@vellumai/assistant 0.4.26 → 0.4.30

package/src/__tests__/channel-approval-routes.test.ts

@@ -51,30 +51,8 @@ mock.module("../daemon/handlers.js", () => ({
   }),
 }));
 
-// Mock ingress member store to return an active member for all lookups.
-// The ingress ACL is always-on and requires member records, but approval
-// route tests focus on approval orchestration, not ACL enforcement.
-mock.module("../memory/ingress-member-store.js", () => ({
-  findMember: () => ({
-    id: "member-test-default",
-    assistantId: "self",
-    sourceChannel: "telegram",
-    externalUserId: "telegram-user-default",
-    externalChatId: null,
-    displayName: null,
-    username: null,
-    status: "active",
-    policy: "allow",
-    inviteId: null,
-    createdBySessionId: null,
-    revokedReason: null,
-    blockedReason: null,
-    lastSeenAt: null,
-    createdAt: Date.now(),
-    updatedAt: Date.now(),
-  }),
-  updateLastSeen: () => {},
-}));
+import { upsertContact } from "../contacts/contact-store.js";
+import { createGuardianBinding } from "../contacts/contacts-write.js";
 import type { Session } from "../daemon/session.js";
 import {
   createCanonicalGuardianDelivery,
@@ -84,10 +62,9 @@ import {
 import * as channelDeliveryStore from "../memory/channel-delivery-store.js";
 import {
   createApprovalRequest,
-  createBinding,
   getAllPendingApprovalsByGuardianChat,
 } from "../memory/channel-guardian-store.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb, resetDb, resetTestTables } from "../memory/db.js";
 import {
   conversations,
   externalConversationBindings,
@@ -133,18 +110,20 @@ function ensureConversation(conversationId: string): void {
 }
 
 function resetTables(): void {
-  const db = getDb();
-  db.run("DELETE FROM scoped_approval_grants");
-  db.run("DELETE FROM canonical_guardian_deliveries");
-  db.run("DELETE FROM canonical_guardian_requests");
-  db.run("DELETE FROM channel_guardian_approval_requests");
-  db.run("DELETE FROM channel_guardian_verification_challenges");
-  db.run("DELETE FROM channel_guardian_bindings");
-  db.run("DELETE FROM conversation_keys");
-  db.run("DELETE FROM message_runs");
-  db.run("DELETE FROM channel_inbound_events");
-  db.run("DELETE FROM messages");
-  db.run("DELETE FROM conversations");
+  resetTestTables(
+    "scoped_approval_grants",
+    "canonical_guardian_deliveries",
+    "canonical_guardian_requests",
+    "channel_guardian_approval_requests",
+    "channel_guardian_verification_challenges",
+    "conversation_keys",
+    "message_runs",
+    "channel_inbound_events",
+    "messages",
+    "conversations",
+    "contact_channels",
+    "contacts",
+  );
   channelDeliveryStore.resetAllRunDeliveryClaims();
   pendingInteractions.clear();
 }
@@ -226,8 +205,32 @@ function makeInboundRequest(overrides: Record<string, unknown> = {}): Request {
 
 const noopProcessMessage = mock(async () => ({ messageId: "msg-1" }));
 
+function ensureTestContact(): void {
+  upsertContact({
+    displayName: "Test User",
+    assistantId: "self",
+    channels: [
+      {
+        type: "telegram",
+        address: "telegram-user-default",
+        externalUserId: "telegram-user-default",
+        status: "active",
+        policy: "allow",
+      },
+      {
+        type: "sms",
+        address: "sms-user-default",
+        externalUserId: "sms-user-default",
+        status: "active",
+        policy: "allow",
+      },
+    ],
+  });
+}
+
 beforeEach(() => {
   resetTables();
+  ensureTestContact();
   noopProcessMessage.mockClear();
 });
 
