  const removed = new Set<string>([OS_BETA_PROFILE_KEY]);
+  const removed = new Set<string>([key]);
   let cascading = true;
   while (cascading) {
     cascading = false;