@@ -264,7 +267,7 @@ describe("stale callback handling without matching pending approval", () => {
 
 describe("inbound callback metadata triggers decision handling", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -277,7 +280,7 @@ describe("inbound callback metadata triggers decision handling", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Establish the conversation to get a conversationId mapping
     const initReq = makeInboundRequest({ content: "init" });
@@ -318,7 +321,7 @@ describe("inbound callback metadata triggers decision handling", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -358,7 +361,7 @@ describe("inbound callback metadata triggers decision handling", () => {
 
 describe("inbound text matching approval phrases triggers decision handling", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -371,7 +374,7 @@ describe("inbound text matching approval phrases triggers decision handling", ()
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -404,7 +407,7 @@ describe("inbound text matching approval phrases triggers decision handling", ()
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -440,7 +443,7 @@ describe("inbound text matching approval phrases triggers decision handling", ()
 
 describe("non-decision messages during pending approval (legacy fallback)", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -453,7 +456,7 @@ describe("non-decision messages during pending approval (legacy fallback)", () =
     const replySpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -522,7 +525,7 @@ describe("messages without pending approval proceed normally", () => {
 
 describe("empty content with callbackData bypasses validation", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -562,7 +565,7 @@ describe("empty content with callbackData bypasses validation", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const req = makeInboundRequest({
       content: "",
@@ -600,7 +603,7 @@ describe("empty content with callbackData bypasses validation", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Send with no content field at all, just callbackData
     const reqBody = {
@@ -635,7 +638,7 @@ describe("empty content with callbackData bypasses validation", () => {
 
 describe("callback requestId validation", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -648,7 +651,7 @@ describe("callback requestId validation", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -688,7 +691,7 @@ describe("callback requestId validation", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -726,7 +729,7 @@ describe("callback requestId validation", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -763,7 +766,7 @@ describe("callback requestId validation", () => {
 
 describe("no immediate reply after approval decision", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -776,7 +779,7 @@ describe("no immediate reply after approval decision", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -815,7 +818,7 @@ describe("no immediate reply after approval decision", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -896,7 +899,7 @@ describe("stale callback handling", () => {
 
 describe("SMS channel approval decisions", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "sms",
       guardianExternalUserId: "sms-user-default",
@@ -931,7 +934,7 @@ describe("SMS channel approval decisions", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Establish the conversation via SMS
     const initReq = makeSmsInboundRequest({ content: "init" });
@@ -965,7 +968,7 @@ describe("SMS channel approval decisions", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeSmsInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -998,7 +1001,7 @@ describe("SMS channel approval decisions", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
     const approvalSpy = spyOn(
       gatewayClient,
       "deliverApprovalPrompt",
@@ -1058,7 +1061,7 @@ describe("SMS guardian verify intercept", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const req = new Request("http://localhost/channels/inbound", {
       method: "POST",
@@ -1102,7 +1105,7 @@ describe("SMS guardian verify intercept", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const req = new Request("http://localhost/channels/inbound", {
       method: "POST",
@@ -1188,7 +1191,7 @@ describe("SMS guardian verify intercept", () => {
 
 describe("guardian decision scoping — multiple pending approvals", () => {
   test("callback for older request resolves to the correct approval request", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-scope-user",
@@ -1199,7 +1202,7 @@ describe("guardian decision scoping — multiple pending approvals", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const olderConvId = "conv-scope-older";
     const newerConvId = "conv-scope-newer";
@@ -1273,7 +1276,7 @@ describe("guardian decision scoping — multiple pending approvals", () => {
 
 describe("ambiguous plain-text decision with multiple pending requests", () => {
   test("does not apply plain-text decision to wrong request when multiple pending", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-ambig-user",
@@ -1284,7 +1287,7 @@ describe("ambiguous plain-text decision with multiple pending requests", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convA = "conv-ambig-a";
     const convB = "conv-ambig-b";
@@ -1373,7 +1376,7 @@ describe("expired guardian approval auto-denies via sweep", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-expiry-sweep";
     ensureConversation(convId);
@@ -1402,7 +1405,7 @@ describe("expired guardian approval auto-denies via sweep", () => {
     sweepExpiredGuardianApprovals("https://gateway.test", () => "token");
 
     // Wait for async notifications
-    await new Promise((resolve) => setTimeout(resolve, 200));
+    await new Promise((resolve) => setTimeout(resolve, 10));
 
     // The session should have been denied
     expect(sessionMock).toHaveBeenCalledWith("req-exp-1", "deny");
@@ -1437,7 +1440,7 @@ describe("expired guardian approval auto-denies via sweep", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-not-expired";
     ensureConversation(convId);
@@ -1459,7 +1462,7 @@ describe("expired guardian approval auto-denies via sweep", () => {
 
     sweepExpiredGuardianApprovals("https://gateway.test", () => "token");
 
-    await new Promise((resolve) => setTimeout(resolve, 200));
+    await new Promise((resolve) => setTimeout(resolve, 10));
 
     // The session should NOT have been called
     expect(sessionMock).not.toHaveBeenCalled();
@@ -1512,7 +1515,7 @@ describe("assistant-scoped guardian verification via handleChannelInbound", () =
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const req = makeInboundRequest({
       content: secret,
@@ -1540,7 +1543,7 @@ describe("assistant-scoped guardian verification via handleChannelInbound", () =
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const req = makeInboundRequest({
       content: secret,
@@ -1574,7 +1577,7 @@ describe("assistant-scoped guardian verification via handleChannelInbound", () =
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const req = makeInboundRequest({
       content: secret,
@@ -1595,6 +1598,20 @@ describe("assistant-scoped guardian verification via handleChannelInbound", () =
   });
 
   test("inbound with explicit assistantId does not mutate existing external bindings", async () => {
+    upsertContact({
+      displayName: "Incoming User",
+      assistantId: "self",
+      channels: [
+        {
+          type: "telegram",
+          address: "incoming-user",
+          externalUserId: "incoming-user",
+          status: "active",
+          policy: "allow",
+        },
+      ],
+    });
+
     const db = getDb();
     const now = Date.now();
     ensureConversation("conv-existing-binding");
@@ -1647,7 +1664,7 @@ describe("assistant-scoped guardian verification via handleChannelInbound", () =
 
 describe("conversational approval engine — standard path", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -1660,7 +1677,7 @@ describe("conversational approval engine — standard path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -1718,7 +1735,7 @@ describe("conversational approval engine — standard path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -1766,7 +1783,7 @@ describe("conversational approval engine — standard path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -1813,7 +1830,7 @@ describe("conversational approval engine — standard path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -1868,7 +1885,7 @@ describe("conversational approval engine — standard path", () => {
 
 describe("guardian conversational approval via conversation engine", () => {
   test("guardian follow-up clarification: engine returns keep_pending", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-conv-user",
@@ -1879,7 +1896,7 @@ describe("guardian conversational approval via conversation engine", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-guardian-clarify";
     ensureConversation(convId);
@@ -1950,7 +1967,7 @@ describe("guardian conversational approval via conversation engine", () => {
   });
 
   test("guardian natural-language approval: engine returns approve_once", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-nlp-user",
@@ -1961,7 +1978,7 @@ describe("guardian conversational approval via conversation engine", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-guardian-nlp";
     ensureConversation(convId);
@@ -2030,7 +2047,7 @@ describe("guardian conversational approval via conversation engine", () => {
   });
 
   test("guardian callback button approve_always is downgraded to approve_once", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-dg-user",
@@ -2041,7 +2058,7 @@ describe("guardian conversational approval via conversation engine", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-guardian-downgrade";
     ensureConversation(convId);
@@ -2085,7 +2102,7 @@ describe("guardian conversational approval via conversation engine", () => {
   });
 
   test("multi-pending guardian disambiguation: engine requests clarification", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-multi-user",
@@ -2096,7 +2113,7 @@ describe("guardian conversational approval via conversation engine", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convA = "conv-multi-a";
     const convB = "conv-multi-b";
@@ -2188,7 +2205,7 @@ describe("guardian conversational approval via conversation engine", () => {
 
 describe("keep_pending remains conversational — standard path", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -2201,7 +2218,7 @@ describe("keep_pending remains conversational — standard path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -2249,7 +2266,7 @@ describe("keep_pending remains conversational — standard path", () => {
 
 describe("keep_pending remains conversational — guardian path", () => {
   test('guardian explicit "yes" with keep_pending returns assistant_turn without applying a decision', async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-user-fb",
@@ -2260,7 +2277,7 @@ describe("keep_pending remains conversational — guardian path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-gfb-1";
     ensureConversation(convId);
@@ -2324,20 +2341,33 @@ describe("keep_pending remains conversational — guardian path", () => {
 
 describe("requester cancel of guardian-gated pending request", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-cancel",
       guardianDeliveryChatId: "guardian-cancel-chat",
       guardianPrincipalId: "guardian-cancel",
     });
+    upsertContact({
+      displayName: "Requester Cancel User",
+      assistantId: "self",
+      channels: [
+        {
+          type: "telegram",
+          address: "requester-cancel-user",
+          externalUserId: "requester-cancel-user",
+          status: "active",
+          policy: "allow",
+        },
+      ],
+    });
   });
 
   test('requester explicit "deny" can cancel when the conversation engine returns reject', async () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Create requester conversation
     const initReq = makeInboundRequest({
@@ -2420,7 +2450,7 @@ describe("requester cancel of guardian-gated pending request", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({
       content: "init",
@@ -2496,7 +2526,7 @@ describe("requester cancel of guardian-gated pending request", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({
       content: "init",
@@ -2569,7 +2599,7 @@ describe("requester cancel of guardian-gated pending request", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({
       content: "init",
@@ -2626,7 +2656,7 @@ describe("requester cancel of guardian-gated pending request", () => {
 
 describe("engine decision race condition — standard path", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -2639,7 +2669,7 @@ describe("engine decision race condition — standard path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({ content: "init" });
     await handleChannelInbound(initReq, noopProcessMessage);
@@ -2696,7 +2726,7 @@ describe("engine decision race condition — standard path", () => {
 
 describe("engine decision race condition — guardian path", () => {
   test("returns stale_ignored when guardian engine approves but interaction was already resolved", async () => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-race-user",
@@ -2707,7 +2737,7 @@ describe("engine decision race condition — guardian path", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const convId = "conv-guardian-race";
     ensureConversation(convId);
@@ -2778,14 +2808,14 @@ describe("engine decision race condition — guardian path", () => {
 
 describe("non-decision status reply for different channels", () => {
   beforeEach(() => {
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
       guardianDeliveryChatId: "chat-123",
       guardianPrincipalId: "telegram-user-default",
     });
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "sms",
       guardianExternalUserId: "telegram-user-default",
@@ -2798,7 +2828,7 @@ describe("non-decision status reply for different channels", () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Establish the conversation using sms (non-rich channel)
     const initReq = makeInboundRequest({
@@ -2845,7 +2875,7 @@ describe("non-decision status reply for different channels", () => {
     const replySpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Establish the conversation using telegram (rich channel)
     const initReq = makeInboundRequest({
@@ -2896,7 +2926,7 @@ describe("non-decision status reply for different channels", () => {
 describe("background channel processing approval prompts", () => {
   test("marks guardian channel turns interactive and delivers approval prompt when confirmation is pending", async () => {
     // Set up a guardian binding so the sender is recognized as a guardian
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "telegram-user-default",
@@ -2943,7 +2973,7 @@ describe("background channel processing approval prompts", () => {
     const body = (await res.json()) as Record<string, unknown>;
     expect(body.accepted).toBe(true);
 
-    await new Promise((resolve) => setTimeout(resolve, 700));
+    await new Promise((resolve) => setTimeout(resolve, 400));
 
     expect(processCalls.length).toBeGreaterThan(0);
     expect(processCalls[0].options?.isInteractive).toBe(true);
@@ -2960,7 +2990,7 @@ describe("background channel processing approval prompts", () => {
   test("guardian prompt delivery still works when binding ID formatting differs from sender ID", async () => {
     // Guardian binding includes extra whitespace; trust resolution canonicalizes
     // identity and prompt delivery should still treat this sender as the guardian.
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "  telegram-user-default  ",
@@ -3012,7 +3042,7 @@ describe("background channel processing approval prompts", () => {
     const body = (await res.json()) as Record<string, unknown>;
     expect(body.accepted).toBe(true);
 
-    await new Promise((resolve) => setTimeout(resolve, 700));
+    await new Promise((resolve) => setTimeout(resolve, 400));
 
     expect(processCalls.length).toBeGreaterThan(0);
     expect(processCalls[0].options?.isInteractive).toBe(true);
@@ -3025,7 +3055,7 @@ describe("background channel processing approval prompts", () => {
     // Set up a guardian binding for a DIFFERENT user so the sender is a
     // trusted contact (not the guardian). The guardian route is resolvable
     // because the binding exists — approval notifications can be delivered.
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-user-other",
@@ -3118,7 +3148,7 @@ describe("background channel processing approval prompts", () => {
     const body = (await res.json()) as Record<string, unknown>;
     expect(body.accepted).toBe(true);
 
-    await new Promise((resolve) => setTimeout(resolve, 700));
+    await new Promise((resolve) => setTimeout(resolve, 400));
 
     expect(processCalls.length).toBeGreaterThan(0);
     expect(processCalls[0].options?.isInteractive).toBe(false);
@@ -3147,7 +3177,7 @@ describe("NL approval routing via destination-scoped canonical requests", () =>
     ensureConversation("conv-voice-nl-1");
 
     // Create guardian binding for Telegram
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: guardianUserId,
@@ -3205,7 +3235,7 @@ describe("NL approval routing via destination-scoped canonical requests", () =>
     const differentChatId = "different-chat-999";
 
     // Create guardian binding for the guardian user on the different chat
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: guardianUserId,
@@ -3262,20 +3292,33 @@ describe("NL approval routing via destination-scoped canonical requests", () =>
 describe("trusted-contact self-approval blocked before guardian approval row exists", () => {
   beforeEach(() => {
     // Create a guardian binding so the requester resolves as trusted_contact
-    createBinding({
+    createGuardianBinding({
       assistantId: "self",
       channel: "telegram",
       guardianExternalUserId: "guardian-tc-selfapproval",
       guardianDeliveryChatId: "guardian-tc-selfapproval-chat",
       guardianPrincipalId: "guardian-tc-selfapproval",
     });
+    upsertContact({
+      displayName: "TC Self-Approval User",
+      assistantId: "self",
+      channels: [
+        {
+          type: "telegram",
+          address: "tc-selfapproval-user",
+          externalUserId: "tc-selfapproval-user",
+          status: "active",
+          policy: "allow",
+        },
+      ],
+    });
   });
 
   test("trusted contact cannot self-approve via conversational engine when no guardian approval row exists", async () => {
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     // Create the requester conversation (different user than guardian)
     const initReq = makeInboundRequest({
@@ -3344,7 +3387,7 @@ describe("trusted-contact self-approval blocked before guardian approval row exi
     const deliverSpy = spyOn(
       gatewayClient,
       "deliverChannelReply",
-    ).mockResolvedValue(undefined);
+    ).mockResolvedValue({ ok: true });
 
     const initReq = makeInboundRequest({
       content: "init",